WO2015145976A1

WO2015145976A1 - Communication system, control instruction device, control implementation device, communication control method, and storage medium with program stored thereon

Info

Publication number: WO2015145976A1
Application number: PCT/JP2015/000992
Authority: WO
Inventors: 玲未沼尻
Original assignee: 日本電気株式会社
Priority date: 2014-03-28
Filing date: 2015-02-26
Publication date: 2015-10-01
Also published as: JPWO2015145976A1

Abstract

This invention implements access control appropriate to the current communication status of either the originating node of a packet or the destination node of said packet. This control instruction device comprises a communication-status management unit, a determination unit, and an instruction unit. The communication-status management unit stores, in a communication-status storage unit, the status of communication between nodes that communicate via a control implementation device. The determination unit refers to said communication-status storage unit to acquire the status of communication between either the originating node of a packet about which an inquiry was made or the destination node of said packet and another node. On the basis of the originating node, the destination node, and the communication status of the originating node and/or the destination node, the determination unit determines a processing method for the packet in question, and the instruction unit instructs the control implementation device to apply said processing method.

Description

Communication system, control instruction apparatus, control execution apparatus, communication control method, and storage medium for storing program

The present invention relates to a communication system, a control instruction device, a control execution device, a communication control method, and a storage medium for storing a program.

Recently, a technique called programmable flow or open flow has been proposed (see Non-Patent Documents 1 and 2). OpenFlow is a technology that considers communication as an end-to-end flow and performs path control, failure recovery, load balancing, and optimization on a per-flow basis. The OpenFlow switch specified in Non-Patent Document 2 includes a secure channel for communication with the OpenFlow controller, and operates according to a flow table that is appropriately added or rewritten from the OpenFlow controller. For each flow, a set of a match condition (Match Fields), flow statistical information (Counters), and an instruction (Instructions) that defines processing contents is defined for each flow (flow table). (For example, it is described in the section of “4.1 Flow Table” of Non-Patent Document 2).

For example, when the OpenFlow switch receives a packet, the OpenFlow switch searches the flow table for an entry having a matching condition (see “4.3 Match Fields” in Non-Patent Document 2) that matches the header information of the received packet. When an entry that matches the received packet is found as a result of the search, the OpenFlow switch updates the flow statistical information (counter) and executes the processing contents described in the instruction field of the entry on the received packet. To do. The processing content is, for example, packet transmission from a designated port, flooding or discarding. On the other hand, if no entry matching the received packet is found as a result of the search, the OpenFlow switch sends an entry setting request to the OpenFlow controller via the secure channel, that is, a control for processing the received packet. An information transmission request (Packet-In message) is transmitted. The OpenFlow switch receives a flow entry whose processing content is defined and updates the flow table. As described above, the OpenFlow switch performs packet transfer using the entry stored in the flow table as control information.

Patent Document 1 discloses an example of an access control apparatus that performs role-based access control (Role-Based Access Control, hereinafter referred to as “RBAC”). The access control device disclosed in Patent Literature 1 includes a user information table, a role information table, and an access control table. The user information table stores a user and an attribute value that the user has in association with each other. The role information table stores a combination of attribute values and a role defined by the combination of the attribute values in association with each other. The access control table stores the content and role ID (Identifier) in association with each other. The role ID defines an access condition for the content. The access control device disclosed in Patent Literature 1 sets a list of users having attribute values corresponding to roles in the user list information table for each role based on the user information table and the role information table. When an access request to the content occurs, the access control unit identifies the role of the access condition based on the access control table, and sets the access authority depending on whether or not the access user is included in the user list of the specified role. judge.

JP 2010-1117885 A

The following analysis was given by the inventor of the present invention. By using the technology disclosed in Non-Patent Document 1 and Non-Patent Document 2 to set a flow entry that considers the role in the OpenFlow switch on the communication path, role-based access control as disclosed in Patent Document 1 is performed. Of course, even path control can be realized.

However, the technique disclosed in the prior art document has a problem in that access control according to the current communication status of the node that is the transmission source or transmission destination of the packet cannot be performed. This is because the technology disclosed in the prior art document does not have a mechanism for detecting the current communication status of a certain node and performing access control.

For example, assume that a company has security guidelines that include policy 1 and policy 2 as shown below.
Policy 1: While node A is accessing node C where customer confidential information is stored, communication from node A to node B is not permitted.
Policy 2: While node A is not accessing node C, communication from node A to node B is permitted.

The technology disclosed in the prior art documents cannot realize access control according to the above security guidelines. An object of the present invention is to realize access control according to the current communication status of a node that is a transmission source of a packet or a node that is a transmission destination.

A first aspect of the present invention is a communication for storing a communication status between nodes that perform communication in a communication status storage unit via a control execution device that processes the packet based on an instruction to an inquiry regarding a packet processing method. A communication status between a status management unit, a transmission source node or a transmission destination node of the packet to be inquired, and another node is obtained by referring to the communication status storage unit, and the transmission source node , The transmission destination node, a determination unit that determines a processing method of the packet based on the communication status of at least one of the transmission source node and the transmission destination node, and the control of the determined processing method A control instruction device comprising: an instruction unit that instructs the device.

A second aspect of the present invention is a communication system including a control execution device and a control instruction device, wherein the control execution device makes an inquiry to the control instruction device for a packet processing method, and the inquiry A packet processing unit that processes the packet based on an instruction to the communication status management, wherein the control instruction device stores a communication status between nodes that communicate via the control execution device in a communication status storage unit And a communication status between the source node or destination node of the packet to be inquired and another node by referring to the communication status storage unit, the source node, A processing method of the packet based on the communication status of the transmission destination node and at least one of the transmission source node and the transmission destination node A determination unit for determining a, and a instructing unit for instructing the processing method described above determined for the control execution unit, a communication system.

According to a third aspect of the present invention, a control execution apparatus that processes the packet and a control instruction apparatus that is communicably connected based on an instruction to an inquiry regarding a packet processing method are configured such that a node via the control execution apparatus A communication status storage unit that stores the communication status of the packet that is the target of the inquiry by referring to the communication status storage unit. Determining a processing method of the packet based on the communication status of the transmission destination node and at least one of the transmission source node and the transmission destination node, and determining the determined processing method to the control execution device. It is a control method to instruct.

