Patent Description:
Along with the expansion of the Internet, a sudden increase in access to corporate websites at the time of a business scandal and an increase in traffic as represented by distributed denial of service (DDoS) attacks have become a major concern to the Internet connected user network such as a corporate network (for example, refer to Patent Literature <NUM>). As means for protecting a user network from such temporary bursts of traffic, network services such as a content delivery network (CDN) for offloading traffic outside of the user network and a cloud type DDoS protection service have become mainstream.

Such network services realize services by intentionally redirecting traffic originally leading to a specific device in an Internet connected user network to a network service provider network using a domain name system (DNS) or a border gateway protocol (BGP) and apply attack mitigation devices or the like in the provider network to clean the traffic.

When traffic redirection using the DNS is performed, an IP address relative to a host name of a user is mapped to an IP address of a network address translation (NAT) or proxy installed in a service provider network and traffic is redirected to a provider network. In the case of redirection using the BGP, traffic is redirected to a service provider network by advertising a longer address prefix route than that normally advertised by the user for the BGP route selection mechanism prefer more specific routes.

Aside from the DNS or the BGP redirection methods as described above, policy-based routing (PBR) is another method to redirect traffic within a network. The PBR method defines a policy to an interface on a router where the traffic passes through and the traffic matched to the policy to be forwarded to a specific interface on the same router according to the policy rule.

Documents <CIT> and <CIT> disclose a method for communication which includes coupling a first port of a Layer-<NUM> packet router to receive communication traffic from a network, the traffic including packets destined for a target address, which is accessible via a second port of the router. At the router, the packets that are destined for the target address are diverted to a traffic processor via a third port of the router. The diverted packets are processed at the traffic processor, and returning the processed packets to the router via the third port. At the router, the processed packets are conveyed from the third port to the second port for delivery to the target address.

In a redirection method using the DNS, the NAT or a proxy of a service provider is present between a service provider network and a user host which is an actual destination, addresses of the destination and a source are converted into an address of the service provider. For this reason, the source address of a packet which reaches the destination is the service provider and return packet is naturally comes back to the service provider network. In this way, traffic from the user to the Internet can also be redirected to the service provider network. On the other hand, since the original address information is replaced by the NAT or a proxy, access analysis on the user side is difficult. Furthermore, since the redirection of traffic depends on the DNS name resolution, traffic accessing by directly designating an IP address of the user without using the DNS is invalid.

On the other hand, since redirection using the BGP uses the user's IP address itself, there is no problem that the original address information or access directly designating an IP address becoming invalid. Here, since route control using the BGP is destination based traffic control, it is not possible to redirect traffic from the user to the Internet to the service provider network. Therefore, it is difficult to use this method for session aware network services such as stateful firewalls, which restricts services which can be provided by network service providers.

Any methods using the DNS and the BGP are traffic redirection methods for access from the Internet to a specific device and it is not possible to redirect traffic from a specific device to the Internet.

With regard to methods of redirecting specific traffic using the PBR, it is necessary to set a policy to all the interfaces through which the traffic enters to the user network. Thus, maintaining all routers at the user locations or dynamic router configuration changes are difficult.

As described above, in the related art, there is a problem that it is not easy to redirect traffic from a specific device to the Internet.

In view of the above-described circumstances, an objective of the present invention is to provide a technique capable of easily redirecting traffic from a specific device to the Internet.

An aspect of the present invention is a communication control method as defined in the appended set of claims.

An aspect of the present invention is a communication system as defined in the appended set of claims.

An aspect of the present invention is a computer program product comprising instructions which, when the program is executed by a computer, cause the computer to carry out the steps of the method as defined in the appended set of claims.

According to the present invention, it is possible to easily perform redirection with respect to traffic from a specific device to the Internet.

<FIG> is a constitution diagram of a communication system <NUM> according to an embodiment. The communication system <NUM> illustrated in <FIG> includes an autonomous system (AS)X <NUM>, an ASY <NUM>, an ASZ <NUM>, and a network <NUM> (a specific network). The network <NUM> is a specific network which constitutes the Internet and is constituted of one or more autonomous systems. The network <NUM> is constituted to include, for example, a router <NUM> and routing information is shared between the router <NUM> and the other routers (not shown) included in the network <NUM>.

