Abstract: A configuration that can perform access control for each user/client, without arranging an Authenticator or an EAPoL pass switch at each location. A forwarding node processes a packet between a supplicant and a prescribed authentication device, in accordance with a processing rule that has been set. The authentication device performs a prescribed authentication procedure with the supplicant and notifies a result thereof to a control server. In a case where an authentication procedure with the authentication device succeeds, the control server creates a first forwarding path between the supplicant and a destination node, and transmits a processing rule for a packet received or transmitted between the supplicant and a destination node, following the first forwarding path, in at least one forwarding node in the first forwarding path.

Abstract: Provided is a communication system that includes a plurality of packet transfer units and a control unit which controls each packet transfer unit, in the communication system of which, a communications network used for each packet transfer unit to transfer packets, and a communications network used for the control unit to control each packet transfer unit can be integrated into one kind. The control unit transmits a reply request to each packet transfer unit. The packet transfer unit, upon receiving the reply request, transmits the reply request from a port other than that through which the packet transfer unit has received the reply request. Upon receiving the reply request, the packet transfer unit also returns a reply including information on ports of the local packet transfer unit, the reply being transmitted through a path for the control unit.

Abstract: The control unit specifies an undetected connection destination port and sends a reply request to a connection destination of the undetected connection destination port. The packet transfer unit determines whether the received reply request is to be transferred to any other packet transfer unit. The packet transfer unit, upon determining the reply request to be transferred to any other packet transfer unit, transfers the reply request to any other packet transfer unit. The packet transfer unit, upon determining the reply request not to be transferred to any other packet transfer unit, returns a reply that includes information on ports of the local packet transfer unit, the reply being sent along a path leading to the control unit.

Abstract: A communication network management system has: a communication network including a plurality of nodes and a plurality of links connecting between the plurality of nodes; and a management computer connected to the plurality of nodes. A loop-shape communication route in the communication network is a loop route. The management computer transmits a frame to one node on the loop route. When receiving the frame, each node on the loop route forwards the received frame to a subsequent node along the loop route and, if a predetermined condition is satisfied, returns a response back to the management computer. The management computer determines whether or not a failure is occurring, based on reception state of the response.

Abstract: A communication network management system has: a communication network including a plurality of nodes and a plurality of links connecting between the plurality of nodes; and a management computer that manages the communication network. The management computer has: a storage means in which a route information indicating a transfer route of frames in the communication network is stored; and a monitoring means configured to perform, based on the route information, transmission and reception of frames to and from the communication network. The monitoring means transmits a frame to the transfer route. Each of the plurality of nodes, when receiving a frame, not only forwards the received frame along the transfer route but also sends a reply to the management computer. The monitoring means identifies a location of failure occurrence on the transfer route, based on reception state of the reply from the plurality of nodes.

Abstract: A communication network includes a plurality of nodes and a plurality of links connecting between the nodes. A management computer managing the communication network has a storage means, an entry control means and a monitoring means. A route information indicating a transfer route of frames in the communication network is stored in the storage means. The monitoring means performs, based on the route information, transmission and reception of frames to and from the communication network. The entry control means instructs each node to set up a forwarding table indicating a correspondence relationship between an input source and a forwarding destination of frames. More specifically, the entry control means instructs the each node to set up the forwarding table such that frames are forwarded along the transfer route indicated by the route information.

Abstract: The present invention provides a tunneling apparatus which can perform tunneling without requiring the network to be suspended or requiring the existing configuration of a local network to be modified. The frame sorting part 11 determines whether or not a frame input from a local network through a physical interface is an encapsulated tunnel frame. If such frame is a tunnel frame, the frame sorting part 11 outputs such frame to the decapsulation unit of the tunneling part 13. If such frame is not a tunnel frame, the frame sorting part 11 outputs such frame to at least one of the address resolution unit of the kernel part 12 and the encapsulation unit of the tunneling part, based on the characteristics of such frame.

Abstract: A multicast tree design apparatus designs a multicast tree by mathematical programming.

Abstract: When a data link layer frame whose destination address has been designated as a multiple address is inputted from a tunneling source via a decapsulation unit 202, a destination processing unit 201 generates data link layer frames in which the destination address of the frame is replaced with each of one or more unicast addresses that are preset in a table unit 205 for a source address of the data link layer frame and outputs the generated frames to a local network 11.

Abstract: An IP address assigning method for assigning a fixed address to a user terminal apparatus through a network in a system for remote accessing to the network to which a tunneling apparatus belongs from the user terminal apparatus. The user terminal apparatus connected to a first network requests a setting of a communication tunnel to the tunneling apparatus for remote accessing a second network. The tunneling apparatus receiving the request sends a DHCP message including a MAC address assigned to a physical NIC of the user terminal apparatus to a DHCP server connected to the network. The DHCP server sends a DHCP message including a fixed IP address corresponding to a preset MAC address. The tunneling apparatus assigns the IP address included in the received DHCP message to the user terminal apparatus.

Abstract: The present invention provides a tunneling apparatus which can perform tunneling without requiring the network to be suspended or requiring the existing configuration of a local network to be modified. The frame sorting part 11 determines whether or not a frame input from a local network through a physical interface is an encapsulated tunnel frame. If such frame is a tunnel frame, the frame sorting part 11 outputs such frame to the decapsulation unit of the tunneling part 13. If such frame is not a tunnel frame, the frame sorting part 11 outputs such frame to at least one of the address resolution unit of the kernel part 12 and the encapsulation unit of the tunneling part, based on the characteristics of such frame.

Abstract: In a client terminal of a communication system, a cipher session establishing section establishes a cipher session use connection between the client terminal as a source client terminal and a relay server by transmitting/receiving a cipher session establishment message between the source client terminal and the relay server, and notifies header information contained in a cipher session header to the relay server. A shared key managing section holds a client shared key with a destination client terminal, A data enciphering section performs encipherment of a data and/or MAC (Message Authentication Code) calculation of the data by using the client shared key and to output the performing result as a client cipher data. A message producing section produces a data communication message including a cipher data field in which the client cipher data is inserted and a non-cipher data field in which the cipher session header containing the header information is inserted.

Abstract: A node A21 sets a communication tunnel for encapsulating a data link packet with other nodes joining in a virtual LAN to a peer-to-peer type, and comprises a packet forward table A2141 for forwarding the data link layer packet received from a communication tunnel to another communication tunnel. In addition, the node A21 reconfigures the topology of the virtual LAN using a topology calculation unit A2153 when another node withdrew from the virtual LAN, and opens or removes communication tunnels according to the reconfigured topology using a tunnel control unit A2152.