Network connection management device and network connection management program

Abstract

To properly manage connection to a network from communication terminal devices such as laptops and manage seats for employees at an office in which free addresses are adopted.SOLUTION: When accepting an IP address grant request, a MAC address inquiry unit 121 makes a MAC address inquiry. If a result of the inquiry shows that a requester has been registered, an IP address grant unit 122 grants a first IP address to a communication terminal device of the requester, or if the result shows that the requester has not been registered, grants a second IP address to the communication terminal device of the requester. A VLAN construction unit 123 causes first storage means to record a MAC address of the communication terminal device to which the first IP address has been granted, and constructs a VLAN.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] This invention relates to a device and program that manages the connection of communication terminal devices such as notebook PCs (Personal Computing) to a network in a free address system, which means that employees do not have fixed seats in the office but work at a seat of their choice. [Background technology]

[0002] In an office that adopts a style called free address, the space can be used more effectively than in the conventional style where each employee has a fixed seat, but it is difficult to know where each employee is in the office. For this reason, Patent Document 1 described later discloses an invention related to a seat management device connected to a client terminal via a network. The seat management device displays on the client terminal a display screen including a seat layout diagram in which an identifier indicating whether or not each seat is registered and a list indicating whether or not each user's seat is registered. When a user is selected on the list, the identifier of the user's seat is displayed on the client terminal in a display form different from other identifiers. This makes it easier to know the location of each employee. In Patent Document 1, it is explained in paragraphs

[0049] to

[0060] that seat registration and cancellation are performed from the client terminal used by the employee to the seat management server. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP2009-37555A Summary of the Invention [Problem to be solved by the invention]

[0004] Generally, communication terminal devices such as laptop PCs used in an office are loaned to employees by the company. However, there are cases where employees bring their own laptop PCs or tablet PCs to the office and use them as necessary. It is also considered that visitors may use their own laptop PCs or tablet PCs. In an office that adopts a free address system, since seats are not fixed, it is relatively easy to bring in communication terminal devices other than those loaned by the company. However, there is a problem in allowing employees' own laptop PCs and visitors' laptop PCs to connect to the company's network unconditionally. This is because if they are able to connect to the company's network, there is a high probability that highly confidential data may be viewed, tampered with, or even taken out.

[0005] As mentioned above, to manage seats in an office that employs a free address system, each employee must specify the seat they will use, for example, through their own communication terminal device, and must also input or select their own name. This work is done every day and is time-consuming and tedious. It is important that seat management in an office that employs a free address system can be done easily and accurately without much effort, and it is desirable to do it automatically, without the employees even being aware of it.

[0006] In view of the above, an object of the present invention is to enable appropriate management of the connection of communication terminal devices such as notebook PCs to a network in an office where a free address system is adopted, and further to enable easy and appropriate management of the seats of employees, etc. [Means for solving the problem]

[0007] In order to solve the above problem, the network connection management device according to the invention described in claim 1 comprises: a first receiving means for receiving an IP (Internet Protocol) address assignment request including device identification information of the communication terminal device from the communication terminal device; a query means for querying whether the communication terminal device which is a source of the request for granting is permitted to be used and registered in advance, based on the device identification information included in the request for granting received through the first receiving means; an assignment means for assigning a first IP address when a result of the inquiry by said inquiry means indicates that the IP address is pre-registered, and for assigning a second IP address having a different aspect from the first IP address when a result of the inquiry by said inquiry means indicates that the IP address is not pre-registered; a configuration means for recording terminal identification information of the communication terminal device to which the first IP address is assigned by the assignment means in a first storage means, thereby configuring a virtual LAN (Local Area Network); The present invention is characterized by comprising:

[0008] According to the network connection management device of claim 1, a first receiving means receives a request for an IP address assignment. Based on device identification information included in the accepted assignment request, a query means determines whether the requesting communication terminal device is authorized for use and preregistered. If the result of the query by the query means indicates that the device is preregistered, a first IP address is assigned to the requesting communication terminal device by the assigning means. If the result of the query by the query means indicates that the device is not preregistered, a second IP address is assigned to the requesting communication terminal device by the assigning means.

[0009] A virtual LAN (Local Area Network) is configured by the configuration means recording in the first storage means the terminal identification information of the communication terminal device to which the first IP address has been assigned by the assignment means. That is, a LAN is configured by the communication terminal devices whose terminal identification information has been recorded in the first storage means, and communication between the communication terminal devices whose terminal identification information has been recorded in the first storage means is made possible. Conversely, a communication terminal device that has been assigned a second IP address and does not have terminal identification information recorded in the first storage means cannot be connected to the virtual LAN.

[0010] The network connection management device of the invention described in claim 2 comprises: 2. A network connection management device according to claim 1, the communication terminal device is capable of transmitting a seat registration request including device identification information of the external device and device identification information of the communication terminal device itself when an external device that is in one-to-one correspondence with a seat in a free address office is connected to the communication terminal device; a second receiving means for receiving the seat registration request from the communication terminal device; an update means for updating the device identification information in a seat database in which the device identification information and seat identification information for identifying the seat are associated with each other when the seat registration request is received through the second reception means; The present invention is characterized by comprising:

[0011] According to the network connection management device described in claim 2, when an external device that is in one-to-one correspondence with a seat in a free address office is connected, the communication terminal device transmits a seat registration request including device identification information of the external device and device identification information of the communication terminal device itself. Therefore, when a seat registration request is accepted through the second accepting means, the updating means updates the device identification information in the seat database that associates the device identification information with seat identification information that specifies a seat. This makes it possible to automatically grasp which communication terminal device is being used at which seat. Effect of the Invention

[0012] According to the invention described in claim 1, in an office where a free address system is adopted, it becomes possible to manage the connection of communication terminal devices such as notebook PCs to a network. Furthermore, according to the invention described in claim 2, it becomes possible to manage the seats where the communication terminal devices are used. [Brief description of the drawings]

[0013] [Figure 1] 1 is a diagram for explaining an example of the configuration of a network system configured using a UTM device to which an embodiment of the device and program of the present invention is applied. [Diagram 2] FIG. 13 is a diagram illustrating an example of the relationship between seats and USB devices in a free address office. [Diagram 3] FIG. 2 is a diagram for explaining a process flow in the network system of the embodiment. [Figure 4] FIG. 2 is a diagram for explaining a configuration example of a seat management server device according to an embodiment; [Diagram 5] 1 is a block diagram illustrating a configuration example of a UTM device according to an embodiment. [Figure 6] 2 is a diagram for explaining a VLAN (Virtual Local Area Network) whitelist and a WAN (Wide Area Network) whitelist of the UTM device of the embodiment. FIG. [Figure 7] 2 is a diagram for explaining an example of stored data in an address DB (Data Base) of a UTM device according to an embodiment; FIG. [Figure 8] FIG. 2 is a block diagram illustrating an example of the configuration of a PC according to an embodiment. [Figure 9] 11 is a flowchart for explaining processing executed in a registered PC and an unregistered PC. [Figure 10] 11 is a flowchart illustrating a process executed by a UTM device. [Figure 11]2 is a diagram for explaining network connection control and seat management control performed in the network system of the embodiment. FIG. [Figure 12] FIG. 13 is a diagram for explaining a display example of a seating management screen. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] An embodiment of the device and program according to the present invention will be described below with reference to the drawings. In the embodiment described below, the device and program according to the present invention will be described as being applied to a UTM (Unified Threat Management) device. In the embodiment described below, the network system configured using the UTM device is constructed in an office that adopts a free address style.

