Patent ID: 8681803
Filing Date: 2014-03-25
Classification: H04L

Abstract:
1. A communication system, comprising: a plurality of forwarding nodes processing a packet according to a processing rule; a control apparatus that controls the plurality of forwarding nodes; an authentication apparatus that authenticates a user who uses a host connected to one of the plurality of forwarding nodes; and a policy management apparatus that includes at least one of (a) a first linking unit that links an identifier of a host to be subject to access control and an identifier of a forwarding node to which the host is connected and (b) a second linking unit that links an identifier of a host to be subject to access control and an identifier of a user who uses the host, the policy management apparatus holding an access control policy for identifying a host to be subject to the access control using at least one of the identifier of the forwarding node and the identifier of the user, wherein each of the plurality of forwarding nodes transmits to the policy management apparatus a set of an identifier of a host connected to own forwarding node and an identifier of the own forwarding node; the authentication apparatus transmits to the policy management apparatus a set of an identifier of a host connected to one of the plurality of forwarding nodes and an identifier of a user, the policy management apparatus refers to the access control policy and, if a host connected to one of the plurality of forwarding nodes is a host to be subject to the access control, notifies content of the access control to the control apparatus as an access control list, and the control apparatus generates a processing rule in accordance with the access control list and sets the generated processing rule in the plurality of forwarding nodes.