Master device, communication control method, communication control program, and communication control system

Abstract

To reduce the workload involved in configuring communication control in a network.SOLUTION: A master device 10 receives an input of installation information indicating that a plurality of zones for a plurality of edge devices 20 is installed. The master device 10 acquires connection information from each of the plurality of edge devices 20, regarding terminals connected to each edge device 20. The master device 10 sets each of the plurality of zones as a group for the communication control, and classifies the terminals indicated by the connection information into the group corresponding to the zone in which the edge device 20 as an acquisition source of the connection information is installed.SELECTED DRAWING: Figure 4

Description

Technical Field

[0001] The present disclosure relates to a technique for controlling communication between terminals.

Background Art

[0002] In a control system for controlling factory equipment including manufacturing, the system configuration is generally divided and managed into a plurality of zones such as production management, production status monitoring, and production lines. For protected assets that are devices existing in the same zone, security measures of an equivalent level are required. Here, in the "Cyber-Physical Security Countermeasure Guidelines Ver1.0 for Factory Systems" of the Ministry of Economy, Trade and Industry, a zone is defined as an area where the content or importance of operations is equivalent. It is also described that security measures of an equivalent level are necessary for protected assets existing in the same zone.

[0003] Patent Document 1 describes detecting a terminal indicated by an address not present in a group list as an unclassified terminal and designating the group to which the unclassified terminal belongs. In Patent Document 1, by detecting unclassified terminals, the burden related to grouping terminals is reduced.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] The setting work for communication control to realize a secure network is mainly performed manually while referring to various information such as a network configuration diagram and individual terminal information, which is a very time-consuming and complicated task. Therefore, there is a problem that setting errors are likely to occur and it is burdensome in operation. By using the technique described in Patent Document 1, the labor of searching for unclassified terminals can be saved, so the burden on the setting work can be reduced to some extent. However, it is still necessary to perform settings for each terminal, resulting in a large burden and a high likelihood of setting errors. An object of the present disclosure is to reduce the work burden related to settings.

Means for Solving the Problem

[0006] The master device according to the present disclosure A zone reception unit that receives an input of installation information indicating in which zone among a plurality of zones the target edge device is installed, with each of the plurality of edge devices as the target edge device; An information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device; While setting each of the plurality of zones as a group for performing communication control, the terminal indicated by the connection information acquired by the information acquisition unit is classified into the group of the zone indicated by the installation information received by the zone reception unit, which is the zone where the edge device that is the acquisition source of the connection information is installed and includes.

Advantages of the Invention

[0007] In the present disclosure, a group is set for each zone, and the terminal is classified into the group of the zone where the edge device that is the acquisition source of the connection information is installed. As a result, it becomes possible to automatically classify terminals into groups, and the work burden related to settings can be reduced.

Brief Description of the Drawings

[0008]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Mode for Carrying Out the Invention

[0009] Embodiment 1. ***Description of Configuration*** Referring to FIG. 1, the configuration of the communication control system 1 according to Embodiment 1 will be described. The communication control system 1 includes a master device 10 and a plurality of edge devices 20. The master device 10 and each edge device 20 are connected via a network device 90. The master device 10 is a computer installed in a management center or the like for managing the communication control system 1. Each edge device 20 is a computer installed at a site such as a factory and an office, to which one or more terminals 30 are connected.

[0010] Referring to FIG. 2, the configuration of the master device 10 according to Embodiment 1 will be described. The master device 10 includes hardware such as a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to other hardware via signal lines and controls these other hardware.

[0011] The master device 10 includes, as functional components, a zone reception unit 111, a tree display unit 112, an information acquisition unit 113, a terminal classification unit 114, a change reception unit 115, a policy setting unit 116, and a setting transmission unit 117. The functions of the respective functional components of the master device 10 are realized by software. The storage 13 stores a program for realizing the functions of the respective functional components of the master device 10. This program is read into the memory 12 by the processor 11 and executed by the processor 11. Thereby, the functions of the respective functional components of the master device 10 are realized.

[0012] With reference to FIG. 3, the configuration of the edge device 20 according to Embodiment 1 will be described. The edge device 20 includes hardware such as a processor 21, a memory 22, a storage 23, and a communication interface 24. The processor 21 is connected to other hardware via signal lines and controls these other hardware.