The ASX <NUM>, the ASY <NUM>, and the ASZ <NUM> are autonomous systems (ASs). The ASX <NUM>, the ASY <NUM>, and the ASZ <NUM> correspond to a network <NUM> (a first network), a network <NUM>, and a network <NUM> (a second network).

Here, it is assumed that the network <NUM> corresponding to the ASX <NUM> is identified by a network address (a prefix) "<NUM>. <NUM>/<NUM>" It is assumed that a network <NUM> is provided on the network <NUM> and the network <NUM> is identified by a network address (a prefix) "<NUM>. <NUM>/<NUM>".

The ASX <NUM> includes a router <NUM> and a target device <NUM> (a specific device).

The target device <NUM> is, for example, a communication device to be attacked which is a transmission destination of communication forming aggressive traffic. Furthermore, the target device <NUM> is, for example, a communication device which communicates with the network <NUM>. It is assumed that an IP address (a network address) in the network <NUM> is assigned to the target device <NUM>, and for example, the address thereof is identified as "<NUM>.

Routing information is shared between the router <NUM> and the other routers (not shown) included in the network <NUM> and the router <NUM> performs route control for communication in the ASX <NUM>. The router <NUM> is connected to an external network and advertises routing information on each AS corresponding to a network of a connection destination. For example, the router <NUM> is connected to the ASZ <NUM> via a logical path L13. The router <NUM> transfers traffic addressed to the target device <NUM> to the target device <NUM> and transfers the traffic transmitted from the target device <NUM> to the ASZ <NUM>.

The ASZ <NUM> includes a router <NUM> and a router <NUM>. Each of the router <NUM> and the router <NUM> are connected to an external network and advertise routing information on each AS corresponding to a network of a connection destination. For example, the router <NUM> is connected to the router <NUM> of the network <NUM> via a logical path L34. Furthermore, the router <NUM> is connected to the ASY <NUM> via a logical path L23.

The router <NUM> is connected to the ASX <NUM> via the logical path L13. Furthermore, the router <NUM> is connected to the ASY <NUM> via a tunnel T23 forming a logical path. The tunnel T23 transparently relays an IP packet between the ASY <NUM> and the ASZ <NUM> and may be configured through, for example, a method of relaying an encapsulated IP packet (for example, generic routing encapsulation: GRE). The router <NUM> includes a main routing table and a virtual routing and forwarding (VRF) table corresponding to a service providing device <NUM>.

It is assumed that the VRF table of the router <NUM> is assumed to be set so that "a router <NUM>" is designated to a default route such that a packet from the target device <NUM> flows to the ASY <NUM> and "a router <NUM>" is designated to a default route such that a packet addressed to the target device <NUM> is transferred to the target device <NUM>. As a method of designating a path addressed to the target device <NUM>, it is conceivable to dynamically copy or statically set the route of the target device <NUM> from the main routing table of the router <NUM>.

Routing information is shared between the router <NUM> and the router <NUM> and the router <NUM> and the router <NUM> perform route control for communication in the ASZ <NUM>.

The ASY <NUM> includes a router <NUM>, a router <NUM>, a communication control device <NUM>, and the service providing device <NUM> (a processing device). The router <NUM> and the router <NUM> are connected to the network <NUM> which is an external network and advertise routing information on the ASZ <NUM> corresponding to the network <NUM> of a connection destination. For example, the router <NUM> is connected to the ASZ <NUM> via the logical path L23. The router <NUM> is connected to the ASZ <NUM> via the tunnel T23 forming the logical path.

As the router <NUM>, a router in which a routing table is set so that "a service providing device <NUM>" is designated to a default route such that a packet flows to the service providing device <NUM> and "a router <NUM>" is designated to such that a packet addressed to the target device <NUM> is transferred to the target device <NUM> is set. Here, when the service providing device <NUM> is an L3 device, the service providing device <NUM> is set as a default route. However, when the service providing device <NUM> is an L2 device, a router which is before the service providing device <NUM> is set as a default route. Although <FIG> illustrates a case in which the router <NUM> and the router <NUM> are constituted to be separate, but it is not limited to, and the present invention may be constituted with an integrated device and connection in the network <NUM> may have a constitution other than that illustrated in the drawings.

