JP2021166414A - Communication control system, master device, communication control method, and communication control program - Google Patents

Abstract

To prevent inappropriate communication from being permitted while reducing the burden of managing a white list.SOLUTION: Each of a plurality of edge devices 20 obtains a communication log between addresses classified into different groups in a group list in which the addresses of terminals 30 connected to one of the edge devices 20 are classified into a plurality of groups on the basis of terminal information of the terminal 30. A master device 10 accepts a setting of whether to allow communication between the addresses from which logs have been acquired. The master device 10 generates a white list that allows communication between the addresses classified in the same group and communication that has been set to be allowed.SELECTED DRAWING: Figure 1

Description

The present disclosure relates to communication control technology based on a white list.

There is a technology that controls communication based on a white list that indicates the targets for which communication is permitted. Communication control based on the white list is effective from the viewpoint of security. However, in the communication control based on the white list, even if the communication should be permitted, it is not permitted unless the target to be permitted is indicated in the white list. As a result, a situation may occur in which appropriate processing cannot be executed. Therefore, it is necessary to manage the white list appropriately. Therefore, the communication control based on the white list imposes a burden on the administrator in terms of managing the white list.

Patent Document 1 describes a technique for automatically generating a white list. This reduces the burden of managing the white list. In Patent Document 1, a white list is generated so that communication performed during the white list generation period is permitted.

Japanese Unexamined Patent Publication No. 2017-046149

In the technique described in Patent Document 1, if inappropriate communication is performed during the white list generation period, a white list is generated so that inappropriate communication is permitted. As a result, inappropriate communication is permitted even after communication control based on the white list is started.
It is an object of the present disclosure to reduce the burden of managing the white list and to prevent inappropriate communication from being permitted.

The communication control system according to the present disclosure is
It is a communication control system equipped with a plurality of edge devices and a master device.
Each of the plurality of edge devices
Acquires a log of communication between addresses classified into different groups in a group list in which the addresses of terminals connected to one of the plurality of edge devices are classified into a plurality of groups based on the terminal information of the terminal. Equipped with a log acquisition unit
The master device further
A setting reception unit that accepts settings for whether or not to allow communication for which logs have been acquired by the log acquisition unit, and a setting reception unit.
It includes a white list generation unit that generates a white list that permits communication between addresses classified into the same group in the group list and communication for which communication is permitted by the setting reception unit.

In the present disclosure, a white list is generated that allows communication between addresses classified into the same group and communication performed between addresses classified into different groups that is set to allow communication. As a result, it is possible to reduce the burden of managing the white list and prevent inappropriate communication from being permitted.

The block diagram of the communication control system 1 which concerns on Embodiment 1. FIG. The block diagram of the master apparatus 10 which concerns on Embodiment 1. FIG. The block diagram of the edge apparatus 20 which concerns on Embodiment 1. FIG. The flowchart which shows the operation of the communication control system 1 which concerns on Embodiment 1. FIG. The explanatory view of the address 41 which concerns on Embodiment 1. FIG. The explanatory view of the address 41 and the terminal information 42 which concerns on Embodiment 1. FIG. The explanatory view of the terminal table 43 which concerns on Embodiment 1. FIG. Explanatory drawing of group 44 which concerns on Embodiment 1. FIG. The explanatory view of the access list 46 for inspection which concerns on Embodiment 1. FIG. Explanatory drawing of log data 47 which concerns on Embodiment 1. FIG. Explanatory drawing of intergroup communication list 48 which concerns on Embodiment 1. FIG. The explanatory view of the white list 49 which concerns on Embodiment 1. FIG. The block diagram of the master apparatus 10 which concerns on modification 1. FIG. The flowchart which shows the operation of the communication control system 1 which concerns on modification 1. The flowchart which shows the operation of the communication control system 1 which concerns on Embodiment 2.

Embodiment 1.
*** Explanation of configuration ***
The configuration of the communication control system 1 according to the first embodiment will be described with reference to FIG.
The communication control system 1 includes a master device 10 and a plurality of edge devices 20. The master device 10 and each edge device 20 are connected via a network device 90.
The master device 10 is a computer installed in a management center or the like for managing the communication control system 1. Each edge device 20 is a computer installed in a field such as a factory or an office and to which one or more terminals 30 are connected. As the terminal 30, there are a plurality of types of terminals 30, such as an IT (Information Technology) type terminal 30 and an OT (Operational Technology) type terminal 30.

