JP2023047950A - Master device, communication control method, communication control program, and communication control system - Google Patents

Abstract

To make it possible to reduce the work burden required for communication control settings in a network.SOLUTION: A master device 10 sets a policy for controlling communication between groups into which terminals 30 connected any of edge devices 20 among the plurality of edge devices 20 are classified. The master device 10 permits communication between the same groups, accepts an indication as to whether to permit regarding communication between different groups, and sets the policy. Each of the edge devices 20 controls communication between the terminals 30 based on the policy set by the master device 10.SELECTED DRAWING: Figure 1

Description

The present disclosure relates to technology for controlling communication between terminals.

A network security device controls communication of a terminal connected to the network security device. This control is based on the IP (Internet
This is achieved by setting in advance whether or not to permit communication for a combination of the IP address of the data destination terminal and the IP address of the data destination terminal.

Patent Literature 1 describes defining a plurality of groups in a network and controlling communication between groups using group identifiers.

JP-A-11-112559

The task of setting whether or not to permit communication for each combination of IP addresses is complicated and takes time. Although Patent Document 1 describes controlling communication between groups, it does not describe how to set the control of communication between groups. The task of setting whether or not to permit communication for each combination of groups is not as long as the work of setting whether or not to permit communication for each combination of IP addresses, but it takes time.
An object of the present disclosure is to make it possible to reduce the work load associated with setting.

The master device according to the present disclosure is
A policy setting unit that sets a policy for controlling communication between groups in which terminals connected to the network are classified, and whether communication between the same group is permitted or communication between different groups is permitted A policy setting unit that accepts a designation of whether or not to set the policy.

In the present disclosure, a policy is set by receiving a specification as to whether or not communication between the same group is permitted, and communication between different groups is permitted. As a result, it is possible to reduce the work load related to setting.

1 is a configuration diagram of a communication control system 1 according to Embodiment 1. FIG. 1 is a configuration diagram of a master device 10 according to Embodiment 1; FIG. 2 is a configuration diagram of the edge device 20 according to the first embodiment; FIG. 4 is a flowchart showing the overall operation of the communication control system 1 according to Embodiment 1; 4 is an explanatory diagram of an address 41 and terminal information 42 according to Embodiment 1; FIG. FIG. 4 is an explanatory diagram of a policy 45 according to the first embodiment; FIG. 5 is a flowchart of classification processing (step S12 in FIG. 4) according to the first embodiment; FIG. 8 is an explanatory diagram of address reception processing (step S21 in FIG. 7) according to the first embodiment; FIG. 8 is an explanatory diagram of terminal extraction processing (step S22 in FIG. 7) according to the first embodiment; FIG. 8 is an explanatory diagram of the list display process (step S23 in FIG. 7) according to the first embodiment; FIG. 5 is a flowchart of policy setting processing (step S13 in FIG. 4) according to the first embodiment; FIG. 12 is an explanatory diagram of the list display process (step S31 in FIG. 11) according to the first embodiment; FIG. FIG. 12 is an explanatory diagram of the policy setting process (step S32 in FIG. 11) according to the first embodiment; FIG. 9 is a flowchart showing the overall operation of the communication control system 1 according to Embodiment 2; FIG. 15 is an explanatory diagram of a policy setting process (step S43 in FIG. 14) according to the second embodiment; FIG. FIG. 15 is an explanatory diagram of a classification change process (step S46 in FIG. 14) according to the second embodiment; FIG. FIG. 15 is an explanatory diagram of a classification change process (step S46 in FIG. 14) according to the second embodiment; FIG.

Embodiment 1.
*** Configuration description ***
A configuration of a communication control system 1 according to Embodiment 1 will be described with reference to FIG.
A communication control system 1 includes a master device 10 and a plurality of edge devices 20 . The master device 10 and each edge device 20 are connected via a network device 90 .
The master device 10 is a computer installed in a management center or the like for managing the communication control system 1 . Each edge device 20 is a computer installed at a site such as a factory or office and connected to one or more terminals 30 . As the terminal 30 , there are a plurality of types of terminals 30 , such as an IT (Information Technology) type terminal 30 and an OT (Operational Technology) type terminal 30 .

