Network control method and equipment

• US 20040158643A1
• Filed: 01/16/2004
• Published: 08/12/2004
• Est. Priority Date: 02/10/2003
• Status: Abandoned Application

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Atarashi, Yoshifumi, Suzuki, Shinsuke, Ikeda, Naoya
• Application Number:
  US10/758,114
• Publication Number:
  US 20040158643A1
• Time in Patent Office: Days
• US Class Current: 709/232
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

By using combinations of a plurality of firewall techniques and making these techniques work together appropriately, problems presented with popular use of always-on Internet connections and end-to-end communications using IPv6 are resolved. This flexible manner of applying access control techniques grants favors to corporate network users, resulting from the popular use of always-on Internet connections and IPv6, e.g., the promotion of teleworking and virtual offices. A traffic control computing device which processes control requests from traffic control devices, provided in a network, coordinates the control actions of the individual traffic control devices appropriately.

Claims

1. A traffic control computing device comprising:

a traffic control interface to connect to traffic control devices which control traffic in a network;

a traffic control request interface to connect to traffic control request detecting devices which determine whether a traffic control must be executed by said traffic control devices;

a first storage device in which information about traffic control received via the traffic control request interface is stored;

a traffic control computing unit connected to said traffic control interface, and connected to said traffic control request interface, and connected to said first storage device,

wherein said traffic control computing unit computes traffic control algorithms based on traffic control requests stored in the first storage device and sends the traffic control algorithms to said traffic control interface.

2. The traffic control computing device according to claim 1, further comprising:

an information unit for acquiring information objects about traffic control details per a traffic control device associated with IDs of the traffic control devices which are now executed separately by said traffic control devices; and

second storage device in which said acquired information objects about traffic control details per traffic control device associated with the IDs of the traffic control devices are stored.

3. The traffic control computing device according to claim 1, wherein IDs of said traffic control request detecting devices are stored in said first storage device.

4. The traffic control computing device according to claim 1, wherein said traffic control computing unit compares the sender of a traffic control request received through said traffic control request interface for a match with any of traffic control information objects stored in said first storage device and rejects said traffic control request if said sender of the received request is not stored in said first storage device.

5. The traffic control computing device according to claim 4, further comprising a traffic control computing unit as a management interface which functions as a contact point for communicating with a network administrator and is structured so that said traffic control computing unit checks whether a traffic control request that conflicts with said traffic control request received is included in said first storage device and, if a conflicting traffic control request is included, compares the sender of the conflicting traffic control request with the sender of said traffic control request received, and, if both the senders are different, sends a notification of the conflicting requests to said traffic control computing management interface.

6. The traffic control computing device according to claim 5, wherein, if both said senders match, said traffic control computing unit is structured to assume that said sender of said conflicting traffic control request would have sent a request to cancel said conflicting traffic control request.

7. The traffic control computing device according to claim 2, wherein, when said information acquiring unit has been successful in acquiring a traffic control information object from a traffic control device, said traffic control computing unit is structured to determine that said traffic control device is operating and updates the traffic control information object for the traffic control device stored in said storage device to said traffic control information object newly acquired.

8. The traffic control computing device according to claim 2, adapted so that when said traffic control information object has failed to be acquired from a traffic control device, said traffic control computing unit determines that said traffic control device is not operating and deletes the traffic control information object for the traffic control device determined as being non-operating from said storage device.

9. A traffic control computing device comprising:

a traffic control interface to connect to traffic control devices which control traffic in a network;

a traffic control request interface to connect to traffic control request detecting devices which determine what traffic control must be executed by said traffic control devices;

a traffic control request list containing information objects about traffic control received through the traffic control request interface associated with IDs of the traffic control request detecting devices which sent the information objects;

a list of traffic control request detecting devices containing the IDs and functions of the traffic control request detecting devices connected to said traffic control computing device;

a list of traffic control devices containing the IDs and functions of the traffic control device connected to said traffic control computing device;

a traffic control method list containing the IDs of the connected traffic control devices and control details which are now executed by the traffic control devices; and

a traffic control computing unit which computes control algorithms, based on control requests described in said traffic control request list.

10. A traffic control method comprising:

providing a traffic control computing device connected to traffic control devices which control traffic in a network and traffic control request detecting devices which detect what traffic control must be executed in the network,

receiving a traffic control request;

storing the received traffic control request and the request sender information into a storage device;

determining whether said received traffic control request conflicts with any of control requests previously stored in said storage device; and

if no conflict is found, computing a control algorithm to complete said control request.

11. The traffic control method according to claim 10, further comprising:

if said conflict exists, determining whether said sender of the received request and the sender of the conflicting control request match; and

if both the senders match, deleting said conflicting control request from said storage device.

12. The traffic control method according to claim 10, further comprising:

if said conflict exists, determining whether said sender of the received request and the sender of the conflicting control request match;

if both the senders are different, notifying a network administrator that said conflict exists; and

resolving the conflict by decision made by the network administrator.

13. The traffic control method according to claim 11, further comprising:

determining whether the sender of the received traffic control request is from a pre-registered sender device; and

rejecting the control request from a non-registered sender.

14. The traffic control method according to claim 13, wherein, if said sender of the received traffic control request is a pre-registered sender, said step of determining whether said received traffic control request conflicts with any of control requests previously stored in said storage device is executed.

15. The traffic control method according to claim 12, further comprising:

receiving information as to whether said network administrator has rejected a part or all of either of the conflicting control requests; and

notifying the sender of the rejected control request that the control request was rejected.

16. The traffic control method according to claim 10, further comprising:

comparing said computed control algorithm with control algorithms separately held by the traffic control devices connected to the computing device;

if said computed control algorithm is not held by said traffic control devices, transmitting the computed control algorithm to the appropriate one of said traffic control devices.

17. A network control method comprising:

receiving a traffic control request;

storing the received traffic control request and the request sender information into a storage device;

determining whether said received traffic control request conflicts with any of control requests previously stored in said storage device;

if no conflict is found, computing a control algorithm to complete said control request; and

executing traffic control, according to the computed control algorithm.

18. A control method for a network comprising:

providing traffic control devices which control traffic in the network, traffic control request detecting devices which detect what traffic control must be executed in the network, and a traffic control computing device which processes a traffic control request based on said detected traffic control requirement,

receiving, by said traffic control computing device, information (hereinafter referred to as first information) which comprises the identifiers of said traffic control request detecting devices, the detection functions of the traffic control traffic control request detecting devices, and traffic control requests which are now issued from the traffic control request detecting devices; and

storing the acquired first information into a storage device,

wherein, upon receiving a new traffic control request from one of said traffic control request detecting devices, said traffic control computing device determines whether the newly received traffic control request conflicts with any of the traffic control requests stored in said storage device, if no conflict is found, calculates a control algorithm, based on the received traffic control request, and transmits the calculated control algorithm to the appropriate one of said traffic control devices.

19. The control method for the network according to claim 18, further comprising:

acquiring second information which comprises the identifiers of said traffic control devices and the traffic control functions of the traffic control devices; and

storing said second information acquired into the storage device,

wherein, if the control algorithm calculated by said traffic control computing device has already been held by one of said traffic control devices, said traffic control computing device does not transmit the calculated control algorithm.