The configuration of the master device 10 according to the first embodiment will be described with reference to FIG.
The master device 10 includes hardware for a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to other hardware via a signal line and controls these other hardware.

The master device 10 has an address receiving unit 111, a classification unit 112, an inspection list generation unit 113, an inspection list transmission unit 114, a log reception unit 115, a setting reception unit 116, and a white list generation as functional components. A unit 117 and a white list transmission unit 118 are provided. The functions of each functional component of the master device 10 are realized by software.
The storage 13 stores a program that realizes the functions of each functional component of the master device 10. This program is read into memory 12 by processor 11 and loaded into memory 12.
It is executed by the processor 11. As a result, the functions of each functional component of the master device 10 are realized.

The configuration of the edge device 20 according to the first embodiment will be described with reference to FIG.
The edge device 20 includes hardware for a processor 21, a memory 22, a storage 23, and a communication interface 24. The processor 21 is connected to other hardware via a signal line and controls these other hardware.

The edge device 20 has an address acquisition unit 211, a terminal information reception unit 212, an address transmission unit 213, a list reception unit 214, a log acquisition unit 215, a log transmission unit 216, and a communication control unit as functional components. It is equipped with 217. The functions of each functional component of the edge device 20 are realized by software.
The storage 23 stores a program that realizes the functions of each functional component of the edge device 20. This program is read into the memory 22 by the processor 21 and executed by the processor 21. As a result, the functions of each functional component of the edge device 20 are realized.

Processors 11 and 21 are ICs (Integrated Circuits) that perform processing. As a specific example, the processors 11 and 21 are CPUs (Central).
Processing Unit), DSP (Digital Signal Processor), GPU (Graphics Processing Unit).

The memories 12 and 22 are storage devices for temporarily storing data. Specific examples of the memories 12 and 22 are SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory).

The storages 13 and 23 are storage devices for storing data. The storages 13 and 23 are, as a specific example, an HDD (Hard Disk Drive). The storages 13 and 23 include SD (registered trademark, Secure Digital) memory card, CF (Compact Flash, registered trademark), NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk, and DVD (Digital Versaille Disk). ) May be a portable recording medium.

Communication interfaces 14 and 24 are interfaces for communicating with an external device. Specific examples of the communication interfaces 14 and 24 are Ethernet (registered trademark), USB (Universal Serial Bus), and HDMI (registered trademark, High-Definition Multimedia Interface) ports.

*** Explanation of operation ***
The operation of the communication control system 1 according to the first embodiment will be described with reference to FIGS. 4 to 12.
The operation procedure of the communication control system 1 according to the first embodiment corresponds to the communication control method according to the first embodiment. Further, the program that realizes the operation of the communication control system 1 according to the first embodiment corresponds to the communication control program according to the first embodiment.

When the master device 10 and the edge device 20 are installed and the operation is started, the communication control system 1 executes the process shown in FIG.

(Step S11 in FIG. 4: Address acquisition process)
The address acquisition unit 211 of each edge device 20 acquires the address 41 of the terminal 30 connected to itself. At this time, the address acquisition unit 211 may acquire the address 41 of the connected terminal 30 for each port.
Here, as shown in FIG. 5, the address acquisition unit 211 acquires an IP (Internet Protocol) address and a MAC (Media Access Control) address as the address 41 of the terminal 30.

(Step S12 in FIG. 4: Terminal information reception process)
The terminal information receiving unit 212 of each edge device 20 receives the input of the terminal information 42 about the terminal 30 indicated by each address 41 acquired in step S11.
Specifically, the input device is connected to the edge device 20, and the terminal information 42 is input by the person in charge of installing the edge device 20 or the like. Then, the terminal information receiving unit 212 receives the input terminal information 42.
Here, as shown in FIG. 6, the terminal information receiving unit 212 accepts the group name and the terminal name as the terminal information 42, and associates the IP address and the MAC address. The group name is a name that can identify the group to which the terminal 30 belongs. For example, when the terminal 30 is grouped by the IT system and the OT system, the group name is the IT system or the OT system. The terminal name is a name that can identify the terminal 30. For example, the terminal name is assigned according to a predetermined rule based on the place where the terminal 30 is installed, the role of the terminal 30, and the like.

