JP6227476B2 - Access control device, access control method, and program - Google Patents

Description

  The present invention relates to an access control apparatus, an access control method, and a program for executing access control to information, and in particular, an access control apparatus, an access control method, and an access control apparatus for executing access control of various terminal devices connected to a LAN. Regarding the program.

  Conventionally, as security techniques for information terminal devices connected to a network, authentication, introduction of security applications such as anti-virus software, content encryption, filtering, and firewall are known. For example, as a security measure for an information processing apparatus such as a PC, a method of protecting the information processing apparatus by introducing a security application is generally employed. In addition, as a security measure for terminal devices that do not have an input / output interface, such as smart home appliances and IoT (Internet of Things), a function for storing router setting information in advance and setting the router using the setting information There is a known terminal device (see Patent Document 1).

JP 2004-032142 A

  However, the conventional security technology cannot always be applied to various terminal devices such as smart home appliances and IoT (Internet of Things). For example, unlike the information processing apparatus used for multiple purposes such as a PC, these terminal apparatuses have limited apparatus functions. Therefore, it is not always necessary to provide resources for introducing security application or router setting information and setting functions. I don't have it. For this reason, the terminal device may not be able to introduce a security measure application or function.

  An object of the present invention made in view of such circumstances is to provide an access control device, an access control method, and a program capable of executing access control of various terminal devices connected to a LAN.

In order to solve the above problems, an access control device according to the present invention includes a data analysis unit that acquires an identifier of a terminal device connected to a LAN from the terminal device, and an access corresponding to the terminal device based on the identifier. A policy generation unit that acquires control setting information from an external network; and an access control unit that executes access control of the terminal device based on the setting information, the access control unit reaching the access control device If data is transmitted through the browser by the terminal device, characterized that you stopped access control of the terminal device based on the setting information.

The access control method according to the present invention is an access control method using an access control device that executes access control of a terminal device connected to a LAN, and an identifier of the terminal device connected to the LAN is assigned to the terminal device. Obtaining from the external network the access control setting information corresponding to the terminal device based on the identifier, and executing the access control of the terminal device based on the setting information, only including, in said step of performing access control, if the data arriving to the access control device is transmitted through the browser by the terminal device, and stops the access control of the terminal device based on the setting information, it It is characterized by.

In addition, the program according to the present invention obtains an identifier of a terminal device connected to a LAN from an information processing device having a communication function, and an access corresponding to the terminal device based on the identifier. Obtaining control setting information from an external network; and executing access control of the terminal device based on the setting information; and in the step of executing access control, the access control device is reached. If data is transmitted through the browser by the terminal device, characterized that you stopped access control of the terminal device based on the setting information.

  According to the communication system and the communication method of the present invention, it is possible to execute access control of various terminal devices connected to the LAN.

It is a block diagram which shows schematic structure of a communication system provided with the access control apparatus which concerns on one Embodiment of this invention. It is a figure which shows the example of the terminal device management table of FIG. It is a figure which shows the example of the policy table of FIG. It is a figure which shows the example of the browser table of FIG. It is a figure which shows the example of the MAC address management table of FIG. It is a figure which shows the example of the maker URL management table of FIG. It is a figure which shows the example of the product management table of FIG. It is a figure which shows the example of the profile management table of FIG. FIG. 2 is a flowchart illustrating the access control apparatus in FIG. 1. It is a flowchart figure explaining operation | movement of the access control apparatus of FIG. It is a sequence diagram explaining operation | movement of the communication system of FIG. It is a flowchart figure explaining operation | movement of the access control apparatus of FIG. It is a flowchart figure explaining operation | movement of the access control apparatus of FIG. It is a flowchart figure explaining operation | movement of the access control apparatus of FIG. It is a flowchart figure which shows the procedure which produces | generates the product management table and profile management table of FIG.

  Hereinafter, embodiments of the present invention will be described.

  First, a communication system including an access control apparatus according to an embodiment of the present invention will be described. As shown in FIG. 1, the communication system 10 includes a route control device 11, a terminal device 12, an access control device 13, a MAC address management server 14, a manufacturer URL management server 15, a manufacturer-specific profile server 16, Is provided. Any number of terminal devices 12 and manufacturer-specific profile servers 16 may be provided.

  The route control device 11 is a router device, for example, and connects the access control device 13 and an external network 17 such as the Internet. The path control device 11 also resolves the IP address and MAC address in the LAN 18 inside the access control device 13.