According to a fourth aspect of the present invention, based on an instruction to an inquiry regarding a packet processing method, a control execution device that processes the packet and a computer that is communicably connected to a node between the nodes via the control execution device A process of storing a communication status in a communication status storage unit, and referring to the communication status storage unit, obtains a communication status of a transmission source node or a transmission destination node of the packet to be inquired, and the transmission source node , A process for determining a processing method of the packet based on a communication status of the transmission destination node and at least one of the transmission source node and the transmission destination node, and the process determined for the control execution apparatus A computer-readable storage medium storing a program for executing a process for instructing a method.

The object of the present invention is also achieved by a program stored in the computer-readable storage medium.

According to the present invention, it is possible to realize access control according to the current communication status of a node that is a transmission source or transmission destination of a packet.

FIG. 1 is a block diagram showing a configuration of a communication system 1000 according to the first embodiment of the present invention. FIG. 2 is a block diagram showing the configuration of the communication system 1000 according to the first embodiment of the present invention. FIG. 3 is a diagram illustrating an example of information stored in the instruction cache 130 according to the first embodiment of the present invention. FIG. 4 is a diagram illustrating an example of information stored in the communication status storage unit 240 according to the first embodiment of the present invention. FIG. 5 is a diagram illustrating an example of information stored in the first table 250 according to the first embodiment of the present invention. FIG. 6 is a diagram illustrating an example of information stored in the second table 260 according to the first embodiment of the present invention. FIG. 7 is a diagram for explaining the outline of processing of the communication system 1000 according to the first embodiment of the present invention. FIG. 8 is a diagram for explaining an overview of processing of the communication system 1000 according to the first embodiment of the present invention. FIG. 9 is a sequence diagram illustrating an example of the operation of the communication system 1000 according to the first embodiment of the present invention. FIG. 10 is a sequence diagram illustrating an example of the operation of the communication system 1000 according to the first embodiment of the present invention. FIG. 11 is a diagram illustrating an example of information stored in the first table 251 according to the first embodiment of the present invention. FIG. 12 is a diagram illustrating an example of information stored in the first table 252 according to the first embodiment of the present invention. FIG. 13 is a block diagram showing a configuration of a communication system 1000A according to the second embodiment of the present invention. FIG. 14 is a block diagram showing a configuration of a communication control apparatus 300B according to the third embodiment of the present invention. FIG. 15 is a block diagram illustrating an example of a configuration of a computer that can implement a communication execution device and a control instruction device, or a communication control device, according to each embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that the reference numerals of the drawings attached to this summary are attached to the respective elements for convenience as an example for facilitating understanding, and are not intended to limit the present invention to the illustrated embodiment.

(Explanation of terms)
A node is, for example, a terminal (information processing apparatus). For example, the node may be a virtual node realized by virtualization software.

The packet transmission source node is a term indicating a node that has transmitted the packet. The packet transmission destination node is a term indicating a node which is a destination of the packet. Hereinafter, information for identifying a transmission source node of a packet is referred to as a “transmission source node identifier”. Hereinafter, information for identifying a transmission destination node of a packet is referred to as a “transmission destination node identifier”. The node identifier is, for example, an IP (Internet Protocol) address or a MAC (Media Access Control) address, but is not limited thereto.

<First Embodiment>
FIG. 1 is a block diagram showing a configuration of a communication system 1000 according to the first embodiment. As shown in FIG. 1, the communication system 1000 includes a control execution device 100 and a control instruction device 200.

The control execution device 100 is, for example, a network switch (hereinafter also referred to as “switch”). A network switch is a communication device capable of switching a communication path in a communication network (hereinafter also referred to as “network”) by switching, for example, a transfer destination device of a packet flowing through the communication network. The control execution apparatus 100 is connected to a network and performs processing for transferring a received packet. The control execution apparatus 100 receives an instruction regarding the packet processing method from the control instruction apparatus 200. The control execution apparatus 100 transfers the received packet according to the packet processing method instructed from the control instruction apparatus 200.

The control instruction device 200 is a controller, for example. The control instruction device 200 is connected to a network, and is connected to the control execution device 100 via the network. The control instruction device 200 receives an inquiry from the control execution device 100 regarding the packet transfer method. The control instruction device 200 gives an instruction for the inquiry to the control execution device 100.

FIG. 2 is a block diagram showing a detailed configuration of the control execution device 100 and the control instruction device 200 shown in FIG.

(Configuration of control execution apparatus 100)
As illustrated in FIG. 2, the control execution apparatus 100 includes a packet processing unit 110, an inquiry unit 120, and an instruction cache 130.

The packet processing unit 110 will be described. The packet processing unit 110 processes the received packet based on the processing method stored in the instruction cache 130.

The inquiry unit 120 will be described. When the received packet processing method is not stored in the instruction cache 130, the inquiry unit 120 inquires the control instruction apparatus 200 about the received packet processing method. Also, the inquiry unit 120 receives an instruction (that is, a packet processing method) for the inquiry from the control instruction apparatus 200. The inquiry unit 120 writes the received packet processing method in the instruction cache 130. As a result, packets having the same characteristics are processed using the entries stored in the instruction cache 130.

The instruction cache 130 will be described. The instruction cache 130 stores an entry indicating the packet processing method received from the control instruction apparatus 200. For example, when the control execution apparatus 100 is an open flow switch, the instruction cache 130 corresponds to a flow table.

FIG. 3 is a diagram illustrating an example of information stored in the instruction cache 130. As shown in FIG. 3, the instruction cache 130 stores a plurality of entries. The entry associates the node identifier of the packet source node (ie, the source node identifier), the node identifier of the packet destination node (ie, the identifier of the destination node), and the processing method of the packet. Information. For example, when the transmission source node of the packet received by the control execution apparatus 100 is the node 4 and the transmission destination node is the node 5, the control execution apparatus 100 should transmit the packet to the port 1. The entry in the first row in the table shown in FIG.

(Control instruction device 200)
Returning to the description with reference to FIG. As shown in FIG. 2, the control instruction device 200 includes an instruction unit 210, a determination unit 220, a communication status management unit 230, a communication status storage unit 240, a first table 250, and a second table 260. Is provided. In the description of the present embodiment, the first table 250 and the second table 260 represent storage units that store information in the form of a table, for example. In the description of the present embodiment, the first table 250 is also referred to as a first information storage unit 250. Similarly, the second table 260 is also expressed as a second information storage unit 260.

The instruction unit 210 will be described. The instruction unit 210 receives an inquiry about the packet processing method from the control execution apparatus 100. In addition, the instruction unit 210 instructs the control execution apparatus 100 how to process the packet. In addition, the instruction unit 210 transmits an instruction to delete a specific entry stored in the instruction cache 130 to the control execution apparatus 100 at a predetermined timing.

