JP2011234062A - Communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce a burden of a user who has to set necessary information when making an internal call between an internal phone connected to an internal network and a phone connected to an external network.SOLUTION: When a phone, which is in a user virtual private network (VPN), accommodated in an external network makes a call to an internal phone accommodated in an internal network via VPN, a center VPN terminal acquires an IP address to be allocated to a user VPN terminal and an extension number to be allocated to the phone from an authentication server. Then the center VPN terminal includes them in a key exchange message and sends them to the user VPN terminal.

Description

  The present invention relates to communication between a user VPN terminal and a center VPN terminal and a communication between a center VPN terminal and an authentication server when a VPN is constructed by a communication tunnel.

  A VPN (Virtual Private Network) constructed using a tunneling technology or a cryptographic technology on a public network such as the Internet is generally known.

  For example, IPsec is a protocol that implements VPN over the Internet and is specified in RFC4301. This is a technique for ensuring the security of communication data by using common key encryption or public key encryption. IPsec also uses a key management protocol called IKEv2 defined in RFC4306 when dynamically negotiating and managing a shared secret key and SA (Security Association).

  As prior art documents related to the present application, an authentication server accommodated in a predetermined communication network performs authentication using EAP (Extensible Authentication Protocol), and the authentication request information (EAP response) is further expanded and connected to the authentication result information. There is Patent Document 1 that returns restriction information to an IPsec gateway.

  Further, in order to realize internal network connection, there is Patent Document 2 in which a connection control device including information acquisition means necessary for connection between internal networks is arranged in an external network.

JP 2009-5243 JP 2009-28600 JP

  In recent years, with the increase in work forms such as SOHO and telecommuting, it has become necessary to securely connect homes and corporate networks with VPN. In addition, companies are diversifying the use of IP phones using SIP servers.

  Here, it is convenient to communicate an extension telephone used in the internal network with a home telephone via a VPN and use the home telephone like a corporate extension telephone.

  At that time, a VPN connecting from the external network to the corporate network, which is the internal network, is constructed by the user VPN terminal arranged in the external network and the center VPN terminal arranged at the boundary between the internal network and the external network. In order to make an extension call between an analog telephone connected to the user VPN terminal 1 and an extension terminal connected to the internal network, information on the SIP server accommodated in the internal network and an analog telephone connected to the user VPN terminal An extension telephone number assigned to is required. In addition, the SIP server information accommodated in the internal network and the extension telephone number used for the analog telephone connected under the user VPN terminal must be manually registered in the user VPN terminal.

  However, it is not convenient to let users register SIP server information manually. Also, if the extension telephone number is registered for each user VPN terminal, when the user uses another user VPN terminal, new information needs to be set for the other user VPN terminal.

  From the above, when implementing an internal call with an internal network via an external network, an analog phone connected under the user VPN terminal is automatically set up without burdening the user, and VPN It becomes a problem to make it usable as an extension telephone of another network to be connected.

  As an example, a communication system according to the present invention is connected to a first terminal connected to a first network, a second terminal connected to the first network and the second network, and the second network. A communication system comprising an authentication server, wherein the first terminal receives a VPN connection request from a client terminal and a first data storage unit that stores a user ID and a password corresponding to the user ID. A first connection processing unit configured to transmit an authentication request including at least one of the information generated using the password and the user ID to the second terminal, and the authentication server includes the user ID and the user ID An authentication table that holds a password, an IP address, and a telephone number in association with each other, and the password corresponding to the user ID transmitted from the second terminal When the information retrieved using the authentication table corresponds to the retrieved password, the telephone number and IP address information corresponding to the user ID are read from the authentication table and transmitted to the second terminal. An authentication server processing unit, wherein the second terminal receives from the authentication server an authentication client processing unit that transmits information generated using the user ID and the password to the authentication server. And a second connection processing unit that includes the telephone number and the IP address and transmits to the first terminal in a response message to the authentication request.

  When implementing an extension call with an internal network via an external network, the burden of various settings imposed on the user can be reduced.

1 is a configuration diagram of a system in the form of Example 1. FIG. 2 is a functional configuration diagram of a user VPN terminal 1. FIG. 3 is a functional configuration diagram of a center VPN terminal 2. FIG. FIG. 3 is an operation sequence diagram for explaining the first embodiment. FIG. 3 is an operation sequence diagram for explaining the first embodiment. FIG. 2 is an operation sequence diagram illustrating Example 1 of the present invention. FIG. 6 is a configuration diagram of a system in the form of Example 2. It is a flowchart of the process at the time of the switching request | requirement from a user terminal. FIG. 6 is an operation sequence diagram for explaining the second embodiment. FIG. 6 is an operation sequence diagram for explaining the second embodiment. 3 is a functional configuration diagram of a RADIUS server 7. FIG.