  The terminal device 12 is connected to the LAN 18 by wire or wireless. The terminal device 12 transmits and receives data to and from resources on the external network 17 via the route control device 11 and the access control device 13. The terminal device 12 includes, but is not limited to, information processing devices used for multiple purposes such as PCs and smartphones, and various network devices used for specific purposes such as smart home appliances.

  The access control device 13 is connected between the route control device 11 and the LAN 18. The access control device 13 is connected to the route control device 11 and the external network 17. The access control device 13 acquires access control setting information of the terminal device 12 connected to the LAN 18 from the external network 17. The access control device 13 executes access control between the terminal device 12 and resources on the external network (hereinafter referred to as access control of the terminal device 12) based on the acquired setting information. Access control is performed, for example, by filtering packets (data) that reach the access control device 13. The access control device 13 functions as a gateway between the external network 17 and the LAN 18. Details of the configuration and operation of the access control device 13 will be described later.

  The MAC address management server 14 shown in FIG. 1 is connected to the external network 17. The MAC address management server 14 stores a MAC address management table 19.

  The MAC address management table 19 is a table (information) indicating a correspondence relationship between the MAC address that is the identifier of the terminal device 12 and the manufacturer name of the terminal device 12. For example, the MAC address management table 19 shown in FIG. 2 includes information (“MAKER” in the figure) indicating the manufacturer name in association with the first 24 bits of the MAC address (“MAC ADRESS” in the figure). It is not limited to this. In FIG. 2, the manufacturer name corresponding to the MAC address “12-A4-8F” is “A Co.”. The manufacturer name corresponding to the MAC address “12-A4-90” is “B Company”. The manufacturer name corresponding to the MAC address “12-A4-91” is “Cltd.”.

  The manufacturer URL management server 15 shown in FIG. 1 is connected to the external network 17. The manufacturer URL management server 15 stores a manufacturer URL management table 20.

  The manufacturer URL management table 20 is a table showing a correspondence relationship between the manufacturer name of the terminal device 12 and the URL of the manufacturer-specific profile server 16 of the manufacturer. For example, the manufacturer URL management table 20 shown in FIG. 3 includes the URL (“URL” in the figure) of the manufacturer-specific profile server 16 in association with the information (“MAKER” in the figure) indicating the manufacturer name. It is not limited to this. In FIG. 3, the URL corresponding to the manufacturer name “A Co.” is “www.aaa.com”. The URL corresponding to the manufacturer name “B Company” is “www.bbb.co.jp”. The URL corresponding to the manufacturer name “Cltd.” Is “www.ccc.com/profile”.

  The manufacturer-specific profile server 16 shown in FIG. 1 is connected to the external network 17. The manufacturer-specific profile server 16 stores a product management table 21 and a profile management table 22. The manufacturer-specific profile server 16 is managed, for example, by the manufacturer of the terminal device 12. The product management table 21 and the profile management table 22 are created, for example, by a manufacturer that manages the corresponding manufacturer-specific profile server 16 and updated as necessary.

  The product management table 21 is a table showing a correspondence relationship between a MAC address, a product name (product type), and information indicating whether the product is a PC (hereinafter referred to as control target information). For example, the product management table 21 shown in FIG. 4 is associated with the first 32 bits of the MAC address (“MAC ADRESS” in the figure) and the product name (“PRODUCT” in the figure) and control target information (in the figure). Including, but not limited to, “PC or NOT”). In FIG. 4, the product corresponding to the MAC address “12-A4-8F-16” is a television “TV”, not a PC (control target information is “NOT”). The product corresponding to the MAC address “12-A4-8F-17” is a laptop “LAP TOP”, which is a PC (control target information is “PC”). The product corresponding to the MAC address “12-A4-8F-18” is the sensor “SENSOR”, not the PC (the control target information is “NOT”).