(Step S13 in FIG. 4: Address transmission process)
The address transmission unit 213 of each edge device 20 transmits the address 41 to which the terminal information 42 received in step S212 is added to the master device 10.
Then, the address receiving unit 111 of the master device 10 receives the address 41 to which the terminal information 42 transmitted from each edge device 20 is added. That is, the address receiving unit 111 receives the address 41 and the terminal information 42 of the terminal 30 connected to the edge device 20 from each of the plurality of edge devices 20. Then, as shown in FIG. 7, the address receiving unit 111 aggregates the received address 41 and the terminal information 42, and generates the terminal table 43 in association with the edge device ID that determines the edge device 20.

(Step S14 of FIG. 4: Classification process)
The classification unit 112 of the master device 10 classifies the address 41 of the terminal 30 received in step S13 into a plurality of groups 44 based on the terminal information 42 of the terminal 30.
Specifically, the classification unit 112 reads records in order from the terminal table 43, and identifies the group 44 of the records based on the terminal information 42 of the read records. In the first embodiment, the classification unit 112 specifies a group of records for each group name included in the terminal information 42. Therefore, in the case of the terminal table 43 shown in FIG. 7, each record is classified into an IT system group 44 and an OT system group 44 as shown in FIG. The classification unit 112 generates a group list based on the group 44.
Although not shown, the group list is a list that specifies the IP address for each group based on the group 44 shown in FIG. For example, the IT group includes IP A1, IP A2, IP Am, IP An ..., And the OT group includes IP B1, IP B2, IP Bi, IP Bj ... It is a list showing.

(Step S15 of FIG. 4: Inspection access list generation process)
In the first embodiment, the inspection list generation unit 113 permits the communication between all the groups 44 and acquires the log of the communication between the different groups 44, as shown in FIG. Generate Listing 46. Here, permitting communication between all groups 44 means permitting communication between addresses in the same group 44 and permitting communication between addresses in different groups 44. The inspection access list 46 is a provisional white list based on a rule for permitting communication between all groups 44 and then acquiring a log of communication between different groups 44.
Then, the inspection list generation unit 113 treats the pair of the inspection access list 46 and the terminal table 43 as the inspection list 45. The terminal table 43 included in the inspection list 45 has a specific structure similar to that of the group list described above.

Then, the inspection list transmission unit 114 transmits the inspection list 45 to each edge device 20. That is, the inspection list transmission unit 114 transmits the inspection access list 46 and the group list to each edge device 20. Then, the list receiving unit 214 of each edge device 20 receives the inspection list 45.

(Step S16 in FIG. 4: Log acquisition process)
The log acquisition unit 215 of each edge device 20 acquires a log of communication between addresses classified into different groups according to the inspection list 45 during the observation period after receiving the inspection list 45. In the first embodiment, the communication control unit 217 permits communication between all the groups 44 according to the inspection access list 46 received as the inspection list 45. Then, the log acquisition unit 215 acquires a log of communication between different groups 44 among the communication actually performed according to the inspection access list 46. The observation period is set such that a general communication is performed in the target system to which the communication control system 1 is applied.
The communication log contains the IP address of the data source and the IP address of the data destination. As shown in FIG. 10, the communication control unit 217 generates log data 47 by supplementing the MAC address, the group name, and the terminal name with respect to the data transmission source and the data destination with reference to the terminal table 43. ..

When the observation period ends, the log transmission unit 216 transmits the log data 47 to the master device 10. Then, the log receiving unit 115 of the master device 10 receives the log data 47.

(Step S17 in FIG. 4: Setting acceptance process)
The setting reception unit 116 of the master device 10 accepts the setting of whether or not to allow communication between the addresses from which the logs have been acquired.
Specifically, as shown in FIG. 11, the setting reception unit 116 generates an intergroup communication list 48 from which duplicates are eliminated for the log data 47 received from each edge device 20. Then, the setting reception unit 116 accepts the setting of whether or not to allow the communication between the addresses shown in the intergroup communication list 48.

