Relay control unit, relay control system, relay control method, and relay control program

Abstract

Communication allowance determination means determines, using information of a packet received by a packet relay unit and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition. Rule setting means sets, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination means determines not to allow the communication to the destination unit for the packet that meets the match condition.

1 .- 22 . (canceled) 
     
     
         23 . A relay control unit for controlling a packet relay unit, the relay control unit comprising:
 a communication allowance determination section for determining, using information of a packet received by the packet relay unit and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and   a rule setting section for setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination section determines not to allow the communication to the destination unit for the packet that meets the match condition.   
     
     
         24 . The relay control unit according to  claim 23 , wherein the rule setting section sets, at least in the packet relay unit receiving the packet, a rule for discarding the packet that meets the match condition. 
     
     
         25 . The relay control unit according to  claim 23 , wherein the rule setting section sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to another destination different from the destination unit. 
     
     
         26 . The relay control unit according to  claim 25 , further comprising
 a path computation section for computing a path to a predetermined destination according to the match condition,   wherein the rule setting section sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to the destination computed by the path computation section.   
     
     
         27 . The relay control unit according to  claim 23 , further comprising
 a log creation section for creating a log indicating that the communication allowance determination section determines not to allow the communication to the destination unit,   wherein the rule setting section sets, in the packet relay unit, a rule for transmitting the information of the packet to the relay control unit, when the packet relay unit receives the packet for which the process for suppressing the forwarding to the destination unit is executed, and   wherein the log creation section creates the log, when receiving the information of the packet from the packet relay unit.   
     
     
         28 . The relay control unit according to  claim 23 , further comprising
 a rule storage section for storing the rule set in the packet relay unit,   wherein the rule setting section: stores the rule into the rule storage section, when setting the rule in the packet relay unit; and, in the case where the rule to be set in the packet relay unit is already stored in the rule storage section when the communication allowance determination section determines not to allow the communication to the destination unit for the packet that meets the match condition, does not set the rule in the packet relay unit.   
     
     
         29 . The relay control unit according to  claim 27 , further comprising
 a determination count storage section for storing the number of determinations for the packet for which the communication allowance determination section determines not to allow the communication to the destination unit, in association with an element identifying the packet,   wherein the rule setting section: increases the number of determinations for the packet associated with the element, when the communication allowance determination section determines not to allow the communication to the destination unit; and sets, in the packet relay unit, a rule for suppressing transmission of the information of the packet to the relay control unit, in the case where the number of determinations for the packet exceeds a predetermined threshold.   
     
     
         30 . The relay control unit according to  claim 23 , further comprising:
 a path candidate computation section for computing one or more path candidates to the destination unit of the packet, on condition that the communication allowance determination section determines to allow the communication to the destination unit for the packet that meets the match condition; and   path determination section for determining, for each of the path candidates, whether or not a packet relay unit determining not to allow the communication of the packet exists on the path candidate,   wherein, in the case where the packet relay unit determining not to allow the communication of the packet exists on each path of all of the path candidates, the rule setting section sets, at least in the packet relay unit receiving the packet, the rule of executing the process for suppressing the forwarding of the packet to the destination unit.   
     
     
         31 . The relay control unit according to  claim 30 , wherein, in the case where the packet relay unit that does not allow the communication of the packet that meets the match condition exists on the path, the rule setting section sets, in the packet relay unit, the rule of executing the process for suppressing the forwarding of the packet to the destination unit. 
     
     
         32 . The relay control unit according to  claim 28 , wherein the rule setting section sets the rule stored in the rule storage section, in the packet relay unit. 
     
     
         33 . A relay control system comprising:
 a packet relay unit; and   a relay control unit for controlling the packet relay unit,   wherein the relay control unit includes:   a communication allowance determination section for determining, using information of a packet received by the packet relay unit and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and   a rule setting section for setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination section determines not to allow the communication to the destination unit for the packet that meets the match condition.   
     
     
         34 . The relay control system according to  claim 33 , wherein the rule setting section sets, at least in the packet relay unit receiving the packet, a rule for discarding the packet that meets the match condition. 
     
     
         35 . The relay control system according to  claim 33 , wherein the rule setting section sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to another destination different from the destination unit. 
     
     
         36 . A packet relay unit comprising:
 a flow storage section for storing a flow which is information associating a process for a received packet with information identifying the packet; and   a packet relay section for relaying the received packet based on the flow stored in the flow storage section,   wherein the packet relay section transmits information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage section, and processes the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed for the packet.   
     
     
         37 . A relay control method comprising:
 a relay control unit for controlling a packet relay unit determining, using information of a packet received by the packet relay unit and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and   the relay control unit setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication to the destination unit is determined no to be allowed for the packet that meets the match condition.   
     
     
         38 . The relay control method according to  claim 37 , wherein a rule for discarding the packet that meets the match condition is set at least in the packet relay unit receiving the packet, on condition that the communication to the destination unit is determined no to be allowed for the received packet. 
     
     
         39 . The relay control method according to  claim 37 , wherein a rule for transmitting the packet that meets the match condition to another destination different from the destination unit is set at least in the packet relay unit receiving the packet, on condition that the communication to the destination unit is determined no to be allowed for the received packet. 
     
     
         40 . A packet relay method comprising:
 relaying a received packet based on a flow stored in flow storage section for storing the flow which is information associating a process for the received packet with information identifying the packet; and   transmitting information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage section, and relaying the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed for the packet.   
     
     
         41 . A relay control program applied to a computer for controlling a packet relay unit, the relay control program causing the computer to execute:
 a communication allowance determination process of determining, using information of a packet received by the packet relay unit and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and   a rule setting process of setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication to the destination unit is determined no to be allowed for the packet that meets the match condition in the communication allowance determination process.   
     
     
         42 . The relay control program according to  claim 41 , causing the computer to
 set, at least in the packet relay unit receiving the packet, a rule for discarding the packet that meets the match condition, in the rule setting process.   
     
     
         43 . The relay control program according to  claim 41 , causing the computer to
 set, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to another destination different from the destination unit, in the rule setting process.   
     
     
         44 . A packet relay program applied to a computer that includes flow storage section for storing a flow which is information associating a process for a received packet with information identifying the packet, the packet relay program causing the computer to execute
 a packet relay process of relaying the received packet based on the flow stored in the flow storage section,   wherein in the packet relay process, the computer is caused to transmit information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage section, and process the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed for the packet.