Communication system, control device, policy management device, communication method, and program
View Patent ↗A communication system includes a control device; a forwarding node that processes, in accordance with a processing rule set by control device, a packet transmitted from a user terminal; and a policy management device that manages communication policy and notifies the control device of communication policy that corresponds to a user for whom authentication has succeeded; a setting request transmission permitting unit that, based on notification from the policy management device, sets to a forwarding node that receives a packet from the user terminal a first processing rule causing the forwarding node to make a setting request of processing rule with regard to a packet transmitted from the user terminal; and a path control unit that determines path from user terminal to access destination and sets to forwarding node along the path the second processing rule that corresponds to the path.
1. A communication system, comprising:
a control device;
a forwarding node that processes, in accordance with a processing rule set by the control device, a packet transmitted from a user terminal; and
a policy management device that manages a communication policy and notifies the control device of a communication policy that corresponds to a user for whom authentication has succeeded,
wherein the control device further comprises:
a setting request transmission permitting unit that, based on the notification from the policy management device, sets to a forwarding node that receives a packet from the user terminal a first processing rule causing the forwarding node to make a setting request of a processing rule with regard to a packet transmitted from the user terminal; and
a path control unit that, in a case of receiving the setting request from a forwarding node to which the first processing rule is set, determines a path from the user terminal to an access destination in accordance with the communication policy, and sets to a forwarding node along the path a second processing rule that corresponds to the path.
2. The communication system according to claim 1 , wherein:
the communication policy includes a policy of generating for the first processing rule a matching rule that identifies a packet for which a setting request of a processing rule is allowed; and
the setting request transmission permitting unit refers to the communication policy, and, in a case of receiving a packet that matches the matching rule from the user terminal, sets a first processing rule that causes a setting request of a processing rule to the control device.
3. The communication system according to claim 1 , wherein:
the communication policy includes information of a resource that is accessible by the user, or a resource that is inaccessible by the user; and
the path control unit sets the second processing rule, in a case where a destination of a packet related to a setting request of a processing rule received from the forwarding node is a destination that is accessible by the user.
4. The communication system according to claim 1 , wherein:
the policy management device further notifies the control device that a user, for whom authentication has failed, is detected; and
the control device, based on the notification, sets to a predetermined forwarding node a processing rule that prevents forwarding of a packet from the user to a predetermined authentication device.
5. The communication system according to claim 1 , wherein
a notification is given to the control device as to whether or not a user authentication procedure against all predetermined authentication devices is completed, and
the control device, in a case where a communication policy received from the policy management device indicates that a user authentication procedure against all predetermined authentication devices is not completed, sets to a predetermined forwarding node a processing rule that causes the predetermined forwarding node to start a user authentication procedure between the user and a predetermined authentication device.
6. The communication system according to claim 1 , wherein:
the communication policy includes information for determining a forwarding node, to which the first processing rule is to be set; and
the setting request transmission permitting unit refers to the communication policy to set the first processing rule to a plurality of forwarding nodes.
7. A control device, that is connected to:
a forwarding node that processes, in accordance with a processing rule set by the control device, a packet transmitted from a user terminal; and
a policy management device that manages a communication policy and notifies the control device of a communication policy that corresponds to a user for whom authentication has succeeded, wherein the control device comprises:
a setting request transmission permitting unit that, based on the notification from the policy management device, sets to a forwarding node that receives a packet from the user terminal a first processing rule causing the forwarding node to make a setting request of a processing rule with regard to a packet transmitted from the user terminal; and
a path control unit that, in a case of receiving the setting request from a forwarding node to which the first processing rule is set, determines a path from the user terminal to an access destination in accordance with the communication policy, and sets to a forwarding node along the path a second processing rule that corresponds to the path.
8. The control device according to claim 7 , wherein:
the communication policy includes a policy of generating a matching rule that identifies a packet, to which processing content prescribed in the first processing rule is applied; and
the setting request transmission permitting unit refers to the communication policy, and, in a case of receiving a packet that matches the matching rule from the user terminal, sets a first processing rule that causes a setting request of a processing rule to the control device.