  The profile management table 22 is a table showing a correspondence relationship between product names and access control profiles (setting information) corresponding to the products. For example, the profile management table 22 shown in FIG. 5 is associated with a product name (“PRODUCT” in the figure), a port number (“PORT” in the figure) and a protocol (“PROTOCOL” in the figure). ”), Setting information having a communication destination address (“ URL / IP ”in the figure), and an input / output type (“ I / O ”in the figure), but is not limited thereto. The setting information corresponding to the television (“TV”) shown in FIG. 5 is, for example, the port number “20”, the protocol is “FTP”, and the input (“IN”) from the address “URL001” to the product is permitted. It is a setting to be done. In addition, for port number “80”, the protocol is “HTTP”, and output from product to address “URL002” (“OUT”) and input from address “URL003” to product (“IN”) are permitted. This is a setting. In addition, since the setting information corresponding to the laptop (“LAP TOP”) does not perform access control (stops) for the terminal device 12 that is a PC, as will be described later, The profile management table 22 may not be included. Further, the setting information corresponding to the sensor (“SENSOR”) is the same as the setting information corresponding to the television, and the description thereof is omitted.

  Next, the configuration of the access control device 13 will be described. As illustrated in FIG. 1, the access control device 13 includes a data analysis unit 23, a terminal device determination unit 24, a policy generation unit 25, a table control unit 26, a storage unit 27, an access control unit 28, and a control. Unit 29.

  The data analysis unit 23 has a packet analysis function 30 and a frame analysis function 31.

  With the packet analysis function 30, the data analysis unit 23 analyzes the contents of the IP packet of the data that has reached the access control device 13.

  Further, the data analysis unit 23 extracts the MAC address of the transmission destination and / or the transmission source from the header part of the MAC frame of the data that has reached the access control device 13 by the frame analysis function 31.

  The terminal device determination unit 24 determines whether or not the terminal device 12 connected to the LAN 18 is new. Specifically, the terminal device determination unit 24 acquires the source MAC address extracted by the data analysis unit 23 from the data reached from the LAN 18 side. The terminal device determination unit 24 checks the acquired MAC address against a terminal device management table 37 described later. If the MAC address does not exist in the terminal device management table 37, the terminal device determination unit 24 determines that the terminal device 12 is new. On the other hand, when the MAC address exists in the terminal device management table 37, the terminal device determination unit 24 determines that the terminal device 12 is existing (not new). Hereinafter, the terminal device 12 whose MAC address does not exist in the terminal device management table 37 is referred to as a new terminal device 12, and the terminal device 12 that exists in the terminal device management table 37 is referred to as an existing terminal device 12.

  In addition, the terminal device determination unit 24 has the transmission destination or transmission source MAC address acquired from the data analysis unit 23 in the terminal device management table 37 for the data that has reached the access control device 13 during the access control. It is determined whether or not. If neither the transmission destination nor the transmission source MAC address exists in the terminal device management table 37, the terminal device determination unit 24 discards the data.

  The policy generation unit 25 includes an external network connection function 32, a manufacturer specifying function 33, a policy acquisition destination specifying function 34, a terminal device specifying function 35, and a policy editing function 36.

  With the external network connection function 32, the policy generation unit 25 connects to the external network 17 via the path control device 11.

  With the manufacturer specifying function 33, the policy generation unit 25 acquires the manufacturer name corresponding to the MAC address extracted by the data analysis unit 23. Specifically, the policy generation unit 25 accesses the MAC address management server 14, compares the MAC address with the MAC address management table 19, and extracts a manufacturer name corresponding to the MAC address.

  By the policy acquisition destination specifying function 34, the policy generation unit 25 acquires the URL of the manufacturer-specific profile server 16 corresponding to the acquired manufacturer name. Specifically, the policy generation unit 25 accesses the manufacturer URL management server 15, compares the manufacturer name with the manufacturer URL management table 20, and extracts the URL of the manufacturer-specific profile server 16 corresponding to the manufacturer name.

  By the terminal device specifying function 35, the policy generation unit 25 acquires the product name and control target information of the terminal device 12 corresponding to the MAC address extracted by the data analysis unit 23. Specifically, the policy generating unit 25 accesses the manufacturer-specific profile server 16 using the extracted URL, and compares the MAC address with the product management table 21 to extract the product name and the control target information.

  With the policy editing function 36, the policy generation unit 25 acquires access control setting information corresponding to the acquired product name. Specifically, when the policy generation unit 25 indicates that the acquired control target information is not a PC, the policy generation unit 25 compares the identified product name with the profile management table 22 of the manufacturer-specific profile server 16 to correspond to the product name. Get access control setting information. On the other hand, the policy generating unit 25 may stop acquiring the setting information when the acquired control target information indicates a PC.