A configuration of the master device 10 according to the first embodiment will be described with reference to FIG.
The master device 10 comprises hardware including a processor 11 , a memory 12 , a storage 13 and a communication interface 14 . The processor 11 is connected to other hardware via signal lines and controls these other hardware.

The master device 10 includes an address reception unit 111, a terminal extraction unit 112, a terminal classification unit 113, a policy setting unit 114, and a setting transmission unit 115 as functional components. The functions of each functional component of the master device 10 are realized by software.
The storage 13 stores a program that implements the function of each functional component of the master device 10 . This program is read into the memory 12 by the processor 11 and executed by the processor 11 . Thereby, the function of each functional component of the master device 10 is realized.

The configuration of the edge device 20 according to the first embodiment will be described with reference to FIG.
The edge device 20 includes hardware including a processor 21 , a memory 22 , a storage 23 and a communication interface 24 . The processor 21 is connected to other hardware via signal lines and controls these other hardware.

The edge device 20 includes an address acquisition unit 211, an address transmission unit 212, a setting reception unit 213, a communication control unit 214, and a log acquisition unit 215 as functional components. The function of each functional component of the edge device 20 is realized by software.
The storage 23 stores a program that implements the function of each functional component of the edge device 20 . This program is read into the memory 22 by the processor 21 and executed by the processor 21 . Thereby, the function of each functional component of the edge device 20 is realized.

The processors 11 and 21 are ICs (Integrated Circuits) that perform processing. As a specific example, the processors 11 and 21 are CPUs (Central
Processing Unit), DSP (Digital Signal Processor), and GPU (Graphics Processing Unit).

The memories 12 and 22 are storage devices that temporarily store data. Specific examples of the memories 12 and 22 are SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory).

The storages 13 and 23 are storage devices that store data. As a specific example, the storages 13 and 23 are HDDs (Hard Disk Drives). The storages 13 and 23 are SD (registered trademark, Secure Digital) memory cards, CF (Compact Flash, registered trademark), NAND flashes, flexible disks, optical disks, compact disks, Blu-ray (registered trademark) disks, DVDs (Digital Versatile Disks). ) may be a portable recording medium.

Communication interfaces 14 and 24 are interfaces for communicating with external devices. Specific examples of the communication interfaces 14 and 24 are Ethernet (registered trademark), USB (Universal Serial Bus), and HDMI (registered trademark, High-Definition Multimedia Interface) ports.

***Description of operation***
The operation of the communication control system 1 according to the first embodiment will be described with reference to FIGS. 4 to 13. FIG.
The operation procedure of the communication control system 1 according to the first embodiment corresponds to the communication control method according to the first embodiment. A program that realizes the operation of the communication control system 1 according to the first embodiment corresponds to the communication control program according to the first embodiment.

Overall operation of the communication control system 1 according to the first embodiment will be described with reference to FIG.
(Step S11: Address Acquisition Processing)
The address acquisition unit 211 of each edge device 20 acquires the address 41 of the terminal 30 connected to the same network as the edge device 20 . The same network refers to networks with the same network address. At this time, the address acquisition unit 211 may acquire the address 41 of the connected terminal 30 for each port.
Here, the address acquisition unit 211 acquires an IP address and a MAC (Media Access Control) address as the address 41 of the terminal 30, as shown in FIG.

The address transmission unit 212 of each edge device 20 transmits the address 41 to which the terminal information 42 is added to the master device 10 .
Here, as shown in FIG. 5, the address transmission unit 212 adds the group name, terminal name, edge device name, and remarks as the terminal information 42 . The group name is the identification name of the group to which the terminal 30 belongs, and is set to unclassified here. The terminal name is a name for facilitating identification of the terminal 30, and the MAC address is set here. The edge device name is the identification name of the edge device 20 connected to the network to which the terminal 30 is connected. Here, the name of the edge device 20 including the address transmission unit 212 is set. The remark is information for facilitating identification of the terminal 30, and manufacturer information is set here. The manufacturer information is information that can identify the manufacturer, such as the name of the manufacturer specified from the company code of the MAC address.

