JP2018064228A - Packet controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To allow a network (NW) constructed with a low-priced access bridge device to have high hierarchy protection (two stages of a firewall (FW) and an access link).SOLUTION: A packet controller of the present disclosure includes: a packet receiving unit 33 for acquiring a MAC address from an access bridge device; a white list holding unit 31 for holding a white list 31a of MAC addresses; a comparison unit 32 for determining whether the MAC address is included in the white list 31a; a packet transmission unit 35 for transferring a packet included in the white list 31a; a packet discard unit 34 for discarding a packet not included in the white list 31a; and an external apparatus control unit 36 for blocking communication of a packet of which a transmission source has a MAC address not included in the white list 31a if the MAC address not included in the white list 31a is found.SELECTED DRAWING: Figure 3

Description

  The present disclosure relates to a packet control device and a packet control method.

  A packet transfer apparatus for an IP network has been proposed (for example, see Patent Document 1). The packet transfer apparatus of Patent Literature 1 includes an address table that holds addresses of terminals or servers that can communicate via the packet transfer apparatus.

  The packet transfer apparatus of Patent Literature 1 transfers a packet when the address of the transmission source of the packet is held in the address table. On the other hand, if the packet source address is not held in the address table, the packet is not transferred. As a result, the packet transfer apparatus disclosed in Patent Document 1 prevents inflow of unauthorized packets to the backbone network connected to the backbone of the packet transfer apparatus.

JP2015-159482A

  The packet transfer apparatus of Patent Document 1 is directly connected to a terminal or a server. For this reason, when a LAN (Local Area Network) is constructed between the terminal or server and the backbone network, it is necessary to arrange the packet transfer apparatus of Patent Document 1 in accordance with the number of terminals and servers. As described above, the packet transfer device disclosed in Patent Document 1 requires the entire network to be unified by the same manufacturer's packet transfer device, so that the change of the network becomes large and the investment is increased.

  A network of a firewall device and a low-cost access bridge device is used for the LAN. The firewall device cuts off the communication of the intruding PC. The access bridge device includes an arbitrary device having a packet transfer function, and examples thereof include an L2 switch and a wireless access point. However, as with the packet transfer apparatus disclosed in Patent Document 1, the firewall apparatus can prevent intrusion into the backbone network, but cannot prevent intrusion into the LAN.

  Therefore, the present disclosure aims to enable a high-level defense that prevents intrusion into the backbone network and prevents intrusion into the access bridge device even in a network configured with low-cost access bridge devices. And

Specifically, the packet control device of the present disclosure is:
A packet receiver (33) that receives a packet transmitted from the access bridge device (4) and acquires a device identifier of the transmission source from the packet;
A white list holding unit (31) for holding a white list (31a) of device identifiers of terminal devices connected to the access bridge device (4);
A comparison unit (32) for determining whether or not the device identifier acquired by the packet reception unit (33) is included in the white list (31a);
A packet transmission unit (35) for forwarding a packet whose destination device identifier is included in the white list (31a) to a destination;
A packet discard unit (34) for discarding a packet whose source device identifier is not included in the white list (31a);
When a device identifier not included in the white list (31a) is found in the comparison unit (32), the device identifier is stored using a packet transfer control table held by the access bridge device (4). An external device control unit that blocks communication of packets whose source is a device identifier not included in the white list (31a) with respect to the access bridge device (4) that holds the packet transfer control table that is stored ( 36).

Specifically, the packet control method of the present disclosure is:
A packet receiving unit (33) for receiving a packet transmitted from the access bridge device (4) and acquiring a transmission source device identifier from the packet;
The comparison unit (32) refers to the device identifier white list (31a) of the terminal device connected to the access bridge device (4), and the device identifier acquired by the packet reception unit (33) is the white list. (31a) a comparison procedure for determining whether or not included,
A packet transmission procedure in which a packet transmission unit (35) transfers a packet having a device identifier of a transmission source included in the white list (31a) toward a destination;
A packet discarding procedure for discarding a packet whose source device identifier is not included in the whitelist (31a);
The packet transfer control table held by the access bridge device (4) when the external device control unit (36) finds a device identifier not included in the white list (31a) in the comparison unit (32). The access bridge device (4) holding the packet transfer control table storing the device identifier is used to send a packet having a device identifier not included in the white list (31a) as a transmission source. And an external device control procedure for interrupting communication.

