WO2012086816A1 - 通信システム、制御装置、ポリシ管理装置、通信方法およびプログラム - Google Patents
通信システム、制御装置、ポリシ管理装置、通信方法およびプログラム Download PDFInfo
- Publication number
- WO2012086816A1 WO2012086816A1 PCT/JP2011/079938 JP2011079938W WO2012086816A1 WO 2012086816 A1 WO2012086816 A1 WO 2012086816A1 JP 2011079938 W JP2011079938 W JP 2011079938W WO 2012086816 A1 WO2012086816 A1 WO 2012086816A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- information
- user
- access
- access authority
- processing rule
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0893—Assignment of logical groups to network elements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/40—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/70—Admission control; Resource allocation
- H04L47/80—Actions related to the user profile or the type of traffic
- H04L47/808—User-type aware
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
Definitions
- the present invention relates to a communication system, a control device, a policy management device, a communication method, and a program, and more particularly to a communication system, a node, a control server, a communication method, and a communication method that realizes communication by transferring a packet by a transfer node arranged in a network.
- a communication system a control device, a policy management device, a communication method, and a program
- a communication system a node, a control server, a communication method, and a communication method that realizes communication by transferring a packet by a transfer node arranged in a network.
- Non-Patent Documents 1 and 2 OpenFlow captures communication as an end-to-end flow and performs path control, failure recovery, load balancing, and optimization on a per-flow basis.
- the OpenFlow switch specified in Non-Patent Document 2 includes a secure channel for communication with an OpenFlow controller that is positioned as a control device, and operates according to a flow table that is appropriately added or rewritten from the OpenFlow controller. In the flow table, for each flow, a set of a matching rule (header field) to be matched with the packet header, flow statistical information (Counters), and an action (Actions) that defines the processing content is defined (FIG. 12). reference).
- the OpenFlow switch when it receives a packet, it searches the flow table for an entry having a matching rule (see the header field in FIG. 12) that matches the header information of the received packet. When an entry that matches the received packet is found as a result of the search, the OpenFlow switch updates the flow statistical information (counter) and processes the process (specified) in the action field of the entry for the received packet. Perform packet transmission, flooding, discard, etc. from the port. On the other hand, if no entry matching the received packet is found as a result of the search, the OpenFlow switch forwards the received packet to the OpenFlow controller via the secure channel, and the source / destination of the received packet. To request the determination of the route of the packet based on the above, receive the flow entry that realizes this, and update the flow table. As described above, the OpenFlow switch performs packet transfer using an entry stored in the flow table as a processing rule.
- Patent Document 1 performs a permission check by referring to a policy file when a new flow occurs, and then performs access control by calculating a route (see [0052] of Patent Document 1). For this reason, the configuration of Patent Document 1 has a problem in that access control is limited to a terminal base and access control cannot be performed on a user base. For example, in a case where multiple users share the same terminal, if one user is allowed access to a certain network resource, other users who later use the same terminal can also access the network resource. Inconvenience can occur.
- the present invention has been made in view of the above circumstances, and the object of the present invention is to provide each user with a simple configuration in a communication system in which a control device such as the OpenFlow centrally controls forwarding nodes.
- a control device such as the OpenFlow centrally controls forwarding nodes.
- a plurality of transfers that process a received packet according to a processing rule that associates a matching rule for specifying a flow with a processing content that is applied to a packet that conforms to the matching rule.
- An access control policy storage unit that associates the node, the role granted to the user, and the access authority set for each role, and information related to the access authority corresponding to the role of the user who has been successfully authenticated is stored in the control device.
- a route between the terminal of the user who has succeeded in the authentication and the resource accessible by the user is created, and the route
- a communication system including a control device for setting processing rules in the upper transfer node.
- a plurality of forwarding nodes that process a received packet according to a processing rule that associates a matching rule for specifying a flow with a processing content that is applied to a packet that conforms to the matching rule.
- an access control policy storage unit that associates the role granted to the user with the access authority set for each role, and provides the control device with information on the access authority corresponding to the user role that has been successfully authenticated.
- a policy management device and based on the information regarding the access right received from the policy management device, create a path between the terminal of the user who has succeeded in the authentication and the resource accessible by the user,
- a control device is provided that sets a processing rule for a forwarding node on the route.
- a policy management device that provides information regarding access authority corresponding to the role of a user who has been successfully authenticated to the control device described above.
- a plurality of forwarding nodes that process a received packet according to a processing rule that associates a matching rule for specifying a flow with a processing content that is applied to a packet that conforms to the matching rule.
- an access control policy storage unit that associates the role granted to the user with the access authority set for each role, and provides the control device with information on the access authority corresponding to the user role that has been successfully authenticated. Based on the information regarding the access authority received from the policy management apparatus by the policy management apparatus and the connected control apparatus, a path between the terminal of the user who has succeeded in the authentication and the resource accessible by the user is obtained.
- a communication method including a step of creating and a step of setting a processing rule for a forwarding node on the route. This method is linked to a specific machine, which is a control device that controls a plurality of forwarding nodes that process received packets.
- a plurality of forwarding nodes that process a received packet according to a processing rule that associates a matching rule for specifying a flow with a processing content that is applied to a packet that conforms to the matching rule.
- an access control policy storage unit that associates the role granted to the user with the access authority set for each role, and provides the control device with information on the access authority corresponding to the user role that has been successfully authenticated.