  The table control unit 26 browses and edits various tables stored in the storage unit 27. For example, the table control unit 26 adds various information acquired by the policy generation unit 25 to a terminal device management table 37 and a policy table 38 to be described later. Details of the operation in which the table control unit 26 edits various tables will be described later.

  The storage unit 27 is, for example, a memory device, and stores various information necessary for the operation of the access control device 13. For example, the storage unit 27 stores in advance the URL of the MAC address management server 14 and the URL of the manufacturer URL management server 15. In addition, the storage unit 27 stores a terminal device management table 37, a policy table 38, and a browser table 39.

  Here, various tables stored in the storage unit 27 will be described in detail together with the operation of the table control unit 26.

  First, the terminal device management table 37 will be described. The terminal device management table 37 is a table showing a correspondence relationship between the terminal device 12 connected to the LAN 18, the MAC address, the control target information, and the time stamp. The time stamp is information indicating the latest time when data having the corresponding terminal device 12 as a transmission destination or transmission source reaches the access control device 13. For example, the terminal device management table 37 shown in FIG. 6 is associated with the serial number of the terminal device 12 (“DEVICE No” in the figure), the MAC address (“MAC ADRESS” in the figure), and the control target information (see FIG. 6). "PC or NOT") and a time stamp ("DATE" in the figure), but are not limited to this. In FIG. 6, the MAC address corresponding to the serial number “001” of the terminal device 12 is “A8-C1-3A-B2-21-F9”, and the terminal device 12 is a PC (the control target information is “PC”). ) The time stamp is March 3, 2014 (“14/03/03”). The same applies to the serial numbers of the other terminal devices 12, and a description thereof will be omitted.

  When the terminal device 12 determined by the terminal device determination unit 24 is new, the table control unit 26 adds the serial number of the terminal device 12 to the terminal device management table 37. The table control unit 26 adds the MAC address extracted by the data analysis unit 23 and the control target information acquired by the policy generation unit 25 to the terminal device management table 37 in association with the serial number. The table control unit 26 updates the time stamp corresponding to the MAC address of the existing terminal device 12 when data having the existing terminal device 12 as a transmission destination or transmission source reaches the access control device 13.

  Next, the policy table 38 will be described. The policy table 38 is a table showing the correspondence between the terminal device 12 connected to the LAN 18 and the access control setting information. For example, the policy table 38 shown in FIG. 7 is associated with the serial number of the terminal device 12 (“DEVICE No” in the figure), the port number (“PORT” in the figure) permitted to communicate, and the protocol (in the figure). "PROTOCOL"), communication destination address ("URL / IP" in the figure), and setting information having an input / output type ("I / O" in the figure), but is not limited thereto. 7, the terminal device 12 corresponding to the serial number “001” of the terminal device 12 is a PC as shown in the terminal device management table 37 of FIG. As will be described later, since the access control device 13 of the present embodiment does not perform access control (stops) for the PC, the policy table 38 may not include access control setting information corresponding to the serial number “001”. Good.

  When the terminal device 12 determined by the terminal device determination unit 24 is new, the table control unit 26 adds the serial number of the terminal device 12 to the policy table 38. The table control unit 26 adds the access control setting information acquired by the policy generation unit 25 to the policy table 38 in association with the serial number of the terminal device 12.

  Next, the browser table 39 will be described. The browser table 39 includes information indicating a web browser that can be included in USER-AGENT in an HTTP packet, for example. For example, the browser table 39 shown in FIG. 8 includes web browsers “BROWSER001” to “BROUSER003”.

  The access control unit 28 illustrated in FIG. 1 includes a protocol determination function 40, a browser determination function 41, and a filtering function 42. These functions operate during execution of access control of the terminal device 12.

  With the protocol determination function 40, the access control unit 28 determines the protocol of the data that has reached the access control device 13.

  With the browser determination function 41, the access control unit 28 determines whether the data that has reached the access control device 13 has been transmitted by the terminal device 12 via the browser. Specifically, the access control unit 28 extracts browser information from the USER-AGENT of the HTTP packet that reaches the access control device 13 and the transmission source is the terminal device 12, and compares the browser information with the browser table 39. . If the extracted browser information exists in the browser table 39, the access control unit 28 determines that the data has been transmitted by the terminal device 12 via the browser. On the other hand, when the extracted browser information does not exist in the browser table 39, the access control unit 28 determines that the data is not transmitted by the terminal device 12 via the browser.