(Step S18 in FIG. 4: White list generation process)
As shown in FIG. 12, the white list generation unit 117 of the master device 10 permits communication between addresses classified into the same group in step S14 and communication between addresses set to allow communication in step S17. White list 49 is generated. In the white list 49 shown in FIG. 12, communication between IT systems and OT systems and communication between IP A1 and IP B1 whose IP address is set to allow communication in step S17 are permitted. In the white list 49 shown in FIG. 12, communication between addresses whose IP addresses are classified into different groups 44 other than communication between IP A1 and IP B1 is set to be blocked.
Then, the white list transmission unit 118 transmits the white list 49 to each edge device 20. Then, the list receiving unit 214 of each edge device 20 receives the white list 49.

(Step S19 in FIG. 4: Communication control process)
The communication control unit 217 of each edge device 20 controls the communication according to the white list 49 received in step S18. That is, the communication control unit 217 permits only the communication set to be permitted in the white list 49, and blocks other communication.

*** Effect of Embodiment 1 ***
As described above, in the communication control system 1 according to the first embodiment, the terminals 30 connected to each edge device 20 are classified into the group 44, and the log of the communication between the addresses classified into the different groups 44 is observed during the observation period. Obtained during. Then, the setting of whether or not to allow the communication between the addresses for which the log is acquired is accepted, and the white that permits the communication between the addresses classified in the same group 44 and the communication between the addresses set to be permitted is permitted. Listing 49 is generated. That is, based on the provisionally created access list 46 for inspection, communication during the observation period is permitted, and a white list 49 is generated based on the log.
As a result, it is not necessary to set the white list 49 for each communication between the same groups 44, so that the burden of managing the white list 49 can be reduced. On the other hand, the communication between different groups 44 is set in the white list 49 after it is determined whether or not to allow it based on the log of the communication performed during the observation period. Therefore, it is possible to prevent unauthorized communication from being permitted.

For example, it is desirable to prohibit communication between the IT terminal 30 and the OT terminal 30 in principle from the viewpoint of safety. However, there may be a case where the data of the OT terminal 30 is analyzed by the IT terminal 30. As for the communication in this case, it is exceptionally necessary to allow the communication between the IT terminal 30 and the OT terminal 30. In such a case, in the communication control system 1 according to the first embodiment, it is determined whether or not the communication between the IT system terminal 30 and the OT system terminal 30 performed during the observation period is individually permitted. It is possible to generate an appropriate white list 49 just by setting it.

*** Other configurations ***
<Modification example 1>
In the first embodiment, each edge device 20 accepts the input of the terminal information 42. This is because it is considered that a person in charge of installing the edge device 20 or the like can easily know the terminal information 42 about the terminal 30 connected to the edge device 20.
However, the master device 10 may accept the input of the terminal information 42. For example, when the administrator of the communication control system 1 knows the terminal 30 connected to each edge device 20, it is appropriate that the master device 10 accepts the input of the terminal information 42. Further, at the timing when the master device 10 collects the IP address and MAC address of the terminal 30 from the edge device 20, it is collated with the database of the external organization or the database in the organization where the master device 10 is installed, and the group name and the terminal name are obtained. May be configured to obtain. In that case, the master device 10 automatically generates the terminal information 42 corresponding to the address 41.

The configuration of the master device 10 according to the first modification will be described with reference to FIG.
The master device 10 is different from the master device 10 shown in FIG. 2 in that it includes a terminal information receiving unit 119 as a functional component.

The operation of the communication control system 1 according to the first modification will be described with reference to FIG.
The process of step S21 is the same as the process of step S11 of FIG. Further, the processing of steps S24 to S29 is the same as the processing of steps S14 to S19 of FIG.
In step S22, the address transmission unit 213 of each edge device 20 transmits the address 41 acquired in step S21 to the master device 10. That is, the address transmitter 213
Sends the address 41 to the master device 10 in a state where the terminal information 42 is not added. In step S23, the terminal information receiving unit 119 of the master device 10 receives the input of the terminal information 42 about the terminal 30 indicated by each address 41 transmitted from each edge device 20.

The terminal information 42 for a part of the addresses 41 may be received by the edge device 20, and the terminal information 42 for the remaining addresses 41 may be received by the master device 10.