9. The control device according to claim 7 , wherein:
the communication policy includes information of a resource that is accessible by the user, or a resource that is inaccessible by the user; and
the path control unit sets the second processing rule, in a case where a destination of a packet related to a setting request of a processing rule received from the forwarding node is a destination that is accessible by the user.
10. The control device according to claim 7 , wherein
in a case where the control device receives from the policy management device a notification that a user, for whom authentication has failed, is detected, the control device sets to a predetermined forwarding node a processing rule that prevents forwarding of a packet from the user to a predetermined authentication device.
11. The control device according to claim 7 , wherein
in a case where a communication policy received from the policy management device indicates that a user authentication procedure against all predetermined authentication devices is not completed, the control device sets to a predetermined forwarding node a processing rule that causes the predetermined forwarding node to start a user authentication procedure between the user and a predetermined authentication device.
12. The control device according to claim 7 , wherein:
the communication policy includes information for determining a forwarding node, to which the first processing rule is to be set; and
the setting request transmission permitting unit refers to the communication policy to set the first processing rule to a plurality of forwarding nodes.
13. A policy management device that provides the control device of claim 7 with a communication policy that corresponds to a user for whom authentication has succeeded.
14. A communication method, comprising:
using a control device connected to:
a forwarding node that processes, in accordance with a processing rule set by the control device, a packet transmitted from a user terminal; and
a policy management device that manages a communication policy and notifies the control device of a communication policy that corresponds to a user for whom authentication has succeeded, wherein the communication method further comprises:
based on the notification from the policy management device, setting to a forwarding node that receives a packet from the user terminal a first processing rule causing the forwarding node to make a setting request of a processing rule with regard to a packet transmitted from the user terminal; and
in a case of receiving the setting request from a forwarding node for which the first processing rule is set, determining a path from the user terminal to an access destination in accordance with the communication policy, and setting to a forwarding node along the path a second processing rule that corresponds to the path.
15. A non-transient computer-readable storage medium storing a program that causes a computer comprising included in a control device connected to:
a forwarding node that processes, in accordance with a processing rule set by the control device, a packet transmitted from a user terminal; and
a policy management device that manages a communication policy and notifies the control device of a communication policy that corresponds to a user for whom authentication has succeeded, to execute:
based on the notification from the policy management device, setting to a forwarding node that receives a packet from the user terminal a first processing rule causing the forwarding node to make a setting request of a processing rule with regard to a packet transmitted from the user terminal; and
in a case of receiving the setting request from a forwarding node for which the first processing rule is set, determining a path from the user terminal to an access destination in accordance with the communication policy, and setting to a forwarding node along the path a second processing rule that corresponds to the path.
16. The communication method according to claim 14 , wherein:
the communication policy includes a policy of generating a matching rule that identifies a packet, to which processing content prescribed in the first processing rule is applied; and
the communication method comprises referring to the communication policy, and, in a case of receiving a packet that matches the matching rule from the user terminal, setting a first processing rule that causes a setting request of a processing rule to the control device.
17. The communication method according to claim 14 , wherein:
the communication policy includes information of a resource that is accessible by the user, or a resource that is inaccessible by the user; and
the communication method comprises setting the second processing rule, in a case where a destination of a packet related to a setting request of a processing rule received from the forwarding node is a destination that is accessible by the user.
18. The non-transient computer-readable storage medium according to claim 15 , wherein:
the communication policy includes a policy of generating a matching rule that identifies a packet, to which processing content prescribed in the first processing rule is applied; and
the program causes the computer to execute referring to the communication policy, and, in a case of receiving a packet that matches the matching rule from the user terminal, setting a first processing rule that causes a setting request of a processing rule to the control device.
19. The non-transitory computer-readable storage medium according to claim 15 , wherein:
the communication policy includes information of a resource that is accessible by the user, or a resource that is inaccessible by the user; and
the program causes the computer to execute setting the second processing rule, in a case where a destination of a packet related to a setting request of a processing rule received from the forwarding node is a destination that is accessible by the user.
20. The communication system according to claim 1 , wherein if a communication policy received from the policy management device indicates that a user authentication procedure against all predetermined authentication devices is not completed, then the control device sets to a processing rule that causes a predetermined forwarding node to start a user authentication procedure between the user and a predetermined authentication device.