  With the filtering function 42, the access control unit 28 executes access control of the terminal device 12 based on access control setting information corresponding to the terminal device 12 connected in the LAN 18. Specifically, the access control unit 28 checks the MAC address acquired from the data analysis unit 23 against the terminal device management table 37, and based on the control target information, determines whether the terminal device 12 corresponding to the MAC address is a PC. Determine whether or not. When the terminal device 12 is not a PC, the access control unit 28 further determines whether data is transmitted by the terminal device 12. The access control unit 28 then sets the terminal device 12 based on the setting information in the policy table 38 except when the terminal device 12 is a PC and when the data is transmitted by the terminal device 12 via a browser. Execute access control. On the other hand, when the terminal device 12 is a PC, or when data is transmitted from the terminal device 12 via a browser, the access control unit 28 stops access control of the terminal device 12 based on the setting information, and stores the data. Let it pass.

  The control unit 29 is, for example, a processor, and controls the overall operation of each component of the access control device 13. For example, the control unit 29 controls the policy generation unit 25 and the table control unit 26 to update the terminal device management table 37 and the policy table 38 periodically, for example.

  Specifically, the control unit 29 controls the table control unit 26 to identify the terminal device 12 that has not transmitted or received data from the terminal device management table 37 for a predetermined period or longer based on the time stamp. The control unit 29 controls the table control unit 26 to delete information corresponding to the identified terminal device 12 from the terminal device management table 37 and the policy table 38.

  Specifically, the control unit 29 controls the table control unit 26 to extract the MAC address of the terminal device 12 that is not a PC from the terminal device management table 37 based on the control target information. The control unit 29 controls the policy generation unit 25 and the table control unit 26 to set the setting information in the policy table 38 and the setting in the profile management table 22 on the manufacturer-specific profile server 16 corresponding to the extracted MAC address. Match information. When there is a difference between the two pieces of setting information, the control unit 29 controls the policy generation unit 25 and the table control unit 26 to acquire the setting information in the profile management table 22, and uses the acquired setting information as a policy. Update or replace the setting information in the table 38.

  Next, the operation of the access control device 13 according to this embodiment will be described. The operation of the access control device 13 is roughly divided into three. The first operation is an operation of acquiring and storing access control setting information of the terminal device 12 when the new terminal device 12 is connected to the LAN 18. The second operation is an operation for executing access control of the existing (not new) terminal device 12 connected to the LAN 18 based on the stored setting information and the like. The third operation is an operation for deleting and updating the stored setting information and the like.

  First, the first operation of the access control device 13 will be described with reference to FIGS. 9 to 14. FIG. 9 is a flowchart for explaining the first operation of the access control device 13. When the data arrives from the LAN 18 side, the access control device 13 executes the first operation.

  First, the data analysis unit 23 acquires the MAC address of the transmission source of the data that arrived from the LAN 18 side (step S100).

  Next, the terminal device determination unit 24 compares the MAC address acquired in step S100 with the terminal management table to determine whether or not the terminal device 12 corresponding to the MAC address is new (step S101). When the terminal device 12 is not new (step S101-No), the first operation is terminated.

  On the other hand, if the terminal device 12 is new (step S101—Yes), the table control unit 26 adds the serial number of the terminal device 12 to the terminal device management table 37, and associates the MAC address with the serial number (step S102). .

  Then, the address control device performs a policy generation process to be described later (step S103) and ends the first operation. Information corresponding to the terminal device 12 is added to the terminal device management table 37 and the policy table 38 by the policy generation process.

  FIG. 10 is a flowchart for explaining policy generation processing executed by the access control device 13.

  First, the policy generation unit 25 acquires a manufacturer name corresponding to the MAC address extracted by the data analysis unit 23 from the MAC address management server 14 (step S200).

  Subsequently, the policy generation unit 25 acquires the URL of the manufacturer-specific profile server 16 corresponding to the manufacturer name acquired in step S200 from the manufacturer URL management server 15 (step S201).

  Subsequently, the policy generation unit 25 acquires the product name and control target information of the terminal device 12 corresponding to the MAC address extracted by the data analysis unit 23 from the manufacturer-specific profile server 16 (step S202).

  Subsequently, the policy generation unit 25 determines whether or not the terminal device 12 is a PC based on the control target information acquired in step S202 (step S203). When it determines with the terminal device 12 being PC (step S203-Yes), it progresses to step S206.