- a policy management device and a computer constituting the connected control device based on information relating to access authority received from the policy management device, a terminal of the user who has succeeded in authentication, and a resource accessible by the user
- a program for executing a process for creating a route between and a process for setting a processing rule for a forwarding node on the route It is provided.
- This program can be recorded on a computer-readable storage medium. That is, the present invention can be embodied as a computer program product.
- FIG. 1 It is a sequence diagram showing a series of operation
- reception is performed according to a processing rule in which a matching rule for specifying a flow is associated with a processing content applied to a packet that conforms to the matching rule.
- a processing rule in which a matching rule for specifying a flow is associated with a processing content applied to a packet that conforms to the matching rule.
- This can be realized by a plurality of forwarding nodes 200A and 200B that process packets, a policy management device 320, and a control device 300 that sets processing rules with expiration dates in the forwarding nodes 200A and 200B.
- the reference numerals of the drawings attached to this summary are attached to the respective elements for convenience as an example for facilitating understanding, and are not intended to limit the present invention to the illustrated embodiment.
- the policy management apparatus 320 includes an access control policy storage unit 321 that associates roles granted to a user with access authority set for each role, and is provided from the authentication apparatus 310 or the like. Based on the authentication result, information related to the access authority corresponding to the role of the user who has been successfully authenticated is provided to the control device 300.
- the control device 300 creates a path between the terminal 100 of the user who has succeeded in the authentication and the network resource 600 accessible by the user based on the information regarding the access authority received from the policy management device 320, and Set processing rules for forwarding nodes on the route.
- the processing rule is provided with an expiration date, and when the expiration date has passed since the packet was set in the forwarding nodes 200A and 200B or when the packet that conforms to the matching rule was received last.
- the rule may be deleted.
- the control device 300 If the user fails to authenticate, if the user succeeds in the authentication but tries to access the resource exceeding the role, the control device 300 is informed to the starting point side of the path (forwarding node 200A in FIG. 1). It is desirable to set a processing rule for discarding packets attempting to access resources outside the authority range. As a result, the load on the control device 300 can be reduced.
- FIG. 2 is a diagram illustrating the configuration of the communication system according to the first embodiment of this invention.
- a plurality of forwarding nodes 200A, 200B, and 200C a control device 300 that sets these forwarding nodes and processing rules, and a policy management device 320 that provides access control list information (ACL information) to the control device 300.
- ACL information access control list information
- an authentication apparatus 310 that provides authentication information indicating an authentication result to the policy management apparatus 320.
- the forwarding nodes 200A, 200B, and 200C are switching devices that process a received packet according to a processing rule that associates a matching rule for specifying a flow with a processing content applied to the matching rule.
- the OpenFlow switch of Non-Patent Document 2 that operates using the flow entry shown in FIG. 12 as a processing rule can also be used.
- the forwarding node 200A is arranged at the Tokyo head office, and receives packets from the user terminal 100A at the Tokyo head office to the business server 600A and the management tool 600B.
- the forwarding node 200B is arranged in the Osaka branch office and accepts packets from the user terminal 100B in the Osaka branch office to the business server 600A and the management tool 600B.
- a business server 600A and a management tool 600B are connected to the transfer node 200C.
- the business server 600A is a server that provides services used by users at the Tokyo head office and the Osaka branch for daily business.
- the management tool 600B provides a management tool for managing the settings of these business servers and the information held in the access control policy storage unit 321 and the resource information storage unit 322.
- resource_group_0001 is given as a resource group ID to the business server 600A
- resource_group_0002 is given as a resource group ID to the management tool 600B.
- the authentication device 310 is an authentication server or the like that performs a user authentication procedure with the user terminals 100A and 100B using a password, biometric authentication information, or the like.
- the authentication device 310 transmits authentication information indicating the result of the user authentication procedure with the user terminals 100A and 100B to the policy management device 320.
- FIG. 3 is an example of authentication information held in the authentication device 310 of the present embodiment.
- the authentication device 310 sends the user 1, the IP address: 192.168.100.1, the MAC address: 00-00-00- to the policy management device 320.
- An attribute of 44-55-66 and an entry of user1 with a role ID: role_0001 are transmitted as authentication information.
- the policy management apparatus 320 when authentication of the user whose user ID is user2 is successful, the policy management apparatus 320 is notified of user2, IP address: 192.168.100.2, MAC address: 00-00-00-77-88- An entry of user2 with an attribute of 99 and a role ID: role_0002 is transmitted as authentication information.
- the authentication device 310 may transmit authentication information indicating that authentication of a user terminal having an attribute corresponding to the policy management device 320 has failed. Further, when a processing rule for discarding a packet with respect to an unknown flow is set in the forwarding nodes 200A to 200C, it is possible to omit the transmission of authentication information upon failure.
- the policy management device 320 is connected to the access control policy storage unit 321 and the resource information storage unit 322, creates access control list information (ACL information) corresponding to the authentication information received from the authentication device 310, and transmits it to the control device 300 It is a device to do.
- ACL information access control list information
- FIG. 4 is an example of policy information stored in the access control policy storage unit 321.
- the resource group ID given to the resource group and the policy information in which the access authority is set are shown.
- a user having a role ID: role_0001 is permitted to access both resource group IDs: resource_group_0001 and resource_group_0002.
- the user with the role ID: role_0002 is prohibited from accessing the resource group ID: resource_group_0001 and is allowed to access the resource_group_0002.
