Processing device, processing system, processing method, and program

Abstract

To provide a processing device that can easily determine the communication path. [Solution] The processing device includes a control means that causes the device to display a single piece of information indicating a range of IP addresses, which is an aggregate of information indicating consecutive IP (Internet Protocol) addresses listed in the access control list.

Description

Technical Field

[0001] The present disclosure relates to a processing apparatus, a processing system, a processing method, and a program.

Background Art

[0002] Data communication via communication networks is performed in various technical fields. Patent Document 1 discloses, as a related technology, a technology related to an apparatus that searches for the shortest path and specifies route ACL (Access Control List) information associated with network device names on the shortest path.

Prior Art Literature

Patent Literature

[0003]

Patent Literature 1

Summary of the Invention

Problem to be Solved by the Invention

[0004] In the technical field related to communication such as that described in Patent Document 1, there is a demand for a technology that enables easy grasping of communication paths.

[0005] One object of various aspects of the present disclosure is to provide a processing apparatus, a processing system, a processing method, and a program that can solve the above problem.

Means for Solving the Problem

[0006] According to one aspect of the present disclosure, the processing apparatus comprises control means for displaying one piece of information indicating an aggregated IP address range, which is aggregated from information indicating consecutive IP (Internet Protocol) addresses described in an access control list.

[0007] According to one aspect of the present disclosure, the processing system comprises the above-mentioned processing device and a display device that displays a single piece of information indicating a range of IP addresses, which is an aggregate of information indicating consecutive IP addresses listed in the access control list by the processing device.

[0008] According to another aspect of this disclosure, the processing method includes displaying a single piece of information indicating a range of IP addresses, which is an aggregate of information indicating consecutive IP (Internet Protocol) addresses listed in the access control list.

[0009] According to another aspect of this disclosure, the program causes a computer to display a single piece of information indicating a range of IP addresses, which is an aggregate of information indicating consecutive IP (Internet Protocol) addresses listed in an access control list. [Effects of the Invention]

[0010] According to each aspect of this disclosure, an appropriate degeneracy threshold can be dynamically adjusted. [Brief explanation of the drawing]

[0011] [Figure 1] This figure shows an example of the configuration of a processing system according to some embodiments of the present disclosure. [Figure 2] This figure shows an example of the configuration of an apparatus according to some embodiments of the present disclosure. [Figure 3] This figure shows an example of router information according to some embodiments of the present disclosure. [Figure 4] This figure shows an example of information indicating the number of access control lists used in each function according to some embodiments of this disclosure. [Figure 5] This figure shows an example of the settings for each function according to some embodiments of this disclosure. [Figure 6] This figure shows an example of the processing flow of a processing system according to some embodiments of the present disclosure. [Figure 7] It is a diagram illustrating an example of an access control list according to some embodiments of the present disclosure. [Figure 8] It is a first diagram for explaining processing performed by an aggregation unit according to some embodiments of the present disclosure. [Figure 9] It is a diagram illustrating an example of an access list according to some embodiments of the present disclosure. [Figure 10] It is a second diagram for explaining processing performed by an aggregation unit according to some embodiments of the present disclosure. [Figure 11] It is a diagram illustrating an example of a processing flow of a processing system according to some embodiments of the present disclosure. [Figure 12] It is a diagram illustrating an example of first information according to some embodiments of the present disclosure. [Figure 13] It is a diagram illustrating an example of second information according to some embodiments of the present disclosure. [Figure 14] It is a diagram illustrating an example of an access control list according to some embodiments of the present disclosure. [Figure 15] It is a diagram illustrating an example of third information according to some embodiments of the present disclosure. [Figure 16] It is a diagram illustrating an example of an access control list according to some embodiments of the present disclosure. [Figure 17] It is a diagram illustrating an example of fourth information according to some embodiments of the present disclosure. [Figure 18] It is a diagram illustrating an example of an access control list according to some embodiments of the present disclosure. [Figure 19] It is a diagram illustrating an example of a configuration of a processing apparatus according to some embodiments of the present disclosure. [Figure 20] It is a diagram illustrating an example of a processing flow of a processing apparatus according to some embodiments of the present disclosure. [Figure 21] It is a schematic block diagram illustrating a configuration of a computer according to at least one embodiment. DETAILED DESCRIPTION OF EMBODIMENTS

[0012] The embodiments will be described in detail below with reference to the drawings. <Embodiment> A processing system 1 according to an embodiment of this disclosure will be described with reference to the drawings. The processing system 1 is a system that can easily grasp the communication path.

[0013] (Configuration of the processing system) Figure 1 is a diagram showing an example of the configuration of a processing system 1 according to some embodiments of the present disclosure. The processing system 1 according to the embodiments of the present disclosure comprises routers 10a, 10b, 10c, a processing unit 20, and a display device 30, as shown in Figure 1. When it is not necessary to distinguish between routers 10a, 10b, and 10c, routers 10a, 10b, and 10c may be collectively referred to as router 10.

[0014] Each of the routers 10 stores an Access Control List (ACL). Each router 10 also stores router information X1, which is information about the router itself. Each router 10 controls communication access to the controlled communication devices based on the Access Control List (ACL). The Access Control List (ACL) is a list for controlling communication access. The Access Control List (ACL) contains the IP (Internet Protocol) addresses of the communication devices controlled by the router 10. Details of the Access Control List (ACL) will be described later. Details of router information X1 will also be described later.

[0015] Figure 2 shows an example of the configuration of a processing unit 20 according to some embodiments of the present disclosure. As shown in Figure 2, the processing unit 20 comprises a collection unit 201, an aggregation unit 202, a control unit 203, a storage unit 204, and a preprocessing unit 205.

