Communication system, control apparatus, policy management apparatus, communication method, and program

A communication method, comprising

• using a control apparatus connected to a plurality of forwarding nodes configured to process a received packet in accordance with a packet handling operation associating a matching rule for identifying a flow and processing content to be applied to a packet that conforms with the matching rule, and a policy management apparatus comprising an access control policy storage unit configured to associate roles assigned to users and access rights set for each role, the policy management apparatus providing information related to access rights associated with a role of a user who is successfully authenticated, to the control apparatus;
• the control apparatus performing:
• creating a path between a terminal of the user who is successfully authenticated and a resource that the user can access, based on information related to access rights received from the policy management apparatus,
• setting a packet handling operation in a forwarding node in the path, and
• setting a period of validity for the packet handling operation of the forwarding node in the path.

A program stored in a non-transitory computer readable medium, configured to control processes as defined below

• wherein execution is preformed on a computer making up a control apparatus connected to a plurality of forwarding nodes configured to process a received packet in accordance with a packet handling operation associating a matching rule for identifying a flow and processing content to be applied to a packet that conforms with the matching rule, and a policy management apparatus comprising an access control policy storage unit configured to associate roles assigned to users and access rights set for each role, the policy management apparatus being further configured to provide information related to access rights associated with a role of a user who is successfully authenticated, to the control apparatus;
• a process of creating a path between a terminal of the user who is successfully authenticated and a resource that the user can access, based on information related to access rights received from the policy management apparatus,
• a process of setting a packet handling operation in a forwarding node in the path, and
• a process of setting a period of validity for the packet handling operation of the forwarding node in the path.