- FIG. 5 is an example of resource information stored in the resource information storage unit 322.
- the resource IDs of the resources belonging to the resource group ID and the detailed attributes thereof are associated with each other.
- a group specified by resource group ID: resource_group_0001 includes resources having resource_0001, resource_0002, and resource_0003, and each IP address, MAC address, port number used for the service, and the like can be specified. .
- the policy management apparatus 320 provides the control apparatus 300 with access control list information (ACL information) of the user who has been authenticated by the authentication apparatus 310.
- ACL information access control list information
- the role ID included in the authentication information received from the authentication device 310 may identify the resource group ID associated with the corresponding role ID and the content of the access authority from the policy information in FIG. it can.
- access control list information ACL information
- ACL information is created from the resource information in FIG. 5 using information on resources belonging to the resource group ID. If the authentication information indicating that the user terminal authentication has failed is received from the authentication device 310, the policy management device 320 notifies the control device 300 to the starting point side of the route (the forwarding node 200A in FIG. 1). Then, access control list information (ACL information) having contents prohibiting access to each resource group is created.
- FIG. 6 shows access control list information (ACL information) of a user having the user ID: user1 created from the information shown in FIGS. 3, 4, and 5.
- ACL information access control list information
- the transmission source field of FIG. 6 the value of the attribute information of the user ID: user1 of the authentication information of FIG. 3 is set.
- the destination field a resource attribute extracted from the resource information of FIG. 5 based on the content of the role ID: role_0001 of the policy information of FIG. 4 is set.
- the access authority field the same value as the access authority of the role ID: role_0001 of the policy information in FIG. 4 is set.
- the service and port number set in the resource attribute field of the resource information in FIG. 5 are set.
- the control device 300 creates a processing rule for realizing the access control list information (ACL information) as described above, and sets it in the forwarding nodes 200A to 200C.
- ACL information access control list information
- FIG. 7 is a block diagram showing a detailed configuration of the control device 300 of the present embodiment.
- the control device 300 includes a node communication unit 11, a control message processing unit 12, a processing rule management unit 13, a processing rule storage unit 14, and a forwarding node that communicate with the forwarding nodes 200A to 200C.
- the management unit 15 includes a processing rule creation unit 16, a topology management unit 17, a terminal location management unit 18, an ACL information management unit 19, and an ACL information storage unit 20. Each of these operates as follows.
- the control message processing unit 12 analyzes the control message received from the forwarding node and delivers the control message information to the corresponding processing means in the control device 300.
- the processing rule management unit 13 manages what processing rule is set for which forwarding node. Specifically, the processing rule created by the processing rule creation unit 16 is registered in the processing rule storage unit 14 and set in the forwarding node, and set in the forwarding node by a processing rule deletion notification from the forwarding node. The registered information in the processing rule storage unit 14 is updated in response to a change in the processed processing rule.
- the forwarding node management unit 15 manages the capabilities of the forwarding nodes controlled by the control device 300 (for example, the number and type of ports, the types of supported actions, etc.).
- the processing rule creation unit 16 When the processing rule creation unit 16 receives the access control list information (ACL information) from the ACL information management unit 19, the processing rule creation unit 16 creates a route based on the content and creates a processing rule for realizing the route. Specifically, the processing rule creation unit 16 accesses the access right from the user terminal based on the location information of the communication terminal managed by the terminal location management unit 18 and the network topology information constructed by the topology management unit 17. The packet transfer route to the resource having Next, the processing rule creation unit 16 acquires the port information of the forwarding node on the forwarding route from the forwarding node management unit 15 and executes it on the forwarding node on the route to realize the calculated forwarding route. And a collation rule for specifying a flow to which the action is applied.
- ACL information access control list information
- the collation rule can be created using the source IP address, destination IP address, condition (option), etc. of the access control list information (ACL information) in FIG. Therefore, in the case of the first entry in the access control list information (ACL information) of FIG. 6, the packet addressed from the source IP address 192.168.100.1 to the destination IP address 192.168.0.1 is Each processing rule that defines an action to be transferred from a port to which the forwarding node 200C, the business server 600A, and the management tool 600B as a hop are connected is created.
- the processing rule creation unit 16 determines, based on the location information of the user terminal managed by the terminal location management unit 18, the forwarding node to which the user terminal is connected. In addition, a processing rule defining an action and a collation rule for discarding a packet from the user terminal to a resource that does not have an access right is created.
- the topology management unit 17 constructs network topology information based on the connection relation of the forwarding nodes 200A to 200C collected via the node communication unit 11.
- the terminal location management unit 18 manages information for specifying the location of the user terminal connected to the communication system.
- an IP address is used as information for identifying a user terminal
- a forwarding node identifier of a forwarding node to which the user terminal is connected and information on its port are used as information for specifying the position of the user terminal.
- information provided from the authentication device 310 may be used to identify the terminal and its position.
- the ACL information management unit 19 When the ACL information management unit 19 receives the access control list information (ACL information) from the policy management device 320, the ACL information management unit 19 stores it in the ACL information storage unit 20 and transmits it to the processing rule creation unit 16.
- ACL information access control list information
- the control device 300 as described above is based on the OpenFlow controller described in Non-Patent Documents 1 and 2, and adds a function for creating a processing rule (flow entry) triggered by reception of the access control list information (ACL information). Can also be realized.
- each unit (processing means) of the control device 300 shown in FIG. 3 stores, in the computer constituting the control device 300, the above-described information using the hardware, and executes the above-described processes. It can also be realized by a program.