  The above disclosures can be combined as much as possible.

  According to the present disclosure, even in a network constituted by low-cost access bridge devices, high-level defense (2 of FW and access link) prevents intrusion into the backbone network and prevents access to the access bridge device. Stage).

1 is a schematic configuration diagram of a packet control system according to a first embodiment. 3 is an example of a white list according to the first embodiment. It is an example of the structure of the firewall apparatus which concerns on Embodiment 1. FIG. 3 is an example of a frame structure of an Ethernet (registered trademark) frame according to the first embodiment. 3 is an example of a forwarding database according to the first embodiment. 3 is an example of an L2SW list according to the first embodiment. 6 is a flowchart of L2SW control in the external device control unit according to the first embodiment. 3 is an example of port closing control according to the first embodiment. It is a schematic block diagram of the packet control system which concerns on Embodiment 2. It is an example of the L2SW list which concerns on Embodiment 2. 10 is a flowchart of L2SW control in the external device control unit according to the second embodiment. 6 is an example of filter control according to the second embodiment. It is a schematic block diagram of the packet control system which concerns on Embodiment 3.

  Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In addition, this indication is not limited to embodiment shown below. These embodiments are merely examples, and the present disclosure can be implemented in various modifications and improvements based on the knowledge of those skilled in the art. In the present specification and drawings, the same reference numerals denote the same components.

(Embodiment 1)
FIG. 1 shows a schematic configuration diagram of a packet control system according to the present embodiment. The packet control system according to the present embodiment includes a plurality of L2 switches (hereinafter referred to as L2SW) 4A-1 to 4A-3 and a firewall device 3 that functions as a packet control device.

  The L2SWs 4A-1 to 4A-3 function as an access bridge device that configures the LAN. The regular PCs 5-1 and 5-2 function as terminal devices and are connected to the L2SW 4A-2. The regular PCs 5-3 and 5-4 function as terminal devices and are connected to the L2SW 4A-3. The regular PC 5 is an arbitrary terminal having a unique device identifier, and includes an arbitrary terminal having a communication function such as a computer, a camera, or a sensor. The device identifier is an arbitrary identification that can identify the terminal, and is, for example, a MAC address. Hereinafter, a case where the device identifier is a MAC address will be described.

  In the present embodiment, an example in which L2SW 4A-1, L2SW 4A-2, and 4A-3 are cascade-connected is shown as an example of a LAN, but the topology of the LAN connection is not limited to this. The topology includes, for example, a ring shape and a star shape. Although the number of L2SWs 4A used in this embodiment is three, the number of L2SWs 4A that can be used is not particularly limited.

  The firewall device 3 is connected between the backbone network and the LAN. The firewall device 3 realizes a multistage defense access firewall and inspects each port of the L2SWs 4A-1 to 4A-3. Thereby, when the intrusion PC 6 is connected to the L2SW 4A-3, the connection port of the intrusion PC 6 is found and blocked.

  First, the regular PCs 5-1 to 5-4 communicate with the backbone NW2 via the L2SWs 4A-1 to 4A-3 and the firewall device 3. At this time, the L2SWs 4A-1 to 4A-3 transfer the packet based on the MAC address included in the packet. The firewall device 3 checks whether the source MAC address of the packet received from the LAN side is included in the white list 31a, and determines that the MAC address not included in the white list 31a is an intrusion PC. By discarding a packet that does not match the white list 31a and whose MAC address of the intruding PC 6 is included in the source MAC, communication that tries to pass from the invading PC 6 to the backbone NW2 is blocked.

