Connection control system, connection control equipment and connection management equipment

• US 7,694,015 B2
• Filed: 01/29/2004
• Issued: 04/06/2010
• Est. Priority Date: 12/03/2003
• Status: Expired due to Fees

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Akiyama, Hidehiro, Yoshiuchi, Hideya, Takeda, Yukiko, Yoshizawa, Masahiro
• Primary Examiner(s): Pwu; Jeffrey
• Assistant Examiner(s): Nguyen; Van Kim T
• Application Number:
  US10/766,189
• Publication Number:
  US 20050144289A1
• Time in Patent Office: 2,259 Days
• Field of Search: None
• US Class Current: 709/244
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04W 12/06 Authentication

Abstract

With respect to a communication operation between networks having no connection permission, a connection control apparatus calculates a communicatable detour communication path from a connection policy database, and in such a case that a communication operation can be carried out between these networks having no connection permission, the connection control apparatus permits the communication operation via a detour communication path after authentication.

Claims

1. A connection management apparatus to be coupled to a first gateway belonging to a first network and connecting to a first terminal, a second gateway belonging to a second network connecting to a second terminal, and a third gateway belonging to a third network, comprising:

a transmission/reception unit connectable to said first, second and third networks; and

a CPU connected to said transmission/reception unit,

wherein;

when a connection request issued from said first terminal to said second terminal is received by said transmission/reception unit, said CPU judges whether or not a first connection directly between the first and second networks is permitted under a predetermined connection restriction between networks to be established from said first terminal to said second terminal;

when said first connection is not permitted to be established directly from said first network to said second network as a result of said judgment, said CPU generates an address identifying a second connection including said first gateway, said second gateway and said third gateway, which are connectable from the first terminal to said second terminal, and then said CPU transmits a data containing said generated address from said transmission/reception unit to said first terminal, and transmits an address registration request containing said generated address from said transmission/reception unit to said first gateway and said third gateway for starting the second connection from said first terminal to said second terminal via said third gateway; and

when a notification notifying that said second connection has finished is received by said transmission/reception unit from said first terminal, said CPU transmits an address deletion request contained in said address registration request from said transmission/reception unit to said first gateway and said third gateway.

2. A connection management apparatus as claimed in claim 1, further comprising a memory connected to said CPU, wherein

said memory stores a database for judging as to whether or not the first connection from the first terminal to the second terminal can be established;

and

said CPU executes said judgment by employing said database.

3. A connection management apparatus as claimed in claim 2, wherein when said first connection is permitted to be established as judged, said CPU further reads out a program from said memory and executes the program to authenticate said first terminal and generates said address after authentication of said first terminal is succeeded.

4. A connection management apparatus as claimed in claim 3, wherein prior to establishing the second connection, the authentication apparatus executes authentication of said first terminal and ensures that said first terminal is authorized to connect to the first, second and third gateways constituting said second connection.

5. A connection management apparatus as claimed in claim 1, wherein

when said first connection is not permitted to be established as judged, said CPU retrieves the second communication path from said first terminal to said second terminal;

and

when the second communication path is available and retrieved accordingly, said CPU generates said address.

6. A connection management apparatus as claimed in claim 2, wherein when said first connection is not permitted to be established as judged, said CPU notifies such a fact to said first terminal, and said CPU generates said address after a request has been issued from said first terminal.

7. A connection management apparatus as claimed in claim 5, wherein when said first connection is permitted to be established as judged, said CPU reads out a program from a memory connected to said CPU and executes the program to authenticate said first terminal, and generates said address after authentication of said first terminal is succeeded.

8. A connection management apparatus as claimed in claim 1, wherein when said first connection is not permitted to be established as judged, said CPU notifies such a fact to said first terminal, and the CPU generates said address after a request has been issued from said first terminal.

9. A connection management apparatus as claimed in claim 1, wherein the predetermined connection restriction between networks is applicable to all terminals belonging to the networks.