- FIG. 8 It is a sequence diagram showing a series of operation
- the authentication device 310 performs user authentication (S002 in FIG. 8).
- the policy management device When the authentication device 310 transmits authentication information to the policy management device 320 (S003 in FIG. 8), the policy management device refers to the access control policy storage unit 321 and the resource information storage unit 322 based on the received authentication information, and accesses Control list information (ACL information) is created (S004 in FIG. 8) and transmitted to the control device 300 (S005 in FIG. 8).
- ACL information Control list information
- the control device 300 confirms the access control list information (ACL information), performs route calculation to realize the content, and creates a processing rule that defines the packet processing content in each forwarding node (S006 in FIG. 8).
- control device 300 sets a processing rule for the forwarding node on the route (S007 in FIG. 8), communication between the user terminal and the business server becomes possible (“communication start” in FIG. 8).
- the control apparatus 300 sets processing rules in consideration of the position, period, and time. You can also. For example, as shown in FIG. 10, when the administrator having the role ID: role_0001 accesses the forwarding node 200B of the Osaka branch office from the Tokyo head office by setting a processing rule for discarding packets to the management tool 600B. Allows access to both the business server and the management tool, but when accessing from the Osaka branch office on a business trip, etc., it is possible to restrict access depending on the location, such as restricting access to the management tool. . Of course, it is possible to completely prohibit access from the Osaka branch office, and these can be easily changed by rewriting the entry of the corresponding role ID of the policy information via the management tool 600B.
- control device 300 refers to the policy information at a predetermined time interval and updates the processing rule, so that there is a certain period (for example, 2011/04/01 to 2011/06/01) for each roll.
- a certain period for example, 2011/04/01 to 2011/06/01
- access restrictions such as restricting access to the management tool 600B are applied during other periods and times. You can also. It is also possible to implement access restriction that combines the above-described position, time, and period.
- control device 300 the authentication device 310, the policy management device 320, the access control policy storage unit 321, and the resource information storage unit 322 are described as being provided independently. Such a configuration can also be adopted.
- control device 300 sets a processing rule that realizes the content defined in the access control list information (ACL information) when receiving the access control list information (ACL information).
- control device 300 may create and set a processing rule when a flow occurs and a processing rule setting request is received from the forwarding node that received the first packet. In this way, it is possible to reduce the number of processing rules set for each forwarding node.
- the user terminals 100A and 100B have been described as performing the authentication procedure directly on the authentication device 310.
- the authentication packet related to the authentication procedure is transferred to the authentication device via the transfer node, and the authentication procedure is performed.
- An implementation configuration can also be adopted. For example, it can be realized by setting a matching rule that specifies an authentication packet and a processing rule that defines an action for transferring the packet to the authentication device 310 in a transfer node connected to the user terminals 100A and 100B. is there.
- information exchanged between the authentication device 310, the policy management device 320, and the control device 300 can be exchanged by setting a route between transfer nodes and setting a processing rule for transferring them. .
- the controller is Holds information on access authority received from the policy management device, It is preferable that the route is created and the processing rule is set in response to reception of the processing rule setting request from the forwarding node regarding the packet received from the user terminal.
- the control device may set a processing rule that causes the forwarding node to discard a packet to a resource prohibited from access from the user terminal, based on the information regarding the access authority received from the policy management device. preferable.
- the information about the access authority includes an access authority according to the location of the user's terminal,
- the controller is Setting the processing rule based on the location of the user terminal identified from the information included in the processing rule setting request received from the forwarding node and the access authority corresponding to the location of the user terminal. preferable.
- the controller is Holds information on access authority received from the policy management device, It is preferable that the route is created and the processing rule is set in response to reception of the processing rule setting request from the forwarding node regarding the packet received from the user terminal.
- the controller is It is preferable to set a processing rule that causes the forwarding node to discard a packet for a resource that is prohibited from being accessed from the user terminal, based on information on access authority received from the policy management apparatus.
- the access authority information received from the policy management device includes an access authority corresponding to the location of the user terminal
- the controller is Setting the processing rule based on the location of the user terminal identified from the information included in the processing rule setting request received from the forwarding node and the access authority corresponding to the location of the user terminal. preferable.