<Modification 2>
In the first embodiment, the white list 49 is set to allow communication between addresses classified in the same group and communication between addresses set to be permitted, and to block the remaining communication. The white list 49 may be set to acquire a log while blocking the remaining communication.
In this case, in step S19 of FIG. 4, the communication control unit 217 of each edge device 20 blocks the communication set to be blocked according to the white list 49. At this time, the log acquisition unit 215 acquires the log of the blocked communication. Periodically or at an arbitrary timing, the communication control unit 217 generates log data 47 from the log and transmits it to the master device 10. When the log data 47 is transmitted, the setting reception unit 116 accepts the setting of whether or not to allow communication between the addresses from which the logs have been acquired. Then, when the white list generation unit 117 accepts the setting to allow communication, the white list generation unit 117 adds the setting to the white list 49.
This makes it possible to add to the white list 49 after the observation period when the communication between the terminals 30 of different groups 44 that was not performed during the observation period includes the communication to be permitted.

<Modification example 3>
In the first embodiment, each functional component is realized by software. However, as a modification 3, each functional component may be realized by hardware. The difference between the third modification and the first embodiment will be described.

When each functional component is realized by hardware, the master device 10 includes an electronic circuit instead of the processor 11, the memory 12, and the storage 13. The electronic circuit is a dedicated circuit that realizes the functions of each functional component, the memory 12, and the storage 13.
Similarly, when each functional component is implemented in hardware, the edge device 20 includes an electronic circuit instead of the processor 21, the memory 22, and the storage 23. The electronic circuit is a dedicated circuit that realizes the functions of each functional component, the memory 22, and the storage 23.

As the electronic circuit, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Special Integrated Circuit), and an FPGA (Field-Programmable Gate Array) are assumed. Will be done.
Each functional component may be realized by one electronic circuit, or each functional component may be distributed and realized by a plurality of electronic circuits.

<Modification example 4>
As a modification 4, some functional components may be realized by hardware, and other functional components may be realized by software.

Processors 11 and 21, memories 12, 22, storages 13, 23, and electronic circuits are called processing circuits. That is, the function of each functional component is realized by the processing circuit.

Embodiment 2.
In the second embodiment, a case where a new terminal 30 is connected to the edge device 20 after the operation of the communication control system 1 is started will be described. In the second embodiment, the same points as those in the first embodiment will be omitted.

*** Explanation of operation ***
The operation of the communication control system 1 according to the second embodiment will be described with reference to FIG.
(Step S31 in FIG. 15: Setting addition process)
When a new terminal 30 is connected to the edge device 20 after the operation of the communication control system 1 is started, the setting reception unit 116 of the master device 10 displays the address 41 and the terminal information 42 of the added terminal 30 in the terminal table 43. Add to. Specifically, the administrator of the communication control system 1 inputs the address 41 and the terminal information 42 for the added terminal 30. Then, the setting reception unit 116 adds the input address 41 and the terminal information 42 to the terminal table 43.

Further, the setting reception unit 116 adds the setting to the white list 49 when the added terminal 30 needs to communicate with the terminal 30 of a different group 44. Specifically, the administrator of the communication control system 1 inputs the settings for permitted communication. The setting reception unit 116 adds the input setting to the white list 49.

(Step S32 in FIG. 15: Resending process)
The white list generation unit 117 of the master device 10 transmits the terminal table 43 to which the address 41 and the terminal information 42 are added in step S31 and the white list 49 to which the settings are added to each edge device 20. Then, the list receiving unit 214 of each edge device 20 receives the terminal table 43 and the white list 49.

(Step S33 in FIG. 15: Communication control process)
The communication control unit 217 of each edge device 20 controls the communication according to the white list 49 received in step S32.

*** Effect of Embodiment 2 ***
As described above, in the communication control system 1 according to the second embodiment, when a new terminal 30 is connected to the edge device 20 after the start of operation, the setting for the new terminal 30 is added to the white list 49. NS. That is, even if a new terminal 30 is connected, it is not necessary to set an observation period again and acquire the log. Therefore, when a new terminal 30 is connected, it is possible to immediately start the operation with an appropriate white list 49.

