# US 2018/0324180 A1 · Access control system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324180 A1 - Document ID: US20180324180A1 - Status: Published application - Kind: A1 - Application number: 15/966,957 - Filed: 2018-04-30 - Published: 2018-11-08 - Earliest claimed: 2017-05-02 - Assignees: Allied Telesis Holdings K.K. - Applicants: Allied Telesis Holdings K.K. - Inventors: Mitsuhiro Watanabe - Web page: https://patentgrep.com/patent/US20180324180A1 ## CPC - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP] - H04L 41/0681: Configuration of triggering conditions - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 51/046: Interoperability with other network applications or services - H04L 51/212: using filtering or selective blocking - H04L 51/42: Mailbox-related aspects, e.g. synchronisation of mailboxes - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0272: {Virtual private networks} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract To provide an access control system for performing access control, etc., in a case of detecting irregular behavior in a network, an access control system includes a message-obtainment-processing unit configured to obtain from an email server an email message including information for identifying a suspect-terminal that has conducted irregular behavior, the email message being generated in a security system located inside or outside a private network constituted by use of a software defined network (SDN) to be received by the email server. The message-obtainment-processing unit causes an SDN controller in the private network to provide, to the suspect-terminal or an edge network device that controls communication of the suspect-terminal, a control instruction based on the obtained email message, so as to cause the suspect-terminal or the edge network device to execute a process for access control against the suspect-terminal. ## Claims ### Claim 1 An access control system for performing access control in a private network, the access control system comprising: a message-obtainment-processing unit configured to obtain from a message server a message including information for identifying a suspect-terminal, the message being generated in a security system located inside or outside the private network to be received by the message server, wherein the message-obtainment-processing unit causes a computer that controls communication in the private network to provide, to the suspect-terminal or a computer that controls communication of the suspect-terminal, a control instruction based on the obtained message, so as to cause the suspect-terminal or the computer that controls communication of the suspect-terminal to execute a process for access control against the suspect-terminal, and wherein the message is a message of a messaging service by use of a port that is permitted to pass through a firewall of the private network. ### Claim 2 (depends on 1) The access control system according to claim 1, wherein the private network is constituted by use of a software defined network (SDN), wherein the message server is an email server and the message is an email message, and wherein the computer that controls communication in the private network is an SDN controller and the computer that controls communication of the suspect-terminal is an edge network device. ### Claim 3 (depends on 2) The access control system according to claim 2, wherein the email message is partially or entirely written in a code that is not processable for the SDN controller, and wherein the message-obtainment-processing unit converts the obtained email message into information that is processable for the SDN controller and then causes the SDN controller to provide, to the suspect-terminal or the edge network device, a control instruction corresponding to the information converted into, so as to cause the suspect-terminal or the edge network device to execute the process for access control against the suspect-terminal. ### Claim 4 (depends on 2) The access control system according to claim 2, wherein the email message further includes information indicative of control content for the process for access control, and wherein the message-obtainment-processing unit provides, to the suspect-terminal or the edge network device, a control instruction corresponding to the control content. ### Claim 5 (depends on 3) The access control system according to claim 3, wherein the email message further includes information indicative of control content for the process for access control, and wherein the message-obtainment-processing unit provides, to the suspect-terminal or the edge network device, a control instruction corresponding to the control content. ### Claim 6 (depends on 2) The access control system according to claim 2, wherein the email message further includes information indicative of an irregular state of the suspect-terminal, and wherein the message-obtainment-processing unit specifies control content corresponding to the information indicative of the irregular state for the process for access control and provides, to the suspect-terminal or the edge network device, a control instruction corresponding to the control content. ### Claim 7 (depends on 3) The access control system according to claim 3, wherein the email message further includes information indicative of an irregular state of the suspect-terminal, and wherein the message-obtainment-processing unit specifies control content corresponding to the information indicative of the irregular state for the process for access control and provides, to the suspect-terminal or the edge network device, a control instruction corresponding to the control content. ### Claim 8 (depends on 1) The access control system according to claim 1, wherein, when irregular behavior in the private network is detected, the security system specifies a user terminal that has conducted the irregular behavior as the suspect-terminal and generates the email message including identification information of the suspect-terminal, wherein the email server stores the email message sent from the security system, and wherein the SDN controller controls communication in the private network and is provided with the message-obtainment-processing unit configured to obtain the email message stored in the email server. ### Claim 9 (depends on 1) The access control system according to claim 1, wherein, when irregular behavior in the private network is detected, the security system specifies a user terminal that has conducted the irregular behavior as the suspect-terminal and accepts, from a predetermined person who administers the private network, generation of the email message including identification information of the specified suspect-terminal, wherein the email server stores the email message sent from the security system, and wherein the SDN controller controls communication in the private network and is provided with the message-obtainment-processing unit configured to obtain the email message stored in the email server. ### Claim 10 (depends on 2) The access control system according to claim 2, wherein the message-obtainment-processing unit specifies, based on sender information in the obtained email message, the security system from which the email message has been sent, wherein the message-obtainment-processing unit inserts information for identifying the specified security system into a syslog message, which is converted into based on the email message, wherein the SDN controller refers to information in the syslog