(Step S12: Classification process)
The address receiving unit 111 of the master device 10 receives the address 41 to which the terminal information 42 is added, which is transmitted in step S11. The address 41 of the same terminal 30 may be transmitted from a plurality of edge devices 20 . In this case, the address receiving unit 111 leaves only one address 41 of the same terminal 30 and deletes the rest so as to eliminate duplication.
Then, the terminal extraction unit 112 of the master device 10 extracts the terminals 30 indicated by the addresses that do not exist in the group list 44 indicating the addresses 41 belonging to each group 43 among the received addresses 41 as unclassified terminals 31 . Then, the terminal classification unit 113 of the master device 10 displays information about the unclassified terminal 31 and allows the user to specify the group 43 to which the unclassified terminal 31 belongs.
As a result, the unclassified terminal 31 is classified into one of the groups, and the group list 44 is updated.

(Step S13: Policy setting process)
The policy setting unit 114 of the master device 10 sets a policy 45 for controlling communication between groups, as shown in FIG. At this time, the policy setting unit 114 automatically permits communication between the same groups and sets the policy 45 by accepting designation as to whether or not to permit communication between different groups. In addition, the policy setting unit 114 sets the policy 45 by receiving a specification as to whether or not to acquire a log for communication between different groups.
The setting transmission unit 115 of the master device 10 transmits the policy 45 to each of the edge devices 20 .

(Step S14: communication control processing)
The setting reception unit 213 of each edge device 20 receives the policy 45 transmitted in step S13. The communication control unit 214 of each edge device 20 controls communication between terminals 30 based on the policy 45 . Further, the log acquisition unit 215 acquires a communication log when the policy 45 is set to acquire a log.

For example, assume that the policy 45 shown in FIG. 6 is set. Assume that the edge device 20 receives data whose source IP address belongs to the IT group, whose destination IP address belongs to the DMZ group, and whose communication protocol is XXX. In this case, the setting reception unit 213 determines that policy 1 is met, and permits communication. Also, the log acquisition unit 215 acquires a communication log.

When the communication control system 1 is introduced, the processes from step S11 to step S14 are executed in order.
After that, the process of step S14 is continuously executed, and communication between the terminals 30 is controlled. Moreover, even when the process of step S14 is being executed, the process of step S11 is periodically executed. Then, the process of step S12 is executed each time the address 41 is transmitted in step S11 or at regular time intervals. The process of step S13 is performed as needed.

The classification process (step S12 in FIG. 4) according to the first embodiment will be described with reference to FIG. (Step S21: Address reception processing)
The address receiving unit 111 receives the address 41 to which the terminal information 42 is added, which is transmitted from each edge device 20 in step S11. As shown in FIG. 8 , the addresses 41 and terminal information 42 collected by each edge device 20 are aggregated in the master device 10 .

(Step S22: terminal extraction process)
The terminal extraction unit 112 extracts terminals 30 indicated by addresses 41 that do not exist in the group list 44 from among the addresses 41 received in step S21 as unclassified terminals 31 . The group list 44 is a group 43 in which the terminals 30 connected to one of the edge devices 20 among the plurality of edge devices 20 are classified, and indicates the group 43 for controlling communication. At this time, if there is an unclassified address 41 among the addresses 41 received in the past, the terminal extraction unit 112 also extracts the terminal 30 indicated by this address 41 as an unclassified terminal 31 .

Here, it is assumed that address 41 shown in FIG. 9A is received. It is also assumed that the group list 44 shown in (B) of FIG. 9 is stored in the storage 13 . Then, unclassified terminals 31 are extracted as shown in FIG. 9C.
That is, two terminals 30 that do not exist in the group list 44 or are not classified are extracted as unclassified terminals 31 .

(Step S23: list display processing)
As shown in FIG. 10 , the terminal classification unit 113 displays a list of information regarding the unclassified terminals 31 . Here, the information about the unclassified terminal 31 is the address 41 and the terminal name, edge device name and remarks in the terminal information 42 . That is, as the information about the unclassified terminal 31, the edge device name, which is the identification information of the edge device 20 that received the address 41 of the unclassified terminal 31, is displayed. As information on the unclassified terminal 31, manufacturer information indicating the manufacturer of the unclassified terminal 31 specified from the MAC address is displayed.
Of the address 41, the terminal name, the edge device name, and the remarks, only a part of the information is displayed in a list, and the rest of the information is displayed when the cursor is moved. good too.