[0015] [Network system configuration example] Fig. 1 is a diagram for explaining an example of the configuration of a network system configured using a UTM device 1 to which an embodiment of the device and program of the present invention is applied. As shown in Fig. 1, the UTM device 1 is connected to the Internet 3 via a router 2. A seat management server device 4 is also connected to the UTM device 1 via a LAN 5, and registered PCs 7(1), 7(2), ... and unregistered PCs 9(1), 9(2), ... can be connected via APs (Access Points) 6(1), 6(2), ....

[0016] The UTM device 1 efficiently and comprehensively protects LAN systems formed within a company from threats such as computer viruses and hacking, and is also called a unified threat management device. The UTM device 1 of this embodiment also has two new functions. One is a function to manage connections to networks such as the LAN 5 and the Internet 3 for communication terminal devices such as PCs connected via the LAN 5. The other is a function to manage the seats of employees who use communication terminal devices such as PCs (Personal Computers) connected via the LAN 5 in an office where a free address system is adopted. The details of these functions will be described later.

[0017] The router 2 is responsible for relaying data between the LAN 5 and the Internet 3. The Internet 3 refers to a computer network interconnected using Internet Protocol Suite technology, and in this embodiment includes, for example, a public switched telephone network or an optical telephone network that connects the router 2 and other communication terminal devices to the Internet 3. In this specification, the term WAN (Wide Area Network) may be used as a synonym for the Internet.

[0018] The seat management server device 4 realizes a function of managing the MAC addresses (device identification information) of communication terminal devices, mainly notebook PCs, which are loaned to employees by the company and can be connected to the intranet, in association with the names of employees, etc. The seat management server device 4 also realizes a function of managing the usage status of each seat (desk) in the free address office in cooperation with the UTM device 1.

[0019] LAN5 means a network formed in an office, but in the narrow sense, it means the LAN cable itself. APs 6(1), 6(2), ... connect wireless LAN clients (communication terminal devices) such as notebook PCs and tablet PCs to LAN5 by, for example, wireless communication according to the Wi-Fi (registered trademark) standard. Note that, here, notebook PCs and tablet PCs are wirelessly connected to LAN5 via APs 6(1), 6(2), ..., but this is not limiting. For example, it is of course possible to wired connect notebook PCs and tablet PCs to LAN5 using a hub device and a LAN cable.

[0020] Registered PCs 7(1), 7(2), ... are communication terminal devices such as notebook PCs that are loaned to employees by the company and can be connected to the company's internal network. In other words, a registered PC is a communication terminal device whose MAC address and the name of the employee to whom it is loaned are registered and managed in association with the seat management server device 4. USB devices 8(1), 8(2), ..., which will be described in detail later, are used to manage which communication terminal device is being used at each seat in the free address office, and further, who is using that communication terminal device.

[0021] The unregistered PCs 9(1), 9(2), ... are communication terminal devices other than those loaned to employees by the company, such as notebook PCs or tablet PCs owned personally by employees, or notebook PCs or tablet PCs brought in by visitors. Therefore, the unregistered PCs 9(1), 9(2), ... are unmanaged communication terminal devices that are not managed in the seat management server device 4 in association with the MAC addresses and employee names, etc.

[0022] In the following, registered PCs 7(1), 7(2), ... refer to various portable communication terminal devices such as notebook PCs and tablet PCs whose information is managed by the seat management server device 4. Also, unregistered PCs 9(1), 9(2), ... refer to various portable communication terminal devices such as notebook PCs and tablet PCs whose information is not managed by the seat management server device 4.

[0023] Moreover, registered PCs 7(1), 7(2), ... basically have the same configuration, and when there is no need to distinguish between them, they will be collectively referred to as registered PC 7. Similarly, unregistered PCs 9(1), 9(2), ... basically have the same configuration, and when there is no need to distinguish between them, they will be collectively referred to as registered PC 9. Moreover, USB devices 8(1), 8(2), ... basically have the same configuration, and when there is no need to distinguish between them, they will be collectively referred to as USB device 8.

[0024] Figure 2 is a diagram explaining the relationship between seats and USB devices in a free address office. A free address is a style in which employees do not have fixed seats in the office and can work at any seat of their choice. There are various ways to design an office, but for example, as shown in Figure 2, a large table without drawers TB and a round table RTB are placed in the office, and partitions are installed as appropriate, so that employees can choose where they like to work.

[0025] In the example shown in FIG. 2, the table TB is divided into six parts, and each part is assigned a seat ID (seat identification information), such as desks E-2F-01, E-2F-02, E-2F-03, ... Similarly, the round table RTB is divided into four parts, and each part is assigned a seat ID (seat identification information), such as desks E-2F-07, E-2F-08, E-2F-09, E-2F-10. In this embodiment, the seat ID is made up of building identification information, floor number identification information, and desk identification information, such as, for example, which desk on the second floor of building E. The seat ID is not limited to this example, and various types of seat IDs can be used.

[0026] Furthermore, as shown in Fig. 2, the above-mentioned USB devices 8(1), 8(2), ... are provided on each desk in one-to-one correspondence. In Fig. 2, symbols A01, A02, ... indicate USB IDs, which are device identification information of the USB devices 8(1), 8(2), ... provided on each desk in one-to-one correspondence. Each of the USB devices 8(1), 8(2), ... includes a USB interface and a flash memory, and the USB ID and a presence authentication program are recorded in the flash memory. Each of the USB devices 8(1), 8(2), ... is attached to the corresponding desk by, for example, a wire or chain, and cannot be used away from the corresponding desk.

[0027] In the network system configured as shown in FIG. 1 for the free address office described with reference to FIG. 2, the registered PC 7 is allowed to connect to the in-house network, VLAN (Virtual Local Area Network), and the Internet 3. However, the unregistered PC 9 is not allowed to connect to the VLAN, and is allowed to connect to the Internet 3 under certain conditions. Furthermore, in the network system of this embodiment, the UTM device 1 and the seat management server device 4 cooperate to manage the seats where the registered PC 7 and the unregistered PC 9 are used, by using USB devices 8(1), 8(2), ... associated with each seat in the free address office. It is also possible to manage who is using the registered PC 7, that is, who is in the seat using the registered PC.

[0028] FIG. 3 is a diagram for explaining the flow of processing in the network system of the embodiment. FIG. 3 shows the configuration of the network system shown in FIG. 1 in a more organized manner. In FIG. 3, registered PCs 7(1), 7(2), ... and unregistered PCs 9(1), 9(2), ... are shown as one large block, as indicated by reference numerals 7 and 9. The registered PC 7 and the unregistered PC 9 are connected to the UTM device 1. The seat management server device 4 is also connected to the UTM device 1. The UTM device 1 is connected to the Internet 3 via a router 2.

