Access control apparatus and access control method

• US 7,372,861 B2
• Filed: 05/06/2004
• Issued: 05/13/2008
• Est. Priority Date: 05/08/2003
• Status: Expired due to Fees

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Tomizawa, Hitoshi
• Primary Examiner(s): Ngo; Ricky Q.
• Assistant Examiner(s): Mui; Gary
• Application Number:
  US10/839,230
• Publication Number:
  US 20050021717A1
• Time in Patent Office: 1,468 Days
• Field of Search: 370/401, 370/410, 370/468, 370/389, 370/400, 370/431, 370/462, 370/463, 370/252, 370/253, 709223-226
• US Class Current: 370/401
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

An access control apparatus and method limits, to a finite time length, connection of a user terminal to a public network. The user terminal is disconnected from the public network when the use time of the logical address assigned to the user terminal reaches the time limit set for the logical address. The apparatus and method utilizes IDs issued to multiple users and IDs for multiple user terminals, and enables limiting connection to a public network from a user terminal that is connected by a leased circuit.

Claims

1. An access control apparatus which controls connection to a public network via a service provider terminal from a plurality of user terminals manipulated by unspecified users, comprising:

means for holding a predetermined number of addresses provided in advance by the service provider terminal and converting two addresses into each other;

an address capable of specifying an arbitrary apparatus on the public network and a unique address under control of said means for holding a predetermined number of addresses;

means for issuing IDs for specifying users of the user terminals;

means receiving addresses, assigned by the service provider terminal, transferred by the means for holding a predetermined number of addresses for managing these addresses;

means for, upon reception of a connection request from one of the user terminals, determining whether a logical address has already been assigned to the requesting user terminal;

means for assigning a logical address for which a time limit is set, to a user terminal not assigned any logical address;

means for, in response to a connection request from the user terminal assigned the logical address, requesting the user terminal serving as a transmission source of the connection request to transmit the ID;

means for determining, on the basis of the ID acquired from the user terminal serving as the transmission source of the connection request, a user and a used user terminal by which the connection request to the public network has been transmitted;

means for connecting the user terminal to the public network when a use time of the logical address assigned to the user terminal serving as the transmission source of the connection request falls within the time limit set for the logical address; and

means for disconnecting the user terminal from the public network when the use time of the logical address assigned to the user terminal connected to the public network reaches the time limit set for the logical address.

2. An apparatus according to claim 1, wherein the ID issued to a user of the user terminal and the address assigned to the user terminal are managed in separate tables, and the user and the used user terminal by which the connection request to the public network has been transmitted are determined on the basis of the ID acquired from the user terminal serving as the transmission source of the connection request and the address assigned to the user terminal.

3. An access control apparatus which controls connection to a public network via a service provider terminal from a plurality of user terminals manipulated by unspecified users, comprising:

means for holding a predetermined number of addresses provided in advance by the service provider terminal;

means receiving addresses, assigned by the service provider terminal, transferred by the means for holding predetermined number of addresses for managing these addresses;

means for, upon reception of a connection request from one of the user terminals, determining whether a logical address has already been assigned to the requesting user terminal;

means for assigning a logical address for which a time limit is set, to a user terminal not assigned any logical address;

means for acquiring a physical address from the user terminal assigned the logical address;

means for associating the logical address of the user terminal serving as a transmission source of the connection request with information representing use times of the physical address and the logical address of the user terminal;

means for connecting the user terminal to the public network when the use time of the logical address assigned to the user terminal serving as the transmission source of the connection request falls within the time limit set for the logical address; and

means for disconnecting the user terminal from the public network when the use time of the logical address assigned to the user terminal connected to the public network reaches the time limit set for the logical address.

4. An apparatus according to claim 3, wherein the logical address assigned to the user terminal serving as the transmission source of the connection request and the physical address of the user terminal are managed in the same table.

5. An access control method of controlling connection to a public network via a service provider terminal from a plurality of user terminals manipulated by unspecified users, comprising the steps of:

holding a predetermined number of addresses provided in advance by the service provider terminal and converting two addresses into each other;

an address capable of specifying an arbitrary apparatus on the public network and a unique address;

issuing IDs for specifying users to users of the user terminals;

receiving addresses, assigned by the service provider terminal, and managing these addresses;

determining, upon reception of a connection request from one of the user terminals, whether a logical address has already been assigned to the requesting user terminal;

assigning a logical address for which a time limit is set, to a user terminal not assigned any logical address;

requesting, in response to a connection request from the user terminal assigned the logical address, the user terminal serving as a transmission source of the connection request to transmit the ID;

determining, on the basis of the ID acquired from the user terminal serving as the transmission source of the connection request, a user and a used user terminal by which the connection request to the public network has been transmitted;

connecting the user terminal to the public network when a use time of the logical address assigned to the user terminal serving as the transmission source of the connection request falls within the time limit set for the logical address; and

disconnecting the user terminal from the public network when the use time of the logical address assigned to the user terminal connected to the public network reaches the time limit set for the logical address.

6. An access control method of controlling connection to a public network via a service provider terminal from a plurality of user terminals manipulated by unspecified users, comprising the steps of:

holding a predetermined number of addresses provided in advance by the service provider terminal;

receiving addresses, assigned by the service provider terminal, and managing these addresses;

determining, upon reception of a connection request from one of the user terminals, whether a logical address has already been assigned to the requesting user terminal;

assigning a logical address for which a time limit is set, to a user terminal not assigned any logical address;

acquiring a physical address from the user terminal assigned the logical address;

associating the logical address of the user terminal serving as a transmission source of the connection request with information representing use times of the physical address and the logical address of the user terminal;

connecting the user terminal to the public network when the use time of the logical address assigned to the user terminal serving as the transmission source of the connection request falls within the time limit set for the logical address; and

disconnecting the user terminal from the public network when the use time of the logical address assigned to the user terminal connected to the public network reaches the time limit set for the logical address.