The communication control device <NUM> controls a communication path in the communication system <NUM> to control an influence of aggressive traffic addressed to the target device <NUM> to be reduced. Furthermore, the communication control device <NUM> controls the communication path in the communication system <NUM> to control traffic from the target device <NUM> to the network <NUM> to be redirected to the network itself.

For example, the communication control device <NUM> includes a path setting device <NUM> and a communication control device <NUM>. The path setting device <NUM> sets a communication path leading from the network <NUM> to the network <NUM> (hereinafter referred to as "a downlink path") and a communication path leading from the network <NUM> to the network <NUM> (hereinafter referred to as "an uplink path").

To be specific, the path setting device <NUM> controls the ASZ <NUM> such that the uplink path in the network <NUM> which is on a communication path between the network <NUM> and the network <NUM> is branched. The path setting device <NUM> sets a first path of the branched path as a path leading to the router <NUM> included in the ASY <NUM>. Furthermore, the path setting device <NUM> sets a second path of the branched path as a path leading to the network <NUM> via the router <NUM>. The path setting device <NUM> dynamically controls the uplink path using the above-described determined routing information (a first routing information). For example, the path setting device <NUM> uses a BGP Flowspec (a first routing protocol) in the uplink path.

Also, the path setting device <NUM> performs control so that a tunnel is formed in a part of the first path. To be specific, the path setting device <NUM> performs control so that a tunnel is formed for the router <NUM>. Thus, a tunnel is formed between the router <NUM> and the router <NUM>.

The path setting device <NUM> controls the ASZ <NUM> to branch the downlink path in the network <NUM> which is on a communication path between the network <NUM> and the network <NUM>. The path setting device <NUM> sets a third path of the branched path as a path leading to the target device <NUM>. Furthermore, the path setting device <NUM> sets a fourth path of the branched path as a path leading to the network <NUM> in which an address space of the target device <NUM> is excluded from an address space of the network <NUM>. That is to say, the path setting device <NUM> sets the fourth path as a path leading to any of the remaining address spaces in which the address space (<NUM>. <NUM>) of the target device <NUM> is excluded from the address space (<NUM>. <NUM>/<NUM>) of the network <NUM>. The path setting device <NUM> dynamically controls the downlink path using the above-described determined routing information.

For example, the path setting device <NUM> uses the BGP (a second routing protocol) in the downlink path. As a method using the BGP, the well-known technique disclosed in paragraph <NUM> (for example, the technique disclosed in <CIT>) may be used and a technique of setting the third path of the branched path as a path leading to the target device <NUM> assigned to a predetermined address space and setting the fourth path of the branched path as a path leading to the address space of the network <NUM> in which the address space of the target device <NUM> is excluded from the address space of the network <NUM> using the above-described the BGP may be used.

The communication control device <NUM> controls the service providing device <NUM> so that the service providing device <NUM> which restricts communication leading to the predetermined address space is provided on the third path, the service providing device <NUM> restricts communication leading to the predetermined address space via the third path when a predetermined constraint condition is satisfied, and communication leading to the predetermined address space via the third path is allowed when the constraint condition is not satisfied.

The service providing device <NUM> is provided on the ASY <NUM> and performs predetermined processing for a packet redirected from the ASZ <NUM>. Examples of the predetermined processing include security processing regarding for example Web filtering, anti-virus, anti-spam, and an intrusion detection system (IDS)/intrusion prevention system (IPS). Here, as an example of security processing, the service providing device <NUM> restricts communication according to a predetermined condition. The service providing device <NUM> restricts communication leading to the target device <NUM> when a predetermined constraint condition is satisfied and allows communication leading to the target device <NUM> when a constraint condition is not satisfied.

The above-described processing in the service providing device <NUM> may be configured to be performed in accordance with control from the communication control device <NUM>. The service providing device <NUM> may be, for example, a unified threat management (UTM) device or may have some functions such as a stateful firewall, a transparent cache, a deep packet inspection (DPI), a URL filter, and a WPA. In the embodiment, a case in which the service providing device <NUM> performs security processing as predetermined processing will be described as an example.

A process in the ASY <NUM> will be described below. <FIG> is a flowchart for describing a flow of processing in the ASY <NUM>.