[0029] For example, an employee comes to the free address office, decides on a seat (desk) to work at, and turns on the registered PC 7 or his / her own unregistered PC 9. In this case, the registered PC 7 or the unregistered PC 9 sends a DHCP (Dynamic Host Configuration Protocol) request (request for an IP address) including its own MAC address to the UTM device 1 (step S1).

[0030] When the UTM device 1 receives an IP address assignment request from a registered PC 7 or an unregistered PC 9, it inquires about the MAC address with the seat management server device 4 (step S2). The seat management server device 4, which will be described in detail later, has a user DB (database) that associates the MAC addresses of registered PCs 7 with the names of employees. Therefore, the seat management server device 4 refers to the user DB to identify whether the PC (communication terminal device) identified by the provided MAC address is a registered PC 7 or an unregistered PC 9, and returns the identification result to the UTM device 1 as an inquiry response (step S3).

[0031] When the UTM device 1 receives the inquiry response and the inquiry response indicates that the requesting PC is a registered PC 7, the UTM device 1 assigns an IP address for a registered PC (first IP address) to the requesting registered PC 7 (step S4). When the UTM device 1 receives the inquiry response and the inquiry response indicates that the requesting PC is an unregistered PC 9, the UTM device 1 assigns an IP address for an unregistered PC (second IP address) to the requesting unregistered PC 9 (step S4).

[0032] Here, the IP address for a registered PC is, for example, in the format of "172.16.26.X / 24", and the IP address for an unregistered PC is, for example, in the format of "192.16.26.X / 24". Note that the character "X" in the above IP address is a variable, which is changed so that there is no duplication in the communication terminal device connected to the UTM device 1. Also, the notation " / 24" in the IP address indicates that 24 bits are the network portion, and in the above example, "172.16.26" and "192.16.26" indicate that they are the network portion.

[0033] That is, an IP address is made up of four blocks of 8 bits, totaling 32 bits of data, and the notation " / 24" indicates that the first 24 bits are the network section and the remaining 8 bits are the host section. In this case, the first 24 bits indicate the network, and the remaining 8 bits (the variable "X" part) are information assigned to each host (communication terminal device). Therefore, a communication terminal device that has been given an IP address with the network section "172.16.26" is a registered PC9, and becomes a communication terminal device that constitutes a VLAN (intra-company network).

[0034] Furthermore, the UTM device 1 registers the MAC address of the registered PC 7, to which the IP address "172.16.26.X / 24" for the registered PC has been assigned, in the VLAN whitelist and the WAN whitelist. The VLAN whitelist is a list of MAC addresses of PCs (communication terminal devices) that are permitted to connect to the VLAN (corporate network), and the WAN whitelist is a list of MAC addresses of PCs (communication terminal devices) that are permitted to connect to the Internet 3. Therefore, the UTM device 1 can enable only PCs whose MAC addresses are registered in the VLAN whitelist to connect to the VLAN (corporate network). Furthermore, the UTM device 1 can enable only PCs whose MAC addresses are registered in the WAN whitelist to connect to the Internet 3.

[0035] As described above, for example, assume that an employee comes to the free address office, decides on a seat (desk) to work at, and powers on the registered PC 7 or his / her own unregistered PC 9. In this case, the employee connects the USB device 8 associated with the desk to be used to the registered PC 7 or his / her own unregistered PC 9. To explain more specifically, assume that an employee decides to use seat E-2F-07 at the round table RTB in the free address office shown in Fig. 2, sets up a laptop computer, powers it on, and gets ready to work.

[0036] In this case, the employee can automatically perform seat registration processing by inserting the USB device 8(7) into the USB interface of the laptop PC. That is, assume that the laptop PC 7 is a registered PC 7, and is assigned the IP address "172.16.26.X / 24" for registered PCs. The registered PC 7 sends a seat registration request including the USB ID (A07) of the USB device 8(7) and the MAC address of the laptop PC to the UTM device 1 (step S5).

[0037] Also, assume that the laptop PC is an unregistered PC and has been assigned the IP address for unregistered PCs, “192.16.26.X / 24.” The unregistered PC 9 transmits a seat registration request including the USB ID (A07) of the USB device 8(7) and the MAC address of the laptop PC, to the UTM device 1, and transmits a WAN whitelist registration request including the MAC address of the unregistered PC 9 to the UTM device 1 (step S5).

[0038] When the UTM device 1 receives the seat registration request, it requests the seat management server device 4 to update the seat DB (Data Base) (step S6). The seat DB, which will be described in detail later, associates USB IDs, seat IDs, and MAC addresses, and can manage which PCs are used at which seats. Therefore, by referring to the seat DB and user DB of the seat management server device 4, it is possible to know who is using which seat (who is in which seat).

[0039] Furthermore, when the UTM device 1 receives a WAN whitelist registration request, it registers the MAC address included in the WAN whitelist registration request in the WAN whitelist. As a result, even if the PC is unregistered, the PC that sent the WAN whitelist registration request is permitted to connect to the Internet 3. In this case, the PC is registered only in the WAN whitelist and is not registered in the VLAN whitelist, so the unregistered PC is not permitted to connect to the VLAN (corporate network).

[0040] That is, only registered PCs 7 whose MAC addresses are registered in the VLAN whitelist are allowed to connect to the VLAN and communicate with other registered PCs 7. However, in the WAN whitelist, not only registered PCs 7 but also unregistered PCs 9 connected to a USB device 8 are allowed to connect to the Internet 3.

[0041] As mentioned above, for registered PCs, the MAC address is registered in the VLA whitelist and WAN whitelist when the IP address is assigned, so even if a UAB device is not connected and a seat registration request is not sent, the use of VLAN and Internet 3 is possible. Registered PCs are PCs loaned to employees by the company, and the employee who uses them is also identified, so it can be determined that the PC is safe even if the seat cannot be identified.

[0042] In contrast, in the case of an unregistered PC, if a seat is registered by connecting a UAB device and sending a seat registration request, the PC will not be allowed to connect to the company network, but will be allowed to connect to the Internet 3. However, an unregistered PC that has not been registered will not be allowed to connect to the company network, let alone the Internet. This is because the user of an unregistered PC 9 cannot be identified, and it is unknown what it will be used for.

[0043] The configuration and operation of each device constituting the network system of this embodiment that functions as described above will be specifically described below. The following description will be given in the order of the seat management server device 4 → UTM device 1 → registered PC 7 and unregistered PC 9.

[0044] [Configuration example of seat management server device 4] FIG. 4 is a diagram for explaining a configuration example of the seat management server device 4 of the embodiment. The connection end 401T constitutes a connection end to the LAN 5. The LAN I / F (Interface) 401 is a part that performs communication processing through the LAN 5. That is, the LAN I / F 401 converts a signal addressed to the device and transmitted via the LAN 5 into a signal in a format that can be processed by the device, and imports this. The LAN I / F 401 also converts a signal to be transmitted from the device into a signal in a format for transmission, and sends this to the LAN 5 to transmit to the other party.

[0045] The control unit 402 is a microprocessor including a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), a non-volatile memory, etc. (not shown), and controls each unit of the seat management server device 4. The storage device 403 is a device unit including a recording medium such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive) and its driver, and records, reads, modifies, deletes, etc., various data on the recording medium. The storage device 403 stores and holds necessary data and programs, and is also used as a working area for temporarily storing intermediate data generated in various processes.