(Step S24: terminal classification process)
The terminal classification unit 113 allows the user to specify the group 43 to which the unclassified terminal 31 belongs. The user is, for example, an administrator of the communication control system 1 or the like. Specifically, the group 43 to which the unclassified terminal 31 belongs is designated by selecting a radio button in the designation column of the group 43 shown in FIG. The selection by the designated field is made by the user. That is, the terminal classification unit 113 displays the specifiable groups and allows them to be selectively specified. Thereby, the terminal classification unit 113 updates the group list 44 .
At this time, the terminal classification unit 113 not only designates the group 43, but also changes at least one of the terminal name of the unclassified terminal 31 and the remark in which related information related to the unclassified terminal 31 is registered. may be accepted. The terminal name and remarks of the unclassified terminal 31 are used to identify the unclassified terminal 31 . By inputting appropriate information here, it becomes possible to easily carry out the work when reviewing the classification of the group 43 at a later date.

The policy setting process (step S13 in FIG. 4) according to the first embodiment will be described with reference to FIG.
(Step S31: list display processing)
As shown in FIG. 12, the policy setting unit 114 displays a list of policies 45 that have been set for communication between different groups.

(Step S32: Policy setting process)
The policy setting unit 114 receives inputs such as addition, change, and deletion of policies 45 between different groups. Inputs such as addition, change, and deletion of the policy 45 are performed by the user. Specifically, the policy setting unit 114 displays an input screen for adding the policy 45 when the add button or the change button in FIG. 12 is pressed. As shown in FIG. 13, on this input screen, a data transmission source group, a data transmission destination group, a communication protocol, a transmission destination port number, whether or not to permit communication, and whether or not to acquire a log are displayed. It can be specified whether or not. Whether or not to permit communication is specified by selecting permit or deny in the action column. Also, on this input screen, it is possible to specify whether or not to validate the policy 45 . When the add button in FIG. 12 is pressed, the input screen shown in FIG. 13 is displayed with default values displayed. When the change button in FIG. 12 is pressed, the input screen shown in FIG. 13 is displayed with the setting of the policy 45 before change displayed.
The policy setting unit 114 sets the policy 45 according to the information input on the input screen. Since it is possible to specify the communication protocol on the input screen, it is possible to set the policy 45 by specifying whether or not to permit communication between different groups according to the communication protocol. The communication protocol is TCP (Transmission Control
Protocol), UDP (User Datagram Protocol), and the like. In addition, when the communication protocol is specified on the input screen, it is possible to specify whether or not to allow communication for each port, so whether communication between different groups is allowed according to the port The policy 45 can be set by specifying whether or not. In addition, since it is possible to specify whether or not to acquire a log on the input screen, it is possible to specify whether or not to acquire a communication log for communication between different groups, apart from communication control. A policy 45 is configurable.

Note that the policy setting unit 114 may set the policy 45 by reading setting data set for the policy 45 . After setting the policy 45 by reading the setting data, the policy setting unit 114 may receive input such as addition, change, or deletion of the policy 45 .

(Step S33: Policy transmission processing)
The setting transmission unit 115 transmits the policy 45 set in step S32 to each edge device 20 .

*** Effect of Embodiment 1 ***
As described above, the communication control system 1 according to Embodiment 1 extracts the terminal 30 indicated by the address 41 that does not exist in the group list 44 as the unclassified terminal 31 . This saves the user of the communication control system 1 from having to search for the terminal 30 that needs to be classified into the group 43 from among many terminals 30, and makes it possible to easily classify the terminal 30 into the group 43. is.

Further, the communication control system 1 according to Embodiment 1 collectively displays necessary information on one screen when the classification into the group 43 is designated. This eliminates the need to consider the classification by displaying various screens, and prevents operational errors and specification errors when specifying the group classification.

Further, the communication control system 1 according to the first embodiment displays the edge device name, which is the identification information of the edge device 20 from which the address 41 of the unclassified terminal 31 is received, when specifying the classification into the group 43 . This makes it easy to identify that a terminal 30 not scheduled to be connected has been connected, and it is possible to detect an unauthorized terminal 30 at an early stage.

Further, the communication control system 1 according to Embodiment 1 displays the manufacturer information specified from the MAC address when specifying the classification into the group 43 . This makes it easier to identify which terminal 30 the unclassified terminal 31 is and to easily classify it into the group 43 .

