Master device, communication control method, communication control program, and communication control system

Abstract

To make it possible to reduce the workload associated with setting up encrypted communication.SOLUTION: A master device 10 classifies a plurality of terminals 30 connected to a network into a plurality of groups. The master device 10 accepts designation as to whether or not to permit communication between the groups into which the plurality of terminals 30 are classified, and sets a policy. The master device 10 additionally sets whether or not to encrypt the communication between the groups in the policy. The master device 10 transmits the policy to each edge device 20, and causes the edge device to control communication in accordance with the policy.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a technique for controlling communication between terminals. [Background technology]

[0002] The network security device controls the communication of the terminals connected to the network security device. This control is based on the IP address (Internet Protocol) of the terminal that is the source of the data. This is achieved by setting in advance whether or not communication will be permitted for a combination of a Personal Identification Protocol (PII) address and the IP address of the terminal to which the data is to be sent.

[0003] In recent years, the risk of cyber attacks has increased. Therefore, encryption of communications has become essential to prevent the leakage and tampering of important information of companies and other entities.

[0004] Patent Document 1 describes defining a plurality of groups within a network and controlling communication between the groups using group identifiers. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 11-112559 Summary of the Invention [Problem to be solved by the invention]

[0006] The task of setting whether or not to permit communication for each combination of IP addresses is cumbersome and time-consuming. Patent Document 1 describes controlling communication between groups, but does not describe how to set the control of communication between groups. Although the task of setting whether or not to permit communication for each combination of groups is not as time-consuming as the task of setting whether or not to permit communication for each combination of IP addresses, it is time-consuming.

[0007] The task of setting up encrypted communications for each combination of IP addresses is cumbersome and time-consuming, just like the task of setting whether or not to permit communications. In addition, setting up encrypted communications is difficult unless the user has a certain level of knowledge, and it can be time-consuming for knowledgeable users to perform the task for all combinations of IP addresses. In addition, it is difficult to install new encryption software on terminals in factories, including those in the manufacturing industry, because factory operations are prioritized and old operating systems are used, etc. Therefore, it may not be possible to set up encrypted communication on each terminal. The present disclosure aims to reduce the workload associated with setting up encrypted communications. [Means for solving the problem]

[0008] The master device according to the present disclosure comprises: a terminal classification unit that classifies a plurality of terminals connected to the network into a plurality of groups; an encryption setting unit that receives a designation as to whether or not to encrypt communication between groups into which the plurality of terminals are classified by the terminal classification unit and sets a policy; Equipped with. Effect of the Invention

[0009] In the present disclosure, a policy is set by accepting a designation as to whether or not to encrypt communications between groups into which terminals are classified, thereby making it possible to reduce the workload associated with setting up encrypted communications. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a configuration diagram of a communication control system 1 according to a first embodiment. [Diagram 2] FIG. 2 is a configuration diagram of a master device 10 according to the first embodiment. [Diagram 3] FIG. 2 is a configuration diagram of an edge device 20 according to the first embodiment. [Figure 4]3 is a flowchart showing the overall operation of the communication control system 1 according to the first embodiment. [Diagram 5] FIG. 4 is an explanatory diagram of an address 41 and terminal information 42 according to the first embodiment. [Figure 6] FIG. 4 is an explanatory diagram of a policy 45 according to the first embodiment. [Figure 7] 5 is a flowchart of a classification process (step S12 in FIG. 4) according to the first embodiment. [Figure 8] FIG. 8 is an explanatory diagram of an address reception process (step S21 in FIG. 7) according to the first embodiment. [Figure 9] FIG. 8 is an explanatory diagram of a terminal extraction process (step S22 in FIG. 7) according to the first embodiment. [Figure 10] FIG. 8 is an explanatory diagram of the list display process (step S23 in FIG. 7) according to the first embodiment. [Figure 11] 5 is a flowchart of a policy setting process (step S13 in FIG. 4) according to the first embodiment. [Figure 12] FIG. 12 is an explanatory diagram of the list display process (step S31 in FIG. 11) according to the first embodiment. [Figure 13] FIG. 12 is an explanatory diagram of a policy setting process (step S32 in FIG. 11) according to the first embodiment. [Figure 14] 4 is a flowchart of a communication control process according to the first embodiment. [Figure 15] FIG. 3 is an explanatory diagram of encryption processing according to the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Embodiment 1 ***Configuration Description*** The configuration of a communication control system 1 according to the first embodiment will be described with reference to FIG. The communication control system 1 includes a master device 10 and a plurality of edge devices 20. The master device 10 and each edge device 20 are connected via a network device 90. The master device 10 is a computer installed in a management center or the like, and is used to manage the communication control system 1. Each edge device 20 is a computer installed at a site such as a factory or an office, and is connected to one or more terminals 30. The terminals 30 are devices installed in a factory or the like, and control manufacturing equipment and the like. Examples of the terminals 30 include IT (Information There are a plurality of types of terminals 30, such as a terminal 30 of the Operational Technology (OT) type and a terminal 30 of the Operational Technology (OT) type.