[0016] The collection unit 201 obtains the access control list (ACL) stored by each router 10 from each router 10. The collection unit 201 outputs the obtained access control list (ACL) to the aggregation unit 202.

[0017] Furthermore, the collection unit 201 acquires router information X1 stored by each router 10 from each router 10. The collection unit 201 outputs the acquired router information X1 to the aggregation unit 202. Figure 3 is a diagram showing an example of router information X1 according to some embodiments of the present disclosure. As shown in Figure 3, the router information X1 includes information indicating an ID (IDentification) for uniquely identifying the router 10, and information indicating the location to which the router 10 belongs. An example of information indicating the ID is a MAC (Media Access Control) address. The information indicating the ID can be any information that can uniquely identify the router 10.

[0018] Furthermore, the collection unit 201 retrieves the settings for each function stored by each router 10 from each router 10. Details of the settings for each function will be described later.

[0019] The aggregation unit 202 receives an access control list (ACL) from the collection unit 201. Based on the received access control list (ACL), the aggregation unit 202 generates an access list (AL). The access list (AL) is a list for displaying the contents of the access control list (ACL). For example, the aggregation unit 202 generates the access list (AL) by grouping consecutive IP addresses in the access control list (ACL). The aggregation unit 202 outputs the generated access list (AL) to the control unit 203. Details of the access list (AL) will be described later.

[0020] Furthermore, the aggregation unit 202 receives router information X1 from the collection unit 201. The aggregation unit 202 also receives information X2 from the preprocessing unit 205, which includes the number of access control lists (ACLs) used for each function. From the received router information X1 and information X2, the aggregation unit 202 generates first information I1, which is information showing the relationship between the group of routers 10 and the functions used in the access control lists (ACLs). Specifically, the aggregation unit 202 identifies the router group, which is the group of routers 10, from the number of IDs used to uniquely identify the routers 10 included in the router information X1. The aggregation unit 202 also identifies the functions used in the access control lists (ACLs) from information X2. Details of the first information I1 will be described later.

[0021] The control unit 203 performs various controls that the processing unit 20 performs. For example, the control unit 203 receives the access list AL from the aggregation unit 202. The control unit 203 then displays the received access list AL on the display device 30.

[0022] The storage unit 204 stores various information necessary for the processing performed by the processing unit 20. For example, the storage unit 204 stores the access control list (ACL) acquired by the collection unit 201. Also, for example, the storage unit 204 stores the access list (AL) generated by the aggregation unit 202.

[0023] The preprocessor 205 receives the settings for each function from the collection unit 201. Each function is a function of the router 10 that is required for the management of the router 10 or a function used for controlling communication, and which utilizes an access control list ACL stored by the router 10. The settings for each function are information about each function, including the access control list ACL used by that function. Figure 4 is a diagram showing an example of information X2 including the number of access control list ACLs used by each function according to some embodiments of this disclosure. The preprocessor 205 reads the number of access control list ACLs used by each function from the received settings for each function. From the number of access control list ACLs used by each function that the preprocessor 205 has read, it generates information X2 including the number of access control list ACLs used by each function, for example, as shown in Figure 4. The preprocessor 205 then outputs the generated information X2 to the aggregation unit 202. The number of access control lists (labeled ACL in Figure 4) used for each function in Figure 4 represents the number of access control lists (ACLs) used by each function, such as Filter, PBR (Policy Based Routing), and SSH (Secure Shell). Figure 5 is a diagram showing an example of the settings for each function according to some embodiments of this disclosure. For example, if router 10a stores the settings for each function as shown in Figure 5 (similar to access control lists (ACLs), with one function set per line), the collection unit 201 collects the settings for each function from router 10a.

[0024] In the settings for each function (for example, Figure 5), the bolded elements in each row represent the access control list name. Note that the other elements in the settings for each function are specific to each function and do not affect the creation of information X2, which contains information indicating the number of access control lists (ACLs) used by each function.

[0025] In the example shown in Figure 5, the number of access control lists used by router 10a's Filter is acl-gyoumu and acl-internt, which is 2 (the first and second lines are counted as one because they have the same access control list name, acl-gyoumu). Also, the number of access control lists used by BPR is acl-internt, which is 1. Furthermore, the number of access control lists used by SSH is acl-gyoumu, which is 1.

[0026] As described above, each of the routers 10 stores information indicating what function it is and the name of the access control list to use for each setting (i.e., it has settings to control the function and communication access).

[0027] The display device 30 displays the access list AL under the control of the control unit 203 of the processing device 20.

[0028] The processing performed by the processing system 1 according to the embodiment of this disclosure is merely an example, and the processing performed by the processing system 1 is not limited to the processing described above. For example, the processing system 1 may perform the processing described below.

[0029] (Processing performed by the processing system) Figure 6 shows an example of the processing flow of processing system 1 according to some embodiments of the present disclosure. Here, referring to Figure 6, the process by which processing system 1 generates an access list AL and displays the generated access list AL will be described.

[0030] The collection unit 201 obtains the access control list ACL stored by each router 10 from each router 10 (step S1). The collection unit 201 outputs the obtained access control list ACL to the aggregation unit 202. The details of the access control list ACL will now be explained.

