Communication control apparatus, communication control method, and program

A communication control method, comprising:

• by a communication control apparatus that controls communication between a first apparatus and a second apparatus connected to the first apparatus via a plurality of relay apparatuses, referring to a control policy including access control supplementary control that is other than the access control from the first apparatus to the second apparatus and network configuration information about a network configuration among the first apparatus, the second apparatus, and the plurality of relay apparatuses, wherein:
• the supplementary control of the control policy includes first supplementary control and second supplementary control that need to be executed after the first supplementary control;
• and
• the plurality of relay apparatuses include a first relay apparatus executing the first supplementary control and a second relay apparatus executing the second supplementary control;
• generating a communication path that matches the control policy from the first apparatus to the second apparatus and goes through at least one of the plurality of relay apparatuses, wherein the generating comprises generating the communication path so that data flows through the second relay apparatus after flowing through the first relay apparatus;
• and
• instructing one or more relay apparatuses on the communication path among the plurality of relay apparatuses to execute the access control and the supplementary control included in the control policy.

A non-transitory computer-readable recording medium, storing a program that cause a computer to execute:

• referring to a control policy DB that stores a control policy including access control and supplementary control that is other than the access control from a first apparatus to a second apparatus connected to the first apparatus via a plurality of relay apparatuses, and referring to a network configuration DB that stores network configuration information about a network configuration among the first apparatus, the second apparatus, and the plurality of relay apparatuses, wherein the supplementary control of the control policy includes first supplementary control and second supplementary control that needs to be executed after the first supplementary control and wherein the plurality of relay apparatuses include a first relay apparatus executing the first supplementary control and a second relay apparatus executing the second supplementary control;
• generating a communication path that matches the control policy from the first apparatus to the second apparatus and goes through at least one of the plurality of relay apparatuses;
• and instructing one or more of the relay apparatuses on the communication path among the plurality of relay apparatuses to execute the access control and the supplementary control included in the control policy, wherein the generating comprises generating the communication path so that data flows through the second relay apparatus after flowing through the first relay apparatus.