[0012] The configuration of the master device 10 according to the first embodiment will be described with reference to FIG. The master device 10 includes the following hardware components: a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to other hardware components via signal lines and controls these other hardware components.

[0013] The master device 10 comprises, as functional components, an address receiving unit 111, a terminal extracting unit 112, a terminal classifying unit 113, a policy setting unit 114, an encryption setting unit 115, and a setting transmitting unit 116. The functions of the functional components of the master device 10 are realized by software. The storage 13 stores a program that realizes the function of each functional component of the master device 10. The program is loaded into the memory 12 by the processor 11 and executed by the processor 11. In this way, the function of each functional component of the master device 10 is realized.

[0014] The configuration of the edge device 20 according to the first embodiment will be described with reference to FIG. The edge device 20 includes the following hardware components: a processor 21, a memory 22, a storage 23, and a communication interface 24. The processor 21 is connected to other hardware components via signal lines and controls the other hardware components.

[0015] Edge device 20 includes, as functional components, an address acquisition unit 211, an address transmission unit 212, a setting reception unit 213, a communication control unit 214, and a log acquisition unit 215. The functions of each functional component of edge device 20 are realized by software. Communication control unit 214 includes an availability determination unit 216, an encryption determination unit 217, an encryption unit 218, and a transmission unit 219. The storage 23 stores a program for implementing the functions of each functional component of the edge device 20. The program is loaded into the memory 22 by the processor 21 and executed by the processor 21. In this way, the function of each functional component of the edge device 20 is implemented.

[0016] The processors 11 and 21 are integrated circuits (ICs) that perform processing. Processing Unit), DSP (Digital Signal Processor), and GPU (Graphics Processing Unit).

[0017] The memories 12 and 22 are storage devices that temporarily store data. Specific examples of the memories 12 and 22 include SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory).

[0018] The storages 13 and 23 are storage devices that store data. A specific example of the storages 13 and 23 is a hard disk drive (HDD). The storages 13 and 23 may also be portable recording media such as a Secure Digital (SD, registered trademark) memory card, a CompactFlash (CF, registered trademark), a NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a digital versatile disk (DVD).

[0019] The communication interfaces 14 and 24 are interfaces for communicating with external devices, and are, for example, ports for Ethernet (registered trademark), Universal Serial Bus (USB), and High-Definition Multimedia Interface (HDMI, registered trademark).

[0020] ***Explanation of Operation*** The operation of the communication control system 1 according to the first embodiment will be described with reference to FIGS. An operation procedure of the communication control system 1 according to the embodiment 1 corresponds to a communication control method according to the embodiment 1. Moreover, a program for realizing the operation of the communication control system 1 according to the embodiment 1 corresponds to a communication control program according to the embodiment 1.

[0021] The overall operation of the communication control system 1 according to the first embodiment will be described with reference to FIG. (Step S11: Address acquisition process) The address acquisition unit 211 of each edge device 20 acquires the address 41 of the terminal 30 connected in the same network as the edge device 20. The same network refers to a network having the same network address. In this case, the address acquisition unit 211 may acquire the address 41 of the connected terminal 30 for each port. Here, the address acquisition unit 211 acquires an IP address and a MAC (Media Access Control) address as the address 41 of the terminal 30, as shown in FIG.

[0022] The address transmitting unit 212 of each edge device 20 transmits the address 41 with the terminal information 42 added thereto to the master device 10 . Here, the address transmission unit 212 adds a group name, a terminal name, an edge device name, and a remark as the terminal information 42, as shown in FIG. 5. The group name is an identification name of the group to which the terminal 30 belongs, and is set as "unclassified" here. The terminal name is a name for making it easier to identify the terminal 30, and a MAC address is set here. The edge device name is an identification name of the edge device 20 connected to the network to which the terminal 30 is connected, and the name of the edge device 20 equipped with the address transmission unit 212 is set here. The remark is information for making it easier to identify the terminal 30, and manufacturer information is set here. The manufacturer information is information capable of identifying a manufacturer, such as the name of a manufacturer identified from a company code of a MAC address.