[0013] The edge device 20 includes, as functional components, an address acquisition unit 211, an information transmission unit 212, a setting reception unit 213, a communication control unit 214, and a log acquisition unit 215. The functions of the respective functional components of the edge device 20 are realized by software. The storage 23 stores a program for realizing the functions of the respective functional components of the edge device 20. This program is read into the memory 22 by the processor 21 and executed by the processor 21. Thereby, the functions of the respective functional components of the edge device 20 are realized.

[0014] The processors 11 and 21 are ICs (Integrated Circuits) that perform processing. Specific examples of the processors 11 and 21 are a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit).

[0015] The memories 12 and 22 are storage devices that temporarily store data. As specific examples, the memories 12 and 22 are SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory).

[0016] The storages 13 and 23 are storage devices that store data. As a specific example, the storage 13 and 23 is an HDD (Hard Disk Drive). Also, the storage 13 and 23 may be a portable recording medium such as an SD (registered trademark, Secure Digital) memory card, a CF (CompactFlash, registered trademark), a NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD (Digital Versatile Disk).

[0017] The communication interfaces 14 and 24 are interfaces for communicating with external devices. As specific examples, the communication interfaces 14 and 24 are ports of Ethernet (registered trademark), USB (Universal Serial Bus), and HDMI (registered trademark, High-Definition Multimedia Interface).

[0018] ***Description of Operations*** With reference to FIGS. 4 to 9, the operations of the communication control system 1 according to Embodiment 1 will be described. The operation procedure of the communication control system 1 according to Embodiment 1 corresponds to the communication control method according to Embodiment 1. Also, the program for realizing the operations of the communication control system 1 according to Embodiment 1 corresponds to the communication control program according to Embodiment 1.

[0019] With reference to FIG. 4, the overall operations of the communication control system 1 according to Embodiment 1 will be described. As a prerequisite for the process shown in FIG. 4, as shown in FIG. 5, a plurality of zones 40 are set in the factory, with areas having the same business content or importance being defined as one zone 40. In FIG. 5, a production management zone 40, a production status monitoring zone 40, and a zone 40 for production line 1 are set. Edge devices 20 are arranged in each of the plurality of zones 40. One or more terminals 30 are connected to the edge device 20 arranged in each zone 40.

[0020] (Step S11: Zone reception process) The zone reception unit 111 of the master device 10 sets each of the plurality of edge devices 20 as the target edge device 20. The zone reception unit 111 receives an input of installation information indicating in which zone 40 among the plurality of zones 40 the target edge device 20 is installed. Specifically, the installation information of the zone 40 installed for each edge device 20 is input by the user using the master device 10. Then, the zone reception unit 111 receives the installation information of the zone 40 input for each edge device 20. The zone reception unit 111 associates the identification information of the edge device 20 with the identification information of the zone 40 and stores it in the memory 12. The identification information of the edge device 20 is, for example, the name of the edge device, such as the edge device name. The identification information of the zone 40 is, for example, the name of the zone, such as the zone name.

[0021] For example, as shown in FIG. 6, the tree display unit 112 displays on the display device an asset tree 50, which is tree structure data representing the factory as the root and each zone 40 as a child node with the root as the parent. Here, the factory is described as the root, but it may also be said that the communication control system 1 is the root. The zone reception unit 111 allows the input of installation information indicating the position where the edge device 20 is installed with respect to the asset tree 50. Specifically, in FIG. 6, the node representing the target edge device 20 is arranged as a child node with the node representing the zone 40 as the parent by the user, and thus the zone reception unit 111 receives the input of the installation information in which each edge device 20 is associated with the installed zone 40. For example, when installation information is input and received in this way, the edge device 20 with the edge device name Edge3 is set as a child node having the node representing the production management zone 40 as its parent. Also, the edge device 20 with the edge device name Edge2 is set as a child node having the node representing the production status monitoring zone 40 as its parent. Further, the edge device 20 with the edge device name Edge1 is set as a child node having the node representing the production line 1 zone 40 as its parent Here, an example is shown in which installation information associating each edge device 20 with the installed zone 40 is input and received by arranging the node representing the edge device 20 as a child node having the node representing the zone 40 as its parent using the asset tree 50 which is tree structure data. However, setting data associating each edge device 20 with the installed zone 40 may be prepared by the user, and the zone reception unit 111 may receive the input of the installation information by reading the setting data. As long as each edge device 20 can be associated with the installed zone 40, the installation information may be received by other input methods