The communication control device <NUM> acquires data used for designating each communication state detected in the ASX <NUM> and data used for designating each communication state detected in the service providing device <NUM> (Step S10). The communication control device <NUM> determines the communication state of the ASX <NUM> using the acquired data (Step S20).

When abnormal traffic is detected through the determination of Step S20 and a countermeasure function is not in operation, the communication control device <NUM> controls a state of the communication path of the service providing device <NUM> and the ASZ <NUM> to activate the countermeasure function (Step S20-activation). A method of activating the countermeasure function will be described in detail later (Step S30). The service providing device <NUM> determines a packet supplied via the ASZ <NUM> in the uplink path or the downlink path and performs security processing in accordance with the determination result (Step S40). For example, in the downlink path, the service providing device <NUM> performs a filtering process of restricting the packet when a predetermined constraint condition is satisfied and allowing the packet when a constraint condition is not satisfied.

On the other hand, when the countermeasure function is in operation and abnormal traffic continues to be detected through the determination of Step S20, the communication control device <NUM> causes the countermeasure function to continue through the process of Step S40 (Step S20-continuing).

I, when the countermeasure function is in operation and abnormal traffic is not detected through the determination of Step S20, the communication control device <NUM> cancels the countermeasure function which is in operation (Step S20-end), returns the communication path to a normal state before the countermeasure function was activated, and ends the process using the service providing device <NUM> (Step S50).

With the above-described procedure, the communication system <NUM> can reduce traffic for aggressive communication. Although a procedure of switching between a process in a normal condition and a process in a countermeasure condition is included in the above-described procedure, countermeasure may be executed at constantly.

A countermeasure function in the downlink path using the communication system <NUM> will be described below with reference to <FIG> and <FIG>. <FIG> is a sequence diagram illustrate an action of the countermeasure function in the downlink path by the communication system <NUM> according to the embodiment.

First, a communication path in a normal condition is set. The ASX <NUM> advertises routing information M21A1 on the ASZ <NUM>. The routing information M21A1 advertised by the ASX <NUM> includes, for example, data that designate "<NUM>. <NUM>/<NUM>" as prefixes and "X" as an AS path (AS-PATH) and "a router <NUM>" as a next hop (Next-hop), respectively. The ASZ <NUM> shares routing information in the ASZ <NUM> in response to the reception of the routing information M21A1 and advertises the routing information M21A2 on the network <NUM>.

The routing information M21A2 advertised by the ASZ <NUM> includes, for example, data obtained by designating "<NUM>. <NUM>/<NUM>" as prefixes and "ZX" as an AS path and "a router <NUM>" as a next hop, respectively. "X" "Y" and "Z" designating AS paths indicate the ASX <NUM>, the ASY <NUM>, and the ASZ <NUM>. For example, it is assumed that when described as "ZX" as described above AS paths are listed in the order of "X" and "Z. " The same applies to the following description.

The router in the network <NUM> obtains the above-described routing information M21A2 and updates the held routing information.

The communication control device <NUM> controls the router <NUM> or the service providing device <NUM> to generate routing information M32DF. The routing information M32DF includes data obtained by designating "<NUM>. <NUM>/<NUM>" as prefixes and "YX" as an AS path and "a router <NUM>" as a next hop, respectively. In addition, the communication control device <NUM> generates routing information M24DF. For example, the routing information M24DF includes data obtained by designating "<NUM>. <NUM>/<NUM>" as prefixes and "YX" as an AS path and "a router <NUM>" as a next hop, respectively. In the designate of the AS path, an attaching "X" to the beginning of the AS path enable set a path for countermeasures without advertising on an AS path from the ASX <NUM> side.

Moreover, the communication control device <NUM> causes the router <NUM> to advertise the routing information M32DF and the routing information M24DF on the ASZ <NUM>.

The above-described routing information M32DF includes address information indicating a predetermined address space having a prefix designated as, for example, "<NUM>. <NUM>/<NUM>" and the predetermined address space is set to be smaller than an address space of the network <NUM> (or the network <NUM>). The routing information M24DF includes address information indicating the address space of the network <NUM> (or the network <NUM>). The routing information M24DF may further include information used to allow the routing information M32DF to be preferentially selected.