[0023] (Step S12: Classification process) The address receiving unit 111 of the master device 10 receives the address 41 with the terminal information 42 added thereto, which was transmitted in step S11. There are cases where the address 41 of the same terminal 30 is transmitted from a plurality of edge devices 20. In this case, the address receiving unit 111 leaves only one address 41 of the same terminal 30 and deletes the rest so that there is no duplication. Then, the terminal extraction unit 112 of the master device 10 extracts, from the received addresses 41, terminals 30 indicated by addresses that do not exist in the group list 44 indicating the addresses 41 belonging to each group 43 as unclassified terminals 31. Then, the terminal classification unit 113 of the master device 10 displays information about the unclassified terminal 31 and allows the user to specify the group 43 to which the unclassified terminal 31 belongs. As a result, the unclassified terminal 31 is classified into one of the groups, and the group list 44 is updated.

[0024] (Step S13: Policy setting process) The policy setting unit 114 of the master device 10 sets a policy 45 for controlling communication between groups, as shown in Fig. 6. In this case, the policy setting unit 114 automatically permits communication between the same group, and sets the policy 45 by accepting a designation as to whether or not to permit communication between different groups. The policy setting unit 114 may also set the policy 45 by accepting a designation as to whether or not to permit communication between the same group. The policy setting unit 114 also sets the policy 45 by accepting a designation as to whether or not to acquire a log for communication between different groups. In addition, the encryption setting unit 115 of the master device 10 accepts a designation as to whether or not to encrypt communication between groups for which a policy that permits communication has been set, and adds a setting as to whether or not to encrypt communication to the policy. The setting transmission unit 116 of the master device 10 transmits the policy 45 to each of the edge devices 20 .

[0025] (Step S14: Communication control process) The setting receiver 213 of each edge device 20 receives the policy 45 transmitted in step S13. The communication controller 214 of each edge device 20 controls communication between the terminals 30 based on the policy 45. Furthermore, the log acquirer 215 acquires a communication log when the policy 45 specifies that a log should be acquired. When controlling communication between terminals 30 based on the policy 45, the communication control unit 214 encrypts the communication data before communication if encryption is set. Specifically, when encryption is set, the communication control unit 214 encrypts the communication data before communication between the edge device 20 to which the source terminal 30 is connected and the edge device 20 to which the destination terminal 30 is connected. In other words, when encryption is set, communication data is not encrypted between terminals 30, but is encrypted between the edge device 20 to which the source terminal 30 is connected and the edge device 20 to which the destination terminal 30 is connected.

[0026] When the communication control system 1 is introduced, the processes from step S11 to step S14 are executed in order. Thereafter, the process of step S14 continues to be executed, and communication between the terminals 30 is controlled. Also, while the process of step S14 is being executed, the process of step S11 is executed periodically. Then, the process of step S12 is executed every time the address 41 is transmitted in step S11, or at regular time intervals. The process of step S13 is executed as necessary.

[0027] The classification process (step S12 in FIG. 4) according to the first embodiment will be described with reference to FIG. (Step S21: Address reception process) The address receiving unit 111 receives the address 41 to which the terminal information 42 is added, which is transmitted from each edge device 20 in step S11. As shown in FIG. 8, the address 41 and the terminal information 42 collected by each edge device 20 are aggregated in the master device 10.

[0028] (Step S22: Terminal extraction process) The terminal extraction unit 112 extracts, from among the addresses 41 received in step S21, the terminal 30 indicated by the address 41 that does not exist in the group list 44 as an unclassified terminal 31. The group list 44 indicates the group 43 into which the terminals 30 connected to any one of the edge devices 20 out of the multiple edge devices 20 are classified, and indicates the group 43 for controlling communication. At this time, if there is an address 41 that has not been classified among the previously received addresses 41, the terminal extraction unit 112 also extracts the terminal 30 indicated by this address 41 as an unclassified terminal 31.

[0029] Here, it is assumed that the address 41 shown in Fig. 9(A) is received. Also, it is assumed that the group list 44 shown in Fig. 9(B) is stored in the storage 13. Then, an unclassified terminal 31 is extracted as shown in Fig. 9(C). That is, two terminals 30 that are not in the group list 44 or that have not been classified are extracted as unclassified terminals 31.