  In order to solve the above-mentioned problems, information for functioning as an extension telephone for a user VPN terminal accommodated in an external network is acquired when a communication tunnel is established. In the step of constructing a communication tunnel, when the center VPN terminal and the authentication server authenticate the user VPN terminal, the authentication server notifies the center VPN terminal of the extension number of the user VPN terminal. The received extension telephone number and the assigned IP address are transmitted to the user VPN terminal by a key exchange message. Here, the IP address of the SIP server accommodated in the internal network held by the center VPN terminal may be transmitted together. The user VPN terminal registers the extension telephone number with the SIP server and establishes a session, thereby making the extension network call between the external network and the internal network telephone.

  The authentication server manages the user's extension telephone number using the user ID set in the user VPN terminal as an identifier. When the user VPN terminal is successfully authenticated, the authentication extension message notifies the corresponding extension telephone number to the center VPN terminal. To do.

  In addition, the center VPN terminal that has received the extension number from the authentication server extends and uses the key exchange message in order to notify the user VPN terminal of the extension number and the assigned IP address (and the IP address of the SIP server).

  A management server may be further arranged in the internal network. In this case, a user who uses an extension telephone connected to the internal network uses the home telephone as an extension telephone even from a telephone connected to an external network such as home by accessing the management server with a PC. Can be switched as follows.

  When a user accesses the management server to switch to using the home phone as an extension phone, the management server accesses the extension phone used on the internal network and deletes the information registered in the SIP server from the extension phone. The communication destination is switched by transmitting an instruction to transmit a message for requesting and an instruction to validate the extension telephone number payout from the authentication server to the center VPN terminal.

  Since the user switches to using the internal network extension telephone as the extension telephone, when accessing the management server, the management server accesses the user VPN terminal and requests deletion of information registered in the SIP server from the user VPN terminal. The communication destination is switched by sending an instruction to send the message and an instruction to enable the extension of the extension telephone number from the authentication server to the center VPN terminal.

  In addition, a management server is used to send a message for requesting deletion of information registered on the SIP server from the user VPN terminal and an instruction for enabling the extension of the extension telephone number from the authentication server to the center VPN terminal. Instead, an IP phone that is an extension phone may have the same function.

  Hereinafter, embodiments of the invention will be described in detail.

  FIG. 1 is a network configuration example according to an embodiment of the present invention. In this embodiment, the user VPN terminal 1 connected to the external network 3, the analog phone 6 connected to the user VPN terminal 1, the CLI terminal that sends a VPN connection request to the user VPN terminal, a private company such as a company, etc. Center VPN terminal 2 that is located on the internal network 4 that connects the external network 3 and the internal network, RADIUS (Remote Authentication Dial In User Service) server 7 as the authentication server, SIP server 5 as the session control server, and internal An extension telephone 9 which is an IP telephone of the network 4 is provided.

  The user VPN terminal 1 and the center VPN terminal 2 have a VPN connection function, and by constructing an IPsec tunnel 8 that is a communication tunnel connecting the external networks 3, a user using the user VPN terminal 1 can connect to the internal network. You can get a private address and communicate as if you were in the internal network 4.

  The user VPN terminal 1 also has a SIP-UA function for transmitting a call request from the analog telephone 6 as a SIP signal. The SIP server 5 connected to the internal network 4 performs call processing for IP telephone connection, and the RADIUS server 7 holds the user password, extension telephone information, and IP address information, and provides terminal authentication and user information. Paying out.

  FIG. 11 is a functional configuration diagram of the RADIUS server 7. The RADIUS server 7 includes a RADIUS data processing unit 45, a data storage unit 46, and an IP packet processing unit 47. The RADIUS data processing unit 45 determines the contents of the IP packet received by the IP packet processing unit 47, acquires necessary information from the data storage unit, and controls data in the data storage unit. The data storage unit 46 manages the user ID and password used by the user, the IP address assigned to the user terminal used by the user, and the extension number. The IP packet processing unit 47 performs processing to transfer to the RADIUS data processing unit 45 and processing to transmit to the RADIUS Client. Next, functional configurations of the user VPN terminal 1 and the center VPN terminal 2 will be described.