Further, the communication control system 1 according to Embodiment 1 automatically permits communication between the same group on the master device 10 side, and accepts designation of whether or not to permit communication between different groups. Set policy 45 . As a result, it is only necessary to set whether or not to permit communication between different groups, and it is possible to reduce the work load related to the setting. By creating the inter-group communication control policy 45 before operation, the operation can be started without spending time setting the communication control. Also, since the policy 45 does not become complicated, it becomes easier to manage and build a secure network.

Further, the communication control system 1 according to Embodiment 1 accepts a specification as to whether or not to permit communication according to a communication protocol, and sets a policy. Further, the communication control system 1 according to Embodiment 1 accepts a specification as to whether or not to permit communication according to a port when a communication protocol is specified, and sets a policy. This makes it possible to implement appropriate control of communication.

In addition, the communication control system 1 according to Embodiment 1 sets the policy 45 by receiving a designation as to whether or not to acquire a log of communication between different groups. As a result, while permitting communication between some groups, it is also possible to take measures such as acquiring logs and monitoring the content of communication.

Further, the communication control system 1 according to Embodiment 1 displays the policy 45 as a list. The policy 45 can be changed as needed by pressing a change button on the screen displaying the list. This makes it possible to reduce change mistakes when changing the policy 45 . Also, management of the policy 45 becomes easier.

***Other Configurations***
<Modification 1>
In the first embodiment, the master device 10 and the edge device 20 are described as devices having different functions. However, a plurality of devices having both the function of the master device 10 and the function of the edge device 20 are prepared, and the communication control system 1 is configured with one of them as the master device 10 and the rest as the edge devices 20. good too.
Also, the master device 10 may have the function of the edge device 20 . When the master device 10 has the function of the edge device 20, the master device 10 acquires the address 41 of the terminal 30 connected to the same network. When the master device 10 acquires the address 41, the device name of the master device 10 is added as the edge device name. In addition, when the master device 10 has the function of the edge device 20 , the master device 10 controls communication between the terminals 30 based on the policy 45 like the edge device 20 .

<Modification 2>
In Embodiment 1, each functional component is realized by software. However, as Modification 2, each functional component may be implemented by hardware. Regarding this modification 2, the points different from the first embodiment will be described.

When each functional component is implemented by hardware, the master device 10 has electronic circuits instead of the processor 11, the memory 12 and the storage 13. FIG. The electronic circuit is a dedicated circuit that realizes the functions of each functional component, memory 12 and storage 13 .
Similarly, when each functional component is implemented by hardware, the edge device 20 is provided with electronic circuits instead of the processor 21 , memory 22 and storage 23 . The electronic circuit is a dedicated circuit that realizes the functions of each functional component, memory 22 and storage 23 .

The electronic circuit 15 includes a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), and an FPGA (Field-Programmable Gate Array). is assumed.
Each functional component may be implemented by one electronic circuit 15, or each functional component may be implemented by being distributed among a plurality of electronic circuits 15. FIG.

<Modification 3>
As a modified example 3, some functional components may be implemented by hardware, and other functional components may be implemented by software.

The processor 11, the memory 12, the storage 13 and the electronic circuit 15 are called a processing circuit. That is, the function of each functional component is realized by the processing circuit.

Embodiment 2.
Embodiment 2 differs from Embodiment 1 in that an inspection policy 46 is set. In the second embodiment, this different point will be explained, and the explanation of the same point will be omitted.

***Description of operation***
The operation of the communication control system 1 according to the second embodiment will be described with reference to FIGS. 14 to 17. FIG.
The operation procedure of the communication control system 1 according to the second embodiment corresponds to the communication control method according to the second embodiment. A program that realizes the operation of the communication control system 1 according to the second embodiment corresponds to the communication control program according to the second embodiment.

Overall operation of the communication control system 1 according to the second embodiment will be described with reference to FIG.
The processing from step S41 to step S42 is the same as the processing from step S11 to step S12 in FIG.

(Step S43: Policy setting process)
The policy setting unit 114 of the master device 10 sets a policy 45 for controlling communication between groups, as shown in FIG. Here, it differs from the processing in step S13 of FIG. 4 in that the policy 45 including the inspection policy 46 is set. The inspection policy 46 is the policy 45 set to permit all communications between different groups and to acquire logs.