10. A connection control system to be coupled to a first a gateway belonging to a first network and connecting to a first terminal, a second gateway belonging to a second network and connecting to a second terminal, and a third gateway belonging to a third network, comprising:

a connection control apparatus including a first transmission/reception unit connected to said first, second and third networks and a first processor connected to said first transmission/reception unit; and

an address generation apparatus including a second transmission/reception unit connected to said first, second and third networks and a second processor connected to said second transmission/reception unit, wherein

when a connection request issued from said first terminal to said second terminal is received by said first transmission/reception unit, said first processor judges whether or not a first connection directly between the first and second networks is permitted under a predetermined connection restriction between networks to be established from said first terminal to said second terminal, and

when said first connection is not permitted to be established directly from said first network to said second network as a result of said judgment, said first transmission/reception unit transmits a generation request for generating an address required for establishing a second connection by which said first terminal is permitted to be connected to said second terminal via said third gateway to said address generation apparatus, and

said second transmission/reception unit receives said generation request for generating said address, said second processor generates an address identifying said first gateway, said second gateway and said third gateway via which a second connection between said first terminal and said second terminal is permitted to be established, and said second transmission/reception unit transmits a data containing said generated address to said first terminal and then transmits an address registration request containing said generated address to said first gateway and said third gateway for starting the second connection; and

when an notification notifying that said second connection has finished is received by a transmission/reception unit of said address generation apparatus from said first terminal, said second transmission/receptions unit transmits an address deletion request contained in said address registration request to said first gateway and said third gateway.

11. A connection control system as claimed in claim 10, wherein

when said first connection is not permitted to be established as judged by said first processor, said first processor further retrieves an another communication path of said second connection from said first terminal to said second terminal;

and

when said another communication path of said second connection is available and retrieved accordingly, said first transmission/reception unit transmits said generation request for generating said address required for establishing said second connection by which said first terminal can be connected to said second terminal to said address generation apparatus.

12. A connection control system as claim in claim 11, wherein

when said first connection is not permitted to be established as judged by said first processor, said connection control apparatus notifies such a fact to said first terminal, and said address generation apparatus generates said address connectable to said second terminal after a request has been issued from said first terminal.

13. A connection control system as claimed in claim 11, further comprising an authentication apparatus which includes a third processor, a memory and a third transmission/reception unit connected to said first, second and third networks, and said third processor and said memory being connected to said third transmission/reception unit and to each other,

wherein when said first connection is permitted to be established as judged in said connection control apparatus, said third processor executes the authentication of said first terminal and then said address generation apparatus generates said address connectable to said second terminal after authentication of said first terminal is succeeded.

14. A connection control system as claimed in claim 10, wherein when said first connection is not permitted to be established as judged by said first processor, said connection control apparatus notifies such a fact to said first terminal;

and furthermore, said address generation apparatus generates said address connectable to said second terminal after a request has been issued from said first terminal.

15. A connection control system as claimed in claim 14, further comprising an authentication apparatus which includes a third transmission/reception unit connected to said first, second and third networks, a third processor and a memory, and said third processor and said memory are connected to said third transmission/reception unit and to each other,

wherein when said first connection is permitted to be established as judged in said connection control apparatus, said third processor executes the authentication of said first terminal and then said address generation apparatus generates said address connectable to said second terminal after authentication of said first terminal is succeeded.

16. A connection control system as claimed in claim 10, further comprising an authentication apparatus which includes a third transmission/reception unit connected to said first, second and third networks a third processor and a memory, and said third processor and said memory are connected to said third transmission/reception unit and to each other,

wherein when said first connection is permitted to be established as judged in said connection control apparatus, said third processor executes the authentication of said first terminal and then said address generation apparatus generates said address connectable to said second terminal after authentication of said first terminal is succeeded.

17. A connection control system as claimed in claim 16, wherein prior to establishing the second connection, said third processor of the authentication apparatus executes authentication of said first terminal and ensures that said first terminal is authorized to connect to the first, second and third gateways constituting said second connection.

18. A connection control system as claimed in claim 10, wherein the predetermined connection restriction between networks is applicable to all terminals belonging to the networks.