Since the new terminal 30 is added because it is needed, it is assumed that the role is clear. Therefore, it is recognized that the administrator of the communication control system 1 is aware of the address 41 and the terminal information 42 and whether or not communication with the terminal 30 of a different group 44 is necessary for the new terminal 30.

The above can be summarized as follows.
The communication control system according to the present disclosure is a communication control system including a plurality of edge devices and a master device.
The master device is
An address receiving unit that receives the address of the terminal connected to the edge device from each of the plurality of edge devices, and
It is provided with a classification unit that classifies the address of the terminal received by the address receiving unit into a plurality of groups based on the terminal information of the terminal.
Each of the plurality of edge devices
It is provided with a log acquisition unit that acquires a log of communication between addresses classified into different groups by the classification unit.
The master device further
A setting reception unit that accepts settings for whether or not to allow communication between addresses for which logs have been acquired by the log acquisition unit, and a setting reception unit.
It includes a white list generation unit that generates a white list that permits communication between addresses classified into the same group by the classification unit and communication between addresses set when communication is permitted by the setting reception unit.

The master device further
A white list transmission unit that transmits the white list generated by the white list generation unit to each of the plurality of edge devices is provided.
Each of the plurality of edge devices further
A communication control unit that controls communication according to the white list transmitted by the white list transmission unit is provided.

The log acquisition unit acquires the log during the observation period.
Each of the plurality of edge devices further
When the observation period ends, the log transmission unit includes a log transmission unit that transmits the log acquired by the log acquisition unit to the master device.

The master device further
It is provided with an inspection list transmission unit that transmits an inspection list that specifies between addresses classified into different groups by the classification unit to each of the plurality of edge devices.
The log acquisition unit acquires a log of communication between addresses specified by the inspection list transmitted by the inspection list transmission unit.

The white list generator is a case where a new terminal is connected to an edge device among the plurality of edge devices and the new terminal is allowed to communicate with a terminal of a different group. Update the white list.

The master device according to the present disclosure is
An address receiving unit that receives the address of the terminal connected to the edge device from each of the plurality of edge devices, and
A classification unit that classifies the address of the terminal received by the address receiving unit into a plurality of groups based on the terminal information of the terminal.
A log receiving unit that receives communication logs between addresses classified into different groups by the classification unit from each of the plurality of edge devices, and a log receiving unit.
A setting receiving unit that accepts a setting of whether or not to allow communication between addresses for which logs have been received by the log receiving unit, and a setting receiving unit.
It includes a white list generation unit that generates a white list that permits communication between addresses classified into the same group by the classification unit and communication between addresses set when communication is permitted by the setting reception unit.

The communication control method according to the present disclosure is
The master device receives the address of the terminal connected to the edge device from each of the plurality of edge devices, and receives the address of the terminal connected to the edge device.
The master device classifies the address of the terminal into a plurality of groups based on the terminal information of the terminal.
Each of the plurality of edge devices acquires a log of communication between addresses classified into different groups, and obtains a log of communication.
The master device accepts the setting of whether or not to allow communication between the addresses from which the logs have been acquired.
The master device generates a white list that allows communication between addresses classified in the same group and communication between addresses that are set to allow communication.

The communication control program according to the present disclosure is
Address reception processing for receiving the address of the terminal connected to the edge device from each of the plurality of edge devices, and
A classification process for classifying the address of the terminal received by the address reception process into a plurality of groups based on the terminal information of the terminal, and a classification process.
A log acquisition process for acquiring a log of communication between addresses classified into different groups by the classification process, and a log acquisition process.
Setting acceptance processing that accepts the setting of whether to allow communication between the addresses for which logs have been acquired by the log acquisition process, and
Communication control that performs a white list generation process that generates a white list that allows communication between addresses classified into the same group by the classification process and communication between addresses set to allow communication by the setting reception process. Make your computer function as a system.

The embodiments and modifications of the present disclosure have been described above. Some of these embodiments and modifications may be combined and carried out. In addition, any one or several may be partially carried out. The present disclosure is not limited to the above embodiments and modifications, and various modifications can be made as necessary.