  On the other hand, if it is determined in step S203 that the terminal device 12 is not a PC (No in step S203), the policy generation unit 25 acquires the access control setting information corresponding to the MAC address from the manufacturer-specific profile server 16 ( Step S204).

  Next, the table control unit 26 adds the control target information acquired in step S202 to the terminal device management table 37, and adds the setting information acquired in step S204 to the policy table 38 (step S205).

  After step S205 and when it is determined in step S203 that the terminal device 12 is a PC (step S203—Yes), the table control unit 26 adds the control target information acquired in step S202 to the terminal device management table 37. (Step S206).

  FIG. 11 is a sequence diagram illustrating the operation of the communication system 10 while the access control device 13 performs policy generation processing.

  First, when the access control device 13 acquires the manufacturer name corresponding to the MAC address of the terminal device 12, the access control device 13 transmits the MAC address to the MAC address management server 14, and the manufacturer corresponding to the MAC address from the server. A name is acquired (step S300).

  Subsequently, when the access control apparatus 13 acquires the URL of the manufacturer-specific profile server 16 corresponding to the manufacturer name acquired in step S300, the access control apparatus 13 transmits the manufacturer name to the manufacturer URL management server 15, and the server The URL corresponding to the manufacturer name is acquired from (step S301).

  Subsequently, when the access control device 13 acquires the product name and control target information corresponding to the MAC address, the access control device 13 transmits the MAC address to the manufacturer-specific profile server 16, and the product name and control target are transmitted from the server. Information is acquired (step S302).

  When the access control device 13 acquires the access control setting information corresponding to the MAC address, the access control device 13 acquires the setting information corresponding to the MAC address transmitted in step S300 from the manufacturer-specific profile server 16. (Step S303).

  Next, the second operation of the access control device 13 will be described with reference to FIG. FIG. 12 is a flowchart for explaining the second operation of the access control device 13. Hereinafter, the terminal device 12 connected to the LAN 18 will be described as all existing terminal devices 12.

  First, the access control device 13 waits for data arrival (step S400). When data does not arrive (step S400-No), it returns to step S400.

  On the other hand, when the data arrives (step S400-Yes), the data analysis unit 23 extracts the data transmission destination and / or the transmission source MAC address. The terminal device determination unit 24 determines whether or not the transmission destination or transmission source MAC address exists in the terminal device management table 37 (step S401).

  In step S401, if neither the destination MAC address nor the source MAC address exists in the terminal device management table 37 (step S401-No), the terminal device determination unit 24 discards the data (step S402) and step S400. Return to.

  On the other hand, when the MAC address of the transmission destination or the transmission source exists in the terminal device management table 37 in step S401 (step S401-Yes), the table control unit 26 corresponds to the MAC address in the terminal device management table 37. The time stamp is updated (step S403).

  Next, the access control unit 28 checks the MAC address against the terminal device management table 37, and determines whether the terminal device 12 corresponding to the MAC address is a PC based on the control target information (step S404). .

  In step S404, when the terminal device 12 is a PC (step S404-Yes), the access control unit 28 stops the access control based on the setting information in the policy table 38 and passes the data (step S405). The process returns to step S400.

  On the other hand, when the terminal device 12 is not a PC in step S404 (step S404-No), the access control unit 28 determines whether data is transmitted by the terminal device 12 (step S406). When data is not transmitted by the terminal device 12 (step S406—No), the process proceeds to step S409.

  On the other hand, when data is transmitted by the terminal device 12 in step S406 (step S406-Yes), the access control unit 28 determines whether the protocol of the data is HTTP (step S407). When the protocol is not HTTP (step S407-No), the process proceeds to step S409.

  On the other hand, when the protocol is HTTP in Step S407 (Step S407-Yes), the access control unit 28 determines whether data is transmitted through the browser (Step S408). When the data is transmitted via the browser (step S408-Yes), the access control unit 28 stops the access control based on the setting information in the policy table 38, passes the data (step S405), and step S400. Return to.

  On the other hand, if the data is not transmitted via the browser in step S408 (step S408-No), if the data is not transmitted by the terminal device 12 in step S406 (step S406-No), and the protocol is used in step S407. Is not HTTP (step S407-No), the access control unit 28 performs access control (filtering) of the terminal device 12 based on the access control setting information of the terminal device 12 corresponding to the MAC address (step S409). ), The process returns to step S400.