  FIG. 2 is a functional configuration diagram of the user VPN terminal 1. The user VPN terminal 1 includes a device management unit 12, a data storage unit 13, a SIP-UA processing unit 14, an IKE processing unit 15, an IP packet processing unit 16, and a VoIP processing unit 17.

    The SIP-UA processing unit 14 is a session processing unit that processes session establishment with the session control server.

  The IKE processing unit 15 performs key exchange processing for encryption / decryption, proposal of SA having parameters such as ESP encryption algorithm for the center VPN terminal 2, user ID and password for authenticating an IPsec user IP address assignment from the center VPN terminal 2 can be performed.

  The encryption / decryption processing unit 18 performs encryption / decryption processing of packets to be transmitted / received according to the SA determined by the center VPN terminal 2.

  The VoIP processing unit 17 receives a call request from the analog telephone 6, performs off-hook detection, and performs outgoing / incoming processing in cooperation with the SIP-UA processing unit 14. In addition, a process for converting analog voice and IP packets into each other is performed.

  The IP packet processing unit 16 determines the type of IP packet to be transmitted or the received IP packet, and performs processing to transfer to a necessary functional unit.

  The data storage unit 13 stores a user ID and password preset by the user through the device management unit 12 and the IP address of the opposite center VPN terminal 2 as VPN connection settings.

  FIG. 3 is a functional configuration diagram of the center VPN terminal 2.

  The center VPN terminal 2 includes an IKE processing unit 20, a data storage unit 22, a device management unit 24, an IP packet processing unit 23, and a RADIUS client processing unit 25.

  IKE processing unit 20 is a key exchange process for encryption / decryption, determination of SA having parameters such as ESP encryption algorithm proposed by user VPN terminal 1, user ID notified from user VPN terminal 1, Processing to send the password to the RADIUS Client processing unit 25 is performed.

  The encryption / decryption processing unit 26 performs encryption / decryption processing of packets to be transmitted / received according to the SA determined by the center VPN terminal 2. In this encryption / decryption process, the same process as the encryption / decryption processing unit of the user VPN terminal 1 is performed.

  The RADIUS Client processing unit 25 performs information exchange processing with the RADIUS server 7 in order to authenticate the user VPN terminal 1. When the RADIUS server 7 assigns the IP address assigned to the user VPN terminal 1 to the center VPN terminal 2, the IP address assigned by the RADIUS server 7 is obtained by the Radius Client processing unit 25, stored in the IKE processing unit 20, and communicated. The IP address of the center VPN terminal is used as the case. In addition to such a case, when a specific IP address is issued from the RADIUS server 7 to the center VPN terminal 2, the RADIUS Client function unit 25 determines the issued specific IP address as an identifier, and As the IP address to be assigned to the VPN terminal 1, the data storage unit 22 manages a plurality of IP addresses as a pool address, and from this pool address, the RADIUS Client function unit 25 may assign an IP address to the user VPN terminal 1. . The IP packet processing unit 23 determines the type of IP packet to be transmitted or the received IP packet, and performs processing for transferring to a necessary functional unit.

The data storage unit 22 stores the IP address of the SIP server 5 set through the device management unit 24.
An operation example with the above network configuration will be described with reference to the sequence diagrams of FIGS.

  The device management unit 12 detects the VPN connection request S101 issued to the user VPN terminal 1 using a CLI (client) terminal 30 or the like that allows the user to access the user VPN terminal 1, and instructs the IKE processing unit 15 to issue a VPN connection request. Put out. First, the user VPN terminal 1 sends a connection request IKE_SA_INIT Request message S102 to the center VPN terminal 2, and the center VPN terminal 2 receiving it sends a response IKE_SA_INIT Response S103 message to the user VPN terminal 1, Generate a key.

  Then, in order to authenticate the user VPN terminal 1 with the center VPN terminal 2, the IKE processing unit 15 extracts the user ID set in the user VPN terminal 1 from the data storage unit 13, and the first authentication request IKE_AUTH (1) Notify the center VPN terminal 2 by a Request S104 message. The center VPN apparatus 2 that has received the user ID temporarily holds the user ID in the IKE processing unit 20 (S201).

  Then, to authenticate the user VPN terminal 1, it passes to the RADIUS Client processing unit 25, and the RADIUS Client processing unit 25 sends an Access-Request message S105 to the RADIUS server 7 to notify the authentication request and user ID by EAP, The RADIUS server 7 acquires these. The RADIUS server 7 returns a random number, which is a challenge value for EAP-MD5 authentication, to the center VPN terminal 2 in an Access-Challenge message S106.

