Network gateway system having rules for exchanging packet, network gateway method, and network gateway device therefor

• US 7,225,269 B2
• Filed: 05/12/2003
• Issued: 05/29/2007
• Est. Priority Date: 02/04/2002
• Status: Expired due to Fees

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Watanabe, Tomonori
• Primary Examiner(s): Eng; David Y.
• Application Number:
  US10/435,250
• Publication Number:
  US 20040010572A1
• Time in Patent Office: 1,478 Days
• Field of Search: 709/238, 709/223, 709/230
• US Class Current: 709/238
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

Handling a packet according to a gateway rule in a network gateway device ensures security. Centrally controlling the gateway rule in an administration center eliminates the need for individual user'"'"'s consciousness of operation such as a firewall, which makes a network gateway system easy to use. Also, under certain conditions, the packet is handled according to a gateway rule in the network gateway device to reduce a network load. The administration center that holds and creates a gateway rule is provided. The network gateway device holds the gateway rule. When receiving a packet, if a gateway rule corresponding to the packet exists, the received packet is handled according to the gateway rule. If no gateway rule corresponding to the packet exists, the packet is transferred to the administration center, and then the corresponding gateway rule is received from the administration center so that update is performed.

Claims

1. A network gateway system having a network gateway device that interconnects networks, said network gateway system comprising:

an administration center that holds and creates a gateway rule for controlling a packet,

wherein said network gateway device holds the gateway rule;

wherein when receiving a packet, if a gateway rule corresponding to the received packet exists, said network gateway device handles the received packet according to the gateway rule;

wherein if there is no gateway rule corresponding to the received packet, said network gateway device transfers the received packet to the administration center, and then receives a gateway rule corresponding to the packet from the administration center to perform update;

wherein in the network gateway device, an effective time during which the gateway rule is held is determined, and thereby a gateway rule whose effective time has expired is deleted, and

wherein said network gateway device comprises a gateway-rule storing table for holding the gateway rules; and

wherein when receiving the gateway rule from the administration center, if no space area in the gateway-rule storing table exists, a gateway-rule entry with the shortest remaining effective time is first deleted from among the gateway rules stored in the gateway-rule storing table.

2. A network gateway system according to claim 1, wherein:

if the administration center holds a gateway rule corresponding to the packet transmitted from the network gateway device, the administration center transmits the gateway rule; and

if the administration center does not hold the gateway rule corresponding to the packet transmitted from the network gateway device, the administration center newly creates a gateway rule corresponding to the packet, transmits the gateway rule to the network gateway device, and handles the packet according to the corresponding gateway rule.

3. A network gateway system having a network gateway device that interconnects networks, said network gateway system comprising:

an administration center that holds and creates a gateway rule for controlling a packet,

wherein said network gateway device holds the gateway rule;

wherein when receiving a packet, if a gateway rule corresponding to the received packet exists, said network gateway device handles the received packet according to the gateway rule;

wherein if no gateway rule corresponding to the received packet exists, an inquiry about a gateway rule corresponding to the received packet is sent to the administration center, and the gateway rule corresponding to the packet is received from the administration center so that update is performed, and according to the received gateway rule, the received packet is controlled;

wherein in the network gateway device, an effective time during which the gateway rule is held is determined, and thereby a gateway rule whose effective time has expired is deleted;

wherein said network gateway device comprises a gateway-rule storing table for holding the gateway rules; and

wherein when receiving the gateway rule from the administration center, if no space area in the gateway-rule storing table exists, a gateway-rule entry with the shortest remaining effective time is first deleted from among the gateway rules stored in the gateway-rule storing table.

4. A network gateway system according to claim 3, wherein:

when the administration center receives an inquiry from the network gateway device, if the administration center holds a gateway rule corresponding to the inquired packet, the administration center transmits the gateway rule; and

if the administration center does not hold a gateway rule corresponding to the inquired packet, the administration center newly creates a gateway rule corresponding to the packet, and then transmits the gateway rule to the network gateway device.

5. A network gateway method of a network gateway system having a network gateway device that interconnects networks, wherein said network gateway system comprises an administration center that holds and creates a gateway rule for controlling a packet, said network gateway device executing the steps of:

holding the gateway rules, and when receiving a packet, if a gateway rule corresponding to the received packet exists, handling the received packet according to the gateway rule;

if no gateway rule corresponding to the received packet exists, transferring the received packet to the administration center;

receiving a gateway rule corresponding to the packet from the administration center to perform update;

in the network gateway device, determining an effective time during which the gateway rule is held, and deleting a gateway rule whose effective time has expired,

wherein said network gateway device comprises a gateway-rule storing table for holding the gateway rules; and

wherein said network gateway device further executes the step of;

when receiving the gateway rule from the administration center, if no space area in the gateway-rule storing table exists, first deleting a gateway-rule entry with the shortest remaining effective time from among the gateway rules stored in the gateway-rule storing table.