The ASZ <NUM> shares routing information in the ASZ <NUM> in response to the reception of the routing information M32DF and the routing information M24DF and advertises the routing information M24DF1 on the network <NUM>. For example, the routing information M24DF1 includes data obtained by designating "<NUM>. <NUM>/<NUM>" as prefixes and "ZYX" as an AS path and "a router <NUM>" as a next hop, respectively.

The routers in the network <NUM> acquire the routing information M24DF1 and update held routing information.

<FIG> is a diagram for explaining a communication path when the countermeasure function in the downlink path using the communication system <NUM> according to the embodiment is in operation. A description will be provided with reference to <FIG> and <FIG>.

The ASZ <NUM> performs a transfer process as will be illustrated below in accordance with a transmission destination address of a packet when receiving the packet from the router <NUM> of the network <NUM>.

The ASZ <NUM> transfers a packet P32A designating a destination IP address of "<NUM>. <NUM>/<NUM>" serving as a packet addressed to the target device <NUM> to the ASY <NUM> when receiving the packet P32A. The ASY <NUM> obtains the packet P32A and determines whether the packet P32A is a packet for aggressive communication in the service providing device <NUM>. As a result of the determination, when it is determined that the acquired packet P32A is not a packet for aggressive communication, the service providing device <NUM> transfers the packet P32A to the ASZ <NUM> via the tunnel T23. The ASZ <NUM> transfers the packet P32A to the ASX <NUM> via the logical path L13. The ASX <NUM> obtains the transferred packet P32A and the target device <NUM> receives the packet P32A.

The ASZ <NUM> transfers a packet P32DDA designating a destination IP address of "<NUM>. <NUM>/<NUM>" serving as a packet addressed to the target device <NUM> to the ASY <NUM> like Case A1 when receiving the packet P32DDA. The ASY <NUM> obtains the packet P32DDA and determines whether the acquired packet P32DDA is a packet for aggressive communication in the service providing device <NUM>. As a result of the determination, when it is determined that the acquired packet P32DDA is an aggressive packet, the service providing device <NUM> discards the packet P32DDA.

The ASZ <NUM> transfers a packet P24A obtained by designating the destination IP address included in "<NUM>. <NUM>/<NUM>" other than the packet addressed to the target device <NUM> to the ASX <NUM> when receiving the packet P24A. The ASX <NUM> obtains the transferred packet P24A.

The ASZ <NUM> transfers a packet P21A obtained by designating a destination IP address included in "<NUM>. <NUM>/<NUM>" except "<NUM>. <NUM>/<NUM>" to the ASX <NUM> when receiving the packet P21A. The ASX <NUM> obtains the transferred packet P21A.

As described above, the communication system <NUM> according to the embodiment advertises routes using the BGP on the following two routes in the downlink path:.

A countermeasure function in the uplink path using the communication system <NUM> will be described below with reference to <FIG> and <FIG>. <FIG> is a sequence diagram for describing an action of the countermeasure function in the uplink path using the communication system <NUM> according to the embodiment.

First, a communication path in a normal condition is set. The network <NUM> advertises routing information M34A1 on the ASZ <NUM>. The ASZ <NUM> shares routing information in the ASZ <NUM> in response to the reception of the routing information M34A1 and advertises routing information M34A2 on the ASX <NUM>. The routers in the ASX <NUM> acquire the routing information M34A2 and update held routing information.

The communication control device <NUM> controls the router <NUM> or the service providing device <NUM> to generate routing information FS1. The routing information FS1 includes data designating a packet to be transferred to the router <NUM>. For example, the routing information FS1 can be designated by any of a transmission source IP address (srcIP), a destination IP address (dst IP), a transmission source port number (src Port), and a transmission destination port number (dst Port) or a combination thereof. Thus, a path for countermeasures in the uplink path is set. Moreover, the communication control device <NUM> causes the router <NUM> to advertise the routing information FS1 on the ASZ <NUM>. The ASZ <NUM> shares the routing information in the ASZ <NUM> in response to the reception of the routing information FS1.

<FIG> is a diagram for explaining a communication path when the countermeasure function in the uplink path using the communication system <NUM> according to the embodiment is in operation. A description will be provided with reference to <FIG> and <FIG>.