The determination unit 220 will be described. The determination unit 220 refers to the information stored in the header of the packet to acquire the transmission source node identifier and the transmission destination node identifier of the packet. The determination unit 220 searches the communication status storage unit 240, the first table 250, and the second table 260 based on the transmission source node identifier and the transmission destination node identifier. Details of the first table 250 and the second table 260 will be described later. The determination unit 220 determines a processing method for the packet based on the result obtained by the search.

The communication status management unit 230 will be described. When the control instruction apparatus 200 detects that a connection has been established between a transmission source node and a transmission destination node of a packet, the communication status management unit 230 stores an entry for the packet in the communication status storage unit 240. To do. The entry includes information in which the transmission source node identifier and the transmission destination node identifier of the packet are associated with each other.

Alternatively, when the determination unit 220 permits the connection between a transmission source node and a transmission destination node of a packet to be established, the communication status management unit 230 stores an entry for the packet in the communication status storage unit 240. To do.

When the control instruction apparatus 200 detects that the connection between the transmission source node and the transmission destination node of a packet has been disconnected, the communication status management unit 230 deletes the entry for the packet from the communication status storage unit 240. To do. Alternatively, when the determination unit 220 determines to disconnect the connection between the transmission source node and the transmission destination node of a certain packet, the communication status management unit 230 deletes the entry for the packet from the communication status storage unit 240. To do.

That is, that the entry is stored in the communication status storage unit 240 indicates that a connection is currently established between the transmission source node and the transmission destination node in the entry. The communication status management unit 230 only needs to operate so as to maintain a state in which the above-described entry is stored in the communication status storage unit 240. The operation of the communication status management unit 230 is not limited to the specific example described above.

The communication status storage unit 240 will be described. The communication status storage unit 240 stores an entry in which a transmission source node identifier and a transmission destination node identifier are associated with each other. FIG. 4 is a diagram illustrating an example of entries held in the communication status storage unit 240. The entry in the first line illustrated in FIG. 4 includes a source node identifier, a destination node identifier, and a service or protocol identifier.

The communication status storage unit 240 may store a plurality of identifiers such as identifiers of each layer of the network, for example. The communication status storage unit 240 may store, for example, an MAC address that is an identifier of a layer 2 (L2) or an IP address that is an identifier of a layer 3 (L3) of an OSI (Open Systems Interconnection) reference model. Similarly, the communication status storage unit 240 may store a plurality of transmission destination identifiers. Further, the communication status storage unit 240 may store not only one but also a plurality of identifiers of the source and destination services and protocols.

The communication status storage unit 240 may store a port number instead of the transmission source node identifier or the transmission destination node identifier.

The first table 250 (that is, the first information storage unit 250) will be described. The first table 250 stores information (that is, first information) in which the identifier of the node, the current communication status of the node, and the role in the current communication status of the node are associated with each other. Yes. The first table 250 may store the first information in a table format. The first table 250 may store the first information in a format other than the table format. Hereinafter, the role of the node in the current communication state may be simply referred to as “node role”. A role is sometimes called a “role”. The communication status represents, for example, whether or not a connection with another specific node has been established. The communication status may be represented by, for example, a combination of a node identifier and a value indicating whether or not a connection with the node specified by the identifier is established.

Here, the role is explained briefly. For each node, an organization network that the node can access is determined. In addition, for example, a certain node is a node that handles customer data, and another node is a node that is used only locally, so roles that are not necessarily the same are assigned to the respective nodes. The role and importance of these nodes are collectively expressed as roles.

FIG. 5 is a diagram illustrating an example of information stored in the first table 250. In the table shown in FIG. 5, the information shown in the first row indicates that the role of node 1 is “B” while node 1 establishes a connection with node 3. In the table shown in FIG. 5, the information shown in the second row indicates that the role of node 1 is “A” while node 1 has not established a connection with node 3.

As described above, the communication system 1000 according to the present embodiment has a configuration in which the role (role) of the node dynamically changes according to the current communication state of the node.

In the table shown in FIG. 5, the information shown in the fifth line indicates that the role of the node 10 is “D” regardless of the current communication status. In FIG. 5, the symbol “*” shown in the fifth and sixth lines indicates a wild card. The communication status represented by the wild card is suitable for any communication status. Therefore, when a role is associated with an identifier of any node and a communication status represented by a wild card, the role of the node represented by the identifier is determined regardless of the communication status. In other words, the role of a node whose communication status is represented by a wild card is determined regardless of the communication status. Thus, there may be a node whose role is determined regardless of the current communication status. In the table shown in FIG. 5, as will be described later, the node that is first determined to be suitable for the communication status of the transmission source node and the transmission source node and the role associated with the communication status are the roles of the transmission source node. It is.

The node identifier represented by the wildcard matches any node identifier. Therefore, when the role is associated with the identifier of the node represented by the wild card and any communication status, the role of the node in the communication status is determined regardless of the node. In the table shown in FIG. 5, the information shown in the sixth line indicates that the role of the node that has established a connection with the current node 7 is “E” regardless of which node it is. Show. Thus, the role of a node may be determined regardless of which node the node is.

The second table 260 (that is, the second information storage unit 260) will be described. The second table 260 includes information (that is, second information) in which a combination of a role of a transmission source node of a packet and a role of a transmission destination node of the packet is associated with a processing method for the packet. I remember it. The second table 260 may store the second information in a table format. The second table 260 may store the second information in a format other than the table format. The processing method stored in the second table 260 may be information in a format that the control execution device 100 can interpret, or information in a format that the control execution device 100 cannot interpret as it is. FIG. 6 is a diagram illustrating an example of information stored in the second table 260.

In the second information stored in the second table 260, the role of the transmission source node and the role of the transmission destination node are represented by the above-described symbol “*” (that is, a wild card) that matches both roles. May be. For example, when the role of the transmission source node is represented by a wild card, the processing method is determined by the role of the transmission destination node regardless of the role of the transmission source node. When the role of the destination node is represented by a wild card, the processing method is determined by the role of the source node, regardless of the role of the destination node.

In the table shown in FIG. 6, the information shown in the first line indicates that when the role of the transmission source node of the packet is “A” and the role of the transmission destination node is “B”, the processing method of the packet is “ALLOW”. And exclusive ”. “ALLOW and exclusive” represents, for example, that a packet is transmitted exclusively (that is, the packet is transmitted while occupying a communication path). In the table shown in FIG. 6, the information shown in the second line is that the packet processing method is “DENY” when the role of the transmission destination node is “C” regardless of the role of the packet transmission source node. It shows that. “DENY” represents, for example, that the transmission of the packet is rejected.