  Furthermore, the firewall device 3 accesses the subordinate L2SWs 4A-1 to 4A-3, and whether or not the MAC address of the intruding PC 6 is included in the forwarding database (hereinafter referred to as FDB) of the L2SWs 4A-1 to 4A-3. Search for. Access to the L2SWs 4A-1 to 4A-3 uses a procedure supported by the L2SWs 4A-1 to 4A-3 for network management, such as TELNET and SNMP (Simple Network Management Protocol).

  If the MAC address of the intruding PC 6 is in the FDB, there is a high possibility that the invading PC 6 is connected to the port of the L2SW 4A-2, 4A-3 having that FDB. Order the closure. As a result, even in a network composed of low-cost access bridge devices, high-level defense (two levels of FW and access link) is possible.

  FIG. 2 shows an example of the white list 31a. The white list 31a stores MAC addresses of registered regular PCs 5-1 to 5-4. A PC having an address that does not match these MAC addresses, such as the intruding PC 6, is determined to be an intruding PC.

  FIG. 3 shows an example of the configuration of the firewall device 3. The firewall device 3 according to the present embodiment includes a packet reception unit 33, a white list holding unit 31, a comparison unit 32, a packet transmission unit 35, a packet discard unit 34, and an external device control unit 36. .

  The firewall device 3 has two network interfaces 37-1 and 37-2, one of which is connected to the LAN and the other is connected to the WAN. For example, the network interface 37-1 is connected to the L2SW 4A-1, and the network interface 37-2 is connected to the backbone NW2. When receiving a packet from the LAN network interface 37-1, the packet receiving unit 33 extracts a source MAC address from the received packet.

  FIG. 4 shows an example of a frame structure of the Ethernet (registered trademark) frame. A frame transmitted by a packet includes a destination MAC address, a source MAC address, type, data, and FCS. The MAC address of the transmitting PC is stored at a predetermined position of the frame, and if it is an intruding PC 6, the address is stored.

  The extracted source MAC address is passed to the comparison unit 32. The comparison unit 32 checks whether the MAC address of the white list 31 a held by the white list holding unit 31 matches the source MAC address extracted by the packet receiving unit 33.

  If it matches the MAC address of the white list 31a, the packet receiving unit 33 outputs the packet to the packet transmitting unit 35 because it is a registered regular PC. Thereby, the packet from the regular PC is output (forwarded) to the network interface 37-2 on the WAN side via the packet transmission unit 35. If they do not match, the packet discard unit 34 discards packets that are not included in the white list 31a.

  Next, the source MAC address of the discarded packet is passed to the external device control unit 36. The external device control unit 36 accesses the L2SWs 4A-1 to 4A-3 registered in the L2SW list 36a. The external device control unit 36 accesses the L2SWs 4A-1 to 4A-3 using, for example, TELNET. Thereby, the external device control unit 36 acquires the FDB from the L2SWs 4A-1 to 4A-3.

  FIG. 5 is an L2SW FDB. The L2SW FDB functions as a packet transfer control table. When the L2SWs 4A-1 to 4A-3 receive the packet, the L2SW 4A-1 to 4A-3 store the reception port, VLAN ID, and source MAC address of the packet in the FDB.

  FIG. 6 is an example of the L2SW list 36a according to the present embodiment. In this embodiment, three L2SWs 4A-1 to 4A-3 are registered, and IP addresses for accessing the L2SWs 4A-1 to 4A-3 are stored. If there are lower L2SWs 4A-2 and 4A-3, the connection ports and the IP addresses of the lower L2SWs 4A-2 and 4A-3 are stored.

  Next, the packet control method according to the present embodiment will be described. In the packet control method according to the present embodiment, the firewall device 3 sequentially executes a packet reception procedure, a comparison procedure, and a packet processing procedure. In the packet processing procedure, the firewall device 3 executes a packet transmission procedure or a packet discard procedure and an external device control procedure.