[0031] Figure 7 shows an example of an access control list ACL according to some embodiments of the present disclosure. The access control list ACL is a list that sets conditions and whether to allow or deny the communication of relevant packets for each router 10. The access control list ACL contains information listed in the following order: [Access Control List Name] [Sequence Number] [Action] [Protocol] [Source] [Destination] [Options]. The conditions set here are the contents described by the [Access Control List Name] and [Sequence Number]. The settings for allowing or denying the communication of relevant packets are also the contents described by the [Access Control List Name] and [Sequence Number].

[0032] Part 7(a) of Figure 7 shows the access control list (ACL) of router 10a, which is one of the routers 10. Part 7(b) of Figure 7 shows the access control list (ACL) of router 10b, which is another of the routers 10. Part 7(c) of Figure 7 shows the access control list (ACL) of router 10c, which is yet another of the routers 10.

[0033] For example, in the access control list (ACL) of router 10a shown in part (a) of Figure 7, the access control list name "acl-gyoumu" has three sequence numbers: "110", "200", and "60000". Sequence number "110" has the action "deny", protocol "ip", source "src 10.1.1.2 / 31", and destination "dest 20.0.0.1 / 32". Sequence number "200" has the action "deny", protocol "ip", source "src 10.1.1.4 / 30", and destination "dest 20.0.0.1 / 32". Sequence number "60000" has the action "permit", protocol "ip", source "src any", and destination "dest any". Note that the access control list (ACL) for router 10a shown in part (a) of Figure 7 does not include any options.

[0034] Furthermore, for example, in the access control list ACL of router 10b shown in part (b) of Figure 7, the access control list name "acl-gyoumu" has three sequence numbers "110", "200", and "60000". For sequence number "110", the action is "deny", the protocol is "ip", the source is "src 10.1.1.2 / 31", and the destination is "dest 20.0.0.1 / 32". For sequence number "200", the action is "deny", the protocol is "ip", the source is "src 10.1.1.4 / 30", and the destination is "dest 20.0.0.1 / 32". For sequence number "60000", the action is "permit", the protocol is "ip", the source is "src any", and the destination is "dest any". Note that the access control list (ACL) for router 10b shown in part (b) of Figure 7 does not include any options.

[0035] Furthermore, for example, in the access control list ACL of router 10c shown in section (c) of Figure 7, two sequence numbers, "200" and "60000," are listed for the access control list name "acl-internet." For sequence number "200," the action "deny," protocol "ip," source "src 20.2.1.4 / 30," and destination "dest 20.0.0.1 / 32" are listed. For sequence number "60000," the action "permit," protocol "ip," source "src any," and destination "dest any" are listed. Note that no options are listed in the access control list ACL of router 10c shown in section (c) of Figure 7.

[0036] The aggregation unit 202 receives the access control list ACL from the collection unit 201. Based on the received access control list ACL, the aggregation unit 202 generates an access list AL (step S2). The aggregation unit 202 outputs the generated access list AL to the control unit 203. Here, the details of the access list AL will be explained by showing a specific example of how the aggregation unit 202 generates the access list AL based on the access control list ACL. Note that the processing in steps S2a1 to S2a10 shown below shows a more detailed processing of step S2 performed by the aggregation unit 202 for each access control list ACL for each router 10 received from the collection unit 201.

[0037] The aggregation unit 202 extracts the [Action], [Protocol], [Source], and [Destination] portions from the access control list (ACL). The aggregation unit 202 determines whether the IP addresses indicating the source are consecutive in the extracted portions (step S2a1). If the aggregation unit 202 determines that the IP addresses indicating the source are consecutive (YES in step S2a1), it groups the consecutive IP addresses indicating the source together (step S2a2).

[0038] Figure 8 is a first diagram illustrating the processing performed by the aggregation unit 202 according to some embodiments of the present disclosure. For example, when the aggregation unit 202 receives an access control list ACL of router 10a shown in part 7(a) from the collection unit 201, it determines that the actions indicated by part A shown in part 8(a) are the same and that the source IP addresses are consecutive. The aggregation unit 202 then groups the source IP addresses indicated by part A shown in part 8(a) together, such as "10.1.1.2-10.1.1.7".

[0039] Next, the aggregation unit 202 determines whether the destination IP addresses in the access control list (ACL) are consecutive (step S2a3). If the aggregation unit 202 determines that the destination IP addresses are consecutive (YES in step S2a3), it groups the consecutive destination IP addresses together (step S2a4). The aggregation unit 202 then terminates the process in step S2.

[0040] For example, when the aggregation unit 202 receives the access control list ACL of router 10a shown in part 7(a) of Figure 7 from the collection unit 201, it determines that the destination IP addresses indicated by the part labeled B shown in part 8(a) are consecutive (in this case, identical). The aggregation unit 202 then groups the destination IP addresses indicated by the part labeled B shown in part 8(a) of Figure 8 together, such as "20.0.0.1". The aggregation unit 202 then terminates the processing in step S2.

[0041] Furthermore, if the aggregation unit 202 determines that the IP addresses indicating the source are not consecutive (NO in step S2a1), or if it determines that the IP addresses indicating the destination are not consecutive (NO in step S2a3), it terminates the process in step S2.

[0042] Figure 9 shows an example of an access list AL according to some embodiments of the present disclosure. The access list AL shown in Figure 9 is an access list generated by the aggregation unit 202 when the aggregation unit 202 receives an access control list ACL of router 10a shown in part 7(a) of Figure 7 from the collection unit 201. The access list AL is a list generated by grouping consecutive IP addresses in the access control list ACL together, and as shown in Figure 9, it is a list that shows the relationship between the source IP address and the destination IP address.