- ACL information management part 100A, 100B User terminal 200A to 200C Forwarding node 300
- Control device 310 Authentication device 320 Policy management device 321 Access control policy storage unit 322 Resource information storage unit 600 Network resource 600A Business server 600B Management tool
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
本発明は、日本国特許出願:特願2010-287908号(2010年12月24日出願)の優先権主張に基づくものであり、同出願の全記載内容は引用をもって本書に組み込み記載されているものとする。
続いて、本発明の第1の実施形態について図面を参照して詳細に説明する。図2は、本発明の第1の実施形態の通信システムの構成を表した図である。図2を参照すると、複数の転送ノード200A、200B、200Cと、これら転送ノードと処理規則を設定する制御装置300と、制御装置300にアクセスコントロールリスト情報(ACL情報)を提供するポリシ管理装置320と、ポリシ管理装置320に認証結果を示す認証情報を提供する認証装置310と、が示されている。
前記第1の視点に記載の情報システムのとおり。
前記制御装置は、
前記ポリシ管理装置から受信したアクセス権限に関する情報を保持しておき、
前記ユーザの端末から受信したパケットに関する前記転送ノードからの前記処理規則の設定要求の受信を契機に、前記経路の作成と、処理規則の設定を行うことが好ましい。
前記制御装置は、前記ポリシ管理装置から受信したアクセス権限に関する情報に基づいて、前記転送ノードに、前記ユーザの端末からのアクセスが禁じられた資源へのパケットを廃棄させる処理規則を設定することが好ましい。
前記アクセス権限に関する情報には、前記ユーザの端末の位置に応じたアクセス権限が含まれており、
前記制御装置は、
前記転送ノードから受信した処理規則の設定要求に含まれる情報から特定した前記ユーザの端末の位置と、前記ユーザの端末の位置に応じたアクセス権限とに基づいて、前記処理規則を設定することが好ましい。
前記第2の視点に記載の制御装置のとおり。
前記制御装置は、
前記ポリシ管理装置から受信したアクセス権限に関する情報を保持しておき、
前記ユーザの端末から受信したパケットに関する前記転送ノードからの前記処理規則の設定要求の受信を契機に、前記経路の作成と、処理規則の設定を行うことが好ましい。
前記制御装置は、
前記ポリシ管理装置から受信したアクセス権限に関する情報に基づいて、前記転送ノードに、前記ユーザの端末からのアクセスが禁じられた資源へのパケットを廃棄させる処理規則を設定することが好ましい。
前記ポリシ管理装置から受信するアクセス権限に関する情報には、前記ユーザの端末の位置に応じたアクセス権限が含まれており、
前記制御装置は、
前記転送ノードから受信した処理規則の設定要求に含まれる情報から特定した前記ユーザの端末の位置と、前記ユーザの端末の位置に応じたアクセス権限とに基づいて、前記処理規則を設定することが好ましい。
前記第3の視点に記載のポリシ管理装置のとおり。
前記第4の視点に記載の通信方法のとおり。
前記第5の視点に記載のプログラムのとおり。
12 制御メッセージ処理部
13 処理規則管理部
14 処理規則記憶部
15 転送ノード管理部
16 処理規則作成部
17 トポロジ管理部
18 端末位置管理部
19 ACL情報管理部
20 ACL情報記憶部
100A、100B ユーザ端末
200A~200C 転送ノード
300 制御装置
310 認証装置
320 ポリシ管理装置
321 アクセス制御ポリシ記憶部
322 リソース情報記憶部
600 ネットワーク資源
600A 業務サーバ
600B 管理ツール
Claims (11)
- フローを特定するための照合規則と、前記照合規則に適合するパケットに適用する処理内容とを対応付けた処理規則に従って、受信パケットを処理する複数の転送ノードと、
ユーザに付与されるロールと、各ロールに設定されたアクセス権限とを対応付けたアクセス制御ポリシ記憶部を備え、認証に成功したユーザのロールに対応するアクセス権限に関する情報を制御装置に提供するポリシ管理装置と、
前記ポリシ管理装置から受信したアクセス権限に関する情報に基づいて、前記認証に成功したユーザの端末と、前記ユーザがアクセス可能な資源との間の経路を作成し、該経路上の転送ノードに、処理規則を設定する制御装置と、
を含む通信システム。 - 前記制御装置は、
前記ポリシ管理装置から受信したアクセス権限に関する情報を保持しておき、
前記ユーザの端末から受信したパケットに関する前記転送ノードからの前記処理規則の設定要求の受信を契機に、前記経路の作成と、処理規則の設定を行う請求項1の通信システム。 - 前記制御装置は、前記ポリシ管理装置から受信したアクセス権限に関する情報に基づいて、前記転送ノードに、前記ユーザの端末からのアクセスが禁じられた資源へのパケットを廃棄させる処理規則を設定する請求項1または2の通信システム。
- 前記アクセス権限に関する情報には、前記ユーザの端末の位置に応じたアクセス権限が含まれており、
前記制御装置は、
前記転送ノードから受信した処理規則の設定要求に含まれる情報から特定した前記ユーザの端末の位置と、前記ユーザの端末の位置に応じたアクセス権限とに基づいて、前記処理規則を設定する請求項1から3いずれか一の通信システム。 - フローを特定するための照合規則と前記照合規則に適合するパケットに適用する処理内容とを対応付けた処理規則に従って、受信パケットを処理する複数の転送ノードと、ユーザに付与されるロールと各ロールに設定されたアクセス権限とを対応付けたアクセス制御ポリシ記憶部を備え、認証に成功したユーザのロールに対応するアクセス権限に関する情報を制御装置に提供するポリシ管理装置と、接続され、
前記ポリシ管理装置から受信したアクセス権限に関する情報に基づいて、前記認証に成功したユーザの端末と、前記ユーザがアクセス可能な資源との間の経路を作成し、該経路上の転送ノードに、処理規則を設定する制御装置。 - 前記ポリシ管理装置から受信したアクセス権限に関する情報を保持しておき、
前記ユーザの端末から受信したパケットに関する前記転送ノードからの前記処理規則の設定要求の受信を契機に、前記経路の作成と、処理規則の設定を行う請求項5の制御装置。 - 前記ポリシ管理装置から受信したアクセス権限に関する情報に基づいて、前記転送ノードに、前記ユーザの端末からのアクセスが禁じられた資源へのパケットを廃棄させる処理規則を設定する請求項5または6の制御装置。
- 前記ポリシ管理装置から受信するアクセス権限に関する情報には、前記ユーザの端末の位置に応じたアクセス権限が含まれており、
前記転送ノードから受信した処理規則の設定要求に含まれる情報から特定した前記ユーザの端末の位置と、前記ユーザの端末の位置に応じたアクセス権限とに基づいて、前記処理規則を設定する請求項5から7いずれか一の制御装置。 - 請求項5から8いずれか一の制御装置に対し、認証に成功したユーザのロールに対応するアクセス権限に関する情報を提供するポリシ管理装置。
- フローを特定するための照合規則と前記照合規則に適合するパケットに適用する処理内容とを対応付けた処理規則に従って、受信パケットを処理する複数の転送ノードと、ユーザに付与されるロールと各ロールに設定されたアクセス権限とを対応付けたアクセス制御ポリシ記憶部を備え、認証に成功したユーザのロールに対応するアクセス権限に関する情報を制御装置に提供するポリシ管理装置と、接続された制御装置が、
前記ポリシ管理装置から受信したアクセス権限に関する情報に基づいて、前記認証に成功したユーザの端末と、前記ユーザがアクセス可能な資源との間の経路を作成するステップと、