[0046] As shown in FIG. 4B, the seat DB 404 associates USB IDs, seat IDs, and MAC addresses. That is, the seat DB 404 previously stores USB IDs and seat IDs in association with each other. This makes it possible to know which USB device is provided (associated) with which seat, and the seat in the open address office can be uniquely identified by the USB ID of the USB device. The seat registration request includes the USB ID of the USB device associated with the seat and the MAC address of the registered PC 7 or unregistered PC 9 to which the USB device is connected. Therefore, by updating the MAC address in association with the USB ID as shown in FIG. 4B, it is possible to know which registered PC 7 or unregistered PC 9 is used at which seat, based on the information in the seat DB 404.

[0047] As shown in FIG. 4(C), the user DB 405 associates the MAC address of a registered PC loaned from the company and used by a user (employee) with the name of the user (employee). The MAC address and the employee's name are registered in the user DB 405 when the registered PC 7 is loaned. The information in the user DB 405 makes it possible to know which employee is using which registered PC 7. Furthermore, the seat DB 404 described above makes it possible to know which registered PC 7 is being used at which seat by using the seat ID and MAC address. Therefore, by further comparing the MAC address with the information in the user DB 405, it becomes possible to know which employee is working at which seat.

[0048] The seat DB 404 and the user DB 405 are device units consisting of a recording medium and its driver, such as a hard disk drive (HDD) or a solid state drive (SSD), similar to the above-mentioned storage device 403. As shown in Fig. 4, the seat DB 404 and the user DB 405 can be configured as separate device units, or can be formed in the same device unit with different storage areas.

[0049] The seat management server device 4 configured in this way can manage PCs lent to employees by the company as registered PCs and manage who the PCs were lent to. Furthermore, the seat management server device 4 can manage each seat in the free address office and the USB device associated with each seat, and manage the user (employee) who uses each seat for each seat.

[0050] [Example of UTM device 1 configuration] 5 is a block diagram for explaining a configuration example of a UTM device according to an embodiment. A connection end 101T constitutes a connection end with the router 2. A communication I / F (Interface) 101 is a part that performs communication processing via the router 2 and the Internet 3. That is, the communication I / F 101 converts a signal addressed to the device and transmitted via the Internet 3 and the router 2 into a signal in a format that can be processed by the device, and imports this. The communication I / F 101 also converts a signal to be transmitted from the device into a signal in a format for transmission, and sends it to the Internet 3 via the router 2 to transmit it to the other party.

[0051] The control unit 102 is a microprocessor including a CPU, ROM, RAM, non-volatile memory, etc. (not shown), and controls each unit of the UTM device 1. The storage device 103 is a device unit including a recording medium such as an HDD (Hard Disk Drive) or SSD (Solid State Drive) and its driver, and records, reads, modifies, deletes, etc., various data on the recording medium. The storage device 403 stores and holds necessary data and programs, and is also used as a working area for temporarily storing intermediate data generated in various processes.

[0052] As described above, the VLAN whitelist 104 is a list of MAC addresses of PCs (communication terminal devices) permitted to connect to a VLAN (internal network). The WAN whitelist 105 is a list of MAC addresses of PCs (communication terminal devices) permitted to connect to the Internet 3. Fig. 6 is a diagram for explaining the VLAN whitelist and the WAN whitelist of the UTM device 1 of the embodiment.

[0053] As shown in Fig. 6(A), the VLAN whitelist stores and holds the MAC addresses of PCs (communication terminal devices) that can connect to a VLAN. Also, as shown in Fig. 6(B), the WAN whitelist 105 stores and holds the MAC addresses of PCs (communication terminal devices) that can connect to the Internet 3. The registered information in the VLAN whitelist can restrict the PCs that can connect to the VLAN (internal network). Also, the registered information in the WAN whitelist can restrict the PCs that can connect to the Internet 3.

[0054] When an IP address is assigned by the IP address assignment unit 122 described later, the address DB (Data Base) 106 stores and holds the MAC address of the assigned PC and the assigned IP address in association with each other. FIG. 7 is a diagram for explaining an example of data stored in the address DB of the UTM device 1 according to the embodiment. As shown in FIG. 7, the address DB 106 includes MAC addresses and IP addresses, and stores and holds the MAC address of the PC that has sent a request for an IP address assignment and the IP address assigned in response to the assignment request in association with each other. This makes it possible to know which IP address has been assigned to which PC.

[0055] Although not shown, the security function unit 110 is configured to include, for example, a P2P countermeasure unit, an HP access control unit, an antivirus unit, an e-mail countermeasure unit, an IPS / IDS unit, and a firewall unit. That is, the security function unit 110 realizes a function to prohibit P2P connections with parties that do not implement security measures or with malicious parties (function as a P2P countermeasure unit). Note that "P2P" stands for "Peer to Peer," and refers to direct communication between equal parties via the Internet.

[0056] Furthermore, the security function unit 110 realizes a function of prohibiting access to homepages that fall into a desired category by selecting the desired homepage category in advance (function as a homepage access control unit). The security function unit 110 also verifies (virus checks) responses to Web pages (function as an anti-virus unit). More specifically, the security function unit 110 realizes a function of monitoring communications when browsing Web pages and verifying (checking) whether images to be viewed or files to be downloaded contain viruses. The security function unit 110 also realizes a function of blocking received e-mails with unnecessary advertisements or viruses attached (function as an e-mail anti-virus unit).

[0057] The security function unit 110 also realizes a function of preventing inappropriate intrusions and notifying of inappropriate intrusions (a function as an IPS / IDS unit). Here, IPS is an abbreviation for Intrusion Prevention System, and IDS is an abbreviation for Intrusion Detection System. The security function unit 110 can defend against attacks by so-called malware such as worms and Trojan horses. The security function unit 110 also realizes a function of determining whether or not to supply data to the LAN 5 depending on the state of data communication, the software used, and the like, and defending its own system from attacks and unauthorized access from external networks (a function as a firewall unit).

[0058] The parts denoted with reference numerals in the 120 series are the main parts of the device according to the present invention. The MAC address inquiry unit 121 functions under the control of the control unit 102 when the UTM device 1 accepts an IP address assignment request from a registered PC 7 or an unregistered PC 9 through the connection terminal and LAN I / F 107 as the first accepting means. In this case, the MAC address inquiry unit 121 inquires of the seat management server device 4 whether the PC that sent the assignment request is a registered PC or not, based on the MAC address included in the accepted IP address assignment request.

[0059] The IP address assignment unit 122 performs a process of assigning an IP address to the PC that has requested the assignment of the IP address, according to the result of the inquiry by the MAC address inquiry unit 121, which is provided from the seat management server device 4. In this case, if the inquiry result indicates that the PC that has requested the assignment is a registered PC 7, the IP address assignment unit 122 assigns to the PC that has requested the assignment an IP address in which the variable (host part) X of the first IP address ("172.16.26.X / 24") has been changed. Also, if the inquiry result indicates that the PC that has requested the assignment is not a registered PC (it is an unregistered PC 9), the IP address assignment unit 122 assigns to the PC that has requested the assignment an IP address in which the variable (host part) X of the second IP address ("192.16.26.X / 24") has been changed.