[0043] Furthermore, when the aggregation unit 202 receives the access control list ACL of router 10b shown in part (b) of Figure 7 from the collection unit 201, it consolidates the source IP addresses into a single format such as "10.1.1.1-10.1.1.7" and the destination IP addresses into a single format such as "20.0.0.1".

[0044] Furthermore, when the aggregation unit 202 receives the access control list ACL of router 10c shown in part (c) of Figure 7 from the collection unit 201, it determines NO in the processing of step S2a1 and terminates the processing of step S2.

[0045] Figure 10 is a second diagram illustrating the processing performed by the aggregation unit 202 according to some embodiments of the present disclosure. For example, if the [Action], [Protocol], [Source], and [Destination] sections of the access control list ACL are as shown in section (a) of Figure 10, the aggregation unit 202 determines that the source IP addresses in the first and second lines of section (a) of Figure 10 are consecutive. The aggregation unit 202 then combines the source IP addresses in the first and second lines of section (a) of Figure 10 into a single unit. As a result, the access list AL becomes the access list shown in section (b) of Figure 10. Next, the aggregation unit 202 determines that the source IP addresses in the second and third lines of section (b) of Figure 10 are consecutive. The aggregation unit 202 then combines the source IP addresses in the second and third lines of section (b) of Figure 10 into a single unit. As a result, the access list AL becomes the access list shown in section (c) of Figure 10. Next, the aggregation unit 202 determines that the source IP addresses in the first and second rows of section (c) in Figure 10 are consecutive. Then, the aggregation unit 202 combines the source IP addresses in the first and second rows of section (c) in Figure 10 into a single unit. As a result, in this case, the aggregation unit 202 ultimately generates the access list AL shown in section (d) of Figure 10.

[0046] When the processing in step S2 is completed, the aggregation unit 202 outputs the generated access list AL to the control unit 203. The control unit 203 receives the access list AL from the aggregation unit 202. Then, the control unit 203 displays the received access list AL on the display device 30 (step S3). The control unit 203 then completes the series of processes.

[0047] (advantage) The processing system 1 according to the embodiment of this disclosure has been described above. In the processing device 20 of the processing system 1, the control unit 203 (an example of a control means) displays a single piece of information indicating a range of IP addresses, which is an aggregate of information indicating consecutive IP (Internet Protocol) addresses listed in the access control list (ACL). The processing device 20 of the processing system 1 displays the consecutive IP addresses of the source and destination together. As a result, the communication path can be easily understood.

[0048] <Modified examples of embodiments> In the processing system 1 according to the embodiment of this disclosure, the processing unit 20 was described as generating an access list AL based on the access control list ACL and displaying the generated access list AL on the display device 30. However, in the processing system 1 according to a modified embodiment of this disclosure, the processing unit 20 may generate first information I1, which is information showing the relationship between the router 10 group and the functions used in the access control list ACL. Furthermore, the processing unit 20 may generate second information I2, which is information showing the relationship between the router 10 location and the access control list ACL currently in use, third information I3, which is information showing the relationship between the router 10 group and the rules in the access control list ACL, and fourth information I4, which is information showing the relationship between the source and destination in the access control list ACL, based on the access control list ACL. And in the processing system 1 according to a modified embodiment of this disclosure, the processing unit 20 may display the first information I1, second information I2, third information I3, and fourth information I4 on the display device 30.

[0049] (Configuration of the processing system) The modified processing system 1 of the embodiment of the present disclosure comprises routers 10a, 10b, 10c, a processing unit 20, and a display device 30, similar to the processing system 1 of the embodiment of the present disclosure. When it is not necessary to distinguish between routers 10a, 10b, and 10c, routers 10a, 10b, and 10c are collectively referred to as router 10. The following description will mainly explain the differences between the modified processing system 1 of the embodiment of the present disclosure and the processing system 1 of the embodiment of the present disclosure.

[0050] The aggregation unit 202 receives router information X1 from the collection unit 201. The aggregation unit 202 receives information from the preprocessing unit 205 indicating the number of access control lists (ACLs) used by each function. From the received router information X1 and the information indicating the number of access control lists (ACLs) used by each function, the aggregation unit 202 generates first information I1, which is information indicating the relationship between the router 10 group and the functions used in the access control list ACLs. The aggregation unit 202 also receives the access control list ACLs from the collection unit 201. Based on the received access control list ACLs, the aggregation unit 202 generates second information I2, third information I3, and fourth information I4. The aggregation unit 202 outputs first information I1, second information I2, third information I3, and fourth information I4 to the control unit 203. Details of second information I2, third information I3, and fourth information I4 will be described later.

[0051] The control unit 203 performs various controls that the processing unit 20 performs. For example, the control unit 203 receives first information I1, second information I2, third information I3, and fourth information I4 from the aggregation unit 202. The control unit 203 then displays the received first information I1, second information I2, third information I3, and fourth information I4 on the display device 30.

[0052] The storage unit 204 stores various information necessary for the processing performed by the processing unit 20. For example, the storage unit 204 stores the access control list (ACL) acquired by the collection unit 201. Also, the storage unit 204 stores the first information I1, second information I2, third information I3, and fourth information I4 generated by the aggregation unit 202.

[0053] The display device 30 displays the first information I1, the second information I2, the third information I3, and the fourth information I4 under the control of the control unit 203 of the processing device 20.

[0054] The processing described above performed by the processing system 1 according to the modified embodiment of this disclosure is merely an example, and the processing performed by the processing system 1 is not limited to the processing described above. For example, the processing system 1 may perform the processing described below.