The second information stored in the second table 260 may be a database in which documents such as security standards and procedure manuals are databased. The security standard is, for example, PCI DSS (Payment Card Industry Data Security Standard). The security standard describes, for example, security items that should be protected during system operation. In that case, the second table 260 stores, for example, information obtained by converting a security standard described in a natural language into a format that can be automatically determined by the control instruction device 200 as second information.

(Outline of communication control processing)
7 and 8 are diagrams for conceptually explaining an outline of communication control processing performed by the communication system 1000 according to the first embodiment.

7 and FIG. 8 indicate the flow of packets from the node that is the source of the arrow (that is, the start point) to the node that is the tip of the arrow (that is, the end point). The dotted arrows in FIGS. 7 and 8 indicate that a connection is established between the node that is the source of the arrow and the node that is the destination of the arrow.

In FIG. 7, node 1 is going to transmit a packet to node 2 from now on. That is, node 1 is a transmission source node, and node 2 is a transmission destination node. In FIG. 7, node 1 and node 3 are in a state where a connection is established.

The communication system 1000 according to the first embodiment controls the flow of packets from the transmission source node to the transmission destination node according to the current communication status of the transmission source node. For example, the communication system 1000 controls the flow of packets from the node 1 to the node 2 depending on whether or not the node 1 is currently establishing a connection with the node 3.

In FIG. 8, node 1 is a node which is going to transmit a packet to node 2 from now on. That is, node 1 is a transmission source node, and node 2 is a transmission destination node. In FIG. 8, the nodes 2 and 3 are in a state where a connection is established.

The communication system 1000 according to the first embodiment may control the flow of packets from the transmission source node to the transmission destination node according to the current communication state of the transmission destination node. For example, the communication system 1000 controls the flow of packets from the node 1 to the node 2 depending on whether or not the node 2 is currently establishing a connection with the node 3.

The communication system 1000 according to the first embodiment considers both the current communication status of the transmission source node and the current communication status of the transmission destination node, and the flow of packets from the transmission source node to the transmission destination node. May be controlled.

(Description of operation of communication system 1000)
An example of the operation of the communication system 1000 will be described with reference to FIG. FIG. 9 is a sequence diagram illustrating an example of the operation of the communication system 1000 according to the first embodiment. In the following description, it is assumed that the transmission source node is node 1 and the transmission destination node is node 2.

The node 1 that is the transmission source node transmits the packet whose destination is the node 2 to the control execution apparatus 100. (Step S101).

The control execution apparatus 100 receives the packet. The control execution apparatus 100 refers to the header of the packet and acquires the transmission source node identifier and the transmission destination node identifier of the packet. The control execution apparatus 100 searches the instruction cache 130 based on the transmission source node identifier and the transmission destination node identifier. Specifically, the control execution apparatus 100 searches the instruction cache 130 to extract an entry (that is, an entry related to the packet) obtained from the packet and including the transmission source node identifier and the transmission destination node identifier. . If a connection has already been established between the transmission source node specified by the transmission source node identifier and the transmission destination node specified by the transmission destination node identifier, an entry related to the packet exists in the instruction cache 130 (YES in step S102). As described above, the entry related to the packet stored in the instruction cache 130 includes a method for processing the packet. The control execution apparatus 100 processes the packet according to the packet processing method stored in the instruction cache 130 (step S104).

If there is no entry related to the packet in the instruction cache 130 (NO in step S102), the control execution apparatus 100 inquires the control instruction apparatus 200 about the processing method of the packet.

The control instruction device 200 receives an inquiry about the packet processing method from the control execution device 100 and determines the packet processing method (step S103). The control instruction device 200 instructs the control execution device 100 on the determined processing method. For example, the control instruction apparatus 200 may indicate the processing method to the control execution apparatus 100 by transmitting the determined processing method to the control execution apparatus 100. Details of the operation shown in step S103 will be described later.

The control execution apparatus 100 receives a processing method from the control instruction apparatus 200. The control execution apparatus 100 processes the packet based on the received processing method (step S104).

If the processing method indicates, for example, that communication from the node 1 to the node 2 is permitted, the node 2 receives the packet (step S105).

Next, the operation shown in step S103 in FIG. 9 will be described in more detail. FIG. 10 is a sequence diagram for explaining the operation shown in step S103 in more detail.

The instruction unit 210 receives an inquiry about the packet processing method from the control execution apparatus 100 (step S201).

Next, the determination unit 220 refers to the header of the packet and acquires the transmission source node identifier and the transmission destination node identifier of the packet. The determination unit 220 searches the communication status storage unit 240 using the acquired transmission source node identifier and transmission destination node identifier as keys (step S202). By performing such a search, the determination unit 220 extracts an entry including the transmission source node identifier of the packet. In addition, the determination unit 220 extracts an entry including the transmission destination node identifier of the packet.

The communication status storage unit 240 returns the current communication status of the transmission source node specified by the acquired transmission source node identifier to the determination unit 220. In the example shown in FIG. 9, the transmission source node of the packet is node 1. In addition, the communication status storage unit 240 returns the current communication status of the transmission destination node specified by the acquired transmission destination node identifier to the determination unit 220. In the example illustrated in FIG. 9, the transmission destination node of the packet is the node 2. The communication status of a node returned to the determination unit 220 by the communication status storage unit 240 may be information indicating another node with which the node has established a connection, for example. The determination unit 220 may read the identifier of the node associated with the transmission source node identifier of the packet in the entry stored in the communication status storage unit 240 from the communication status storage unit 240. In addition, the determination unit 220 may read from the communication status storage unit 240 the node identifier associated with the destination node identifier of the packet in the entry stored in the communication status storage unit 240. As described above, when an entry including an identifier of a certain node is stored in the communication status storage unit 240, the determination unit 220 establishes a connection with another node whose identifier is included in the entry. Get the information. For example, when the communication status storage unit 240 stores only the entries shown in FIG. 4, the communication status storage unit 240 displays information that “the node 1 is currently establishing a connection with the node 3” as the determination unit 220. It may be returned to. In addition, the communication status storage unit 240 may return information that “the node 2 is not currently establishing a connection with any node” to the determination unit 220.

The determination unit 220 searches the first table 250 using the transmission source node identifier and the current communication status of the transmission source node as keys (step S204). Further, the determination unit 220 searches the first table 250 using the destination node identifier and the current communication status of the destination node as keys (step S204).