6. A network gateway method according to claim 5, wherein said administration center executes the steps of:

if a gateway rule corresponding to a packet transmitted from the network gateway device is held, transmitting the gateway rule;

if a gateway rule corresponding to the packet transmitted from the network gateway device is not held, newly creating a gateway rule corresponding to the packet, and then transmitting the gateway rule to the network gateway device; and

handling the packet according to the corresponding gateway rule.

7. A network gateway method of a network gateway system having a network gateway device that interconnects networks, wherein said network gateway system comprises an administration center that holds and creates a gateway rule for controlling a packet, said network gateway device executing the steps of:

holding the gateway rule, and when receiving a packet, if a gateway rule corresponding to the received packet exists, handling the received packet according to the gateway rule;

if no gateway rule corresponding to the received packet exists, sending an inquiry about a gateway rule corresponding to the received packet to the administration center; and

receiving the gateway rule corresponding to the packet from the administration center to perform update, and thereby controlling the received packet according to the received gateway rule;

in the network gateway device, determining an effective time during which the gateway rule is held, and deleting a gateway rule whose effective time has expired,

wherein said network gateway device comprises a gateway-rule storing table for holding the gateway rules; and

wherein said network gateway device further executes the step of;

when receiving the gateway rule from the administration center, if no space area in the gateway-rule storing table exists, first deleting a gateway-rule entry with the shortest remaining effective time from among the gateway rules stored in the gateway-rule storing table.

8. A network gateway method according to claim 7, wherein said administration center executes the steps of:

when receiving an inquiry from the network gateway device, if the administration center holds a gateway rule corresponding to the inquired packet, transmitting the gateway rule; and

if the administration center does not hold a gateway rule corresponding to the inquired packet, newly creating a gateway rule corresponding to the packet, and then transmitting the gateway rule to the network gateway device.

9. A computer readable medium including instructions to be executed in a network gateway device that interconnects networks, wherein a network gateway system comprises said network gateway device and an administration center that holds and creates a gateway rule for controlling a packet, said instructions comprising steps for:

holding the gateway rules, and when receiving a packet, if a gateway rule corresponding to the received packet exists, handling the received packet according to the gateway rule;

if no gateway rule corresponding to the received packet exists, transferring the received packet to the administration center;

receiving a gateway rule corresponding to the packet from the administration center to perform update;

in the network gateway device, determining an effective time during which the gateway rule is held, and deleting a gateway rule whose effective time has expired,

wherein said network gateway device comprises a gateway-rule storing table for holding the gateway rules; and

wherein said instructions further comprises;

when receiving the gateway rule from the administration center, if no space area in the gateway-rule storing table exists, first deleting a gateway-rule entry with the shortest remaining effective time from among the gateway rules stored in the gateway-rule storing table.

10. A computer readable medium according to claim 9,

wherein said administration center executes the steps of:

if a gateway rule corresponding to a packet transmitted from the network gateway device is held, transmitting the gateway rule;

if a gateway rule corresponding to the packet transmitted from the network gateway device is not held, newly creating a gateway rule corresponding to the packet, and then transmitting the gateway rule to the network gateway device; and

handling the packet according to the corresponding gateway rule.

11. A computer readable medium including instructions to be executed in a network gateway device that interconnects networks, wherein a network gateway system comprises said network gateway device and an administration center that holds and creates a gateway rule for controlling a packet, said instructions comprising steps for:

holding the gateway rule, and when receiving a packet, if a gateway rule corresponding to the received packet exists, handling the received packet according to the gateway rule;

if no gateway rule corresponding to the received packet exists, sending an inquiry about a gateway rule corresponding to the received packet to the administration center; and

receiving the gateway rule corresponding to the packet from the administration center to perform update, and thereby controlling the received packet according to the received gateway rule;

in the network gateway device, determining an effective time during which the gateway rule is held, and deleting a gateway rule whose effective time has expired,

wherein said network gateway device comprises a gateway-rule storing table for holding the gateway rules; and

wherein said instructions further comprises;

when receiving the gateway rule from the administration center, if no space area in the gateway-rule storing table exists, first deleting a gateway-rule entry with the shortest remaining effective time from among the gateway rules stored in the gateway-rule storing table.

12. A computer readable medium according to claim 11,

wherein said administration center executes the steps of:

when receiving an inquiry from the network gateway device, if the administration center holds a gateway rule corresponding to the inquired packet, transmitting the gateway rule; and

if the administration center does not hold a gateway rule corresponding to the inquired packet, newly creating a gateway rule corresponding to the packet, and then transmitting the gateway rule to the network gateway device.