[0055] (Processing performed by the processing system) Figure 11 shows an example of the processing flow of processing system 1 according to some embodiments of the present disclosure. Here, referring to Figure 11, the processing system 1 generates first information I1, second information I2, third information I3, and fourth information I4, and the process of displaying the generated first information I1, second information I2, third information I3, and fourth information I4 will be described.

[0056] The collection unit 201 obtains router information X1 stored by each router 10 from each router 10. The collection unit 201 outputs the obtained router information X1 to the aggregation unit 202. The collection unit 201 also obtains the settings for each function stored by each router 10 from each router 10. The collection unit 201 outputs the obtained settings for each function to the preprocessing unit 205. The collection unit 201 obtains the access control list ACL stored by each router 10 from each router 10 (step S21). The collection unit 201 outputs the obtained access control list ACL to the aggregation unit 202.

[0057] The preprocessor unit 205 receives the settings for each function from the collection unit 201. From the received settings for each function, the preprocessor unit 205 reads the number of access control lists (ACLs) used by each function. From the number of access control lists (ACLs) used by each function that the preprocessor unit 205 reads, it generates information X2 that includes the number of access control lists (ACLs) used by each function. The preprocessor unit 205 then outputs the generated information X2 to the aggregation unit 202.

[0058] The aggregation unit 202 receives router information X1 from the collection unit 201. The aggregation unit 202 receives information from the preprocessing unit 205 indicating the number of access control lists (ACLs) used by each function. From the received router information X1 and the information indicating the number of access control lists (ACLs) used by each function, the aggregation unit 202 generates first information I1, which is information indicating the relationship between the router 10 group and the functions used in the access control list ACLs (step S22). The aggregation unit 202 also receives access control lists (ACLs) from the collection unit 201. Based on the received access control lists (ACLs), the aggregation unit 202 generates second information I2, third information I3, and fourth information I4 (step S23). The aggregation unit 202 outputs first information I1, second information I2, third information I3, and fourth information I4 to the control unit 203. The details of first information I1, second information I2, third information I3, and fourth information I4 will now be explained.

[0059] (1st information) Figure 12 shows an example of the first information I1 according to some embodiments of the present disclosure. The first information I1 according to a modified embodiment of the present disclosure is information showing the relationship between a group of routers 10 and the functions used in the access control list ACL, as shown in Figure 12. The first information I1 is information created by the aggregation unit 202 and stored by the aggregation unit 202 in the storage unit 204. The group of routers 10 in the first information I1 is a group of routers 10 defined by the user. In Figure 12, examples of groups of routers 10 are shown as the Hokuriku branch group, the Tokai branch group, and the Kanto branch group. Also in Figure 12, examples of functions used in the access control list ACL are shown as Filter, PBR (Policy-Based Routing), and SSH (Secure Shell). This first information I1 is information that the display device 30 displays under the control of the control unit 203 of the processing device 20 when the user performs an operation to display the first information in a predetermined menu displayed by the display device 30.

[0060] (Second information) Figure 13 shows an example of the second information I2 according to some embodiments of the present disclosure. The second information I2 according to a modified embodiment of the present disclosure is, for example, information showing the relationship between the router 10's location and the access control list ACL currently in use, as shown in Figure 13. This second information I2 is information that the display device 30 displays when the user performs an operation to select a function for any group of the router 10 in the first information I1 displayed by the display device 30. In other words, for each combination of the router 10's group in the first information I1 and the function used in the access control list ACL, there is a second information I2 as shown in Figure 13.

[0061] The aggregation unit 202 generates second information I2 based on the router information X1 and access control list ACL received from the collection unit 201. Figure 14 shows an example of an access control list ACL according to some embodiments of the present disclosure. For example, the aggregation unit 202 receives router information X1 from the collection unit 201. The aggregation unit 202 uses the received router information X1 to associate each site with the router 10. The aggregation unit 202 identifies the access control list ACL of the router 10 at each associated site. The aggregation unit 202 extracts the [access control list name] from the identified access control list ACL. The aggregation unit 202 then identifies the access control list ACL currently in use indicated by the extracted [access control list name]. Note that by establishing a rule to associate the [access control list name] with the access control list ACL currently in use (for example, including wording indicating the access control list ACL currently in use in the access control list name), extracting the [access control list name] becomes equivalent to extracting the access control list ACL currently in use. Therefore, the aggregation unit 202 can identify that the extracted [access control list name] indicates that an access control list ACL is currently in use.

[0062] For example, in the case of the access control list name "acl-gyoumu" indicated by part A shown in part (a) of Figure 14, the aggregation unit 202 identifies the access control list ACL currently in use indicated by the extracted access control list name "acl-gyoumu" as the "business communication ACL". Also, for example, in the case of the access control list name "acl-internet" indicated by part B shown in part (c) of Figure 14, the aggregation unit 202 identifies the access control list ACL currently in use indicated by the extracted access control list name "acl-internet" as the "internet control ACL". In this way, by extracting the [access control list name] from the access control list ACL of the router 10 at each site, the aggregation unit 202 can identify the access control list ACL currently in use at each site.

[0063] (Third information) Figure 15 shows an example of third information I3 according to some embodiments of the present disclosure. Third information I3 according to a modified embodiment of the present disclosure is information showing the relationship between a group of routers 10 and a rule in an access control list ACL, for example, as shown in Figure 15. This third information I3 is information that the display device 30 displays when the user performs an operation to display any access control list ACL currently in use for any of the router 10 locations as third information I3 in the second information I2 displayed by the display device 30. In other words, for each combination of a router 10 location and an access control list ACL currently in use in the second information I2, there is third information I3 as shown in Figure 15.