  In the packet reception procedure, the packet receiving unit 33 receives a packet transmitted from an access bridge device that transfers a packet based on the MAC address, and acquires a transmission source MAC address from the packet. In the comparison procedure, the comparison unit 32 refers to the white list 31a of the MAC address of the terminal device connected to the access bridge device, and whether or not the MAC address acquired by the packet reception unit 33 is included in the white list 31a. Determine. Thereby, the firewall apparatus 3 determines whether the transmission source of the packet is a regular PC or an intrusion PC.

  When the packet transmission source is a regular PC, the firewall device 3 executes a packet transmission procedure. In the packet transmission procedure, the packet transmission unit 35 transmits a packet whose source MAC address is included in the white list 31a to a network device that forwards the packet toward the destination.

When the packet transmission source is an intrusion PC, the firewall device 3 executes a packet discard procedure and an external device control procedure.
In the packet discard procedure, the packet discard unit 34 discards a packet whose source MAC address is not included in the white list 31a.
In the external device control procedure, when the external device control unit 36 finds the MAC address of the invading PC 6 not included in the white list 31a in the comparison unit 32, the intrusion PC 6 of the L2SW 4A-1 and 4A-3 is connected. Close the port.

  The L2SW control in the external device control unit 36 in the external device control procedure will be described with reference to FIG. The source MAC address of the intrusion PC 6 that does not match the white list 31a is identified and closed by the following processing.

Step S100: The comparison unit 32 finds a MAC address that is not included in the white list 31a.
Step S101: The external device control unit 36 performs a cyclic process on the registered L2SWs 4A-1 to 4A-3 in order. The registered L2SWs 4A-1 to 4A-3 are stored in the L2SW list 36a shown in FIG. 6, and the IP addresses for accessing the L2SWs 4A-1 to 4A-3 and the lower L2SWs 4A-2 and 4A-3 are stored. Is stored, the addresses of the lower L2SWs 4A-2 and 4A-3 and the connection port numbers are stored.

Step S102: The external device control unit 36 makes a TELNET connection to the registered L2SWs 4A-1 to 4A-3 in order.
Step S103: The external device control unit 36 acquires the FDB list of the L2SWs 4A-1 to 4A-3 and acquires the learned MAC address. The FDB is as shown in FIG. 5, and stores the source MAC address, VLAN ID, and reception port number of the packets received by the L2SWs 4A-1 to 4A-3. It indicates that the PC with the MAC address stored in the FDB is connected to the port.
Step S104: The external device control unit 36 checks whether the MAC address of the intruding PC 6 matches the MAC address stored in the FDB.

  Step S105: Whether or not the lower L2SWs 4A-2 and 4A-3 are connected is confirmed. If the matching port is a port connected to the lower L2SW 4A-2, 4A-3, the port of the lower L2SW 4A-2, 4A-3 must be closed, so the port of this L2SW 4A-1 is not closed .

  Step S106: When the lower L2SWs 4A-2 and 4A-3 are not connected, since the intrusion PC 6 is connected to the corresponding port, the corresponding port is closed. Then, the L2SW control in the external device control unit 36 is terminated.

Step S107: It is confirmed whether all MAC addresses do not match the MAC address of the intruding PC 6.
Step S108: If all the MAC addresses do not match the MAC address of the intruding PC 6, the processing is continued to the next L2SW.

  In this embodiment, the FDB is acquired after the intrusion PC 6 is discovered by the firewall device 3. However, even if the FDB is acquired in advance by cyclically accessing the L2SWs 4A-1 to 4A-3 in advance. Good.

  FIG. 8 shows an example of port closing control using TELNET. The external device control unit 36 accesses the L2SWs 4A-1 to 4A-3, acquires the learned MAC address list stored in the FDB, finds the intrusion PC 6, and closes the port. Specifically, first, the external device control unit 36 logs in to TELNET, executes a command for FDB acquisition, and acquires a list of MAC addresses and port numbers. When the external device control unit 36 finds the MAC address “3c97.0e80.4b81” of the intruding PC 6 in the acquired MAC address, it is understood that the intruding PC 6 is connected to the port number “G1 / 0/20”. . In this case, the external device control unit 36 next executes a command for closing the port number “G1 / 0/20”.