The determination unit 220 sets the role associated with the identifier of the node that matches the source node identifier and the communication status that matches the communication status of the returned source node as the role of the source node. What is necessary is just to extract from the information stored in the table 250. Further, the determination unit 220 sets the role associated with the identifier of the node that matches the destination node identifier and the communication status that matches the communication status of the returned destination node as the destination role. What is necessary is just to extract from the information stored in one table 250. The source node identifier conforms to, for example, the same identifier as the source node identifier and the symbol “*” described above. The destination node identifier conforms to, for example, the same identifier as the destination node identifier and the symbol “*” described above. The communication status matches the same communication status as the communication status and the symbol “*” described above. The information stored in the first table 250 may be set so that the roles of a plurality of transmission source nodes are not extracted with respect to the transmission source node identifier and the communication status of the transmission source node.

When the roles of a plurality of transmission source nodes are extracted with respect to the transmission source node identifier and the communication status of the transmission source node, the determination unit 220 performs one transmission from the extracted roles of the plurality of transmission source nodes. The role of the original node may be selected according to a predetermined rule. In the example illustrated in FIG. 6, the determination unit 220 determines whether or not the node identifier and the communication status of the row in order from the first row match the source node identifier and the communication status, which are keys, respectively. What is necessary is just to determine. The determination unit 220 may extract the role associated with the identifier and communication status of the node first determined to be compatible with the transmission source node identifier and the communication status as the role of the transmission source node. .

Similarly, when the roles of a plurality of destination nodes are extracted with respect to the destination node identifier and the communication status of the destination nodes, the determination unit 220 determines that the roles of the plurality of destination nodes extracted are as follows: The role of one destination node may be selected according to a predetermined rule. In the case of the example illustrated in FIG. 6, the determination unit 220 determines whether or not the node identifier and the communication status of the row in order from the first row match the destination node identifier and the communication status, which are keys, respectively. What is necessary is just to determine. The determination unit 220 may extract the role associated with the identifier of the node first determined to be compatible with the transmission source node identifier that is the key and the communication status as the role of the transmission destination node. .

The first table 250 returns the role of the transmission source node and the role of the transmission destination node to the determination unit 220 (step S205). The determination unit 220 may read the role detected as the destination role from the first table 250. Furthermore, the determination unit 220 may read the role detected as the role of the transmission source node from the first table 250. When the first table 250 stores the information illustrated in FIG. 5, the role of the transmission source node (that is, the node 1) in the current communication state is “B”. Further, the role in the current communication state of the transmission destination node (ie, node 2) is “A”.

The determining unit 220 searches the second table 260 using the combination of the role of the transmission source node (B in the above example) and the role of the transmission destination node (A in the above example) as a key (step S206). The determination unit 220 reads “the role of the transmission source node” and “the role of the transmission destination node” that match the combination of the role of the transmission source node and the role of the transmission destination node read from the first table 250. May be detected in the second table 260. The determination unit 220 may extract the processing method associated with the detected combination of the “source node role” and the “destination node role” in the second table 260.

The role matches the role and the role represented by the symbol “*” described above. The role of the transmission source node read from the first table 250 is, for example, the same role as that role in the second table 260, and “the role of the transmission source node”, which is the above-mentioned symbol “*”. " The role of the destination node read from the first table 250 is, for example, the same role as the role in the second table 260 and “the role of the destination node”, which is the above-mentioned symbol “*”. " The combination of “source node role” and “destination node role” that matches the source node role and destination node role included in the key combination is the key combination. Fits. The information stored in the second table 260 may be set so that a plurality of processing methods are not extracted for one key.

When a plurality of processing methods are extracted for one key, the determination unit 220 may select one processing method from the extracted processing methods according to a predetermined method. For example, in the example illustrated in FIG. 6, the determination unit 220 may determine whether or not the role of the transmission source node and the role of the transmission destination node match the key in order from the first row. Then, the determination unit 220 may extract a processing method associated with the role of the transmission source node and the role of the transmission destination node that are first determined to be suitable for the key.

The second table 260 returns the processing method associated with the combination of the role of the transmission source node and the role of the transmission destination node to the determination unit 220 (step S207). The determination unit 220 associates with the combination of “source role” and “destination role” that is read from the first table 250 and matches the combination of the role of the source node and the role of the destination node. The processing method being used may be read from the second table 260. For example, when the second table 260 stores the information shown in FIG. 6, the processing method corresponding to the flow in which the role of the transmission source node is A and the role of the transmission destination node is B is “ALLOW and exclusive”. Is.

The determining unit 220 determines a processing method to be transmitted to the control execution apparatus 100 based on the processing method obtained by searching the second table 260 (step S208). When the processing method stored in the second table 260 is information that can be interpreted by the control execution apparatus 100, the determination unit 220, for example, uses the processing method stored in the second table 260 as it is. May be sent to. When the processing method stored in the second table 260 is not information that can be interpreted by the control execution apparatus 100, the determination unit 220 generates information that can be interpreted by the control execution apparatus 100 based on the processing method. Also good. Then, the determination unit 220 may transmit the generated information to the control execution apparatus 100 as a processing method. For example, when the processing method stored in the second table 260 is not data that can be interpreted by the control execution device 100, the determination unit 220 determines whether the control execution device 100 interprets the predetermined processing method. Data representing an instruction that can be generated may be generated. Then, the determination unit 220 may determine the generated data as data to be transmitted to the control execution apparatus 100. The determination unit 220 may transmit the converted data representing the instruction to the control execution apparatus 100.

For example, when the processing method “DENY” is stored in the second table 260, the control instruction device 200 may transmit an instruction to discard the packet. For example, when the processing method “ALLOW” is stored in the second table 260, the control instruction apparatus 200 may transmit an instruction to transfer the packet to a specific port.

The instruction unit 210 transmits the processing method determined by the determination unit 220 to the control execution apparatus 100 (step S209).

When the communication status storage unit 240 does not store an entry related to the combination of the transmission source node and the transmission destination node of the packet, the communication status management unit 230 stores the entry related to the combination in the communication status storage unit 240. . Since the communication status storage unit 240 does not store an entry related to the combination of the identifier of the node 1 and the identifier of the node 2, the communication status management unit 230 stores the identifier of the node 1 and the identifier of the node 2 in the communication status storage unit 240. Add an entry for the combination.

If the determination unit 220 determines a processing method that does not permit transmission of the packet, the communication status management unit 230 sets an entry related to the combination of the transmission source node identifier and the transmission destination node identifier of the packet to the communication Not stored in the status storage unit 240. This is because no actual communication occurs when the packet is discarded.