1 Communication control system, 10 master device, 11 processor, 12 memory, 13 storage, 14 communication interface, 111 address receiver, 112 classification unit, 113 inspection list generator, 114 inspection list transmitter, 115 log receiver, 116 settings Reception unit, 117 white list generation unit, 118 white list transmission unit, 119 terminal information reception unit, 20 edge device, 21 processor, 22 memory, 23 storage, 24 communication interface, 211 address acquisition unit, 212 terminal information reception unit, 213 Address transmitter, 214 list receiver, 215 log acquisition unit, 216 log transmitter, 217 communication control unit, 30 terminals, 41 addresses, 42 terminal information, 43 terminal table, 44 groups, 45 inspection list, 46 inspection access list , 47 log data, 48 intergroup communication list, 49 white list, 90 network equipment.

Claims (9)

It is a communication control system equipped with a plurality of edge devices and a master device.
Each of the plurality of edge devices
Acquires a log of communication between addresses classified into different groups in a group list in which the addresses of terminals connected to one of the plurality of edge devices are classified into a plurality of groups based on the terminal information of the terminal. Equipped with a log acquisition unit
The master device further
A setting reception unit that accepts settings for whether or not to allow communication for which logs have been acquired by the log acquisition unit, and a setting reception unit.
A communication control including a white list generating unit that generates a white list that permits communication between addresses classified into the same group in the group list and communication that is set to allow communication by the setting receiving unit. system. Each of the plurality of edge devices further
A communication control unit that controls communication according to the white list, and includes a communication control unit that blocks communication that is not permitted by the white list.
The log acquisition unit acquires a log of communication blocked by the communication control unit, and obtains a log of communication.
The setting reception unit accepts a setting of whether or not to allow blocked communication, which is communication for which a log has been acquired by the log acquisition unit.
The communication control system according to claim 1, wherein the white list generation unit is added to the white list as communication that permits communication set to allow communication by the setting reception unit. The master device further
A white list transmission unit that transmits the white list generated by the white list generation unit to each of the plurality of edge devices is provided.
Each of the plurality of edge devices further
The communication control system according to claim 1 or 2, further comprising a communication control unit that controls communication according to the white list transmitted by the white list transmission unit. The log acquisition unit acquires the log during the observation period.
Each of the plurality of edge devices further
The communication control system according to any one of claims 1 to 3, further comprising a log transmission unit that transmits the log acquired by the log acquisition unit to the master device when the observation period ends. The master device further
It is provided with an inspection list transmission unit that transmits an inspection list that specifies between addresses classified into different groups in the group list to each of the plurality of edge devices.
The communication control system according to any one of claims 1 to 4, wherein the log acquisition unit acquires a log of communication between addresses specified by the inspection list transmitted by the inspection list transmission unit. The white list generator is a case where a new terminal is connected to an edge device among the plurality of edge devices and the new terminal is allowed to communicate with a terminal of a different group. The communication control system according to any one of claims 1 to 5, which updates the white list. In the group list in which the addresses of terminals connected to one of a plurality of edge devices are classified into a plurality of groups based on the terminal information of the terminal, the plurality of communication logs between the addresses classified into different groups are recorded. The log receiver that receives from each of the edge devices of
A setting receiving unit that accepts a setting of whether or not to allow communication for which a log has been received by the log receiving unit, and a setting receiving unit.
A master device including a white list generating unit that generates a white list that permits communication between addresses classified into the same group by the group list and communication that is set to allow communication by the setting receiving unit. .. Each of the plurality of edge devices is an address classified into a different group in a group list in which the address of a terminal connected to one of the plurality of edge devices is classified into a plurality of groups based on the terminal information of the terminal. Get the log of communication between
The master device accepts the setting of whether to allow communication between the addresses from which the log was acquired, and accepts the setting.
A communication control method in which the master device generates a white list that permits communication between addresses classified into the same group in the group list and communication for which a setting to allow communication is accepted. Acquires a log of communication between addresses classified into different groups in a group list in which the addresses of terminals connected to one of a plurality of edge devices are classified into a plurality of groups based on the terminal information of the terminal. Log acquisition process and
Setting acceptance processing that accepts the setting of whether to allow communication between the addresses for which logs have been acquired by the log acquisition process, and
Communication control that performs a white list generation process that generates a white list that permits communication between addresses classified into the same group in the group list and communication for which communication is permitted by the setting reception process. A communication control program that makes a computer function as a system.

Images