  As described above, the firewall device 3 according to the present embodiment discards the packet from the intrusion PC 6 and closes the port number “G1 / 0/20” of the L2SW 4A-3 to which the intrusion PC 6 is connected. . As a result, the firewall device 3 according to the present embodiment is a high-level layer that prevents intrusion into the backbone NW2 and prevents intrusion into the L2SW4A-3 even in a network composed of low-cost access bridge devices. Protection (two stages of FW and access link) can be made possible.

(Embodiment 2)
FIG. 9 shows a schematic configuration diagram of a packet control system according to the present embodiment. As in the first embodiment, the packet control system according to the present embodiment includes a plurality of L2SWs 4A-1 to 4A-3 and a firewall device 3 that functions as a packet control device. The configuration of the firewall device 3, the packet reception procedure, the comparison procedure, the packet transmission procedure, and the packet discard procedure are the same as in the first embodiment.

  The firewall device 3 of the present embodiment realizes a multistage defense access firewall and inspects each port of the L2SWs 4A-1 to 4A-3. Thereby, when the intrusion PC 6 is connected to the L2SW 4A-3, the MAC filter function of the L2SW 4A-3 is used in the external device control procedure to prevent the packet from the intrusion PC 6 from entering the LAN.

  First, the regular PCs 5-1 to 5-4 communicate with the backbone NW2 via the L2SW 4 and the firewall device 3. At this time, the firewall device 3 checks whether the source MAC address of the packet received from the LAN side is included in the white list 31a, and determines that the MAC address not included in the white list 31a is the intrusion PC 6. By discarding a packet that does not match the white list 31a and whose MAC address of the intruding PC 6 is included in the source MAC, communication that tries to pass from the invading PC 6 to the backbone NW2 is blocked.

  Furthermore, the firewall device 3 accesses the subordinate L2SWs 4A-2 and 4A-3, and searches whether the MAC address of the intruding PC 6 is in the FDB of the L2SWs 4A-2 and 4A-3. Access to the L2SW 4A-2, 4A-3 uses a procedure supported by the L2SW 4A-2, 4A-3 such as TELNET or SNMP for network management.

  If the intruding PC 6 is in the FDB, it can be seen that the invading PC 6 passes through the corresponding L2SW 4A-3, so the MAC filter of the L2SW 4A-3 is set, and then the packet of the intruding PC 6 flows through the corresponding L2SW 4A-3. Stop to not. As a result, even in a network configured with low-cost L2SW, high-level defense (two steps of FW and access link) is possible.

  FIG. 10 shows an example of the L2SW list 36a according to the present embodiment. The L2SW list 36a stores IP addresses for accessing the L2SWs 4A-1 to 4A-3.

  The L2SW control of the external device control unit 36 in the external device control procedure will be described with reference to FIG. The source MAC address of the intruding PC 6 that does not match the white list 31a is identified and blocked by the following process.

Step S200: The MAC address not included in the white list 31a is found by the comparison unit 32.
Step S201: First, the external device control unit 36 sequentially performs a cyclic process on the registered L2SWs 4A-1 to 4A-3. IP addresses for accessing the registered L2SWs 4A-1 to 4A-3 are stored in the L2SW list 36a shown in FIG. 10, and are used to access the respective L2SWs 4A-1 to 4A-3.

Step S202: The external device control unit 36 performs TELNET connection in the order of the registered L2SWs 4A-1 to 4A-3.
Step S203: An FDB list of L2SWs 4A-1 to 4A-3 is acquired, and learned MAC addresses are acquired. The FDB to be used has the same format as that in FIG. Indicates that the PC with the MAC address stored in the FDB is connected to the port.

  Step S204: The external device control unit 36 checks whether the MAC address of the intruding PC 6 matches the MAC address stored in the FDB.

Step S205: If it matches the MAC address of the intruding PC 6, a filter is registered that makes it impossible to receive a packet having the source MAC having the MAC address of the invading PC 6 from the port. Thereby, subsequent communication from the intrusion PC 6 can be blocked.
Step S206: It is confirmed whether all MAC addresses match the MAC address of the intruding PC 6.
Step S207: If all the MAC addresses do not match the MAC address of the intruding PC 6, continue the processing to the next L2SW processing.