  The center VPN terminal 2 notifies the challenge value notified from the RADIUS server 7 to the user VPN terminal 1 by the IKE_AUTH (2) Response S107 message which is the first authentication response, and the user VPN terminal 1 which has acquired the challenge value receives the IKE processing unit 20. In step S202, the password set by the user is retrieved from the data storage unit, hash calculation is performed using the password and the challenge value, and the response value that is the hash value of the password is the second authentication request IKE_AUTH (3) Request message The center VPN terminal 2 is notified at S108 (S204). The center VPN terminal 2 that has received the notification notifies the RADIUS server 7 of the user ID and the response value temporarily held by the IKE processing unit 20 by the Access-Request message S109.

  The RADIUS server 7 searches the password stored in the RADIUS server 7 from the received user ID, performs a hash calculation using the same random number notified to the center VPN terminal 2, and the hash value of the password is the center VPN terminal It is confirmed that it matches the response value received from 2 (S203). If the response values match, the RADIUS server 7 authenticates the user VPN terminal 1 as the communication partner, and obtains information to notify the center VPN terminal 2 from the database held by the RADIUS server 7 using the user ID as a key. Therefore, a management table, which is a data part in the RADIUS server, that associates the user ID / password, IP address, and extension telephone number is searched. Then, the extension telephone number corresponding to the user ID and the IP address assigned to the user VPN terminal 1 are included in the authentication success notification and notified to the center VPN terminal 2 by the Access-Accept message S110. The center VPN terminal 2 temporarily holds the extension number received by the RADIUS client processing unit 25 and the assigned IP address in the IKE processing unit 20 (S204).

  At this time, the RADIUS server 7 notifies the center VPN terminal 2 of the specific IP address that is an identifier for authorizing the address assignment, and the RADIUS Client processing unit 25 that has received it notifies the specific IP address. Then, the IP address assigned to the user VPN terminal 1 is selected from the pool address held by the RADIUS client processing unit 25.

  The center VPN terminal 2 notifies the user VPN terminal 1 that the authentication has been successful with the IKE_AUTH (4) Response message S111 as the second authentication response, and the user VPN terminal 1 is responsible for authenticating the device between VPNs. Is sent to the center VPN terminal 2 by the third authentication request IKE_AUTH (5) Request message S112. The center VPN terminal 2 that has received it receives its own authentication information for device authentication between VPNs, the user extension telephone number received from the RADIUS server 7 temporarily stored in the IKE processing unit 20, and the user VPN The user VPN terminal by putting the IP address assigned to the terminal 1 and the IP address of the SIP server 5 held by the data processing unit 13 on the configuration payload of the IKE_AUTH (6) Response message S113 as the third authentication response 1 is notified (S205). Here, the information to be put on the configuration payload of the IKE_AUTH (6) Response message S113 may first be the extension telephone number of the user received from the RADIUS server 7 and the IP address assigned to the user VPN terminal 1. In this case, the IP address of the SIP server 5 held by the data processing unit 13 when the IKE_AUTH Response message is transmitted may be additionally provided.

  At this time, the attribute type value of the configuration payload carrying the extension telephone number and the IP address of the SIP server 5 uses the unassigned range of 16 to 16383. Thereby, the authentication of the user VPN terminal 1 and the center VPN terminal 2 is completed, and the IPsec tunnel S300 is established.

  User VPN terminal 1 uses the received SIP server 5 IP address as the destination, and also uses the received extension telephone number as the source telephone number and the user VPN terminal 1 assigned IP address as the source for registration through the IPsec tunnel. A Register message S114 as a request is transmitted to the SIP server 5, and the assigned IP address and the assigned extension telephone number as information of the analog telephone 6 are registered in the SIP server 5. When the registration is completed, the SIP server 5 returns a 200OK message S115 as a response to the user VPN terminal 1.

  When a call is made from an analog terminal (S206), the user VPN terminal 1 assigns the user VPN terminal 1 with the destination telephone number registered in the extension telephone 9 and the source telephone number registered in the SIP server 5 with respect to the SIP server 5. The SIP server 5 receives the message as an extension telephone number, and the destination IP address is the SIP server and the source IP address is the assigned IP address of the user VPN terminal. An INVITE message S117 is transmitted to 9. When the reception is completed, the extension telephone 9 returns a 200OK message S118 to the SIP server 5, and the SIP server 5 returns a 200OK message S119 to the user VPN terminal 1 to establish the extension call (S301). Here, the extension telephone 9 is an IP terminal having a VoIP function and a SIP compatible function.