[0064] The aggregation unit 202 generates third information I3 based on the access control list ACL received from the collection unit 201. Figure 16 shows an example of an access control list ACL according to some embodiments of the present disclosure. For example, the aggregation unit 202 extracts [Action], [Protocol], [Source], and [Destination] from the access control list ACL. The aggregation unit 202 then identifies the range of IP addresses of the action and source indicated by the extracted [Action], [Protocol], [Source], and [Destination].

[0065] For example, in the case of [Action][Protocol][Source][Destination] shown by part A in section (a) of Figure 16, the aggregation unit 202 identifies the source IP address (labeled "From" in Figure 15) 10.1.1.2-10.1.1.7, the destination IP address (labeled "To" in Figure 15) 20.0.0.1, and the action (labeled "Action" in Figure 15) as deny (labeled "Deny" in Figure 15). Also, for example, in the case of [Action][Protocol][Source][Destination] shown by part B in section (c) of Figure 16, the aggregation unit 202 identifies the source IP address (labeled "From" in Figure 15) 10.1.1.4-10.1.1.7), the destination IP address (labeled "To" in Figure 15) as deny, and the action as deny.

[0066] Similarly, for the remaining portion of the access control list ACL shown in Figure 16, the aggregation unit 202 extracts [Action], [Protocol], [Source], and [Destination], ultimately generating the third information I3 shown in Figure 15.

[0067] Furthermore, regarding the source IP address and destination IP address, the aggregation unit 202 of the processing device 20 in the processing system 1 according to the embodiment of this disclosure performs a process to group consecutive IP addresses together. The aggregation unit 202 then generates third information I3, which is defined as a range of IP addresses, with the aggregated IP addresses as the source IP address and destination IP address.

[0068] (4th information) Figure 17 shows an example of the fourth information I4 according to some embodiments of the present disclosure. The fourth information I4 according to a modified embodiment of the present disclosure is, for example, information showing the relationship between the source and destination in an access control list (ACL), as shown in Figure 17. This fourth information I4 is the information that the display device 30 displays when the user performs an operation to display any of the access control lists (ACLs) currently in use for any of the locations of the router 10 as the fourth information I4 in the second information I2 displayed by the display device 30. In other words, for each combination of the locations of the router 10 and the access control lists (ACLs) currently in use in the second information I2, there is a fourth information I4 as shown in Figure 17.

[0069] The aggregation unit 202 generates fourth information I4 based on the access control list ACL received from the collection unit 201. Figure 18 shows an example of an access control list ACL according to some embodiments of the present disclosure. For example, the aggregation unit 202 extracts [Action], [Protocol], [Source], and [Destination] from the access control list ACL. The aggregation unit 202 then identifies the relationship between the source and destination indicated by the extracted [Action], [Protocol], [Source], and [Destination].

[0070] For example, in the case of [Action][Protocol][Source][Destination] shown by parts A and B in part (a) of Figure 18, the aggregation unit 202 identifies 10.1.1.1-10.1.1.7, which represents the range of source IP addresses formed by combining the source IP addresses indicated by the extracted [Action][Protocol][Source][Destination], and the destination IP address 20.0.0.1. Also, for example, in the case of [Action][Protocol][Source][Destination] shown by parts C and D in part (c) of Figure 18, the aggregation unit 202 identifies 10.1.1.4-10.1.1.7, which represents the range of source IP addresses formed by combining the source IP addresses indicated by the extracted [Action][Protocol][Source][Destination], and the destination IP address 20.0.0.1.

[0071] Similarly, for the remaining portion of the access control list ACL shown in Figure 18, the aggregation unit 202 extracts [Action], [Protocol], [Source], and [Destination], ultimately generating the fourth information I4 shown in Figure 17. Regarding the source IP address and destination IP address, the aggregation unit 202 performs the same process as the aggregation unit 202 of the processing device 20 in the processing system 1 according to this embodiment of the disclosure, by grouping consecutive IP addresses together.

[0072] The control unit 203 displays a predetermined menu on the display device 30 (step S24). The user performs an operation to display the first information in the predetermined menu displayed on the display device 30. In response to the user's operation to display the first information, the control unit 203 displays the first information I1 on the display device 30 (step S25).

[0073] The user performs an operation to display the second information in response to the first information I1 displayed by the display device 30. The control unit 203 displays the second information I2 on the display device 30 in response to the user's operation to display the second information (step S26).

[0074] The user performs an operation to display either the third or fourth piece of information in response to the first piece of information I1 displayed by the display device 30. If the user performs an operation to display the third piece of information I3, the control unit 203 displays the third piece of information I3 on ​​the display device 30 in response to the user's operation to display the third piece of information I3 (step S27). Also, if the user performs an operation to display the fourth piece of information I4, the control unit 203 displays the fourth piece of information I4 on the display device 30 in response to the user's operation to display the fourth piece of information I4 (step S28).

[0075] (advantage) The above describes several embodiments of the processing system 1 of this disclosure. The processing unit 20 of this processing system 1 displays the access control list ACLs set on the router 10 for various conditions as a two-dimensional matrix, such as the first information I1, second information I2, third information I3, and fourth information I4. As a result, the communication path can be easily understood. In addition, the processing unit 20 of this processing system 1 also displays consecutive IP addresses together. As a result, the communication path can be easily understood.

[0076] Figure 19 is a diagram showing an example of the configuration of a processing unit 700 according to some embodiments of the present disclosure. As shown in Figure 19, the processing unit 700 includes a control means 701. In the processing unit 700, the control means 701 displays a single piece of information indicating a range of IP addresses, which is an aggregate of information indicating consecutive IP (Internet Protocol) addresses listed in the access control list.