[0030] (Step S23: List display process) 10, the terminal classification unit 113 displays a list of information related to the unclassified terminal 31. Here, the information related to the unclassified terminal 31 is the address 41, and the terminal name, edge device name, and remarks from the terminal information 42. That is, the edge device name, which is the identification information of the edge device 20 that received the address 41 of the unclassified terminal 31, is displayed as the information related to the unclassified terminal 31. Also, manufacturer information indicating the manufacturer of the unclassified terminal 31 identified from the MAC address is displayed as the information related to the unclassified terminal 31. It is also possible to display only a part of the information, such as the address 41, the terminal name, the edge device name, and the remarks, in a list, and to display the remaining information when an operation such as placing the cursor on the information is performed.

[0031] (Step S24: Terminal classification process) The terminal classification unit 113 allows the user to specify the group 43 to which the unclassified terminal 31 belongs. The user is, for example, an administrator of the communication control system 1. Specifically, the user is caused to select a radio button in a designation field for the group 43 shown in FIG. 10 to specify the group 43 to which the unclassified terminal 31 belongs. Selection in the designation field is performed by the user. In other words, the terminal classification unit 113 displays the groups that can be designated and allows the user to selectively designate one. As a result, the terminal classification unit 113 updates the group list 44. At this time, the terminal classification unit 113 may accept not only the designation of the group 43, but also a change in at least one of the information of the terminal name of the unclassified terminal 31 and the remarks in which the related information related to the unclassified terminal 31 is registered. The terminal name and remarks of the unclassified terminal 31 are used to identify the unclassified terminal 31. By inputting appropriate information here, it becomes possible to easily carry out the task of reviewing the classification of the group 43 at a later date, for example.

[0032] The policy setting process (step S13 in FIG. 4) according to the first embodiment will be described with reference to FIG. (Step S31: List display process) As shown in FIG. 12, the policy setting unit 114 displays a list of policies 45 that have been set regarding communication between groups.

[0033] (Step S32: Policy setting process) The policy setting unit 114 accepts inputs such as addition, modification, and deletion of the policy 45 between groups. The addition, modification, and deletion of the policy 45 are input by the user. Specifically, when the Add button or Change button in FIG. 12 is pressed, the policy setting unit 114 displays an input screen for adding the policy 45. As shown in FIG. 13, this input screen allows the user to specify the group from which the data is sent and the group to which the data is sent, the communication protocol, the port number of the destination, whether to permit communication, and whether to obtain a log. Whether to permit communication is specified by selecting Permit or Deny in the Action column. Also, this input screen allows the user to specify whether to enable the policy 45. When the Add button in Fig. 12 is pressed, the input screen shown in Fig. 13 is displayed with default values ​​displayed. When the Change button in Fig. 12 is pressed, the input screen shown in Fig. 13 is displayed with the settings of policy 45 before the change displayed. The policy setting unit 114 sets the policy 45 according to the information entered on the input screen. Since the input screen allows the specification of a communication protocol, the policy 45 can be set by specifying whether or not communication between groups is permitted according to the communication protocol. The communication protocol is TCP (Transmission Control Protocol). Protocol), UDP (User Datagram Protocol), etc. Furthermore, when a communication protocol is specified on the input screen, it is possible to specify whether or not to permit communication on a port-by-port basis, so that for communication between groups, policy 45 can be set by specifying whether or not to permit communication according to the port. Furthermore, since it is possible to specify whether or not to obtain logs on the input screen, it is possible to set policy 45 by accepting a specification of whether or not to obtain logs of communication between groups, separate from communication control.

[0034] On the screen shown in Fig. 13, it is possible to specify whether or not to encrypt. The encryption setting unit 115 accepts the specification of whether or not to encrypt. Then, a setting of whether or not to encrypt communication is added to the policy 45. As a result, whether or not to encrypt is set for the policy 45 between groups. When a communication protocol is set by the policy setting unit 114, whether or not to encrypt communication is set according to the communication protocol. Also, when a port is specified by the policy setting unit 114, whether or not to encrypt communication is set according to the port. Note that whether or not to encrypt may be set when it is set to permit communication. In this case, the encryption setting unit 115 receives a designation of whether or not to encrypt when the policy setting unit 114 sets to permit communication. Here, the encryption setting unit 115 only accepts a designation of whether or not to encrypt. However, the encryption setting unit 115 may also accept a designation of encryption strength in addition to whether or not to encrypt, and add this to the policy 45. The encryption strength is, for example, an encryption method and the number of bits of an encryption key.