[0060] The VLAN configuration unit 123 records the MAC address of the registered PC 7 to which the first IP address ("172.16.26.X / 24") has been assigned by the IP address assignment unit 122 in the first storage means, that is, the VLAN whitelist 104. In this way, a virtual LAN (VLAN) can be configured in the free address office by the registered PCs 7(1), 7(2), ... whose MAC addresses are registered in the VLAN whitelist 104.

[0061] WAN restriction unit 124 records the MAC address of the registered PC to which the first IP address ("172.16.26.X / 24") has been assigned by IP address assignment unit 122 in WAN whitelist 105, which is the second storage means. In this way, registered PCs 7(1), 7(2), ... whose MAC addresses are registered in WAN whitelist 105 are able to connect to the Internet 3, and other PCs can be restricted so as not to be able to connect to the Internet 3.

[0062] Furthermore, as described above, when an unregistered PC 9 is connected to a USB device that is in one-to-one correspondence with a seat in a free address office, the unregistered PC 9 forms a WAN whitelist registration request including its own MAC address and transmits it to the UTM device 1. In this case, the WAN restriction unit 124 of the UTM device 1 registers the MAC address included in the WAN whitelist registration request in the WAN whitelist 105. This allows the unregistered PC 9 equipped with a USB device for seat registration to connect to the Internet 3 via the UTM device 1.

[0063] As described above, when a USB device that is in one-to-one correspondence with a seat in a free address office is connected to a registered PC 7 or an unregistered PC 9, the registered PC 7 or the unregistered PC 9 forms a seat registration request and transmits it to the UTM device 1. The seat registration request includes the USB ID of the USB device and its own MAC address. This seat registration request is accepted by the UTM device 1 through the connection terminal 107T and the LAN I / F 107, which serve as a second accepting means. In this case, the seat DB update unit 125 functions under the control of the control unit 102.

[0064] The seat DB update unit 125 provides the USB ID and MAC address included in the seat registration request to the seat management server device 4, and requests updating of the seat DB 404. As a result, the control unit 402 of the seat management server device 4 updates the provided MAC address to the row specified by the provided USB ID and the column to which the MAC address is input. As a result, it becomes possible to know which PC is to be used at which seat in the seat DB 404 consisting of information such as the corresponding USB ID → seat ID → MAC address, as shown in Fig. 4(B).

[0065] The connection control unit 126 functions when receiving a connection request to a VLAN (corporate company network) including a MAC address from a registered PC 7 or an unregistered PC 9 through the connection terminal 107T and the LAN I / F 107, or a connection request to the Internet 3. Specifically, when the connection control unit 126 receives a connection request to a VLAN (corporate company network) and the MAC address included therein is present in the VLAN whitelist 104, the connection control unit 126 accepts the connection request and enables connection to the VLAN. In addition, when the connection control unit 126 receives a connection request to a VLAN (corporate company network) and the MAC address included therein is not present in the VLAN whitelist 104, the connection control unit 126 discards the connection request.

[0066] Similarly, when connection control unit 126 receives a connection request to a WAN (Internet 3) and the MAC address included in the request is present in WAN whitelist 105, it accepts the connection request and enables connection to the Internet 3. When connection control unit 126 receives a connection request to a WAN and the MAC address included in the request is not present in WAN whitelist 105, it discards the connection request.

[0067] In this way, the UTM device 1 has a MAC address inquiry function, an IP address assignment function, a VLAN whitelist registration function (VLAN configuration function), a WAN whitelist registration function, a seat DB update function, and a connection control function to VLANs and the Internet 3. These realize a function to manage connections to networks such as the Internet 3 and a VLAN formed on the LAN 5. The UTM device 1 also realizes a function to manage the seats of employees who use communication terminal devices such as PCs that are enabled to communicate via the LAN 5 in a free address environment.

[0068] [Example of configuration of registered PC7 and unregistered PC9] 8 is a block diagram for explaining an example of the configuration of the PCs 7 and 9 according to the embodiment. The registered PC 7 and the unregistered PC 9 are different in that they are registered PCs that are loaned from the company and permitted to be used, and PCs that are not permitted to be used, such as PCs that are privately owned by employees or PCs brought in by visitors. However, since there is no significant difference in configuration, the registered PC 7 and the unregistered PC 9 will be described below as having the same configuration.

[0069] The wireless LAN antenna 701A and the wireless LAN I / F 701 realize a function of connecting to the LAN 5 via the APs 6(1), 6(2), .... The wireless LAN I / F 701 realizes a function of converting data addressed to the device itself, transmitted via the LAN 5 and the APs 6(1), 6(2), ..., into a format that can be processed by the device itself, and importing the data. The wireless LAN I / F 701 also realizes a function of converting data to be transmitted from the device itself into a transmission format, and transmitting the data to the APs 6(1), 6(2), ....

[0070] The control unit 702 is a microprocessor including a CPU, a ROM, a RAM, and a non-volatile memory (not shown), and realizes the function of controlling each part of the PC. The storage device 703 is a device unit including a recording medium such as a hard disk drive (HDD) or a solid state drive (SSD) and a driver for the recording medium, and records, reads, modifies, and deletes various data on the recording medium. The storage device 403 stores and holds necessary data and programs, and is also used as a working area for temporarily storing intermediate data generated in various processes.

[0071] The USB I / F 704 is a USB standard interface, and in this embodiment, accepts connection of a USB device 8 and reads out a USB ID and a presence authentication program. Of course, a USB memory or the like can also be connected, and the control unit 702 can record data in the USB memory or read data from the USB memory through the USB I / F 704.

[0072] The operation unit 705 receives instruction input from the user, converts the input into an electric signal, and supplies the signal to the control unit 702. Specifically, the operation unit 705 is a pointing device such as a keyboard or a mouse. The display controller 706 and the display 707 constitute a display output interface. The audio output processing unit 708 and the speaker 709 constitute an audio output interface. In other words, these constitute a user interface, and information can be input via the operation unit 705 to an input screen displayed on the display 707, and various guidance and warning sounds can be provided by audio output from the speaker 709.

[0073] The process execution unit 710 executes various programs and performs various processes under the control of the control unit 702. Specifically, it executes a presence authentication program read from the USB device 8 connected to the USB I / F 704, forms a seat registration request, and transmits the request to the UTM device 1 via the wireless LAN I / F 701 and the wireless LAN antenna 701A. In addition, like a general PC, it can also execute a browser to view web pages, execute a mailer to create and send e-mail, and receive and display e-mail. In other words, the PCs 7 and 9 can execute various application software to perform the desired processes.

[0074] [Summary of processes performed by PCs 7 and 9 and UTM device 1 in the embodiment] Next, we will summarize the processing performed by the registered PC 7 and the unregistered PC 9 in this embodiment, and the processing performed by the UTM device 1. In the following, we will first explain the processing performed by the registered PC 7 and the unregistered PC 9, and then explain the processing performed by the UTM device 1.