[0022] (Step S12: Address acquisition process) The address acquisition unit 211 of each edge device 20 acquires the address 61 of the terminal 30 connected within the same network as the edge device 20 and connected to the terminal side. The same network refers to a network having the same network address. At this time, the address acquisition unit 211 may acquire the address 61 of the connected terminal 30 for each port Here, as shown in FIG. 7, the address acquisition unit 211 acquires the IP address and the MAC address as the address 61 of the terminal 30. IP is the abbreviation of Internet Protocol. MAC is the abbreviation of Media Access Control

[0023] The information transmission unit 212 of each edge device 20 transmits the address 61 with the terminal information 62 added as the connection information 63 to the master device 10 Here, as shown in FIG. 7, the information transmission unit 212 adds, as the terminal information 62, the edge device name, the terminal name, and the terminal type. The edge device name is the name of the edge device 20 connected to the network to which the terminal 30 is connected. Here, the name of the edge device 20 including the information transmission unit 212 is set. The terminal name is a name for easily identifying the terminal 30. The terminal type is information indicating the type of the terminal 30. The terminal name and the terminal type may be set only when they can be extracted from the terminal 30. In addition to these, the information transmission unit 212 may set the manufacturer information of the terminal 30 as the terminal information 62. The manufacturer information is information that can identify the manufacturer, such as the manufacturer name of the manufacturing manufacturer specified from the company code of the MAC address.

[0024] (Step S13: Classification process) The information acquisition unit 113 of the master device 10 receives the connection information 63 transmitted in step S12. In step S12, since the address acquisition unit 211 acquires the address 61 of the terminal 30 connected to the terminal side, the address 41 of the same terminal 30 is not transmitted from a plurality of edge devices 20. The terminal classification unit 114 of the master device 10 sets each of the plurality of zones as a group for controlling communication by default. Then, the terminal classification unit 114 classifies the terminal 30 indicated by the connection information 63 acquired by the information acquisition unit 113 into the group of the zone 40 where the edge device 20 that is the acquisition source of the connection information 63 is installed, by default.

[0025] Assume that edge devices 20 are installed in each zone 40 as shown in FIG. 6 and installation information is received. Then, as shown in FIG. 8, a check indicating that the MES Server and EWS01, which are terminals 30 indicated by the connection information 63 received from the edge device 20 named Edge3, are classified into the group of the production management zone 40 is automatically displayed. A check indicating that SCADA1 and HMI1, which are terminals 30 indicated by the connection information 63 received from the edge device 20 named Edge2, are classified into the group of the production status monitoring zone 40 is automatically displayed. A check indicating that PLC01, F-Device01, F-Device02, and F-Device03, which are terminals 30 indicated by the connection information 63 received from the edge device 20 named Edge1, are classified into the group of the production line 1 zone 40 is automatically displayed.

[0026] (Step S14: Change reception process) The change reception unit 115 displays the group classified by the terminal classification unit 114 together with the connection information 63 acquired by the information acquisition unit 113 in step S13, and receives a change to the group. Specifically, the change reception unit 115 displays information as shown in FIG. 8. When a change to the group is input by the user of the master device 10, the input is received, and the group of the terminal 30 is changed according to the input. When no change to the group is input, the group remains as classified in step S13.

[0027] (Step S15: Policy setting process) The policy setting unit 116 of the master device 10 sets a policy 64 for controlling communication between groups using the group set in step S14. Specifically, the policy setting unit 116 sets a policy 64 indicating that communication between the same group and different groups is permitted, and for communication between different groups, a log is to be acquired. Also, the policy setting unit 116 sets a policy 64 that does not permit communication with a terminal 30 that does not belong to any group. At this time, the policy setting unit 116 may accept a change to the policy 64 from the user of the master device 10. That is, after setting the above-described policy 64 as the default, the policy setting unit 116 may change the policy 64 as necessary. At this time, the policy setting unit 116 may set other policies in units of groups. Then, the setting transmission unit 117 of the master device 10 transmits the policy 64 to each of the plurality of edge devices 20.