(Step S44: inspection processing)
The processing of step S44 is the same as the processing of step S14 in FIG. However, it differs in that it is executed in a state where the inspection policy 46 is set. By executing the process of step S44, a log of communication between different groups is obtained. A period during which the process of step S44 is executed is called an inspection period. The test period is preset or lasts until instructed.
Assume that the policy 45 is set as shown in FIG. Note that the policies 45 are set in descending order of priority. The priority of policy 45 can be changed by the user. In this case, it is determined whether or not communication is supported in order from the policy 45 above. That is, it is determined whether or not the communication conforms to the policy in order from the policy 45 on the basis of the source group, the destination group, and the communication protocol. For example, in the case of communication corresponding to policy 2, policy 2 is applied, the communication is permitted, and the log is not acquired. In addition, in the case of communication corresponding to policy 3, policy 3 is applied, the communication is rejected, and a log is acquired. If none of the enabled policies 1 to 3 are compliant, the inspection policy 46 is applied, communication is permitted, and a log is acquired.
That is, when the policy 45 set above the inspection policy 46 is applied, the inspection policy 46 is not applied.

(Step S45: Log collection process)
The log acquisition unit 215 of each edge device 20 transmits the log acquired in step S44 to the master device 10. FIG. Terminal classification unit 113 of master device 10 receives the log.

(Step S46: Classification change processing)
As shown in FIG. 16, the terminal classification unit 113 of the master device 10 displays a list of logs collected in step S45.
The log includes information such as action, source name, source IP address, destination name, destination IP address, and communication protocol. Action indicates whether or not communication is permitted. The sender name is the terminal name of the terminal 30 that is the sender. The source IP address is the IP address of the terminal 30 that is the source. The destination name is the terminal name of the destination terminal 30 . The destination IP address is the IP address of the destination terminal 30 . communication protocol is the communication protocol used. Note that the log may include other information.

Then, the terminal classification unit 113 changes the group 43 to which at least one of the data transmission source terminal 30 and the transmission destination terminal 30 in the communication indicated by the log belongs. Specifically, when the communication control button for the target log shown in FIG. 16 is pressed, the terminal classification unit 113 causes the transmission source and the transmission destination in the communication indicated by the target log to be identified as shown in FIG. A change screen for changing the group 43 to which at least one of the terminals 30 belongs is displayed. Then, the designation of the group 43 to which at least one of the terminal 30 of the transmission source and the transmission destination belongs is accepted.

(Step S47: Policy change processing)
When the inspection period ends, the user sets the inspection policy 46 to invalid.

The processing of step S48 is the same as the processing of step S14 in FIG.

After the inspection period has ended and the inspection policy 46 has been set to invalid, the processes from step S11 to step S14 in FIG. 4 are executed in order. Then, the policy 45 is set on the input screen as shown in FIG.
After that, the process of step S14 is continuously executed, and communication between the terminals 30 is controlled. Moreover, even when the process of step S14 is being executed, the process of step S11 is periodically executed. Then, the process of step S12 is executed each time the address 41 is transmitted in step S11 or at regular time intervals. The process of step S13 is performed as needed.

*** Effect of Embodiment 2 ***
As described above, the communication control system 1 according to the second embodiment sets the inspection policy 46, temporarily permits communication between all the groups 43 that do not fall under other policies 45, and saves logs. collect. Then, the group 43 to which the terminal 30 belongs is changed based on the log.
As a result, even when applying the technology of the communication control system 1 to a network that is already in operation, it is possible to prevent the operation of existing processes from being hindered.

Assume that the technology of the communication control system 1 is applied to an already operating network. In this case, communication is already being performed between the terminals 30, and there is a risk that the existing processing will not operate properly due to the communication being restricted by applying the technology of the communication control system 1. FIG. Therefore, by setting the inspection policy 46 and temporarily permitting all communications, the existing processing is made to operate correctly. During this period, logs are collected for communications permitted by the inspection policy 46 being applied. After that, by referring to the log and changing the group to which the terminal 30 belongs, even if the inspection policy 46 is invalidated, the existing processing can be operated correctly.