[0075] <Processing performed on registered PC7 and unregistered PC9> Fig. 9 is a flowchart for explaining the processing executed by the registered PC 7 and the unregistered PC 9. The processing shown in Fig. 9 is executed by the control unit 702 when the registered PC 7 and the unregistered PC 9 are powered on. In the registered PC 7 and the unregistered PC 9 that have been powered on, the control unit 702 forms a DHCP request (a request for assignment of an IP address) including its own MAC address and transmits this to the UTM device 1 (step S101).

[0076] In response to this, the UTM device 1 generates an IP address of "172.16.26.X / 24" if the requestor is a registered PC 7, and generates an IP address of "192.16.26.X / 24" if the requestor is an unregistered PC, and returns this to the requestor. Therefore, the requestor registered PC 7 and unregistered PC 9 receive the IP address from the UTM device 1 and retain (set) it in their own devices (step S102).

[0077] Next, the control unit 702 determines whether or not the USB device 8 is connected to the USB I / F 704 (step S103). It is assumed that it is determined in the determination process of step S103 that the USB device 8 is connected. In this case, the control unit 702 reads out an attendance authentication program from the USB device 8, and supplies it to the process execution unit 710 for execution (step S104). The process execution unit 710 reads out a USB ID from the USB device 8 connected to its own machine by the attendance authentication program, forms a seat registration request including the USB ID and its own MAC address, and transmits it to the UTM device 1 (step S105).

[0078] After that, the process execution unit 710 determines whether the own device is an unregistered PC 9 based on the IP address assigned to the own device (step S106). As described above, if the network of the IP address assigned to the own device is "192.16.26", the own device can be determined to be an unregistered PC. In this case, the process execution unit 710 forms a WAN whitelist registration request including the MAC address of the own device and transmits this to the UTM device 1 (step S107).

[0079] After the process of step S107, or when it is determined in the determination process of step S106 that the own PC is not an unregistered PC, the process execution unit 710 ends the presence authentication program executed in step S104 (step S108). After the process of step S108, or when it is determined in the determination process of step S103 that the USB device 8 is not connected, the control unit 102 ends the process shown in FIG.

[0080] In the determination process of step S103, if it is determined that the USB device 8 is not connected, that is, when the USB device 8 is not connected to the USBI / F704, it is unknown when the USB device 8 will be connected. Therefore, at an appropriate timing, it is checked whether the USB device 8 has been connected. If it is connected, the processes from step S104 to step S108 are performed.

[0081] In this way, the registered PC7 and the unregistered PC9 request the assignment of an IP address, and when the USB device 8 is connected, they form and send a seat registration request. Also, when the USB device 8 is connected and the local device is an unregistered PC, a WAN white list registration request is formed and sent to the UTM device 1.

[0082] <Processing performed by the UTM device 1> FIG. 10 is a flowchart for explaining the processing executed by the UTM device. The processing shown in FIG. 10 is constantly executed by the control unit 102 when the UTM device 1 is powered on. In this case, the control unit 102 receives a DHCP request (request for IP address assignment) from the registered PC7 and the unregistered PC9 through the connection terminal 107T and the LANI / F107 (step S201), and determines whether it has been received (step S202).

[0083] In the determination process of step S202, when it is determined that the DHCP request has not been received, the process from step S201 is repeated to wait for the arrival of the DHCP request. Assume that in the determination process of step S202, it is determined that the DHCP request has been received. In this case, the control unit 102 controls the MAC address inquiry unit 121, extracts the MAC address included in the received DHCP request, and inquires the seat management server device 4 whether the PC having the MAC address is the registered PC7 or the unregistered PC9 (step S203).

[0084] In response to the inquiry by the MAC address inquiry unit 121, the control unit 102 determines whether the inquiry result transmitted from the seat management server device 4 indicates that the PC is a registered PC 7 (step S204). In the judgment process of step S204, it is determined that the sender of the DHCP request is a registered PC 7. In this case, the control unit 102 controls the IP address assignment unit 122 to assign the first IP address, i.e., the IP address "172,16.26.X / 24", to the requesting registered PC 7 (step S205).

[0085] Next, control unit 102 controls VLAN configuration unit 123 to register the MAC address of the registered PC in VLAN whitelist 104, and also controls WAN restriction unit 124 to register the MAC address of the registered PC in WAN whitelist 105 (step S206). The MAC address of the registered PC was included in the DHCP request from the registered PC.

[0086] Thereafter, the control unit 102 receives a seat registration request from the registration PC 7 (step S207) and determines whether or not it has been received (step S208). It is assumed that it has been determined in the determination process of step S208 that a seat registration request has been received. In this case, the control unit 102 controls the seat DB update unit 125 to perform a process of updating the MAC address of the requesting registration PC 7 in the seat DB 404 of the seat management server device 4 (step S209). After the process of step S209, or when it is determined in the determination process of step S208 that a seat registration request has not been received, the process for the registration PC 7 has ended, and the process from step S201 is repeated.

[0087] Also, assume that in the determination process of step S204, it is determined that the sender of the DHCP request is not a registered PC (an unregistered PC). In this case, the control unit 102 controls the IP address assignment unit 122 to assign a second IP address, i.e., an IP address of "192,16.26.X / 24", to the requesting unregistered PC 9 (step S210).

[0088] Thereafter, the control unit 102 receives a seat registration request and a WAN whitelist registration request from the unregistered PC 9 (step S211) and determines whether or not they have been received (step S212). In the determination process of step S212, it is assumed that the seat registration request and the WAN whitelist registration request have been received. In this case, the control unit 102 controls the seat DB update unit 125 to perform a process of updating the MAC address of the unregistered PC 9 that made the request in the seat DB 404 of the seat management server device 4 (step S213).

[0089] Furthermore, control unit 102 controls WAN restriction unit 124 to perform processing to register the MAC address of unregistered PC 9 that made the request in WAN whitelist 105 (step S214). After processing in step S214, or when it is determined in the determination processing in step S212 that a seat registration request and a WAN whitelist registration request have not been received, processing for unregistered PC 9 is completed, and the processing from step S201 in FIG. 10 is repeated.

[0090] Fig. 11 is a diagram for explaining network connection control and seat management control performed in the network system of the embodiment. That is, Fig. 11 shows the effect obtained as a result of the processing in the UTM device 1 shown in Fig. 10. That is, as described above, the UTM device 1 assigns different IP addresses in the network section to the registered PC 7 and the unregistered PC 9.

[0091] Also, the MAC address of the registered PC7 is registered in the VLAN whitelist 104 and the WAN whitelist 105. Therefore, as indicated by the "O" in the In-house (meaning VLAN) column and the "Internet" column in the row of the registered PC7 in FIG. 11, the registered PC7 is allowed to connect to both the VLAN (in-house network) and the Internet 3. When a USB device 8 is connected to the registered PC7, seat management of who is using which seat is also possible, as indicated by the "O" in the "Seat Management" column in the row of the registered PC with USB. However, when a USB device 8 is not connected to the registered PC7, seat management of who is using which seat is not possible, as indicated by the "X" in the "Seat Management" column in the row of the registered PC without USB.