前記経路上の転送ノードに、処理規則を設定するステップと、を含む通信方法。 - フローを特定するための照合規則と前記照合規則に適合するパケットに適用する処理内容とを対応付けた処理規則に従って、受信パケットを処理する複数の転送ノードと、ユーザに付与されるロールと各ロールに設定されたアクセス権限とを対応付けたアクセス制御ポリシ記憶部を備え、認証に成功したユーザのロールに対応するアクセス権限に関する情報を制御装置に提供するポリシ管理装置と、接続された制御装置を構成するコンピュータに、
前記ポリシ管理装置から受信したアクセス権限に関する情報に基づいて、前記認証に成功したユーザの端末と、前記ユーザがアクセス可能な資源との間の経路を作成する処理と、
前記経路上の転送ノードに、処理規則を設定する処理と、を実行させるプログラム。
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/991,588 US9178910B2 (en) | 2010-12-24 | 2011-12-22 | Communication system, control apparatus, policy management apparatus, communication method, and program |
CN2011800622502A CN103283190A (zh) | 2010-12-24 | 2011-12-22 | 通信***、控制装置、策略管理装置、通信方法和程序 |
EP11851466.0A EP2658183A4 (en) | 2010-12-24 | 2011-12-22 | Communication system, control device, policy management device, communication method, and program |
JP2012549898A JP5862577B2 (ja) | 2010-12-24 | 2011-12-22 | 通信システム、制御装置、ポリシ管理装置、通信方法およびプログラム |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2010287908 | 2010-12-24 | ||
JP2010-287908 | 2010-12-24 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2012086816A1 true WO2012086816A1 (ja) | 2012-06-28 |
Family
ID=46314081
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2011/079938 WO2012086816A1 (ja) | 2010-12-24 | 2011-12-22 | 通信システム、制御装置、ポリシ管理装置、通信方法およびプログラム |
Country Status (5)
Country | Link |
---|---|
US (1) | US9178910B2 (ja) |
EP (1) | EP2658183A4 (ja) |
JP (1) | JP5862577B2 (ja) |
CN (1) | CN103283190A (ja) |
WO (1) | WO2012086816A1 (ja) |
Cited By (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2012144203A1 (en) * | 2011-04-18 | 2012-10-26 | Nec Corporation | Terminal, control device, communication method, communication system, communication module,program, and information processing device |
WO2013042634A1 (ja) * | 2011-09-20 | 2013-03-28 | 日本電気株式会社 | 通信システム、ポリシー管理装置、通信方法およびプログラム |
WO2014020902A1 (en) * | 2012-07-30 | 2014-02-06 | Nec Corporation | Communication system, control apparatus, communication method, and program |
WO2014034119A1 (en) * | 2012-08-30 | 2014-03-06 | Nec Corporation | Access control system, access control method, and program |
WO2014141606A1 (ja) * | 2013-03-15 | 2014-09-18 | 日本電気株式会社 | 通信システム |
CN104780147A (zh) * | 2014-01-14 | 2015-07-15 | 杭州华三通信技术有限公司 | 一种byod访问控制的方法及装置 |
WO2015145976A1 (ja) * | 2014-03-28 | 2015-10-01 | 日本電気株式会社 | 通信システム、制御指示装置、制御実施装置、通信制御方法およびプログラムを記憶する記憶媒体 |
JP5811171B2 (ja) * | 2011-02-21 | 2015-11-11 | 日本電気株式会社 | 通信システム、データベース、制御装置、通信方法およびプログラム |
EP2891985A4 (en) * | 2012-08-31 | 2016-05-11 | Nec Corp | RULE DISTRIBUTION DEVICE, EVENT PROCESSING SYSTEM, RULE DISTRIBUTION METHOD, AND RULE DISTRIBUTION PROGRAM |
JP2017536766A (ja) * | 2014-11-19 | 2017-12-07 | 中国科学院声学研究所Institute Of Acoustics, Chinese Academy Of Sciences | 制御プレーン及びデータプレーンからスイッチの外部メモリへアクセスする方法 |
JP2019164570A (ja) * | 2018-03-19 | 2019-09-26 | 株式会社リコー | 情報処理システム、情報処理方法および情報処理プログラム |
Families Citing this family (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN103581018B (zh) * | 2013-07-26 | 2017-08-11 | 北京华为数字技术有限公司 | 报文发送方法、路由器以及业务交换器 |
CN106817300A (zh) * | 2015-12-01 | 2017-06-09 | 阿尔卡特朗讯 | 在sdn网络中控制及辅助控制用户数据流的方法和装置 |
US9819699B1 (en) | 2016-10-13 | 2017-11-14 | Fortress Cyber Security, LLC | Systems and methods for network security memory reduction via distributed rulesets |
CN108074116B (zh) * | 2016-11-09 | 2022-02-22 | 阿里巴巴集团控股有限公司 | 信息提供方法及装置 |
US10891370B2 (en) * | 2016-11-23 | 2021-01-12 | Blackberry Limited | Path-based access control for message-based operating systems |
JP6493426B2 (ja) * | 2017-02-02 | 2019-04-03 | 日本電気株式会社 | 通信システム、通信制御方法および通信プログラム |
US10931528B2 (en) * | 2018-05-04 | 2021-02-23 | VCE IP Holding Company LLC | Layer-based method and system for defining and enforcing policies in an information technology environment |