  Next, an example of a switching process when the extension telephone used by the user on the internal network 4 is switched to use the telephone connected to the external network 3 such as at home will be described.

  In FIG. 7, in addition to the network configuration similar to that of the first embodiment, the user terminal 41 is connected to the user VPN terminal 1, and the user terminal 40 and the management server 10 are connected to the internal network 4, respectively.

  Next, switching processing between the RADIUS server 7 and the management server 10 will be described with reference to FIG. The RADIUS server 7 has a data storage unit 46, and stores a password, an IP address assigned to the terminal, and an extension telephone number in association with the user ID as shown in the management table 53. The management server 10 switches whether the user uses an extension telephone in the internal network 4 or a telephone in the external network 3 such as home. That is, it is set whether the telephone terminal corresponding to the extension number used by the user is an IP terminal in the internal network 4 or a terminal connected to the VPN terminal in the external network 3, and the connection destination of the telephone terminal Is managed as status information. Here, the operation status information is managed in the internal table 51 using the user's extension number as an identifier.

  When the user transmits information including the user's extension number to the management server as a switching request from the user terminal 11 such as a PC, the management server 10 searches the management table 51 using the extension number as an identifier, and selects the corresponding operating state information mode. And a switch request message including the extension number is transmitted to the RADIUS server 7. The IP packet processing unit 47 of the RADIUS server 7 receives the switching processing request and transfers it to the RADIUS data processing unit 45. The RADIUS data processing unit 45 searches the user information 53 in the data storage unit 46 by using the notified extension number and the data storage unit by using the extension number as an identifier, and the RADIUS data processing unit 45 determines the extension number in the detected information. , It performs the process of switching to OFF so that it will not be paid out even if a request from the center VPN terminal 2 is received. When this process is performed, when the user VPN terminal 1 makes a VPN connection request to the center VPN terminal 2, the RADIUS server 7 does not issue an extension number to the center VPN terminal 2, but only an IP address. put out.

  Next, the flow of switching processing when the extension telephone used by the user on the internal network 4 is switched to use the telephone connected to the external network 3 such as home will be described using the sequence of FIG. .

  When a switching request S400 is transmitted from the user (client) terminal 40 connected to the internal network 4 to the management server 10, the management server 10 switches the mode of the internal table 51 (S500) and unREGISTER toward the extension telephone 9. Is sent to the SIP server 5, and further, an instruction S402 for switching ON / OFF of extension number payout to the center VPN terminal 2 is sent to the RADIUS server 7, and the RADIUS server 7 stores the management table 53. Switch to ON (that is, select an external network as the connection destination of the telephone number compatible terminal) (S501). The extension telephone 9 that has received the unREGISTER request S401 transmits an unREGISTER message to the SIP server 5, and the SIP server 5 that has received the message deletes the register information of the extension telephone 9, and transmits a 200OK message S404 to the extension 9.

  Next, the flow of the switching process when the user switches his / her extension from the telephone connected to the external network 3 such as home to the extension telephone used in the internal network 4 will be described using the sequence of FIG. At this time, an IPsec tunnel is established between the user VPN terminal 1 and the center VPN terminal 2.

  When the switch request S600 is transmitted from the user terminal 41 connected to the external network to the management server 10, the management server 10 updates the mode of the internal table 51 (S700), and SIP unREGISTER to the user VPN terminal 1 An instruction S601 for sending to the server 5 is notified, and further, an instruction S602 for switching ON / OFF of extension number payout to the center VPN terminal 2 is sent to the RADIUS server 7, and the RADIUS server 7 turns OFF the management table 53. A process of switching to (that is, selecting the internal network as the connection destination of the telephone number compatible terminal) is performed (S701). The user VPN terminal 1 that has received the unREGISTER request S501 transmits an unREGISTER message to the SIP server 5, and the SIP server 5 that has received it deletes the register information of the user VPN terminal 1 in S702, and a 200OK message S604 to the user VPN terminal 1. Send.