The example of the operation of the communication system 1000 according to the first embodiment has been described above.

In the operation shown in step S202 described above, the determination unit 220 may operate to search the communication status storage unit 240 using at least one of the transmission source node identifier and the transmission destination node identifier as a key.

(Timing when the instruction cache 130 is swept out)
The instruction unit 210 may transmit, to the control execution apparatus 100, an instruction to delete an entry related to the node from the instruction cache 130 at a timing when it is detected that the communication status of an arbitrary node has changed.

Alternatively, the instruction unit 210 instructs the control execution apparatus 100 to delete an entry related to the node from the instruction cache 130 at the timing when the determination unit 220 determines to change the communication status of an arbitrary node. You may send it.

Alternatively, the control execution apparatus 100 may voluntarily delete the entry after a predetermined time has elapsed since the entry was registered in the instruction cache 130.

Alternatively, the control instruction device 200 may include a mechanism for detecting the end of communication between nodes (that is, disconnection of connection). The mechanism may determine whether an entry in the instruction cache 130 is necessary. As a mechanism for detecting the end of communication between nodes, there is a method of checking a communication protocol end message of connection-type communication. For example, in TCP (Transmission Control Protocol), the end of communication can be detected by checking a FIN (finish) flag or an ACK (acknowledgement) flag from the opposite direction. Also in this case, it is desirable that the control execution apparatus 100 transmits a message indicating that the entry in the instruction cache 130 has been deleted by detecting the end of communication (that is, the flow) to the control instruction apparatus 200. In response to receiving the message, the communication status management unit 230 can delete the corresponding entry stored in the communication status storage unit 240.

For example, the OpenFlow switch (the control execution apparatus 100) disclosed in Non-Patent Document 2 uses the “Flow-removed” message to notify the OpenFlow controller (control instruction apparatus 200) that the flow entry has timed out. it can. More specifically, for example, an administrator sets a timeout in the flow entry of the flow table (instruction cache 130) of the OpenFlow switch. When a timeout is established, for example, by not receiving the packet for a certain period of time, the control execution apparatus 100 notifies the control instruction apparatus 200 of the timeout with a “Flow-removed” message. Upon receiving the “Flow-removed” message, the control instruction apparatus 200 searches for an entry in the communication status storage unit 240 based on the transmission destination IP address and port number of the packet included in the timeout notification. The control instruction device 200 deletes the entry specified by the search.

Thus, the contents of the entry stored in the instruction cache 130 are automatically updated to the contents in accordance with the security policy in accordance with the communication status between the nodes.

(Example of hardware configuration)
The control execution apparatus 100 can be realized by an open flow switch, for example. The control execution apparatus 100 may be implemented as a firewall or a network switch. The control execution device 100 is not necessarily a physical device, and may be, for example, a personal firewall or a virtual switch implemented by software operating on a node, that is, on a communication terminal. The function of the control execution apparatus 100 is realized by, for example, a CPU (Central Processing Unit) executing a computer program read into the memory.

The control instruction device 200 can be realized by an open flow controller, for example. The function of the control instruction device 200 is realized, for example, when the CPU executes a computer program (software program, hereinafter simply referred to as “program”) read into the memory.

The control execution device 100 and the control instruction device 200 can be realized by using an open flow control device (controller) and a switch as described above. The control execution apparatus 100 and the control instruction apparatus 200 can also be realized by a control instruction apparatus and a control execution apparatus having equivalent functions, which are not open flow control apparatuses (controllers) and switches.

Note that each unit (processing unit) of the control execution device 100 and the control instruction device 200 illustrated in FIG. 2 performs the processing of each unit described above by using a computer that implements these devices and the hardware of the computer. It can also be realized by a computer program to be executed.

The control execution device 100 and the control instruction device 200 are not necessarily separated from each other. For example, the control execution device 100 and the control instruction device 200 may be the same device. The control execution device 100 may have a function of operating as the control instruction device 200.

(Effects of the first embodiment)
According to the communication system 1000 according to the first embodiment, it is possible to realize access control according to the current communication status of a node that is a transmission source or transmission destination of a packet.

(Modification of the first embodiment)
The communication status storage unit 240 is not necessarily installed in the same device as the device in which the communication status management unit 230 and the determination unit 220 are installed. The communication status storage unit 240 only needs to be mounted so as to be accessible from the communication status management unit 230 and the determination unit 220.

The first table 250 and the second table 260 are not necessarily mounted in the same device as the device in which the determination unit 220 is mounted. The first table 250 and the second table 260 may be mounted so as to be accessible from the determination unit 220.

Further, the number of tables (that is, the number) referred to by the control instruction apparatus 200 is not necessarily limited to the number described above. For example, the control instruction apparatus 200 may refer to three tables as shown below.

1) a table storing information in which nodes, communication statuses and roles of the nodes are associated,
2) a table storing information in which a combination of a role of a transmission source node and a role of a transmission destination node and a flow defined by the combination are associated;
3) A table storing information in which a flow and an action for the flow are associated with each other.

Various variations are conceivable for the information stored in the first table 250. The first table 251 (shown in FIG. 11) and the first table 252 (shown in FIG. 12) are other specific examples of the first table 250. The first table 251 and the first table 252 will be described below.

FIG. 11 is a diagram for explaining information stored in the first table 251. As illustrated in FIG. 11, the first table 251 stores a node identifier of a node, a current communication status of the node, current position information of the node, and a role in association with each other.

If the node is a mobile terminal, the current location information of the node is information such as “inside Tokyo”, “in a specific building”, or “in a specific floor”, for example.

If the node is a virtual node, the current location information of the node includes, for example, the identifier of the physical node that operates the virtual node or the blade server that operates the virtual node. It may be information such as the position of the rack that is being used.

The control instruction device 200 acquires the current position information of the node. The control instruction device 200 may acquire position information of a node from a position detection unit (not shown) that detects the position of the node using, for example, a GPS (Global Positioning System) provided in the node. The determination unit 220 searches the first table 251 using the identifier of the node, the current communication status of the node, and the current position information of the node as keys. The determination unit 220 obtains information regarding the role of the node as a search result.

By storing information as shown in FIG. 11 in the first table 251, the communication system 1000 can realize more detailed communication control that also considers the current position information of the transmission source node or transmission destination node. Can do. The first table 251 has been described above.