[0028] (Step S16: Communication control process) The setting reception unit 213 of each edge device 20 receives the policy 64 transmitted in step S15. The communication control unit 214 of each edge device 20 controls the communication between the terminals 30 based on the policy 64. That is, for communication between terminals 30 belonging to a group set to permit communication by the policy 64, the communication control unit 214 permits the communication and allows the data to pass through. On the other hand, for communication between terminals 30 belonging to a group set not to permit communication by the policy 64, the communication control unit 214 does not permit the communication and does not allow the data to pass through. In addition, when it is set to acquire a log by the policy 64, the log acquisition unit 215 acquires a communication log.

[0029] (Step S17: Status display process) As shown in FIG. 9, the tree display unit 112 monitors the status of the target terminal 30 with each terminal 30 as the target terminal 30, and changes the color etc. of the node corresponding to the target terminal 30 in the asset tree 50 according to the status of the target terminal 30. The status of the terminal 30 is, for example, a state of operating normally and a state in which an error has occurred. In FIG. 9, the node of F-Device01 is hatched, indicating that it is not normal. In the asset tree 50, each terminal 30 is displayed separately for each zone 40. Therefore, for each zone 40, it is possible to easily confirm what state the terminals 30 in that zone 40 are in. Note that the display of the nodes in the zone 40 to which the target terminal 30 belongs may be changed according to the state of the target terminal 30. This makes it easier to grasp the state of each zone 40.

[0030] When introducing the communication control system 1, the processes from step S11 to step S16 are executed in order. After that, the processes of step S15 and step S16 are continuously executed, and the communication between the terminals 30 is controlled. When the processes of step S15 and step S16 are being executed, the process of step S13 may be executed by interruption. That is, the group may be changed during communication control. Also, when the processes of step S15 and step S16 are being executed, the reception of the change of the policy 64 described in step S14 may be accepted.

[0031] ***Effect of Embodiment 1*** As described above, the communication control system 1 according to Embodiment 1 sets a group by default for each zone 40, and classifies the terminal 30 into the group of the zone 40 where the edge device 20 as the acquisition source of the connection information is installed by default. Thereby, it becomes possible to automatically classify the terminal 30 into a group, and the work load related to the setting can be reduced.

[0032] Also, the communication control system 1 according to Embodiment 1 sets a policy 64 for controlling the communication between groups based on the automatically classified groups. Then, the communication control system 1 controls the communication between the terminals 30 according to the policy 64. As a result, the same communication control is performed on each terminal 30 existing in the same zone 40. Therefore, regarding communication control, security measures of the same level are applied to the terminals 30 existing in the same zone 40.

[0033] In addition, the communication control system 1 according to Embodiment 1 displays the states of the respective terminals 30 using an asset tree 50 that displays the terminals 30 classified for each zone 40. Thereby, for each zone 40, it is possible to easily confirm what state the terminals 30 in that zone 40 are in.

[0034] ***Other configurations*** <Modification Example 1> In Embodiment 1, it is assumed that installation information of the zone 40 installed for each edge device 20 is input by the user who uses the master device 10 in step S11 of FIG. 4. However, for each edge device 20, installation information of the zone 40 installed by the user who installs the edge device 20 may be set for the edge device 20 when the edge device 20 is installed. In this case, each edge device 20 transmits the set installation information of the zone 40 to the master device 10. Then, the zone reception unit 111 receives the installation information of the zone 40 transmitted and input from each edge device 20. Thereby, by setting in the edge device 20 which zone 40 it is installed in at the time of installing the edge device 20, it becomes unnecessary for the user of the master device 10 to confirm in which zone 40 each edge device 20 is installed.

[0035] <Modification Example 2> In Embodiment 1, it is assumed that installation information on which zone 40 each of the all edge devices 20 is installed is input in step S11 of FIG. 4. However, there is a possibility that installation information on which zone 40 some of the edge devices 20 are installed may not be input. In this case, the edge device 20 for which the installation information is not input and the source terminal 30 are not classified into a group in step S13 of FIG. 4. Therefore, after the terminal 30 is classified into a group in step S13, the information acquisition unit 113 may extract the terminals 30 that are not classified into any group as unclassified terminals. Then, in step S14 of FIG. 4, the terminal classification unit 114 may cause the group to which the unclassified terminal belongs to be specified.

[0036] <Modification Example 3> In Embodiment 1, each functional component was realized by software. However, as a modification example 3, each functional component may be realized by hardware. Regarding this modification example 3, the differences from Embodiment 1 will be described.

