Patent ID: 8667170

Claim:
A relay apparatus for a terminal or a server on a private network that does not have an address on a global network to perform communication through the global network, comprising: a WAN interface unit which provides communication with the global network; a LAN interface unit which provides communication with the private network; an access control unit having means for controlling access from the global network to the private network in accordance with an access control rule which is established on a per sending device basis or on a per sending network basis; an address translation unit including, means for translating an address in accordance with an address translation rule, in order to transfer information from a terminal on the global network to a terminal on the private network, and means for translating an address in accordance with a rule established on a per sending device basis, in order to transfer information from a terminal on the private network to a terminal on the global network; an authentication unit which performs authentication in response to a request for access permission sent from a terminal on the global network, and a database unit which records the access control rule, the address translation rule, and user information used by the authentication unit to perform authentication wherein: the address translation rule dictates a translation using a combination of a sending device address on the global network and destination address of the relay apparatus on the global network to translate the destination address of the relay apparatus on the global network to destination addresses of the terminal or server on the private network, if a combination of the sending device address and destination address included in a packet received at the WAN interface unit is identical to the combination of the sending device address on the global network and destination address of the relay apparatus on the global network included in the address translation rule, the address translation unit translates the destination address of the packet received at the WAN interface unit to the destination address of the terminal or server on the private network, the access control unit further includes, means for adding an access control rule established on a per sending device basis or a per sending network basis to the database unit if the authentication succeeds; and means for deleting the added access control rule from the database unit when a predetermined criterion for ending communication is satisfied; and the address translation unit further includes, means for adding an address translation rule which sets the terminal on the global network as the sending device to the database unit if the authentication succeeds, and means for deleting the added address translation rule from the database unit when a predetermined criterion for ending communication is satisfied.