As described above, when the policy 45 set above the inspection policy 46 is applied, the inspection policy 46 is not applied. Therefore, if a policy 45 that does not hinder the operation of existing processing is known, other policies 45 can be set along with the inspection policy 46 . For example, it is conceivable to set a rejection policy 45 together with an inspection policy 46 for communication that should not be permitted without interfering with the operation of existing processing. As a result, it is possible to collect logs of communications to be considered while rejecting communications that should be clearly rejected.

The technology of the communication control system 1 is applied to the non-operating network. In this case, by operating the network with only the inspection policy 46 applied, it is possible to collect logs of all communications that occur within the network. Further, by referring to the log and changing the group 43 to which the terminal 30 belongs, communication control can be set, so that the work load can be reduced.

Note that "unit" in the above description may be read as "circuit", "process", "procedure", "process", or "processing circuit".

The embodiments and modifications of the present disclosure have been described above. Some of these embodiments and modifications may be combined and implemented. Also, any one or some may be partially implemented. It should be noted that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as necessary.

1 communication control system, 10 master device, 11 processor, 12 memory, 13 storage, 14 communication interface, 15 electronic circuit, 111 address reception unit, 112 terminal extraction unit, 113 terminal classification unit, 114 policy setting unit, 115 setting transmission unit , 20 edge device, 21 processor, 22 memory, 23 storage, 24 communication interface, 25 electronic circuit, 211 address acquisition unit, 212 address transmission unit, 213 setting reception unit, 214 communication control unit, 215 log acquisition unit, 30 terminal, 31 unclassified terminal, 41 address, 42 terminal information, 43 group, 44 group list, 45 policy, 46 inspection policy.

Claims (11)

A policy setting unit that sets a policy for controlling communication between groups in which terminals connected to the network are classified, and whether communication between the same group is permitted or communication between different groups is permitted A master device comprising a policy setting unit that accepts a designation of whether or not to set the policy. 2. The master device according to claim 1, wherein the policy setting unit accepts designation of whether or not to permit communication according to a communication protocol and sets a policy for communication between different groups. 3. The master device according to claim 2, wherein for communication between different groups, when a communication protocol is specified, the policy setting unit accepts a specification as to whether or not to permit communication according to a port and sets the policy. . 4. The master device according to any one of claims 1 to 3, wherein the policy setting unit receives a designation as to whether or not to obtain a communication log for communication between different groups, and sets the policy. 5. Any one of claims 1 to 4, wherein said policy setting unit displays an input screen for accepting designation of whether or not to permit communication between different groups, and sets information input on said input screen to said policy. 1. A master device according to claim 1. The master device further
6. The master according to any one of claims 1 to 5, further comprising a setting transmission unit that transmits the policy set by the policy setting unit to each of a plurality of edge devices to control communication based on the policy. Device. The master device further
7. Any one of claims 1 to 6, further comprising a terminal classification unit that displays a communication log and accepts a change of the group to which at least one of the terminal of the transmission source and the transmission destination of the data in the communication indicated by the log belongs. A master device as described above. During the inspection period, the policy setting unit permits communication between all different groups that do not fall under other policies, and accepts and inspects a specification to acquire a log of communication between all different groups. 8. The master device according to any one of claims 1 to 7, wherein a usage policy is set as said policy. Specify whether or not a policy for controlling communication between groups that classify terminals connected to a network by a computer is permitted for communication between the same group and communication between different groups. Communication control method to accept and set. Policy setting processing for setting a policy for controlling communication between groups in which terminals connected to a network are classified, and whether communication between the same group is permitted or communication between different groups is permitted A communication control program that causes a computer to function as a master device that accepts a designation of whether or not and performs policy setting processing for setting the policy. A communication control system comprising a plurality of edge devices and a master device,
The master device
A policy setting unit that sets a policy for controlling communication between groups in which terminals connected to the network are classified, and whether communication between the same group is permitted or communication between different groups is permitted a policy setting unit that receives a specification of whether or not to set the policy;
a setting transmission unit that transmits the policy set by the policy setting unit to each of the plurality of edge devices;
Each of the plurality of edge devices,
A communication control system comprising a communication control unit that controls communication between terminals based on the policy transmitted by the setting transmission unit.

Images