The ASZ <NUM> performs a transfer process as will be illustrated below in accordance with any of a transmission source IP address, a transmission destination IP address, a transmission source port number, and a transmission destination port number of a packet from the router <NUM> of the network <NUM> or a combination thereof when receiving the packet. In the description of <FIG> and <FIG>, a case in which the ASZ <NUM> performs a transfer process in accordance with a transmission source IP address of a received packet will be described.

Case B1: regarding a case in which the ASZ <NUM> receives a packet that is not designated as transferred through routing information (a packet whose transmission source IP address is not the target device <NUM>).

The ASZ <NUM> transfers a packet PA to the network <NUM> through a normal path (a path according to the main routing table) when receives the packet PA whose transmission source IP address is not the target device <NUM>. Packet PA is transferred via the network <NUM> and a device which is a transmission destination receives the packet PA.

Case B2: regarding a case in which the ASZ <NUM> receives a packet that as a transferred packet is designated through routing information (a packet whose transmission source IP address is the target device <NUM>).

The ASZ <NUM> transfers a packet PA1 to the VRF when receives the packet PA1 whose transmission source IP address is the target device <NUM>. The VRF transfers the transferred packet PA1 to the ASY <NUM> in accordance with a VRF routing table. The ASY <NUM> obtains the packet PA1 and performs security processing in the service providing device <NUM>.

As the result of the security processing, when it is determined that the packet PA1 is a valid packet (for example, a packet which is not a packet for aggressive communication), the service providing device <NUM> transfers the packet PA1 to the router <NUM>. When it is determined that the packet PA1 is not a valid packet (for example, a packet which is not a packet for aggressive communication), the service providing device <NUM> discards the packet PA1. The router <NUM> transfers the packet PA1 to the ASZ <NUM> via the logical path L23. The ASZ <NUM> obtains the transferred packet PA1 and transfers the acquired packet PA1 to the network <NUM>. The network <NUM> obtains the transferred packet PA1 and a device which is a transmission destination receives the packet PA1.

According to the communication system <NUM> constituted in this way, it is possible to easily perform redirection for traffic from a specific device to the Internet. To be specific, the communication control device <NUM> advertises paths so that communication from the target device <NUM> leads to the ASZ <NUM> using a function of the BGP Flowspec. Thus, it is possible to easily perform redirection for traffic from the specific device to the Internet.

Also, it is possible to secure the transparency of the original IP address, which is a problem when the NAT or a proxy is used in combination with the DNS and to cope with the direct access by designating a user IP address. Furthermore, it is possible to perform redirection of traffic leading from a user to the Internet, which cannot be realized using the BGP and redirection of communication leading from a specific device to the Internet, which cannot be realized using any of the DNS and the BGP.

It is possible to introduce a device which ascertains bi-directions of communication such as a stateful firewall as long as the device is on a traffic path redirected transparently and bi-directionally and the same constitution as that of the device incorporated into a host in the user's network in-line can be realized outside of the user's network. That is to say, it is possible to develop a device or a service which can be used only when being currently disposed in the user's house on a network outside of the user's network and the user can have an advantage obtained when the using of the device is not restricted within the user's house and an advantage in which the user is free from a physical house construction.

Also, in the communication system <NUM>, by providing two paths in the downlink path, it is possible to perform route control to designate a communication path as illustrated in <FIG>. In this way, the communication system <NUM> enables the provision of a low-latency DDoS countermeasures service without the need to change setting of the router in the ASX <NUM>. Thus, the communication system <NUM> can enhance the convenience of the communication system.

In the communication system <NUM>, the filter may be set so that the path advertised by the BGP Flowspec is not valid at an interface connected to an upper router (for example, the router <NUM>) through the router <NUM> to avoid a traffic loop.

Although one target device <NUM> is provided in <FIG>, a plurality of target devices <NUM> may be provided.

The communication control device <NUM> may be configured not to include the communication control device <NUM>.

Although a case in which the network of the target device <NUM> is one AS has been described as an example in the embodiment, the network of the target device <NUM> may not be an AS.

Although a case in which the ASY <NUM> and the ASZ <NUM> are independent ASs has been described as an example in the embodiment, the ASY <NUM> and the ASZ <NUM> may be configured as one AS.