message, based on the information for identifying the security system, the information for identifying the security system being in the syslog message, and the SDN controller provides the control instruction, based on the referred information. ### Claim 11 (depends on 3) The access control system according to claim 3, wherein the message-obtainment-processing unit specifies, based on sender information in the obtained email message, the security system from which the email message has been sent, wherein the message-obtainment-processing unit inserts information for identifying the specified security system into a syslog message, which is converted into based on the email message, wherein the SDN controller refers to information in the syslog message, based on the information for identifying the security system, the information for identifying the security system being in the syslog message, and the SDN controller provides the control instruction, based on the referred information. ### Claim 12 (depends on 4) The access control system according to claim 4, wherein the message-obtainment-processing unit specifies, based on sender information in the obtained email message, the security system from which the email message has been sent, wherein the message-obtainment-processing unit inserts information for identifying the specified security system into a syslog message, which is converted into based on the email message, wherein the SDN controller refers to information in the syslog message, based on the information for identifying the security system, the information for identifying the security system being in the syslog message, and the SDN controller provides the control instruction, based on the referred information. ### Claim 13 (depends on 5) The access control system according to claim 5, wherein the message-obtainment-processing unit specifies, based on sender information in the obtained email message, the security system from which the email message has been sent, wherein the message-obtainment-processing unit inserts information for identifying the specified security system into a syslog message, which is converted into based on the email message, wherein the SDN controller refers to information in the syslog message, based on the information for identifying the security system, the information for identifying the security system being in the syslog message, and the SDN controller provides the control instruction, based on the referred information. ### Claim 14 (depends on 6) The access control system according to claim 6, wherein the message-obtainment-processing unit specifies, based on sender information in the obtained email message, the security system from which the email message has been sent, wherein the message-obtainment-processing unit inserts information for identifying the specified security system into a syslog message, which is converted into based on the email message, wherein the SDN controller refers to information in the syslog message, based on the information for identifying the security system, the information for identifying the security system being in the syslog message, and the SDN controller provides the control instruction, based on the referred information. ### Claim 15 (depends on 7) The access control system according to claim 7, wherein the message-obtainment-processing unit specifies, based on sender information in the obtained email message, the security system from which the email message has been sent, wherein the message-obtainment-processing unit inserts information for identifying the specified security system into a syslog message, which is converted into based on the email message, wherein the SDN controller refers to information in the syslog message, based on the information for identifying the security system, the information for identifying the security system being in the syslog message, and the SDN controller provides the control instruction, based on the referred information. ### Claim 16 (depends on 8) The access control system according to claim 8, wherein the message-obtainment-processing unit specifies, based on sender information in the obtained email message, the security system from which the email message has been sent, wherein the message-obtainment-processing unit inserts information for identifying the specified security system into a syslog message, which is converted into based on the email message, wherein the SDN controller refers to information in the syslog message, based on the information for identifying the security system, the information for identifying the security system being in the syslog message, and the SDN controller provides the control instruction, based on the referred information. ### Claim 17 (depends on 9) The access control system according to claim 9, wherein the message-obtainment-processing unit specifies, based on sender information in the obtained email message, the security system from which the email message has been sent, wherein the message-obtainment-processing unit inserts information for identifying the specified security system into a syslog message, which is converted into based on the email message, wherein the SDN controller refers to information in the syslog message, based on the information for identifying the security system, the information for identifying the security system being in the syslog message, and the SDN controller provides the control instruction, based on the referred information. ### Claim 18 A non-transitory computer-readable recording medium storing a computer program that causes a computer to function as a message-obtainment-processing unit configured to obtain from an email server an email message including information for identifying a suspect-terminal, the email message being generated in a security system located inside or outside a private network, which is constituted by use of an SDN, to be received by the email server, wherein the message-obtainment-processing unit causes an SDN controller in the private network to provide, to the suspect-terminal or an edge network device that controls communication of the suspect-terminal, a control instruction based on the obtained email message, so as to cause the suspect-terminal or the edge network device to execute a process for access control against the suspect-terminal. ### Claim 19 An access control method for performing access control in a private network constituted by use of an SDN, the access control method comprising: when a security system located inside or outside the private network detects irregular behavior in the private network, specifying a user terminal that has conducted the irregular behavior as a suspect-terminal and generating an email message including identification information of the suspect-terminal; storing the generated email message in an email server; causing an SDN controller or a predetermined computer, which controls communication in the private network, to obtain the email message stored in the email server; partially or entirely converting the obtained email message from a code that is not processable for the SDN controller into information that is processable for the SDN controller; providing, from the SDN controller to the suspect-terminal or an edge network device that controls communication of the suspect-terminal, a control instruction corresponding to the information converted into; and causing the suspect-terminal or the edge network device to execute a process for access control against the suspect-terminal, based on the control instruction.