[0037] When each functional component is realized by hardware, the master device 10 includes an electronic circuit instead of the processor 11, the memory 12, and the storage 13. The electronic circuit is a dedicated circuit that realizes the functions of each functional component, the memory 12, and the storage 13. Similarly, when each functional component is realized by hardware, the edge device 20 includes an electronic circuit instead of the processor 21, the memory 22, and the storage 23. The electronic circuit is a dedicated circuit that realizes the functions of each functional component, the memory 22, and the storage 23.

[0038] As the electronic circuit, a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, a logic IC, a GA, an ASIC, an FPGA are assumed. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array. Each functional component may be realized by one electronic circuit, or each functional component may be realized by being distributed among a plurality of electronic circuits.

[0039] <Modification Example 4> As a modification example 4, some of each functional component may be realized by hardware, and the other each functional component may be realized by software.

[0040] The processor 11, the memory 12, the storage 13, and the electronic circuit are referred to as a processing circuit. That is, the functions of each functional component are realized by the processing circuit.

[0041] In addition, the "section" in the above description may be read as "circuit", "step", "procedure", "process", or "processing circuit".

[0042] Hereinafter, various aspects of the present disclosure will be collectively described as appendices. (Appendix 1) A zone reception unit that receives an input of installation information indicating in which zone among a plurality of zones a target edge device is installed, with each of the plurality of edge devices as the target edge device; An information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device; A terminal classification unit that sets each of the plurality of zones as a group for controlling communication, and classifies the terminal indicated by the connection information acquired by the information acquisition unit into the group of the zone indicated by the installation information received by the zone reception unit and in which the edge device that is the acquisition source of the connection information is installed; A master device comprising: (Appendix 2) The master device further comprises: A policy setting unit that sets a policy for controlling communication between groups using the group set by the terminal classification unit; The master device according to Appendix 1, comprising: (Appendix 3) The policy permits communication between the same group and different groups, and indicates that logs are acquired for communication between the different groups. The master device according to Appendix 2. (Appendix 4) The master device further comprises: A change reception unit that displays the group classified by the terminal classification unit together with the connection information acquired by the information acquisition unit for the terminal and receives a change of the group; The master device according to any one of Appendices 1 to 3, comprising: (Appendix 5) The master device further comprises: A tree display unit that displays tree structure data in which each of the plurality of zones is a node, each of the plurality of edge devices is a child node with the node of the zone in which the edge device is installed as the parent, and the terminal is a child node with the node of the edge device that is the acquisition source of the connection information as the parent The master device according to any one of Appendices 1 to 4 including this (Appendix 6) The master device according to Appendix 5, wherein the tree display unit changes the display of the node of the terminal according to the state of the terminal (Appendix 7) A computer receives input of installation information indicating in which zone of a plurality of zones a target edge device is installed, with each of the plurality of edge devices as the target edge device, The computer acquires connection information of a terminal connected to the target edge device from the target edge device, A communication control method in which a computer sets each of the plurality of zones as a group for performing communication control, and classifies the terminal indicated by the connection information into the group of the zone indicated by the installation information, which is the zone where the edge device that is the acquisition source of the connection information is installed (Appendix 8) A zone reception process that receives input of installation information indicating in which zone of a plurality of zones a target edge device is installed, with each of the plurality of edge devices as the target edge device, An information acquisition process that acquires connection information of a terminal connected to the target edge device from the target edge device, A terminal classification process that sets each of the plurality of zones as a group for performing communication control, and classifies the terminal indicated by the connection information acquired by the information acquisition process into the group of the zone indicated by the installation information received by the zone reception process, which is the zone where the edge device that is the acquisition source of the connection information is installed A communication control program that causes a computer to function as a master device that performs these (Appendix 9) A communication control system including a plurality of edge devices and a master device, wherein the master device has a zone reception unit that receives an input of installation information indicating in which zone among a plurality of zones each of the plurality of edge devices is installed, with each of the plurality of edge devices being a target edge device; an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device; sets each of the plurality of zones as a group for controlling communication, and classifies the terminal indicated by the connection information acquired by the information acquisition unit into the group of the zone indicated by the installation information received by the zone reception unit and in which the edge device that is the acquisition source of the connection information is installed; a policy setting unit that sets a policy for controlling communication between groups using the group set by the terminal classification unit; a setting transmission unit that transmits the policy set by the policy setting unit to each of the plurality of edge devices; and each of the plurality of edge devices has a communication control unit that controls communication between terminals based on the policy transmitted by the setting transmission unit. A communication control system.