[0035] The policy setting unit 114 may read setting data set for the policy 45 and set the policy 45. After reading the setting data and setting the policy 45, the policy setting unit 114 may accept an input for adding, changing, deleting, or the like the policy 45.

[0036] (Step S33: Policy transmission process) The setting transmission unit 116 transmits the policy 45 set in step S32 to each edge device 20.

[0037] The communication control process (step S14 in FIG. 4) according to the first embodiment will be described with reference to Fig. 14. The process shown in Fig. 14 is executed in each edge device 20. (Step S41: Policy reception process) The setting reception unit 213 receives the policy 45 transmitted in step S13. The setting reception unit 213 writes the received policy 45 into the storage 13.

[0038] (Step S42: Message reception process) The communication control unit 214 receives the communication message. The communication message includes the IP address of the source terminal 30, the IP address of the destination terminal 30, protocol information that can identify the communication protocol, and communication data. When the communication message is received, the process of step S43 and the process of step S47 are executed in parallel.

[0039] (Step S43: Communication Possibility Determination Process) The possibility determination section 216 of the communication control section 214 determines whether communication is possible based on the IP address of the source terminal 30, the IP address of the destination terminal 30, and the protocol information for the communication message received in step S42. Specifically, the possibility determination unit 216 determines whether or not communication is permitted by the policy 45 stored in the storage 13 for a combination of a group indicated by the IP address of the source terminal 30, a group indicated by the IP address of the destination terminal 30, and a communication protocol indicated by the protocol information. If permitted, the possibility determination unit 216 advances the process to step S44. On the other hand, if not permitted, the possibility determination unit 216 skips the process from step S44 to step S46.

[0040] (Step S44: Encryption determination process) The encryption determination unit 217 of the communication control unit 214 determines whether or not encryption processing is required for the communication message received in step S42 based on the IP address of the source terminal 30, the IP address of the destination terminal 30, and protocol information. Specifically, the encryption determination unit 217 determines whether or not encryption is to be performed according to the policy 45 stored in the storage 13 for a combination of a group indicated by the IP address of the source terminal 30, a group indicated by the IP address of the destination terminal 30, and a communication protocol indicated by the protocol information. If encryption is to be performed, the encryption determination unit 217 advances the process to step S45. On the other hand, if encryption is not to be performed, the encryption determination unit 217 advances the process to step S46.

[0041] (Step S45: Encryption process) The encryption unit 218 of the communication control unit 214 performs encryption processing on the communication data that is included in the communication message received in step S42 and that the encryption determination unit 217 determines in step S44 as requiring encryption. Specifically, when the encryption unit 218 is the encryption unit 218 in the edge device 20 to which the source terminal 30 is connected, the encryption unit 218 encrypts the communication data. In other words, when the source terminal 30, which is a combination of groups requiring encryption, is the connected edge device 20, the encryption unit 218 in the edge device 20 encrypts the communication data. On the other hand, when the encryption unit 218 is the encryption unit 218 in the edge device 20 to which the destination terminal 30 is connected, the encryption unit 218 decrypts the communication data. In other words, when the destination terminal 30, which is a combination of groups requiring encryption, is the connected edge device 20, the encryption unit 218 in the edge device 20 decrypts the communication data. Here, the edge device 20 to which the source terminal 30 is connected means that the edge device 20 has the same network address as the source terminal 30. Similarly, the edge device 20 to which the destination terminal 30 is connected means that the edge device 20 has the same network address as the destination terminal 30.

[0042] Note that the encryption unit 218 omits encryption processing for the communication data when the encryption unit 218 is the encryption unit 218 in the edge device 20 to which both the source terminal 30 and the destination terminal 30 are connected. In other words, the encryption unit 218 does not encrypt or decrypt the communication data.

[0043] (Step S46: Transmission process) The transmitting section 219 of the communication control section 214 transmits the communication message to the destination terminal 30 .

[0044] (Step S47: Log determination process) The communication control unit 214 determines whether or not it is necessary to obtain a log of the communication message received in step S42 based on the IP address of the source terminal 30, the IP address of the destination terminal 30, and protocol information. Specifically, the communication control unit 214 determines whether or not log acquisition is set to yes in the policy 45 stored in the storage 13 for the combination of the group indicated by the IP address of the source terminal 30, the group indicated by the IP address of the destination terminal 30, and the communication protocol indicated by the protocol information. If yes is set, the communication control unit 214 proceeds to step S48. On the other hand, if no log acquisition is set to yes, the communication control unit 214 skips the process of step S48.