[0092] In contrast, in the case of an unregistered PC 9, the MAC address is basically not registered in VLAN whitelist 104 and WAN whitelist 105. However, when a USB device 8 is connected to an unregistered PC 9, seat management becomes possible as to which seat the unregistered PC is being used in, as indicated by the "o" in the seat management column of the row for the unregistered PC with USB in Fig. 11. Also, when a USB device 8 is connected to an unregistered PC 9, the unregistered PC 9 becomes able to connect to the Internet 3, as indicated by the "o" in the Internet column of the row for the unregistered PC with USB in Fig. 11.

[0093] In addition, if an unregistered PC 9 does not have a USB device 8 connected, as shown in the bottom row of Figure 11, connection to the company (meaning VLAN) is not possible ("X"), connection to the Internet 3 is not possible ("X"), and seat management is also not possible ("X").

[0094] Fig. 12 is a diagram for explaining a display example of the seat presence management screen. When a USB device 8 for seat management is also connected to a registered PC 7, as shown in the row of "USB available" in "Registered PC" in Fig. 12, it can connect to both a VLAN and the Internet 3, and seat management is also performed. Therefore, as shown in (1) in Fig. 12, it is possible to know who is at which seat and what they are doing, and to grasp the situation through the display 707 of another registered PC 7.

[0095] Also, when the USB device 8 for seat management is not connected to the registered PC 7, as shown in the row "No USB" in "Registered PC" in Fig. 12, it is possible to connect to both the VLAN and the Internet 3, but the seat is not managed. Therefore, as shown in (2) in Fig. 12, it is possible to know who is doing what, and to grasp the situation through the display 707 of another registered PC 7. In the case of (2), it is not known which seat Suzuki, an employee, is sitting at, but it is possible to grasp the situation by connecting the USB device 8 to the registered PC 7 used by Suzuki.

[0096] Furthermore, when an unregistered PC 9 is connected to a USB device 8 for seat management, as shown in the row of "Unregistered PC" with "USB" in Fig. 11, it cannot connect to a VLAN, but can connect to the Internet 3, and its seat is also managed. Therefore, as shown in (3) in Fig. 12, it is possible to know where the unknown person is sitting and what he or she is doing, and to grasp the situation through the display 707 of another registered PC 7.

[0097] Furthermore, when the USB device 8 for seat management is not connected to the unregistered PC 9, as shown in the row "No USB" in "Unregistered PC" in Fig. 11, it is unable to connect to either the VLAN or the Internet 3, and is not under seat management. Therefore, as shown in (4) in Fig. 12, it is possible to know through the display 707 of another registered PC 7 that an unknown person has accessed the UTM device 1 and attempted to use the network. Although not shown in Fig. 12, if the PC name is registered in association with the MAC address, it is also possible to display the PC name.

[0098] That is, (1) when a registered PC 7 and a USB device 8 are connected, it is possible to display network connection permission, location, name, and PC name. (2) When a registered PC 7 and a USB device 8 are not connected, it is not possible to display network connection permission or location, but it is possible to display the name and PC name. Also, (3) when an unregistered PC 9 and a USB device are connected, it is possible to display Internet connection permission, location, unknown person, and unknown PC. Also, (4) when an unregistered PC 9 and a USB device are not connected, it is possible to display network access not available, location unknown, unknown person, and unknown PC. Of course, for an unregistered PC 9, such as a visitor's PC, it is possible to change the settings to disable all network access even if a USB device 8 is connected.

[0099] [Effects of the embodiment] The UTM device 1 used in the network system of the above-described embodiment allows a registered PC to connect to the VLAN and the Internet 3. In addition, when a USB device 8 is connected to a registered PC 7, it becomes possible to automatically know who is using which seat in a free address office.

[0100] In contrast, in the case of an unregistered PC, connection to the VLAN and the Internet 3 is basically prohibited. However, when a USB device 8 is connected to an unregistered PC 9, connection to the Internet 3 is permitted, and in a free address office, the seat where the unregistered PC 9 is being used can be automatically identified. This makes it possible to call attention to the use of the unregistered PC 9.

[0101] Furthermore, by using different IP addresses in the network portion for the registered PC 7 and the unregistered PC 9, the registered PC 7 and the unregistered PC 9 can be managed as different segments.

[0102] In this way, the UTM device 1 of this embodiment can appropriately manage the network connections of communication terminal devices such as notebook PCs and the seats of employees in an office where a free address system is adopted.

[0103] There may also be cases where an unregistered PC 9 with a manually configured IP address is brought in and attempts to use the VLAN or the Internet 3 via the UTM device 1. In this case, however, since the MAC address of the unregistered PC 9 is not registered in the VLAN whitelist or WAN whitelist, it is possible to disable the use of both the VLAN and the Internet 3.

[0104] [Variations] In the above embodiment, the UTM device 1 and the seat management server device 4 are described as separate devices. However, the UTM device 1 and the seat management server device 4 enclosed by the dotted line in Fig. 1 can of course be configured as an integrated device.

[0105] In the above embodiment, the present invention is applied to a UTM device, but the present invention is not limited to this. The present invention can be applied to various devices that perform network connection management (network connection control) and are provided between the router 2 and the LAN 5 shown in FIG. 1 and do not include the security function unit 110.

[0106] Furthermore, in the above-described embodiment, when a USB device 8 is connected to an unregistered PC 9, a seat registration request and a WAN whitelist registration request are formed and sent to the UTM device 1. However, this is not limited to the above. When a USB device 8 is connected to an unregistered PC 9, a WAN whitelist registration request may not be sent, and only a seat registration request may be formed and sent to the UTM device 1. In this case, the UTM device 1 may be configured to determine whether the sender of the seat registration request is a registered PC 7 or an unregistered PC 9, and if it is determined that the sender is an unregistered PC 9, the MAC address of the unregistered PC 9 may be registered in the WAN whitelist.

[0107] In the above-described embodiment, the registered PC 7 and the unregistered PC 9 are connected to the UTM device 1 by wireless LAN. In this case, the information transmitted from the registered PC 7 and the unregistered PC 9 to the UTM device 1, such as a DHCP request, a seat registration request, and a WAN whitelist registration request, may include the SSID (Service Set Identifier) ​​of the AP 6(1), 6(2), ... that was passed through, and may be provided to the UTM device 1. This allows the UTM device 1 to know which AP 6 the information was transmitted through, which helps to grasp the approximate location of the registered PC 7 and the unregistered PC 9 in the office even if the USB device 8 is not connected.

[0108] Furthermore, if the seat being used by a registered PC 7 cannot be identified because the USB device 8 is not connected, the UTM device 1 can determine the IP address assigned to the registered PC 7 by referring to the address DB 106 based on the MAC address included in a DHCP request or the like from the registered PC 7. In the UTM device 1, for example, the control unit 102 functions to form a message that prompts the registered PC 7 to connect the USB device 8. The control unit 102 can also send this formed message to the registered PC 7 using the IP address to prompt the connection of the USB device 8.

[0109] Furthermore, if there is an unregistered PC 9 with a USB device 8 connected, the seat where the unregistered PC is being used can be identified. For this reason, the control unit of the UTM device 1 can notify the predetermined registered PC 7 used by the administrator of a message such as "An unregistered PC is being used in seat E-2F-01," to prompt confirmation or caution.