  Next, the third operation of the access control device 13 will be described with reference to FIGS. 13 and 14. FIG. 13 is a flowchart for explaining the operation of deleting the stored setting information and the like among the third operations of the access control apparatus 13. The access control device 13 executes this operation periodically, for example.

  First, the control unit 29 controls the table control unit 26 to identify the terminal device 12 that has not transmitted / received data for a predetermined period or longer from the terminal device management table 37 based on the time stamp (step S500).

  Subsequently, the control unit 29 controls the table control unit 26 to delete information corresponding to the terminal device 12 identified in step S500 from the terminal device management table 37 (step S501).

  And the control part 29 controls the table control part 26, and deletes the information corresponding to the terminal device 12 identified in step S500 from the policy table 38 (step S502).

  FIG. 14 is a flowchart for explaining the operation of updating the stored setting information and the like in the third operation of the access control device 13. The access control device 13 executes this operation periodically, for example.

  First, the control unit 29 controls the table control unit 26 to extract the MAC address of the terminal device 12 that is not a PC from the terminal device management table 37 based on the control target information (step S600).

  Subsequently, the control unit 29 controls the policy generation unit 25 to acquire the manufacturer name corresponding to the MAC address extracted in step S600 from the MAC address management server 14 (step S601).

  Subsequently, the control unit 29 controls the policy generation unit 25 to acquire the URL of the manufacturer-specific profile server 16 corresponding to the manufacturer name acquired in step S601 from the manufacturer URL management server 15 (step S602).

  Subsequently, the control unit 29 collates the setting information on the manufacturer-specific profile server 16 corresponding to the MAC address extracted in Step S600 with the setting information on the access control device 13 (Step S603).

  Subsequently, the control unit 29 determines whether or not there is a difference between the two setting information verified in step S603 (step S604). When there is no difference (step S604-No), this operation is terminated.

  On the other hand, if there is a difference in step S604 (step S604-Yes), the control unit 29 controls the policy generation unit 25 to acquire setting information corresponding to the MAC address from the manufacturer-specific profile server 16 (step S605). ).

  Then, the control unit 29 controls the table control unit 26 to update or replace the setting information in the policy table 38 with the setting information acquired in step S605 (step S606).

  Next, with reference to FIG. 15, description will be given of how the manufacturer of the terminal device 12 generates the product management table 21 and the profile management table 22.

  First, the manufacturer generates access control setting information of the terminal device 12 based on the design information of the terminal device 12 (step S700). The design information is, for example, specification information of the terminal device 12 and includes a port number for communication, a protocol, a communication destination address, a communication destination address, and an input / output type, but is not limited thereto.

  Subsequently, the manufacturer adds the setting information generated in step S700 to the profile management table 22 in association with the product name of the terminal device 12 (step S701).

  Then, the manufacturer adds the product name and control target information of the terminal device 12 to the product management table 21 in association with the first 32 bits of the MAC address (step S702).

  As described above, in the access control device 13 according to the present embodiment, the data analysis unit 23 acquires the identifier (MAC address) of the terminal device 12 connected to the LAN 18. The policy generation unit 25 acquires access control setting information corresponding to the terminal device 12 based on the identifier. And the access control part 28 performs access control of the terminal device 12 based on the acquired setting information. Thus, according to the access control device 13, access control can be performed simply by connecting various terminal devices 12 to the LAN 18. In addition, since the terminal device 12 is automatically connected from the LAN 18 to the execution of access control, a secure network environment can be realized without the user having specialized knowledge. Further, since the complexity of work is reduced as compared with the manual setting, the operation cost can be reduced.

  The data transmitted from the terminal device 12 via the browser has a high probability of being transmitted in response to a user input for operating the browser, and is highly likely to be data transmitted by the user's intention. According to the access control device 13 according to the present embodiment, since access control based on setting information is stopped for such data, filtering (data discard) contrary to the user's intention can be prevented.

  In addition, the terminal device 12 which is a PC, for example, has a high probability that individual security measures such as introduction of a security application are taken. Thus, depending on the type and nature of the terminal device 12, there may be a case where the terminal device 12 does not operate normally due to competition between individual security measures and access control by the access control device 13. According to the access control device 13 according to the present embodiment, when the terminal device 12 is not subject to access control (for example, when the terminal device 12 is a PC), the access control based on the setting information is stopped. Conflicts with measures can be avoided.

