Method and apparatus for network service

• US 20030115482A1
• Filed: 02/20/2002
• Published: 06/19/2003
• Est. Priority Date: 12/05/2001
• Status: Abandoned Application

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Miyata, Hiroaki, Takihiro, Masatoshi
• Application Number:
  US10/077,750
• Publication Number:
  US 20030115482A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

The convenience of access control services which are provided as additional services other than a network connection service are enhanced. In compliance with a request for connection to a service network 22 (in FIG. 1) as has been made by a subscriber, a subscriber accommodation device 1 connects a corresponding one of subscribers'"'"' terminals 6a-6c and a server 41 or 42 in a server network 4 as is available to the subscriber, by a bridge connection or a router connection, thereby to construct a closed network. Besides, in compliance with a request for altering the setting of filter information as has been made by a subscriber, the subscriber accommodation device 1 alters packet filtering which is to be applied to IP packets that are exchanged between a corresponding one of the subscribers'"'"' terminals 6a-6c and the service network 22.

Claims

1. A network connection apparatus which provides a terminal of each subscriber with a network connection service for connecting the terminal of the subscriber to a network, and an access control service that is an additional service other than the network connection service, comprising:

a subscriber information storage unit which stores subscriber information for authenticating each subscriber, together with access control information on the access control service available to the subscriber;

a subscriber authentication unit which, upon accepting a request for connection to a first network from the terminal of said subscriber, authenticates said subscriber by reference to subscriber information obtained from said terminal, and the subscriber information stored in said subscriber information storage unit; and

a service providing unit which connects said terminal of said subscriber authenticated by said subscriber authentication unit, to the first network, and which controls access to a predetermined node including said terminal of said subscriber, in accordance with the access control information stored in said subscriber information storage unit together with identification information of said subscriber.

2. A network connection apparatus according to claim 1, wherein:

said service providing unit performs a control in accordance with said access control information stored in said subscriber information storage unit, so that a predetermined server which belongs to a second network different from said first network may be accessed by only said terminal of said subscriber, thereby to construct a closed network which includes the predetermined server and said terminal of said subscriber.

3. A network connection apparatus according to claim 2, wherein:

the second network, and a third network to which said terminal of said subscriber belongs are Ethernets each of which is standardized in IEEE802.3; and

said service providing unit performs a bridge connection between said terminal of said subscriber and said predetermined server, thereby to construct the closed network which includes said predetermined server and said terminal of said subscriber.

4. A network connection apparatus according to claim 2, wherein:

the second network, and a third network to which said terminal of said subscriber belongs are IP (Internet Protocol) networks; and

said service providing unit performs a router connection between said terminal of said subscriber and said predetermined server, thereby to construct the closed network which includes said predetermined server and said terminal of said subscriber.

5. A network connection apparatus according to claim 1, wherein said service providing unit filters packets which are exchanged between said first network and said terminal of said subscriber, in accordance with said access control information stored in said subscriber information storage unit.

6. A network connection apparatus according to claim 5, further comprising a setting acceptance unit which accepts said access control information from said terminal of said subscriber authenticated by said subscriber authentication unit, and which stores the accepted information in said subscriber information storage unit together with said subscriber information of said subscriber.

7. A network connection method which provides a terminal of each subscriber with a network connection service for connecting the terminal of the subscriber to a network, and an access control service that is an additional service other than the network connection service, comprising:

the first step of accepting a request for connection to a first network from the terminal of each subscriber, and then authenticating the subscriber by reference to subscriber information obtained from said terminal, and subscriber information stored in a subscriber information storage unit; and

the second step of connecting said terminal of the authenticated subscriber to the first network, and controlling access to a predetermined node which includes said terminal of said subscriber, in accordance with access control information which is stored in the subscriber information storage unit together with identification information of said subscriber.

8. A network connection method according to claim 7, wherein said second step performs a control in accordance with said access control information stored in said subscriber information storage unit, so that a predetermined server which belongs to a second network different from said first network may be accessed by only said terminal of said subscriber, thereby to construct a closed network which includes the predetermined server and said terminal of said subscriber.

9. A network connection method according to claim 7, wherein said second step filters packets which are exchanged between said first network and said terminal of said subscriber, in accordance with said access control information stored in said subscriber information storage unit.

10. A network connection method according to claim 9, further comprising the third step of accepting said access control information from said terminal of the authenticated subscriber, and storing the accepted information in said subscriber information storage unit together with the subscriber information of said subscriber.