  In the present embodiment, the FDB is acquired after the intrusion PC 6 is discovered in the firewall device 3, but the L2SW 4A-1 to 4A-3 are cyclically accessed in advance and the FDB is acquired in advance. Also good.

  FIG. 12 shows an example of filter control according to the present embodiment. The actual external device control unit 36 accesses the L2SW 4, acquires the FDB, finds the intrusion PC 6, and filters the MAC address. Specifically, first, the external device control unit 36 performs TELNET login, executes a command for FDB acquisition, and acquires a list of MAC addresses. When the external device control unit 36 finds the MAC address “3c97.0e80.4b81” of the intruding PC 6 in the acquired MAC address, it is found that the intruding PC 6 is connected to the port “G1 / 0/20”. In this case, the external device control unit 36 executes a command for prohibiting reception of the packet of the corresponding MAC address.

  As described above, the firewall device 3 according to the present embodiment discards a packet from the intrusion PC 6 and also uses the MAC address “3c97.0e80.4b81” of the intrusion PC 6 in the L2SW 4A-3 to which the intrusion PC 6 is connected. The reception of the packet is prohibited. As a result, the firewall device 3 according to the present embodiment is a high-level layer that prevents intrusion into the backbone NW2 and prevents intrusion into the L2SW4A-3 even in a network composed of low-cost access bridge devices. Protection (two stages of FW and access link) can be made possible.

(Embodiment 3)
FIG. 13 is a schematic configuration diagram of the packet control system according to the present embodiment. The packet control system according to the present embodiment includes a plurality of wireless access points 4B-1 and 4B-2 instead of the L2SWs 4A-1 to 4A-3 of the first and second embodiments. The configuration of the firewall device 3, the packet reception procedure, the comparison procedure, the packet transmission procedure, and the packet discard procedure are the same as in the first embodiment.

  The wireless access points 4B-1 and 4B-2 function as an access bridge device configuring the LAN. The regular PCs 5-1 and 5-2 function as terminal devices and are connected to the wireless access point 4B-1. The regular PCs 5-3 and 5-4 function as terminal devices and are connected to the wireless access point 4B-2. In this embodiment, an example in which the wireless access points 4B-1 and 4B-2 are connected to the firewall device 3 is shown as an example of the LAN, but the LAN is not limited to this. For example, the wireless access points 4B-1 and 4B-2 may be connected to the firewall device 3 via L2SW (not shown).

  The firewall device 3 realizes a multistage defense access firewall and inspects each channel of the wireless access points 4B-1 and 4B-2. Thereby, when the intrusion PC 6 is connected to the wireless access point 4B-2, in the external device control procedure, the MAC filter function of the wireless access point 4B-2 is used to intrude packets from the intrusion PC 6 into the LAN. Stop.

  In the present embodiment, a wireless access point list is provided instead of the L2SW list 36a shown in FIG. In the present embodiment, two wireless access point lists 4B-1 to 4B-2 are registered, and IP addresses for accessing the wireless access points 4B-1 and 4B-2 are stored.

The operation of the external device control unit 36 in the external device control procedure is the same as that of the second embodiment shown in FIG. However, “L2SW” in FIG. 11 replaces “wireless access point”. When the LAN includes both the L2SW and the wireless access point, “L2SW” in FIG. 11 is replaced with “L2SW and the wireless access point”.

  When the comparison unit 32 finds a MAC address that is not included in the white list 31a, the external device control unit 36 accesses the wireless access points 4B-1 and 4B-2 registered in the wireless access point list, Get the packet transfer control table. If the intrusion PC 6 is included in the packet transfer control table, the external device control unit 36 knows that the intrusion PC 6 passes through the wireless access point 4B-2. Is set to prevent packets from the intrusion PC 6 from flowing through the wireless access point 4B-2.