[0045] (Step S48: Log acquisition process) The communication control unit 214 writes in the storage 13 a log regarding the communication message received in step S42.

[0046] After the processes of steps S46 and S48, the process returns to step S42, and control of communication continues. If a new policy 45 is transmitted from the master device 10, the process returns to step S41, and after the policy 45 is received, control of communication continues.

[0047] The encryption process (step S45 in FIG. 14) will be described with reference to FIG 15. Here, it is assumed that the policy 45 shown in FIG 6 is set. Assume that the edge device 20 receives communication data in which the IP address of the source terminal 30 belongs to the IT group, the IP address of the destination terminal 30 belongs to the DMZ group, and the communication protocol is XXX. In this case, in step S43, the communication control unit 214 determines that the data matches policy 1, permits the communication, and advances the process to step S44. Also, since encryption is set in step S44, the communication control unit 214 advances the process to step S45. Here, it is assumed that the source terminal 30 is the terminal 30X and the destination terminal 30 is the terminal 30Y. In this case, the edge device 20V to which the terminal 30X is connected encrypts the communication data in step S45. Then, the edge device 20V transmits a communication message toward the terminal 30Y in step S46. The edge device 20W to which the terminal 30Y is connected decrypts the communication data in step S45. Then, the edge device 20W transmits the communication message toward the terminal 30Y in step S46. As a result, when communication is performed between the terminals 30X and 30Y, the communication data between the edge devices 20V and 20W is encrypted.

[0048] ***Advantages of the First Embodiment*** As described above, the communication control system 1 according to the first embodiment extracts the terminal 30 indicated by the address 41 not present in the group list 44 as an unclassified terminal 31, and causes the terminal to specify the group to which it belongs. Then, the terminal sets whether or not to encrypt communications between the groups into which it is classified. Since it sets whether or not to encrypt communications between groups, it is possible to reduce the workload associated with setting encrypted communications.

[0049] In addition, in the communication control system 1 according to the first embodiment, whether or not to permit communication between groups is set, and for groups set to permit communication, whether or not to encrypt the communication is set. This makes it possible to reduce the number of settings for encrypted communication, and thus the workload associated with setting encrypted communication can be reduced. By creating a policy 45 for communication control between groups before operation, operation can be started without spending time on setting up communication control. In addition, since the policy 45 is not complicated, management becomes easier, and it becomes easier to build a secure network.

[0050] It is difficult to introduce new encryption software into equipment in factories, including those in the manufacturing industry, due to reasons such as prioritizing factory operations or the use of old operating systems. Therefore, it may be difficult to enable all terminals 30 to perform encryption. However, the communication control system 1 according to the first embodiment does not encrypt communication data between terminals 30, but encrypts communication data between edge devices 20 to which terminals 30 are connected. This makes it possible to communicate communication data in an encrypted state over a communication path that is likely to have low security, without enabling the terminals 30 to perform encryption processing.

[0051] ***Other configurations*** <Variation 1> In the first embodiment, the master device 10 and the edge device 20 have been described as devices having different functions. However, the communication control system 1 may be configured by preparing a plurality of devices having both the functions of the master device 10 and the edge device 20, with one of them being the master device 10 and the rest being the edge devices 20. Furthermore, the master device 10 may have the function of the edge device 20. When the master device 10 has the function of the edge device 20, the master device 10 acquires the address 41 of the terminal 30 connected to the same network. When the master device 10 acquires the address 41, the device name of the master device 10 is added as the edge device name. When the master device 10 has the function of the edge device 20, the master device 10 controls the communication between the terminals 30 based on the policy 45, in the same way as the edge device 20.

[0052] <Variation 2> In the first embodiment, it is assumed that all edge devices 20 can perform encryption processing. However, it is possible that some edge devices 20 cannot perform encryption processing. In this case, the edge device 20 to which the source terminal 30 is connected needs to encrypt the communication data after confirming whether the edge device 20 to which the destination terminal 30 is connected is an edge device 20 that can perform decryption.