Although a case in which the routing tables of the routers (for example, the router, the VR, and the VRF) are statically set has been described as an example in the embodiment, the routing tables of the routers may be dynamically set.

Although a constitution in which as the activation condition of a countermeasure function that the abnormal traffic is detected and that the countermeasure function is not in operation is illustrated in the embodiment, the activation condition of the countermeasure function needs to be not limit to this. For example, when the communication control device <NUM> includes an external application programming interface (API), an activation instruction from an external program via the API may be used as an activation condition and a manual activation instruction may be used as an activation condition of the countermeasure function. Thus, the countermeasure function can be activated not only when abnormal traffic is detected but also the case of normal traffic.

The service providing device <NUM> may be configured to perform processing other than the security processing as predetermined processing. For example, the service providing device <NUM> may perform processing for a transparent cache and processing for the WPA. When the service providing device <NUM> performs the processing for the transparent cache, the service providing device <NUM> functions as a cache device between the target device <NUM> and the network <NUM>. Furthermore, when the service providing device <NUM> performs the processing for the WPA, the service providing device <NUM> functions as a device configured to encrypt a packet in at least a part of communication performed between the target device <NUM> and the network <NUM>.

As described above, the service providing device <NUM> can be used for applications other than security. Thus, convenience can be improved.

In the communication system <NUM>, a plurality of service providing devices <NUM> may be provided in the ASY <NUM>. When a constitution is provided in this way, in the ASY <NUM>, one router <NUM> or one virtual router is provided for each service providing device <NUM>. In accordance with the fact that one router <NUM> or one virtual router is provided for each service providing device <NUM> in the ASY <NUM>, in the ASZ <NUM>, the router <NUM> or the virtual router associated with each router <NUM> or virtual router is provided. Moreover, the associated routers are connected through tunnels. <FIG> illustrates a specific constitution. <FIG> illustrates a case in which virtual routers are provided in an ASY <NUM> and an ASZ <NUM> as an example.

<FIG> is a diagram for explaining a communication path in communication system <NUM> according to the modified example when a countermeasure function in an uplink path is in operation. As illustrated in <FIG>, the ASY <NUM> includes a router <NUM>, a router <NUM>, a communication control device <NUM>, and a plurality of service providing devices <NUM>-<NUM> and <NUM>-<NUM>. Here, the router <NUM> includes a plurality of virtual routers (VRs) <NUM>-<NUM> and <NUM>-<NUM>. The ASZ <NUM> includes a router <NUM> and a router <NUM>. Here, the router <NUM> includes a plurality of VRFs <NUM>-<NUM> and <NUM>-<NUM>. The VR <NUM>-<NUM> and the VRF <NUM>-<NUM> are connected to each other via a tunnel T23-<NUM>. The VR <NUM>-<NUM> and the VRF <NUM>-<NUM> are connected to each other via a tunnel T23-<NUM>.

It is assumed that a routing table of the VR <NUM>-<NUM> is set so that "the service providing device <NUM>-<NUM>" is designated as a default route such that a packet from a target device <NUM> flows to the service providing device <NUM>-<NUM> and "the router <NUM>" is designated such that a packet addressed to the target device <NUM> is transferred to the target device <NUM>. Furthermore, it is assumed that a routing table of the VR <NUM>-<NUM> is set so that "the service providing device <NUM>-<NUM>" is designated as a default route such that a packet from the target device <NUM> flows to the service providing device <NUM>-<NUM> and "the router <NUM>" is designated such that a packet addressed to the target device <NUM> is transferred to the target device <NUM>.

It is assumed that a routing table of the VRF <NUM>-<NUM> is set so that "the router <NUM>" is designated as a default route such that a packet from the target device <NUM> flows to the ASY <NUM> and "a router <NUM>" is designated such that a packet addressed to the target device <NUM> is transferred to the target device <NUM>. Furthermore, it is assumed that a routing table of the VRF <NUM>-<NUM> is set so that "the router <NUM>" is designated as a default route such that a packet from the target device <NUM> flows to the ASY <NUM> and "the router <NUM>" is designated such that a packet addressed to the target device <NUM> is transferred to the target device <NUM>.