CN112956163B (zh) * | 2018-10-25 | 2023-06-30 | 索尼公司 | 通信装置以及通信方法 |
CN111787094B (zh) * | 2020-06-29 | 2022-01-28 | 腾讯科技(深圳)有限公司 | 数据处理方法、装置、存储介质及设备 |
CN112383511B (zh) * | 2020-10-27 | 2021-11-26 | 广州锦行网络科技有限公司 | 一种流量转发方法及*** |
CN114726639B (zh) * | 2022-04-24 | 2023-08-22 | 国网河南省电力公司信息通信公司 | 一种访问控制策略自动编排方法及*** |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2004318582A (ja) * | 2003-04-17 | 2004-11-11 | Nippon Telegraph & Telephone East Corp | ネットワークアクセスシステム及び方法、認証装置、エッジルータ、アクセス制御装置、ならびに、コンピュータプログラム |
JP2009135805A (ja) * | 2007-11-30 | 2009-06-18 | Fujitsu Ltd | 仮想網構築プログラム、仮想網構築装置、および仮想網構築方法 |
Family Cites Families (13)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7440573B2 (en) * | 2002-10-08 | 2008-10-21 | Broadcom Corporation | Enterprise wireless local area network switching system |
US7530112B2 (en) * | 2003-09-10 | 2009-05-05 | Cisco Technology, Inc. | Method and apparatus for providing network security using role-based access control |
JP4253569B2 (ja) * | 2003-12-03 | 2009-04-15 | 株式会社日立コミュニケーションテクノロジー | 接続制御システム、接続制御装置、及び接続管理装置 |
US7526792B2 (en) * | 2004-06-09 | 2009-04-28 | Intel Corporation | Integration of policy compliance enforcement and device authentication |
JP4173866B2 (ja) * | 2005-02-21 | 2008-10-29 | 富士通株式会社 | 通信装置 |
CN100389575C (zh) * | 2005-07-13 | 2008-05-21 | 华为技术有限公司 | 一种实现网上设备接入管理的方法 |
US20070022474A1 (en) * | 2005-07-21 | 2007-01-25 | Mistletoe Technologies, Inc. | Portable firewall |
US8626953B2 (en) * | 2006-03-03 | 2014-01-07 | St. Louis University | System and method of communicating data for a hospital |
US20080189769A1 (en) | 2007-02-01 | 2008-08-07 | Martin Casado | Secure network switching infrastructure |
CN101299660B (zh) * | 2007-04-30 | 2010-12-08 | 华为技术有限公司 | 一种执行安全控制的方法、***及设备 |
EP2193630B1 (en) * | 2007-09-26 | 2015-08-26 | Nicira, Inc. | Network operating system for managing and securing networks |
US8572717B2 (en) * | 2008-10-09 | 2013-10-29 | Juniper Networks, Inc. | Dynamic access control policy with port restrictions for a network security appliance |
CN102308302A (zh) * | 2009-02-10 | 2012-01-04 | 日本电气株式会社 | 策略管理设备、策略管理***和用于策略管理的方法和程序 |
-
2011
- 2011-12-22 EP EP11851466.0A patent/EP2658183A4/en not_active Withdrawn
- 2011-12-22 US US13/991,588 patent/US9178910B2/en active Active
- 2011-12-22 WO PCT/JP2011/079938 patent/WO2012086816A1/ja active Application Filing
- 2011-12-22 CN CN2011800622502A patent/CN103283190A/zh active Pending
- 2011-12-22 JP JP2012549898A patent/JP5862577B2/ja active Active
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2004318582A (ja) * | 2003-04-17 | 2004-11-11 | Nippon Telegraph & Telephone East Corp | ネットワークアクセスシステム及び方法、認証装置、エッジルータ、アクセス制御装置、ならびに、コンピュータプログラム |
JP2009135805A (ja) * | 2007-11-30 | 2009-06-18 | Fujitsu Ltd | 仮想網構築プログラム、仮想網構築装置、および仮想網構築方法 |
Non-Patent Citations (2)
Title |
---|
CASADO ET AL.: "Ethane: Taking Control of the Enterprise", PROCEEDINGS OF THE 2007 CONFERENCE ON APPLICATIONS, TECHNOLOGIES, ARCHITECTURES, AND PROTOCOLS FOR COMPUTER COMMUNICATIONS, vol. 37, no. 4, October 2007 (2007-10-01), XP002531272 * |
See also references of EP2658183A4 * |
Cited By (19)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP5811171B2 (ja) * | 2011-02-21 | 2015-11-11 | 日本電気株式会社 | 通信システム、データベース、制御装置、通信方法およびプログラム |
WO2012144203A1 (en) * | 2011-04-18 | 2012-10-26 | Nec Corporation | Terminal, control device, communication method, communication system, communication module,program, and information processing device |