[0053] In this case, in step S33 of FIG. 11, the setting transmission unit 116 transmits the policy 45 together with the identification information of the edge device 20 connected to each terminal 30. The identification information of the edge device 20 to which the terminal 30 is connected is specified in step S11 of FIG. 4. With reference to the identification information of the edge device 20, the encryption determination unit 217 in the edge device 20 to which the source terminal 30 is connected determines whether the edge device 20 to which the destination terminal 30 is connected is an edge device 20 capable of decryption. Then, if the edge device 20 is capable of decryption, the encryption unit 218 encrypts the communication data and transmits it. On the other hand, if the edge device 20 is not capable of decryption, the encryption unit 218 transmits the communication data without encrypting it.

[0054] Here, the address 41 of the same terminal 30 may be transmitted from multiple edge devices 20. That is, one terminal 30 may be connected to multiple edge devices 20. In this case, if at least one edge device 20 can perform encryption processing, the encryption determination unit 217 determines whether the edge device 20 to which the destination terminal 30 is connected is an edge device 20 that can perform decryption.

[0055] If the edge device 20 to which the source terminal 30 is connected is an edge device 20 that cannot perform encryption processing, the communication data received by the edge device 20 to which the destination terminal 30 is connected is not encrypted. That is, in this case, even if the policy 45 is set to encrypt the communication data, the communication data is not encrypted. The encryption determination unit 217 of the edge device 20 to which the destination terminal 30 is connected may determine whether the edge device 20 to which the source terminal 30 is connected has performed encryption processing from the identification information of the edge device 20 to which the source terminal 30 is connected, or may determine whether the data is encrypted from the communication data.

[0056] As a result, even if there are a mixture of edge devices 20 that can perform encryption processing and edge devices 20 that cannot perform encryption processing, it is possible to perform appropriate processing.

[0057] <Variation 3> In the first embodiment, each functional component is realized by software. However, as a third modification, each functional component may be realized by hardware. The following describes the third modification, focusing on the differences from the first embodiment.

[0058] When each functional component is realized by hardware, the master device 10 includes an electronic circuit instead of the processor 11, the memory 12, and the storage 13. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 12, and the storage 13. Similarly, when each functional component is realized by hardware, the edge device 20 includes an electronic circuit instead of the processor 21, the memory 22, and the storage 23. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 22, and the storage 23.

[0059] Possible electronic circuits 15 include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), and an FPGA (Field-Programmable Gate Array). Each functional component may be realized by one electronic circuit 15, or each functional component may be distributed across multiple electronic circuits 15.

[0060] <Modification 4> As a fourth modification, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0061] The processor 11, the memory 12, the storage 13, and the electronic circuit 15 are collectively referred to as a processing circuit. In other words, the functions of the respective functional components are realized by the processing circuit.

[0062] Various aspects of the present disclosure are summarized below as appendices. (Appendix 1) a terminal classification unit that classifies a plurality of terminals connected to the network into a plurality of groups; an encryption setting unit that receives a designation as to whether or not to encrypt communication between groups into which the plurality of terminals are classified by the terminal classification unit and sets a policy; A master device comprising: (Appendix 2) The encryption setting unit sets the policy indicating whether or not to encrypt communication depending on a communication protocol. 2. A master device as described in claim 1. (Appendix 3) The encryption setting unit sets the policy indicating whether or not to encrypt communication depending on a port when a communication protocol is specified. 3. A master device as described in claim 2. (Appendix 4) The master device further comprises: a policy setting section that accepts a designation as to whether or not communication between the same group is permitted and communication between different groups is permitted and sets the policy; Equipped with The master device according to any one of appendices 1 to 3, wherein the encryption setting unit adds a setting for whether or not to encrypt communication to the policy for groups for which a policy is set to allow communication, including between the same group. (Appendix 5) The master device further comprises: a setting transmission section for transmitting the policy set by the encryption setting section to each of a plurality of edge devices and controlling communication based on the policy; 5. The master device of claim 1, further comprising: (Appendix 6) The master device sets the policy in a communication control system in which, for groups set to encrypt communication, an edge device to which a source terminal is connected encrypts communication data received from the source terminal and transmits it to an edge device to which a destination terminal is connected, and the edge device to which the destination terminal is connected decrypts the encrypted communication data and transmits it to the destination terminal. 6. The master device according to claim 5. (Appendix 7) The master device classifies the multiple terminals connected to the network into multiple groups, A communication control method in which a master device accepts a designation as to whether or not to encrypt communications between groups into which the plurality of terminals are classified, and sets a policy. (Appendix 8) A terminal classification process for classifying a plurality of terminals connected to the network into a plurality of groups; an encryption setting process for receiving a designation of whether or not to encrypt communication between groups into which the plurality of terminals are classified by the terminal classification process and setting a policy; A communication control program that causes a computer to function as a master device. (Appendix 9) A communication control system including a master device and a plurality of edge devices, The master device a terminal classification unit that classifies a plurality of terminals connected to the network into a plurality of groups; an encryption setting unit that receives a designation as to whether or not to encrypt communication between groups into which the plurality of terminals are classified by the terminal classification unit and sets a policy; a setting transmission unit that transmits the policy set by the encryption setting unit to each of the edge devices; Equipped with Each of the plurality of edge devices a communication control unit that controls communication between terminals based on the policy transmitted by the setting transmission unit, and for groups in which the policy indicates encryption, when a source terminal is connected, the communication control unit encrypts communication data and transmits it to a destination terminal, and when the destination terminal is connected, the communication control unit decrypts the communication data and transmits it to the destination terminal. A communication control system comprising:

[0063] In addition, the word "part" in the above description may be read as a "circuit," "step," "procedure," "processing," or "processing circuit."

[0064] The above describes the embodiments and modifications of the present disclosure. Some of these embodiments and modifications may be combined and implemented. Also, one or some of them may be partially implemented. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as necessary. [Explanation of symbols]

[0065] 1 communication control system, 10 master device, 11 processor, 12 memory, 13 storage, 14 communication interface, 15 electronic circuit, 111 address receiving unit, 112 terminal extraction unit, 113 terminal classification unit, 114 policy setting unit, 115 setting transmission unit, 20 edge device, 21 processor, 22 memory, 23 storage, 24 communication interface, 25 electronic circuit, 211 address acquisition unit, 212 address transmission unit, 213 setting reception unit, 214 communication control unit, 215 log acquisition unit, 30 terminal, 31 unclassified terminal, 41 address, 42 terminal information, 43 group, 44 group list, 45 policy, 46 inspection policy.

Claims

1. a terminal classification unit that classifies a plurality of terminals connected to the network into a plurality of groups; an encryption setting unit that receives a designation as to whether or not to encrypt communication between groups into which the plurality of terminals are classified by the terminal classification unit and sets a policy; A master device comprising:

2. The encryption setting unit sets the policy indicating whether or not to encrypt communication depending on a communication protocol. The master device of claim 1 .

3. The encryption setting unit sets the policy indicating whether or not to encrypt communication depending on a port when a communication protocol is specified. The master device of claim 2.

4. The master device further comprises: a policy setting section that accepts a designation as to whether or not communication between the same group is permitted and communication between different groups is permitted and sets the policy; Equipped with The master device according to claim 1 , wherein the encryption setting unit adds a setting as to whether or not to encrypt communication between groups for which a policy is set to permit communication, including between groups of the same group, to the policy.

5. The master device further comprises: a setting transmission section for transmitting the policy set by the encryption setting section to each of a plurality of edge devices and controlling communication based on the policy; The master device of claim 1 .

6. The master device sets the policy in a communication control system in which, for groups set to encrypt communication, an edge device to which a source terminal is connected encrypts communication data received from the source terminal and transmits it to an edge device to which a destination terminal is connected, and the edge device to which the destination terminal is connected decrypts the encrypted communication data and transmits it to the destination terminal. The master device of claim 5.

7. The master device classifies the multiple terminals connected to the network into multiple groups, A communication control method in which a master device accepts a designation as to whether or not to encrypt communications between groups into which the plurality of terminals are classified, and sets a policy.

8. A terminal classification process for classifying a plurality of terminals connected to the network into a plurality of groups; an encryption setting process for receiving a designation of whether or not to encrypt communication between groups into which the plurality of terminals are classified by the terminal classification process and setting a policy; A communication control program that causes a computer to function as a master device.

9. A communication control system including a master device and a plurality of edge devices, The master device a terminal classification unit that classifies a plurality of terminals connected to the network into a plurality of groups; an encryption setting unit that receives a designation as to whether or not to encrypt communication between groups into which the plurality of terminals are classified by the terminal classification unit and sets a policy; a setting transmission unit that transmits the policy set by the encryption setting unit to each of the edge devices; Equipped with Each of the plurality of edge devices a communication control unit that controls communication between terminals based on the policy transmitted by the setting transmission unit, and for groups in which the policy indicates encryption, when a source terminal is connected, the communication control unit encrypts communication data and transmits it to a destination terminal, and when the destination terminal is connected, the communication control unit decrypts the communication data and transmits it to the destination terminal. A communication control system comprising:

Images