Here, it is assumed that routing information FS1 indicates that a packet is transferred to the VRF <NUM>-<NUM> when a transmission source IP address of the packet is the target device <NUM>. In this case, the router <NUM> transfers a packet P transmitted from the target device <NUM> to the VRF <NUM> when it receives the packet P from router <NUM> of the network <NUM>. The VRF <NUM>-<NUM> transfers the packet P to the VR <NUM>-<NUM> via the tunnel T23-<NUM> in accordance with the routing table. The VR <NUM>-<NUM> performs security processing on the transferred packet P in the service providing device <NUM>-<NUM>.

As a result of the security processing, when it is determined that the packet P is a valid packet (for example, a packet which is not a packet for aggressive communication), the service providing device <NUM>-<NUM> transfers the packet P to the router <NUM>. When it is determined that the packet P is not a valid packet (for example, a packet which is not a packet for aggressive communication), the service providing device <NUM>-<NUM> discards the packet P. The router <NUM> transfers the packet P to the ASZ <NUM> via a logical path L23. The ASZ <NUM> obtains the transferred packet P and transfers the obtained packet P to a network <NUM>. Packet P is transferred via the network <NUM> and a device which is a transmission destination receives the packet P.

With such a constitution, it is possible to use different service providing devices from the same target device <NUM>. For example, when one service providing device (for example, the service providing device <NUM>-<NUM>) which have the DPI function and another service providing device (for example, the service providing device <NUM>-<NUM>) which have the WPA function, it is possible to use services using the service providing devices from the same target device <NUM> as necessary.

The transferring to the VRF <NUM>-<NUM> may be designated in the routing information FS1 when using the service providing device <NUM>-<NUM>.

The functions in the above-described embodiments may be realized by a computer. In this case, a program configured to realize such functions is recorded on a computer readable recording medium, the program recorded on the recording medium is read into a computer system and executed so that the functions in the above-described embodiments may be realized. Note that the "computer system" mentioned herein may include an operating system (OS) and hardware such as peripheral devices. Furthermore, the "computer readable recording medium" refers to a storage device such as a flexible disk, a magneto-optical disk, a read only memory (ROM), a portable medium such as a compact disk (CD)-ROM, and a hard disc built in a computer system. In addition, the "computer readable recording medium" may include a medium configured to hold the program dynamically for a short period of time like a communication line when the program is transmitted over a network such as the Internet and a communication circuit such as a telephone line and a medium configured to hold the program for a certain period of time like a volatile memory inside a computer system serving as a server and a client in that case. Furthermore, the program may be used to realize some of the above-described functions. In addition, the above-described functions may be realized using a combination with a program which is already recorded in a computer system. Processing devices instituting the communication systems <NUM> may be realized by dedicated hardware.

Claim 1:
A communication control method which performs route control in a communication system (<NUM>), the communication control method comprising:
a specific network (<NUM>) constituting the Internet; a first network (<NUM>) configured to accommodate a specific device (<NUM>) connected to the specific network; a second network (<NUM>) provided between the specific network and the first network; a network (<NUM>) configured to accommodate a processing device (<NUM>) which is connected to the second network; and the processing device configured to perform predetermined processing on the basis of a packet transmitted between the specific network and the first network:
wherein the communication control method comprises:
controlling a path in the second network in accordance with first routing information defining a path leading from the first network to the specific network ;
wherein the path comprises either a first path of the path leading from the first network to the specific network set as a path leading to the specific network via the network,
or a second path of the path leading from the first network to the specific network set as a path leading to the specific networl via the second network and without passing through the network;
the communication control method further includes forming a tunnel between a router device of the second network (<NUM>) and a router device of the network (<NUM>), and controlling a transferring of a packet to the router device of the network (<NUM>) according to the information in the packet sent from the specific device, by transferring the packet to the second path if a source address of the packet does not correspond to the specific device, or transferring the packet to the first path via the router device of the network (<NUM>) and through the tunnel if the source address of the packet corresponds to the specific device;
wherein the communication control method further comprises performing security processing in the processing device;
as a result of the security processing, when it is determined that the packet is a valid packet, the processing device transfers the packet to the specific network via the second network; and
when it is determined that the packet is not a valid packet, the processing device discards the packet.