[0077] The processing unit 700 can be implemented, for example, using the functions of the processing unit 20 illustrated in Figures 1 and 2. The control means 701 can be implemented, for example, using the functions of the control unit 203 illustrated in Figure 2.

[0078] Next, the processing performed by the processing apparatus 700 according to some embodiments of the present disclosure will be described. Figure 20 is a diagram showing an example of the processing flow of the processing apparatus 700 according to some embodiments of the present disclosure. Here, the processing of the processing apparatus 700 will be described with reference to Figure 20.

[0079] In the processing unit 700, the control means 701 displays a single piece of information indicating a range of IP addresses, which is an aggregate of information indicating consecutive IP (Internet Protocol) addresses listed in the access control list (step S101).

[0080] Several embodiments of the processing unit 700 according to the present disclosure have been described above. This processing unit 700 makes it possible to easily determine the communication path.

[0081] In addition, the order of the processes in each embodiment of this disclosure may be changed, as long as appropriate processing is performed.

[0082] Although each embodiment of this disclosure has been described, the processing system 1, router 10, processing unit 20, display device 30, and other control devices described above may have a computer system inside. The processing steps described above are stored in program form on a computer-readable recording medium, and the processing is performed when the computer reads and executes this program. A specific example of a computer is shown below.

[0083] Figure 21 is a schematic block diagram showing the configuration of a computer according to at least one embodiment. As shown in Figure 21, the computer 5 includes a CPU (Central Processing Unit) 6, main memory 7, storage 8, and interface 9.

[0084] For example, the processing system 1, router 10, processing unit 20, display device 30, and other control devices described above are each implemented in the computer 5. The operation of each processing unit described above is stored in storage 8 in the form of a program. The CPU 6 reads the program from storage 8, loads it into main memory 7, and executes the above processing according to the program. The CPU 6 also allocates memory areas in main memory 7 corresponding to each of the above-mentioned storage units according to the program.

[0085] Examples of storage 8 include HDDs (Hard Disk Drives), SSDs (Solid State Drives), magnetic disks, magneto-optical disks, CD-ROMs (Compact Disc Read Only Memory), DVD-ROMs (Digital Versatile Disc Read Only Memory), and semiconductor memory. Storage 8 may be an internal medium directly connected to the bus of computer 5, or an external medium connected to computer 5 via interface 9 or a communication line. Furthermore, if this program is distributed to computer 5 via a communication line, computer 5, upon receiving the program, may expand it into main memory 7 and execute the above processing. In at least one embodiment, storage 8 is a tangible storage medium that is not temporary.

[0086] Furthermore, the above program may implement some of the functions described above. Moreover, the above program may be a file that can implement the above functions in combination with a program already recorded in the computer system, a so-called differential file (differential program).

[0087] While several embodiments of this disclosure have been described, these embodiments are illustrative and do not limit the scope of the disclosure. These embodiments may be modified in various ways, without departing from the gist of the disclosure.

[0088] Furthermore, some or all of the above embodiments may also be described as follows, but are not limited to these.

[0089] (Note 1) A control means that displays a single piece of information indicating a range of IP addresses, which is an aggregate of information indicating consecutive IP (Internet Protocol) addresses listed in the access control list. A processing device equipped with the following features.

[0090] (Note 2) Aggregation means for aggregating information indicating consecutive IP addresses listed in the access control list into a single piece of information indicating a range of IP addresses, Equipped with, The control means is The aggregation means displays one piece of information indicating the range of IP addresses aggregated. The processing apparatus described in Appendix 1.

[0091] (Note 3) An analysis means for analyzing the source IP address or the destination IP address. Equipped with, The aggregation means is The information indicating consecutive IP addresses listed in the access control list shown by the analysis results of the analysis means is aggregated into a single piece of information indicating a range of IP addresses. The apparatus described in Appendix 2, comprising:

[0092] (Note 4) The control means is When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, if a predetermined first operation is performed by the user, one piece of information indicating the range of the aggregated IP addresses is displayed. The processing apparatus described in any one of the appendices 1 to 3.

[0093] (Note 5) The control means is When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, if a predetermined first operation is performed by the user, information showing the relationship between the source and destination in the access control list, including one piece of information indicating the range of aggregated IP addresses, is displayed. The processing apparatus described in Appendix 4.

[0094] (Note 6) The control means is When information showing the relationship between the group of routers and the functions used in the access control list is displayed, and the user performs a predetermined second operation, information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed. The processing apparatus described in Appendix 5.

[0095] (Note 7) The control means is When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, if the user performs a predetermined third operation, information showing the relationship between the router group and the rules in the access control list is displayed. The processing apparatus described in Appendix 5 or Appendix 6.

[0096] (Note 8) The control means is The information showing the relationship between the sender and the recipient is displayed in a two-dimensional matrix. The processing apparatus described in any one of the appendices 5 to 7.

[0097] (Note 9) The processing apparatus described in any one of the appendices 1 to 8, The processing device displays a single piece of information indicating a range of IP addresses, which is an aggregate of information indicating consecutive IP addresses listed in the access control list. A processing system equipped with the following features.

[0098] (Note 10) To display a single piece of information indicating a range of IP addresses, which is aggregated from information indicating consecutive IP (Internet Protocol) addresses listed in the access control list. A processing method that includes this.

[0099] (Note 11) The information indicating consecutive IP addresses listed in the access control list is consolidated into a single piece of information indicating a range of IP addresses. To display a single piece of information indicating the aggregated range of IP addresses, The processing method described in Appendix 10, including the method described therein.