Next, the first table 252 which is another specific example of the first table 250 will be described. FIG. 12 is a diagram for explaining information stored in the first table 252. As shown in FIG. 12, the first table 252 includes a node identifier, a current communication status of the node, “usage information” that is information indicating a user currently using the node, a role, Stores the associated information.

The usage information is, for example, information including at least one of the employee number, job title, department, age, etc. of the user currently using the node.

The control instruction device 200 acquires the current usage information of the node. The control instruction apparatus 200 may acquire the usage information by, for example, reading user information stored in an ID card or the like owned by an individual using a card reader (not shown) or the like. The determination unit 220 searches the first table 252 using the identifier of the node, the current communication status of the node, and the current usage information of the node as keys. The determination unit 220 obtains information regarding the role of the node as a search result.

By storing information as shown in FIG. 12 in the first table 252, the communication system 1000 can realize more detailed communication control that also considers the current usage information of the transmission source node or transmission destination node. Can do. The first table 252 which is another specific example of the first table 250 has been described above.

<Second Embodiment>
FIG. 13 is a block diagram illustrating a configuration of a communication system 1000A according to the second embodiment. Communication system 1000A includes a control execution device 100A and a control instruction device 200A. The control execution apparatus 100A includes a packet processing unit 110A and an inquiry unit 120A. The inquiry unit 120A inquires of the control instruction apparatus 200A about the packet processing method. The packet processing unit 110A processes the packet based on an instruction transmitted from the control instruction apparatus 200A in response to the inquiry.

The control execution apparatus 100A may be able to access a storage unit corresponding to the instruction cache 130 in the first embodiment.

The control instruction device 200A includes an instruction unit 210A, a determination unit 220A, and a communication status management unit 230A.

The communication status management unit 230A stores in the communication status storage unit 240A the communication status between nodes that communicate via the control execution apparatus 100A.

The determination unit 220A acquires the communication status between the transmission source node or the transmission destination node of the packet that is the target of the above-described inquiry and another node by referring to the communication status storage unit 240A. The determination unit 220A determines a processing method of the packet based on the transmission state, the transmission destination node, and the communication status of at least one of the transmission source node and the transmission destination node.

The instruction unit 210A instructs the determined processing method to the control execution apparatus 100A.

The control instruction device 200A can access the communication status storage unit 240A, the storage unit corresponding to the first table 250 in the first embodiment, and the storage unit corresponding to the second table 260 in the first embodiment. It may be. The communication status storage unit 240A may be mounted in the same device as the control instruction device 200A.

<Third Embodiment>
FIG. 14 is a block diagram illustrating a configuration of a communication control device 300B according to the third embodiment. In the third embodiment, the communication control device 300B as one device is used as the control execution device 100 and the control instruction device 200 in the first embodiment, or the control execution device 100A and the control instruction device in the second embodiment. Operates as 200A.

The packet processing unit 310B processes the packet based on the instruction of the determination unit 320B. The determination unit 320B obtains the communication status between the transmission source node or transmission destination node of the packet and another node by referring to the communication status storage unit 340B. The determination unit 320B determines a processing method for the packet based on the transmission status of the transmission source node, the transmission destination node, and at least one of the transmission source node and the transmission destination node.

The communication status management unit 330B stores in the communication status storage unit 340B the communication status between nodes that communicate via the own device 300B.

The communication control device 300B can access a communication status storage unit 340B, a storage unit corresponding to the first table 250 in the first embodiment, and a storage unit corresponding to the second table 260 in the first embodiment. It may be. The communication status storage unit 340B may be mounted in the same device as the communication control device 300B.

Further, the above-described embodiments and modifications can be implemented in appropriate combination.

The block division shown in each block diagram is a configuration shown for convenience of explanation. The present invention described by taking each embodiment as an example is not limited to the configuration shown in each block diagram in the implementation.

<Other embodiments>
As described above, the control execution apparatus 100 and the control instruction apparatus 200 according to the first embodiment can be realized by a computer and a program for controlling the computer, respectively. Each of the control execution apparatus 100 and the control instruction apparatus 200 can be realized by dedicated hardware. The control execution apparatus 100 and the control instruction apparatus 200 can be realized by a combination of a computer and a program for controlling the computer and dedicated hardware, respectively. Similarly, the control execution device 100A and the control instruction device 200A according to the second embodiment and the communication control device 300B according to the third embodiment can be realized by a computer and a program for controlling the computer, respectively. . The control execution device 100A, the control instruction device 200A, and the communication control device 300B can each be realized by dedicated hardware. Alternatively, the control execution device 100A, the control instruction device 200A, and the communication control device 300B can be realized by a combination of a computer, a program for controlling the computer, and dedicated hardware, respectively.

FIG. 15 is a diagram illustrating an example of a hardware configuration of a computer 10000 that can implement the control execution apparatus 100, the control instruction apparatus 200, the control execution apparatus 100A, the control instruction apparatus 200A, and the communication control apparatus 300B. Referring to FIG. 15, a computer 10000 includes a processor 10001, a memory 10002, a storage device 10003, and an I / O (Input / Output) interface 10004. Further, the computer 10000 can access the recording medium 10005. The memory 10002 and the storage device 10003 are storage devices such as a RAM (Random Access Memory) and a hard disk, for example. The recording medium 10005 is, for example, a storage device such as a RAM or a hard disk, a ROM (Read Only Memory), or a portable recording medium. The storage device 10003 may be the recording medium 10005. The processor 10001 can read and write data and programs from and to the memory 10002 and the storage device 10003. The processor 10001 can access, for example, a node via the I / O interface 10004. The processor 10001 can access the recording medium 10005. The recording medium 10005 stores a program that causes the computer 10000 to operate as the control execution apparatus 100, the control instruction apparatus 200, the control execution apparatus 100A, the control instruction apparatus 200A, or the communication control apparatus 300B.

The processor 10001 stores, in the memory 10002, a program that causes the computer 10000 stored in the recording medium 10005 to operate as the control execution apparatus 100, the control instruction apparatus 200, the control execution apparatus 100A, the control instruction apparatus 200A, or the communication control apparatus 300B. To load. When the processor 10001 executes the program loaded in the memory 10002, the computer 10000 operates as the control execution device 100, the control instruction device 200, the control execution device 100A, the control instruction device 200A, or the communication control device 300B. To do.

The plurality of units listed below are realized by, for example, a dedicated program that can be read from a recording medium 10005 that stores the program into the memory 10002 and that can realize the function of each unit, and a processor 10001 that executes the program. be able to. The plurality of parts described above are as follows, for example.