[0043] The embodiments and modifications of the present disclosure have been described above. Some of these embodiments and modifications may be implemented in combination. Also, any one or some of them may be partially implemented. Note that the present disclosure is not limited to the above embodiments and modifications, and various changes can be made as necessary.

Description of Reference Numerals

[0044] 1 Communication control system, 10 Master device, 11 Processor, 12 Memory, 13 Storage, 14 Communication interface, 111 Zone reception unit, 112 Tree display unit, 113 Information acquisition unit, 114 Terminal classification unit, 115 Change reception unit, 116 Policy setting unit, 117 Setting transmission unit, 20 Edge device, 21 Processor, 22 Memory, 23 Storage, 24 Communication interface, 211 Address acquisition unit, 212 Information transmission unit, 213 Setting reception unit, 214 Communication control unit, 215 Log acquisition unit, 30 Terminal, 40 Zone, 50 Asset tree, 61 Address, 62 Terminal information, 63 Connection information, 64 Policy, 90 Network device.

Claims

1. A zone reception unit that receives an input of installation information indicating in which zone among a plurality of zones a target edge device is installed, with each of the plurality of edge devices being the target edge device; An information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device; A terminal classification unit that sets each of the plurality of zones as a group for controlling communication, and classifies the terminal indicated by the connection information acquired by the information acquisition unit into the group of the zone indicated by the installation information received by the zone reception unit and in which the edge device that is the acquisition source of the connection information is installed; A master device comprising the above.

2. The master device further comprises: A policy setting unit that sets a policy for controlling communication between groups using the group set by the terminal classification unit. The master device according to Claim 1, comprising the above.

3. The policy indicates that while permitting communication between the same group and between different groups, a log is acquired for communication between the different groups. The master device according to Claim 2.

4. The master device further comprises: A change reception unit that displays the group classified by the terminal classification unit together with the connection information acquired by the information acquisition unit for the terminal, and receives a change of the group. The master device according to Claim 1, comprising the above.

5. The master device further comprises: A tree display unit that displays tree structure data in which each of the plurality of zones is a node, each of the plurality of edge devices is a child node having the node of the zone in which it is installed as a parent, and the terminal is a child node having the node of the edge device that is the acquisition source of the connection information as a parent. The master device according to Claim 1, comprising the above.

6. The master device according to Claim 5, wherein the tree display unit changes the display of the node of the terminal according to the state of the terminal.

7. A computer receives an input of installation information indicating in which zone among a plurality of zones a target edge device is installed, with each of the plurality of edge devices being the target edge device; A computer acquires connection information of a terminal connected to the target edge device from the target edge device; A communication control method in which a computer sets each of the plurality of zones as a group for controlling communication, and classifies the terminal indicated by the connection information into the group of the zone indicated by the installation information, which is the zone where the edge device that is the acquisition source of the connection information is installed.

8. A zone reception process that accepts input of installation information indicating in which zone among a plurality of zones each of a plurality of edge devices is installed, with each edge device as a target edge device; An information acquisition process that acquires connection information of a terminal connected to the target edge device from the target edge device; A terminal classification process that sets each of the plurality of zones as a group for controlling communication, and classifies the terminal indicated by the connection information acquired by the information acquisition process into the group of the zone indicated by the installation information received by the zone reception process, which is the zone where the edge device that is the acquisition source of the connection information is installed A communication control program that causes a computer to function as a master device that performs the above.

9. A communication control system including a plurality of edge devices and a master device, wherein the master device has a zone reception unit that accepts input of installation information indicating in which zone among a plurality of zones each of the plurality of edge devices is installed, with each edge device as a target edge device; an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device; a terminal classification unit that sets each of the plurality of zones as a group for controlling communication, and classifies the terminal indicated by the connection information acquired by the information acquisition unit into the group of the zone indicated by the installation information received by the zone reception unit, which is the zone where the edge device that is the acquisition source of the connection information is installed; a policy setting unit that sets a policy for controlling communication between groups using the group set by the terminal classification unit; and a setting transmission unit that transmits the policy set by the policy setting unit to each of the plurality of edge devices and is provided with, wherein each of the plurality of edge devices has a communication control unit that controls communication between terminals based on the policy transmitted by the setting transmission unit A communication control system.

Images