[0100] (Note 12) Analyzing the source IP address or the destination IP address, The information indicating consecutive IP addresses listed in the access control list shown by the analysis results of the aforementioned analysis is consolidated into a single piece of information indicating a range of said IP addresses. The processing method described in Appendix 11, including the method described therein.

[0101] (Note 13) When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, and a predetermined first operation is performed by the user, one piece of information indicating the range of the aggregated IP addresses is displayed. A processing method described in any one of the appendices 10 to 12, including the above.

[0102] (Note 14) When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, if a predetermined first operation is performed by the user, information showing the relationship between the source and destination in the access control list, including one piece of information indicating the range of aggregated IP addresses, is displayed. The processing method described in Appendix 13, including the method described therein.

[0103] (Note 15) When information showing the relationship between the group of routers and the functions used in the access control list is displayed, and the user performs a predetermined second operation, information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed. The processing method described in Appendix 14, including the method described therein.

[0104] (Note 16) When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, if the user performs a predetermined third operation, information showing the relationship between the router group and the rules in the access control list is displayed. The processing method described in Appendix 14 or Appendix 15, including the above.

[0105] (Note 17) The information showing the relationship between the sender and the recipient is displayed in a two-dimensional matrix. A processing method described in any one of the appendices 14 to 16, including the above.

[0106] (Note 18) To display a single piece of information indicating a range of IP addresses, which is aggregated from information indicating consecutive IP (Internet Protocol) addresses listed in the access control list. A program that causes a computer to execute something.

[0107] (Note 19) The information indicating consecutive IP addresses listed in the access control list is consolidated into a single piece of information indicating a range of IP addresses. To display a single piece of information indicating the aggregated range of IP addresses, The program described in Appendix 18 that causes the aforementioned computer to execute.

[0108] (Note 20) Analyzing the source IP address or the destination IP address, The information indicating consecutive IP addresses listed in the access control list shown by the analysis results of the aforementioned analysis is consolidated into a single piece of information indicating a range of said IP addresses. The program described in Appendix 19 that causes the aforementioned computer to execute.

[0109] (Note 21) When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, and a predetermined first operation is performed by the user, one piece of information indicating the range of the aggregated IP addresses is displayed. A program described in any one of the appendices 18 to 20 that causes the computer to execute the above.

[0110] (Note 22) When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, if a predetermined first operation is performed by the user, information showing the relationship between the source and destination in the access control list, including one piece of information indicating the range of aggregated IP addresses, is displayed. The program described in Appendix 21 that causes the computer to execute the above.

[0111] (Note 23) When information showing the relationship between the group of routers and the functions used in the access control list is displayed, and the user performs a predetermined second operation, information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed. The program described in Appendix 22 that causes the computer to execute.

[0112] (Note 24) When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, if the user performs a predetermined third operation, information showing the relationship between the router group and the rules in the access control list is displayed. The program described in Appendix 22 or Appendix 23 that causes the computer to execute the aforementioned program.

[0113] (Note 25) The information showing the relationship between the sender and the recipient is displayed in a two-dimensional matrix. A program described in any one of the appendices 22 to 24 that causes the computer to execute the above. [Explanation of symbols]

[0114] 1. Processing System 5. Computers 6..CPU 7. Main Memory 8. Storage 9. Interface 10, 10a, 10b, 10c... Router 20,700... Processing equipment 30...Display device 201...Collection Department 202... Consolidation Department 203... Control Unit 204...Storage section 701... Control means

Claims

1. A control means that displays a single piece of information indicating a range of IP addresses, which is an aggregate of information indicating consecutive IP (Internet Protocol) addresses listed in the access control list. A processing device equipped with the following features.

2. Aggregation means for aggregating information indicating consecutive IP addresses listed in the access control list into a single piece of information indicating a range of IP addresses, Equipped with, The control means is The aggregation means causes the aggregation means to display one piece of information indicating the range of IP addresses aggregated. The apparatus according to claim 1.

3. The control means is When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, if a predetermined first operation is performed by the user, one piece of information indicating the range of the aggregated IP addresses is displayed. The apparatus according to claim 1.

4. The control means is When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, if a predetermined first operation is performed by the user, information showing the relationship between the source and destination in the access control list, including one piece of information indicating the range of aggregated IP addresses, is displayed. The apparatus according to claim 3.

5. The control means is When information showing the relationship between the router group and the functions used in the access control list is displayed, and the user performs a predetermined second operation, information showing the relationship between the router location storing the access control list and the access control list currently in use is displayed. The apparatus according to claim 4.

6. The control means is When information showing the relationship between the location of the router storing the access control list and the access control list currently in use is displayed, if the user performs a predetermined third operation, information showing the relationship between the router group and the rules in the access control list is displayed. The apparatus according to claim 4.

7. The control means is The information showing the relationship between the sender and the recipient is displayed in a two-dimensional matrix. The apparatus according to claim 4.

8. The apparatus according to claim 1, The processing device displays a single piece of information indicating a range of IP addresses, which is an aggregate of information indicating consecutive IP addresses listed in the access control list. A processing system equipped with the following features.

9. To display a single piece of information indicating a range of IP addresses, which is aggregated from information indicating consecutive IP (Internet Protocol) addresses listed in the access control list. A processing method that includes this.

10. To display a single piece of information indicating a range of IP addresses, which is aggregated from information indicating consecutive IP (Internet Protocol) addresses listed in the access control list. A program that causes a computer to execute something.

Images