  For example, the external device control unit 36 performs TELNET login, executes a command for acquiring a packet transfer control table, and acquires a list of MAC addresses. When the external device control unit 36 finds the MAC address of the intrusion PC 6 in the acquired MAC address, it can be seen that the intrusion PC 6 is connected to the channel. In this case, the external device control unit 36 executes a command for prohibiting reception of the packet of the corresponding MAC address.

  As described above, the firewall device 3 according to the present embodiment discards a packet from the intrusion PC 6 and receives a packet with the MAC address of the intrusion PC 6 at the wireless access point 4B-2 to which the intrusion PC 6 is connected. Is prohibited. As a result, the firewall device 3 according to the present embodiment prevents intrusion to the backbone NW2 and prevents intrusion to the wireless access point 4B-2 even in a network composed of low-cost access bridge devices. It is possible to enable high-level defense (two steps of FW and access link).

  The packet control device of the present disclosure can be applied to the communication industry.

1: White list management server 2: Backbone NW
3: Firewall device 31: White list holding unit 31a: White list 32: Comparison unit 33: Packet reception unit 34: Packet discard unit 35: Packet transmission unit 36: External device control unit 36a: L2SW list 37: Network interface 4A- 1, 4A-2, 4A-3: L2SW
4B-1, 4B-2: Wireless access points 5-1, 5-2, 5-3, 5-4: Regular PC
6: Intrusion PC

Claims (6)

A packet receiver (33) that receives a packet transmitted from the access bridge device (4) and acquires a device identifier of the transmission source from the packet;
A white list holding unit (31) for holding a white list (31a) of device identifiers of terminal devices connected to the access bridge device (4);
A comparison unit (32) for determining whether or not the device identifier acquired by the packet reception unit (33) is included in the white list (31a);
A packet transmission unit (35) for forwarding a packet whose destination device identifier is included in the white list (31a) to a destination;
A packet discard unit (34) for discarding a packet whose source device identifier is not included in the white list (31a);
When a device identifier not included in the white list (31a) is found in the comparison unit (32), the device identifier is stored using a packet transfer control table held by the access bridge device (4). An external device control unit that blocks communication of packets whose source is a device identifier not included in the white list (31a) with respect to the access bridge device (4) that holds the packet transfer control table that is stored ( 36)
A packet control device. The access bridge device is an L2 switch,
The packet transfer control table stores a device identifier of the terminal device connected to each port,
The external device control unit closes a port corresponding to a device identifier not included in the white list when a device identifier not included in the white list is found in the comparison unit.
The packet control device according to claim 1. The access bridge device is an L2 switch,
The packet transfer control table stores a device identifier of the terminal device connected to each port,
The external device control unit blocks a device identifier not included in the white list when a device identifier not included in the white list is found in the comparison unit.
The packet control device according to claim 1. The access bridge device is a wireless access point;
The packet transfer control table stores a device identifier of the terminal device connected to each channel,
The external device control unit blocks a device identifier not included in the white list when a device identifier not included in the white list is found in the comparison unit.
The packet control device according to claim 1. The terminal device includes a computer, a camera or a sensor,
The packet control device according to claim 1. A packet receiving unit (33) for receiving a packet transmitted from the access bridge device (4) and acquiring a transmission source device identifier from the packet;
The comparison unit (32) refers to the device identifier white list (31a) of the terminal device connected to the access bridge device (4), and the device identifier acquired by the packet reception unit (33) is the white list. (31a) a comparison procedure for determining whether or not included,
A packet transmission procedure in which a packet transmission unit (35) transfers a packet having a device identifier of a transmission source included in the white list (31a) toward a destination;
A packet discarding procedure for discarding a packet whose source device identifier is not included in the whitelist (31a);
The packet transfer control table held by the access bridge device (4) when the external device control unit (36) finds a device identifier not included in the white list (31a) in the comparison unit (32). The access bridge device (4) holding the packet transfer control table storing the device identifier is used to send a packet having a device identifier not included in the white list (31a) as a transmission source. An external device control procedure for blocking communication;
Packet control method to execute.

Images