US9887920B2 (en) | 2011-04-18 | 2018-02-06 | Nec Corporation | Terminal, control device, communication method, communication system, communication module, program, and information processing device |
US9215611B2 (en) | 2011-04-18 | 2015-12-15 | Nec Corporation | Terminal, control device, communication method, communication system, communication module, program, and information processing device |
WO2013042634A1 (ja) * | 2011-09-20 | 2013-03-28 | 日本電気株式会社 | 通信システム、ポリシー管理装置、通信方法およびプログラム |
JP5288081B1 (ja) * | 2011-09-20 | 2013-09-11 | 日本電気株式会社 | 通信システム、ポリシー管理装置、通信方法およびプログラム |
US8681803B2 (en) | 2011-09-20 | 2014-03-25 | Nec Corporation | Communication system, policy management apparatus, communication method, and program |
WO2014020902A1 (en) * | 2012-07-30 | 2014-02-06 | Nec Corporation | Communication system, control apparatus, communication method, and program |
WO2014034119A1 (en) * | 2012-08-30 | 2014-03-06 | Nec Corporation | Access control system, access control method, and program |
JP2015530763A (ja) * | 2012-08-30 | 2015-10-15 | 日本電気株式会社 | アクセス制御システム、アクセス制御方法及びプログラム |
EP2891985A4 (en) * | 2012-08-31 | 2016-05-11 | Nec Corp | RULE DISTRIBUTION DEVICE, EVENT PROCESSING SYSTEM, RULE DISTRIBUTION METHOD, AND RULE DISTRIBUTION PROGRAM |
JP2014179860A (ja) * | 2013-03-15 | 2014-09-25 | Nec Corp | 通信システム |
WO2014141606A1 (ja) * | 2013-03-15 | 2014-09-18 | 日本電気株式会社 | 通信システム |
CN104780147A (zh) * | 2014-01-14 | 2015-07-15 | 杭州华三通信技术有限公司 | 一种byod访问控制的方法及装置 |
CN104780147B (zh) * | 2014-01-14 | 2019-05-07 | 新华三技术有限公司 | 一种byod访问控制的方法及装置 |
WO2015145976A1 (ja) * | 2014-03-28 | 2015-10-01 | 日本電気株式会社 | 通信システム、制御指示装置、制御実施装置、通信制御方法およびプログラムを記憶する記憶媒体 |
JP2017536766A (ja) * | 2014-11-19 | 2017-12-07 | 中国科学院声学研究所Institute Of Acoustics, Chinese Academy Of Sciences | 制御プレーン及びデータプレーンからスイッチの外部メモリへアクセスする方法 |
JP2019164570A (ja) * | 2018-03-19 | 2019-09-26 | 株式会社リコー | 情報処理システム、情報処理方法および情報処理プログラム |
JP7095339B2 (ja) | 2018-03-19 | 2022-07-05 | 株式会社リコー | 情報処理システム、情報処理方法および情報処理プログラム |
Also Published As
Publication number | Publication date |
---|---|
JP5862577B2 (ja) | 2016-02-16 |
US20130263214A1 (en) | 2013-10-03 |
CN103283190A (zh) | 2013-09-04 |
US9178910B2 (en) | 2015-11-03 |
EP2658183A1 (en) | 2013-10-30 |
EP2658183A4 (en) | 2017-06-21 |
JPWO2012086816A1 (ja) | 2014-06-05 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP5862577B2 (ja) | 通信システム、制御装置、ポリシ管理装置、通信方法およびプログラム | |
JP5811171B2 (ja) | 通信システム、データベース、制御装置、通信方法およびプログラム | |
JP5811179B2 (ja) | 通信システム、制御装置、ポリシ管理装置、通信方法およびプログラム | |
JP5594410B2 (ja) | 端末、制御装置、通信方法、通信システム、通信モジュール、プログラムおよび情報処理装置 | |
JP6028736B2 (ja) | 端末、制御装置、通信方法、通信システム、通信モジュール、プログラムおよび情報処理装置 | |
US9215237B2 (en) | Communication system, control device, communication method, and program | |
JP5812108B2 (ja) | 端末、制御装置、通信方法、通信システム、通信モジュール、プログラムおよび情報処理装置 | |
JP2014516215A (ja) | 通信システム、制御装置、処理規則設定方法およびプログラム | |
US20180191614A1 (en) | Communication system, control apparatus, communication apparatus, communication control method, and program | |
JP5288081B1 (ja) | 通信システム、ポリシー管理装置、通信方法およびプログラム | |
US20130275620A1 (en) | Communication system, control apparatus, communication method, and program | |
WO2014034119A1 (en) | Access control system, access control method, and program |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 11851466 Country of ref document: EP Kind code of ref document: A1 |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2011851466 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 13991588 Country of ref document: US |
|
ENP | Entry into the national phase |
Ref document number: 2012549898 Country of ref document: JP Kind code of ref document: A |
|
NENP | Non-entry into the national phase |
Ref country code: DE |