Communication system, control apparatus, policy management apparatus, communication method, and program

1. A communication system, comprising:

a plurality of forwarding nodes configured to process a received packet in accordance with a packet handling operation associating a matching rule for identifying a flow and processing content to be applied to a packet that conforms with the matching rule;

a policy management apparatus comprising an access control policy storage unit configured to associate roles assigned to users and access rights set for each role; and

a control apparatus,

wherein the policy management apparatus is further configured to provide information related to access rights associated with a role of a user who is successfully authenticated to the control apparatus,

wherein the control apparatus is configured to create a path between a terminal of the user who is successfully authenticated and a resource that the user can access, based on information related to access rights received from the policy management apparatus, to set a packet handling operation in a forwarding node in the path, and to set a period of validity for the packet handling operation of the forwarding node in the path.

2. The communication system according to claim 1 , wherein

the control apparatus is further configured to:

hold information related to access rights received from the policy management apparatus, and

create the path on an occasion of receiving a request to set the packet handling operation from the forwarding node related to a packet received from the user terminal, and

perform a setting of the packet handling operation.

3. The communication system according to claim 1 , wherein

the control apparatus is further configured to set the packet handling operation to drop a packet to a resource for which access from the user terminal is denied, in the forwarding node, based on information related to access rights received from the policy management apparatus.

4. The communication system according claim 1 , wherein

information related to access rights comprises access rights that depend on a location of the user terminal, and

the control apparatus is further configured to set the packet handling operation based on the location of the user terminal identified from information included in a request to set the packet handling operation received from the forwarding node, and access rights that depend on the location of the user terminal.

5. A control apparatus,

the control apparatus being connected to a plurality of forwarding nodes configured to process a received packet in accordance with a packet handling operation associating a matching rule for identifying a flow and processing content to be applied to a packet that conforms with the matching rule, and a policy management apparatus comprising an access control policy storage unit configured to associate roles assigned to users and access rights set for each role,

wherein the policy management apparatus is further configured to provide information related to access rights associated with a role of a user who is successfully authenticated, to the control apparatus, and;

wherein the control apparatus is configured to create a path between a terminal of the user who is successfully authenticated and a resource that the user can access, based on information related to access rights received from the policy management apparatus, to set a packet handling operation in a forwarding node in the path, and to set a period of validity for the packet handling operation of the forwarding node in the path.

6. The control apparatus according to claim 5 , wherein the control apparatus is further configured to:

hold information related to access rights received from the policy management apparatus,

create the path on an occasion of receiving a request to set the packet handling operation from the forwarding node related to a packet received from the user terminal, and

perform a setting of the packet handling operation.

7. The control apparatus according to claim 5 , wherein the control apparatus is further configured to set the packet handling operation to drop a packet to a resource for which access from the user terminal is denied, in the forwarding node, based on information related to access rights received from the policy management apparatus.

8. The control apparatus according claim 5 , wherein

information related to access rights received from the policy management apparatus comprises access rights that depend on a location of the user terminal, and

the control apparatus is further configured to set the packet handling operation is set based on the location of the user terminal identified from information included in a request to set the packet handling operation received from the forwarding node, and access rights that depend on the location of the user terminal.

9. A policy management apparatus, configured to provide information related to access rights corresponding to a role of a user who is successfully authenticated, to the control apparatus according to claim 5 .

10. A communication method, comprising

using a control apparatus connected to a plurality of forwarding nodes configured to process a received packet in accordance with a packet handling operation associating a matching rule for identifying a flow and processing content to be applied to a packet that conforms with the matching rule, and a policy management apparatus comprising an access control policy storage unit configured to associate roles assigned to users and access rights set for each role, the policy management apparatus providing information related to access rights associated with a role of a user who is successfully authenticated, to the control apparatus;

the control apparatus performing:

creating a path between a terminal of the user who is successfully authenticated and a resource that the user can access, based on information related to access rights received from the policy management apparatus,

setting a packet handling operation in a forwarding node in the path, and

setting a period of validity for the packet handling operation of the forwarding node in the path.

11. A program stored in a non-transitory computer readable medium, configured to control processes as defined below

wherein execution is preformed on a computer making up a control apparatus connected to a plurality of forwarding nodes configured to process a received packet in accordance with a packet handling operation associating a matching rule for identifying a flow and processing content to be applied to a packet that conforms with the matching rule, and a policy management apparatus comprising an access control policy storage unit configured to associate roles assigned to users and access rights set for each role, the policy management apparatus being further configured to provide information related to access rights associated with a role of a user who is successfully authenticated, to the control apparatus;

a process of creating a path between a terminal of the user who is successfully authenticated and a resource that the user can access, based on information related to access rights received from the policy management apparatus,

a process of setting a packet handling operation in a forwarding node in the path, and

a process of setting a period of validity for the packet handling operation of the forwarding node in the path.

12. The communication system according to claim 2 , wherein the control apparatus is further configured to set the packet handling operation to drop a packet to a resource for which access from the user terminal is denied, in the forwarding node, based on information related to access rights received from the policy management apparatus.

13. The communication system according to claim 2 , wherein

information related to access rights comprises access rights that depend on a location of the user terminal, and

the control apparatus is further configured to set the packet handling operation based on the location of the user terminal identified from information included in a request to set the packet handling operation received from the forwarding node, and access rights that depend on the location of the user terminal.

14. The communication system according to claim 3 , wherein

information related to access rights comprises access rights that depend on a location of the user terminal, and

the control apparatus is further configured to set the packet handling operation based on the location of the user terminal identified from information included in a request to set the packet handling operation received from the forwarding node, and access rights that depend on the location of the user terminal.

15. The control apparatus according to claim 6 , wherein the control apparatus is further configured to set the packet handling operation to drop a packet to a resource for which access from the user terminal is denied, in the forwarding node, based on information related to access rights received from the policy management apparatus.

16. The control apparatus according to claim 6 , wherein

information related to access rights received from the policy management apparatus comprises access rights that depend on a location of the user terminal, and

the control apparatus is further configured to set the packet handling operation based on the location of the user terminal identified from information included in a request to set the packet handling operation received from the forwarding node, and access rights that depend on the location of the user terminal.

17. The control apparatus according to claim 7 , wherein

information related to access rights received from the policy management apparatus comprises access rights that depend on a location of the user terminal, and

the control apparatus is further configured to set the packet handling operation based on the location of the user terminal identified from information included in a request to set the packet handling operation received from the forwarding node, and access rights that depend on the location of the user terminal.