Packet processor 110,
Inquiry unit 120,
Instruction unit 210,
Determination unit 220,
Communication status management unit 230,
Packet processor 110A,
Inquiry unit 120A,
Instruction unit 210A,
Decision unit 220A,
Communication status manager 230A,
Packet processor 310B,
Determination unit 320B,
And a communication status management unit 330B.

In addition, the instruction cache 130, the communication status storage unit 240, the first table 250, and the second table 260 can be realized by a memory 10002 included in the computer 10000 or a storage device 10003 such as a hard disk device. Further, the communication status storage unit 240A and the communication status storage unit 340B can be realized by a memory 10002 included in the computer 10000 or a storage device 10003 such as a hard disk device.

Alternatively, some or all of the plurality of units listed below can be realized by a dedicated circuit that realizes the function of each unit. The plurality of parts are as follows, for example.

Packet processor 110,
Inquiry unit 120,
Instruction cache 130,
Instruction unit 210,
Determination unit 220,
Communication status management unit 230,
Communication status storage unit 240,
First table 250,
Second table 260,
Packet processor 110A,
Inquiry unit 120A,
Instruction unit 210A,
Decision unit 220A,
Communication status manager 230A,
Communication status storage unit 240A,
Packet processor 310B,
Decision unit 320B,
Communication status management unit 330B,
And a communication status storage unit 340B.

As mentioned above, although the form for implementing this invention was demonstrated, the said embodiment is for making an understanding of this invention easy, and is not for limiting and interpreting this invention. The present invention can be changed and improved without departing from the gist thereof, and equivalents thereof are also included in the present invention.

It should be noted that the disclosures of the above patent documents and non-patent documents are incorporated herein by reference. Within the scope of the entire disclosure (including claims) of the present invention, the embodiments and examples can be changed and adjusted based on the basic technical concept.

This application claims priority based on Japanese Patent Application No. 2014-067522 filed on Mar. 28, 2014, the entire disclosure of which is incorporated herein.

The present invention described using the above embodiments as an example can be applied to access control between computers, for example. For example, it is assumed that the security policy in the company states that the security policy “prohibit information retrieval via the web when accessing confidential customer information” is described. In such a case, by applying the present invention, access control that satisfies such a fine security policy can be realized.

Also, by applying the present invention, it is possible to generate a filtering rule for a flow table provided in the OpenFlow switch with contents in accordance with security guidelines.

Also, by applying the present invention, it is possible to determine whether communication from a certain terminal to a certain terminal is communication satisfying the security standard.

1000 Communication system 100 Control execution device 110 Packet processing unit 120 Inquiry unit 130 Instruction cache 200 Control instruction device 210 Instruction unit 220 Determination unit 230 Communication status management unit 240 Communication status storage unit 250 First table 251 First table 252 First Table 260A second table 1000A communication system 100A control execution device 110A packet processing unit 120A inquiry unit 200A control instruction device

210A instruction unit

220A determination unit 230A communication status management unit 240A communication status storage unit 300B communication control device 310B packet processing unit 320B Determination unit 330B communication status management unit 340B communication status storage unit 10000 computer 10001 processor 10002 memory 10003憶 device 10004 I / O interface 10005 recording medium

Claims

Based on an instruction for an inquiry regarding a packet processing method, a communication status management unit that stores a communication status between nodes performing communication in a communication status storage unit via a control execution device that processes the packet;
The communication status between the source node or destination node of the packet to be inquired and another node is obtained by referring to the communication status storage means, and the source node, the destination node And a determining means for determining a processing method of the packet based on the communication status of at least one of the transmission source node and the transmission destination node;
Instruction means for instructing the control execution apparatus of the determined processing method;
A control instruction device.
The determining means includes
First information that is information in which a node, a communication status between the node and another node, and a role of the node in the communication status are associated with each other;
Second information, which is information associated with a combination of a role of a packet source node and a role of a destination node, and a processing method of the packet;
To determine how to handle the packet,
The control instruction apparatus according to claim 1.
3. The control instruction apparatus according to claim 1, wherein the communication status is information indicating whether or not a certain node is currently establishing a connection with another node.
The first information is information in which a node, information indicating whether or not the node is currently establishing a connection with a specific node, and a role in the communication status of the node are further associated with each other Is,
The control instruction apparatus according to claim 3.
The first information is information in which the node, the current location information of the node, the communication status of the node, the location information of the node and the role in the communication status are further associated,
5. The determination unit according to claim 2, wherein the determination unit acquires current position information of the transmission source node, refers to the first information based on the position information, and determines a packet processing method. The control instruction device described.
The first information includes a node, a usage status that is information representing a user currently using the node, a communication status of the node, a usage status of the node, and a role in the communication status. Further associated information,
The said determination means acquires the utilization condition of the said transmission source node, refers to said 1st information based on the said utilization condition, and determines the processing method of a packet. Control instruction device.
A communication system including a control execution device and a control instruction device,
The control execution device includes:
Inquiry means for making an inquiry to the control instruction device about a packet processing method;
Packet processing means for processing the packet based on an instruction to the inquiry,
The control instruction device includes:
Communication status management means for storing in a communication status storage means a communication status between nodes that communicate via the control execution device;
The communication status between the source node or destination node of the packet to be inquired and another node is obtained by referring to the communication status storage means, and the source node, the destination node And a determining means for determining a processing method of the packet based on the communication status of at least one of the transmission source node and the transmission destination node;
Instruction means for instructing the control execution apparatus of the determined processing method;
A communication system comprising:
A control execution device that processes the packet and a control instruction device that is communicably connected based on an instruction to an inquiry regarding a packet processing method, and a communication status storage unit that indicates a communication status between nodes via the control execution device Remember
By referring to the communication status storage means, the communication status of the source node or destination node of the packet to be inquired is acquired, and the source node, the destination node, and the source node and Based on the communication status of at least one of the destination nodes, determine a method for processing the packet,
Instructing the control execution device about the determined processing method;
Control method.
Based on an instruction for an inquiry about a packet processing method, a control execution device that processes the packet and a computer that is communicably connected to the computer,
Processing for storing a communication status between nodes via the control execution device in a communication status storage unit;
By referring to the communication status storage means, the communication status of the source node or destination node of the packet to be inquired is acquired, and the source node, the destination node, and the source node and A process for determining a processing method of the packet based on a communication status of at least one of the destination nodes;
A process of instructing the control execution apparatus about the determined processing method;
A computer-readable storage medium storing a program for executing the program.
The control execution device connected to be communicable with the control instruction device according to any one of claims 1 to 6.