1 User VPN terminal
2 Center VPN terminal
3 External network
4 Internal network
5 SIP server
6 Analog phone
7 RADIUS server
8 IPsec tunnel
9 Extension phone
10 Management server
12 Device management department
13 Data storage
14 SIP-UA processing section
15 IKE processing section
16 IP packet processor
17 VoIP processing section
18 Encryption / decryption processor
20 IKE processing department
22 Data storage
23 IP packet processor
24 Device Management Department
25 RADIUS Client processing block
26 Encryption / Decryption Processing Unit
30 CLI terminal
40 User terminal
41 User terminal
45 RADIUS data processor
46 Data storage
47 IP packet processor
51 Management table
53 User information management table
S101 VPN connection request
S102 IKE_SA_INIT Request message
S103 IKE_SA_INIT Response message
S104 IKE_AUTH (1) Request message
S105 Access-Request message
S106 Access-Challenge message
S107 IKE_AUTH (2) Response message
S108 IKE_AUTH (3) Request message
S109 Access-Request message
S110 Access-Accept message
S111 IKE_AUTH (4) Response message
S112 IKE_AUTH (5) Request message
S113 IKE_AUTH (6) Response message
S114 Register message
S115 200OK message
S116 INVITE message
S117 INVITE message
S118 200OK message
S119 200OK message
S201 Session management unit 21 holds USER-ID
S202 hash calculation
S203 Response value comparison judgment
S204 Authentication success notification, assigned IP address, extension telephone number are retained
S205 SIP server 5 IP address, assigned IP address, extension telephone number acquisition
S206 Call opportunity occurs
S300 IPsec tunnel establishment
S301 call
S400 switch request
S401 unREGISTER request
Request to switch to S402 ON
S403 unREGISTER message
S404 200OK message
S500 internal table maintenance
Switch to S501 ON
S502 Register information deletion
S600 switch request
S601 unREGISTER request
Request to switch to S602 OFF
S603 unREGISTER message
S604 200OK message
S700 internal table maintenance
Switch to S701 OFF
S702 Register information deletion

Claims (11)

A communication system comprising a first terminal connected to a first network, a second terminal connected to the first network and the second network, and an authentication server connected to the second network. And
The first terminal is
A first data storage unit for storing a user ID and a password corresponding to the user ID;
A first connection processing unit that transmits an authentication request including at least one of the information generated using the password and the user ID to the second terminal when receiving a VPN connection request from a client terminal; And
The authentication server is
An authentication table that holds the user ID, the password, the IP address, and the telephone number in association with each other;
When the password corresponding to the user ID transmitted from the second terminal is searched from the authentication table, and the information generated using the password corresponds to the searched password, the telephone number corresponding to the user ID And an authentication server processing unit that reads IP address information from the authentication table and transmits the IP address information to the second terminal,
The second terminal is
An authentication client processing unit for transmitting the information generated using the user ID and the password to the authentication server;
A communication system, comprising: a second connection processing unit that includes the telephone number and the IP address received from the authentication server and transmits them to the first terminal in a response message to the authentication request. A session control server connected to the second network;
The second terminal further includes a second data storage unit that stores address information of the session control server, and the second connection processing unit reads the session from the second data storage unit in response to the authentication request. 2. The communication system according to claim 1, further including an IP address of a control server, which is transmitted to the first terminal.   The communication system according to claim 1, wherein the IP address information is an assigned IP address assigned to the first terminal by the authentication server processing unit.   The second terminal stores a plurality of IP addresses, and the IP address information is an IP address selection command for causing the second terminal to select an IP address to be assigned to the first terminal from the plurality of IP addresses. The communication system according to claim 1.   The communication system according to claim 1, wherein the information generated using the password is information obtained by performing a hash calculation on the password.   A management server comprising a management table that is connected to the second network and holds operation status information indicating whether a connection destination of a terminal corresponding to the telephone number is the first network or the second network The communication system according to claim 1, further comprising:   The communication system according to claim 6, wherein the management table switches the operating state information based on reception of information including a telephone number from a client terminal connected to the second network. A session control server connected to the second network;
The control server according to claim 6, wherein the management server controls the session control server to perform registration deletion processing on the registration information corresponding to the telephone number based on reception of information including the telephone number. Communications system. The management server transmits a switching request including the telephone number to the authentication server based on reception of information including the telephone number;
The communication system according to claim 6, wherein the authentication server updates connection destination information of a telephone number corresponding terminal in the authentication table based on reception of the switching request. A session control server connected to the second network;
When the management server receives information including a telephone number from a client terminal connected to the first network, the management server controls the session control server to delete the registration information of the first terminal. The communication system according to claim 6. A session control server connected to the second network;
When the management server receives information including a telephone number from a client terminal connected to the second network, the management server controls the session control server to delete registration information corresponding to the telephone number. The communication system according to claim 6.

Images