[0110] Of course, if there is an unregistered PC 9 to which no USB device 8 is connected, the control unit of the UTM device 1 can notify the predefined registered PC 7 used by the administrator of a message such as "An unregistered PC has requested a connection. Please be careful," to warn the administrator. In this case, if the SSID of the AP 6 that was passed through is known, it is possible to check the situation around the AP 6 and to check the usage status of the unregistered PC 9.

[0111] In the above-described embodiment, the USB device 8 is used as an external device, but the present invention is not limited to this. The external device associated with each desk in a free address office may be, for example, a wireless communication device equipped with a short-range wireless communication function conforming to the Bluetooth (registered trademark) standard. In this case, if the registered PC 7 and the unregistered PC 9 also have a short-range wireless communication function conforming to the Bluetooth (registered trademark) standard, simply placing the wireless communication device near the registered PC 7 or the unregistered PC 9 will enable reading of the device ID and presence authentication program that will enable communication.

[0112] However, when using a wireless communication device, it is necessary to limit the communication range to an extremely narrow range so as to prevent wireless communication with other nearby registered PCs 7 or unregistered PCs 9. For this reason, it is desirable to arrange some kind of external device capable of outputting its own device ID, not limited to the USB device 8, on each desk in one-to-one correspondence and connect it to the registered PCs 7 and unregistered PCs 9 by wire.

[0113] In the above embodiment, the present invention is applied to a free address office, but the present invention is not limited to this. It is also possible to apply the present invention to an office where each employee is assigned a fixed seat. Even in this case, there is an advantage that restrictions can be imposed when a device that is not a registered PC is connected, and when a registered PC 7 or an unregistered PC 9 is used at a seat other than the employee's own seat, the seat being used can be identified.

[0114] [others] As can be seen from the above description of the embodiment, the functions of the first, second and third reception means in the claims are realized by the connection terminal 107T and the LAN I / F 107 of the UTM device 1 in the embodiment. The functions of the inquiry means in the claims are realized by the MAC address inquiry unit 121 of the UTM device 1, and the functions of the assignment means in the claims are realized by the IP address assignment unit 122 of the UTM device 1. The functions of the first storage means in the claims are realized by the VLAN whitelist 104 of the UTM device 1, and the functions of the configuration means in the claims are realized by the VLAN configuration unit 123 of the UTM device 1. The functions of the update means in the claims are realized by the seat DB update unit 125 of the UTM device 1. The functions of the second storage means in the claims are realized by the WAN whitelist 105 of the UTM device 1, and the functions of the connection restriction means in the claims are realized by the WAN restriction unit 124 of the UTM device 1.

[0115] Moreover, an embodiment of the program according to the present invention is applied to a program that executes the processing shown in the flowchart of Fig. 10. Furthermore, the functions of the MAC address inquiry unit 121, the IP address assignment unit 122, the VLAN configuration unit 123, the WAN restriction unit 124, the seat DB update unit 125, and the connection control unit 126 of the UTM device 1 in the above-mentioned embodiment can also be realized as functions of the control unit 102 by a program executed in the control unit 102. [Explanation of symbols]

[0116] 1...UTM device, 101T...connection end, 101...communication I / F, 102...control unit, 103...storage device, 104...VLAN whitelist, 105...WAN whitelist, 106...address DB, 107T...connection end, 107...LAN I / F, 110...security function unit, 121...MAC address inquiry unit, 122...IP address assignment unit, 123...VLAN configuration unit, 124...WAN restriction unit, 125...seat DB update unit, 126...connection control unit, 2...router, 3...Internet, 4...seat management server device, 401T ...Connection end, 401...LAN I / F, 402...Control unit, 403...Storage device, 404...Seat DB, 405...User DB, 5...LAN, 6(1), 6(2)...AP, 7, 7(1), 7(2)...Registered PC, 701A...Wireless LAN antenna, 702...Wireless LAN communication unit, 702...Control unit, 703...Storage device, 704...USB I / F, 705...Operation unit, 706...Display controller, 707...Display, 708...Audio output processing unit, 709...Speaker, 710...Processing execution unit, 8...USB device, 9...Unregistered PC

Claims

1. a first receiving means for receiving an IP (Internet Protocol) address assignment request including device identification information of the communication terminal device from the communication terminal device; a querying means for querying whether the communication terminal device which is a source of the request for granting is permitted to be used and registered in advance, based on the device identification information included in the request for granting received through the first receiving means; an assigning means for assigning a first IP address when a result of the inquiry by said inquiry means indicates that the IP address is pre-registered, and for assigning a second IP address having a different aspect from said first IP address when a result of the inquiry by said inquiry means indicates that the IP address is not pre-registered; a configuration means for recording terminal identification information of the communication terminal device to which the first IP address is assigned by the assignment means in a first storage means, thereby configuring a virtual LAN (Local Area Network); A network connection management device comprising:

2. 2. The network connection management device according to claim 1, the communication terminal device is capable of transmitting a seat registration request including device identification information of the external device and device identification information of the communication terminal device itself when an external device that is in one-to-one correspondence with a seat is connected to the communication terminal device; a second receiving means for receiving the seat registration request from the communication terminal device; an update means for updating the device identification information in a seat database in which the device identification information and seat identification information for identifying the seat are associated with each other when the seat registration request is received through the second reception means; A network connection management device comprising:

3. 3. A network connection management device according to claim 2, the communication terminal device to which the second IP address has been assigned by the assignment means is capable of transmitting a registration request to a second storage means including device identification information of the communication terminal device when the external device is connected; a third receiving means for receiving the registration request to the second storage means from the communication terminal device; a connection restriction means for recording, in the second storage means, terminal identification information of the communication terminal device to which the first IP address has been assigned by the assignment means and the terminal identification information included in the registration request accepted through the third acceptance means, and for enabling the communication terminal device, the device identification information of which has been stored in the second storage means, to connect to the Internet; A network connection management device comprising:

4. A network connection management program executed on a computer to enable a communication terminal device to connect to a network in response to a request from the communication terminal device, comprising: the communication terminal device is capable of transmitting a seat registration request including device identification information of the external device and device identification information of the communication terminal device itself when an external device that is in one-to-one correspondence with a seat is connected to the communication terminal device; a first receiving step of receiving, from the communication terminal device, a request for assignment of an IP (Internet Protocol) address including device identification information of the communication terminal device; a query step of querying whether the communication terminal device that is a source of the grant request is permitted to be used and registered in advance based on the device identification information included in the grant request received in the first reception step; an assignment step of assigning a first IP address when the result of the inquiry in the inquiry step indicates that the IP address has been registered in advance, and assigning a second IP address having a different aspect from the first IP address when the result of the inquiry in the inquiry step indicates that the IP address has not been registered in advance; a configuration step of recording terminal identification information of the communication terminal device to which the first IP address has been assigned in the assignment step in a first storage means to configure a virtual LAN (Local Area Network); a second receiving step of receiving the seat registration request from the communication terminal device; an updating step of updating the device identification information in a seat database in which the device identification information and seat identification information for identifying the seat are associated with each other when the seat registration request is accepted through the second accepting step; A network connection management program comprising:

Images