  Although the present invention has been described based on the drawings and examples, it should be noted that those skilled in the art can easily make various modifications and corrections based on the present disclosure. Therefore, it should be noted that these variations and modifications are included in the scope of the present invention. For example, the functions included in each component, each step, etc. can be rearranged so that there is no logical contradiction, and multiple components, steps, etc. can be combined or divided into one It is.

  Moreover, in the above-mentioned embodiment, the structure which acquires the information which the access control apparatus 13 previously memorize | stored, for example, the browser table 39 from an external server etc. may be sufficient. In such a case, the control unit 29 may periodically acquire and update the browser table 39 from an external server, for example. Further, the access control device 13 may store information that the access control device 13 acquires from an external server, for example, the manufacturer URL management table 20 in advance.

  In the above-described embodiment, the control target information has been described as information indicating whether or not the terminal device 12 is a PC. However, the manufacturer arbitrarily determines whether or not the terminal device 12 is an access control target. It may be information. In other words, in the above-described embodiment, the terminal device 12 that is not a PC is set as an access control target. For example, a terminal device 12 that does not have a security application installed or a terminal device 12 having a specification that is less than a predetermined standard is accessed. You may decide on the object of control. Alternatively, the control target information may be automatically determined based on whether or not the security application of the corresponding terminal device is installed or whether the specification has a specification equal to or lower than a predetermined standard.

  Moreover, in order to function as the access control apparatus 13 according to the above-described embodiment, an information processing apparatus having a communication function such as a computer can be suitably used. Such an information processing device stores a program describing processing contents for realizing each function of the access control device 13 according to the embodiment in a storage unit of the information processing device, and the program of the information processing device by the CPU of the information processing device. This can be realized by reading and executing.

DESCRIPTION OF SYMBOLS 10 Communication system 11 Path control device 12 Terminal device 13 Access control device 14 MAC address management server 15 Manufacturer URL management server 16 Manufacturer-specific profile server 17 External network 18 LAN
19 MAC Address Management Table 20 Manufacturer URL Management Table 21 Product Management Table 22 Profile Management Table 23 Data Analysis Unit 24 Terminal Device Determination Unit 25 Policy Generation Unit 26 Table Control Unit 27 Storage Unit 28 Access Control Unit 29 Control Unit 30 Packet Analysis Function 31 Frame analysis function 32 External network connection function 33 Manufacturer specific function 34 Policy acquisition destination specific function 35 Terminal device specific function 36 Policy editing function 37 Terminal device management table 38 Policy table 39 Browser table 40 Protocol determination function 41 Browser determination function 42 Filtering function

Claims (5)

A data analysis unit for obtaining an identifier of the terminal device connected to the LAN from the terminal device;
Based on the identifier, a policy generation unit that acquires access control setting information corresponding to the terminal device from an external network;
An access control unit that executes access control of the terminal device based on the setting information;
Equipped with a,
Said access control unit, if the data arriving to the access control device is transmitted through the browser by the terminal device, that stops access control of the terminal device based on the setting information, the access control device. The access control device according to claim 1 ,
The policy generation unit acquires information indicating whether or not the terminal device is an access control target based on the identifier,
The access control unit is an access control device that stops access control of the terminal device based on setting information when the terminal device is not subject to access control. An access control method using an access control device that executes access control of a terminal device connected to a LAN,
Obtaining an identifier of a terminal device connected to the LAN from the terminal device;
Obtaining access control setting information corresponding to the terminal device from an external network based on the identifier;
Executing access control of the terminal device based on the setting information;
Only including,
In the step of executing access control , an access control method of stopping access control of the terminal device based on setting information when data reaching the access control device is transmitted by the terminal device via a browser . The access control method according to claim 3 ,
Further comprising obtaining information indicating whether the terminal device is subject to access control based on the identifier;
In the step of executing access control, when the terminal device is not subject to access control, the access control method of stopping the access control of the terminal device based on setting information. Information processing device with communication function
Obtaining an identifier of a terminal device connected to the LAN from the terminal device;
Obtaining access control setting information corresponding to the terminal device from an external network based on the identifier;
Executing access control of the terminal device based on the setting information;
Was executed,
In the step of performing access control, if the data arriving to the access control device is transmitted through the browser by the terminal device, a program to Suspend access control of the terminal device based on the setting information.

Images