Master device, communication control method, communication control program, and communication control system

Abstract

This makes it possible to reduce the workload associated with setting communication control in a network. [Solution] A master device 10 accepts input of installation information indicating in which of a plurality of zones each of a plurality of edge devices 20 is installed. The master device 10 acquires connection information of terminals connected to each of the plurality of edge devices 20. The master device 10 sets each of the plurality of zones as a group for controlling communications, and classifies terminals indicated by the connection information into the group of the zone in which the edge device 20 from which the connection information was acquired is installed.

Description

[Technical field]

[0001] The present disclosure relates to a technique for controlling communication between terminals. [Background technology]

[0002] In control systems that control equipment in factories, including those in the manufacturing industry, the system configuration is generally divided into multiple zones for management, production status monitoring, production line, etc. The same level of security measures are required for protected assets, which are equipment that exists in the same zone. Here, the Ministry of Economy, Trade and Industry's "Guidelines for Cyber-Physical Security Measures in Factory Systems Ver. 1.0" defines a zone as an area with the same business content or importance, and states that the same level of security measures is required for protected assets that exist in the same zone.

[0003] Patent Document 1 describes a method for detecting a terminal indicated by an address not present in a group list as an unclassified terminal and for specifying a group to which the unclassified terminal belongs. Patent Document 1 reduces the burden of grouping terminals by detecting unclassified terminals. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 7209792 Summary of the Invention [Problem to be solved by the invention]

[0005] The task of configuring communication control to realize a secure network is usually done manually while referring to various information such as network configuration diagrams and individual terminal information, which is a very time-consuming and cumbersome task. This makes it prone to configuration errors and places a burden on operations. By using the technology described in Patent Document 1, the effort of searching for unclassified terminals can be eliminated, and the burden of the configuration work can be reduced to a certain extent. However, the configuration still needs to be done for each terminal, which is a heavy burden and prone to configuration errors. The present disclosure aims to make it possible to reduce the workload associated with settings. [Means for solving the problem]

[0006] A master device according to the present disclosure comprises: a zone receiving unit that receives input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of the plurality of edge devices being a target edge device; an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device; a terminal classification unit that sets each of the plurality of zones as a group for controlling communication, and classifies a terminal indicated by the connection information acquired by the information acquisition unit into a zone group indicated by the installation information accepted by the zone acceptance unit, the zone group including an edge device that has acquired the connection information; Equipped with. Effect of the Invention

[0007] In the present disclosure, a group is set for each zone, and terminals are classified into the group of the zone in which the edge device from which the connection information is obtained is installed. This makes it possible to automatically classify terminals into groups, thereby reducing the workload associated with the settings. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a configuration diagram of a communication control system 1 according to a first embodiment. [Diagram 2] FIG. 2 is a configuration diagram of a master device 10 according to the first embodiment. [Diagram 3] FIG. 2 is a configuration diagram of an edge device 20 according to the first embodiment. [Figure 4]3 is a flowchart showing the overall operation of the communication control system 1 according to the first embodiment. [Diagram 5] FIG. 2 is an explanatory diagram of an installation state of the edge device 20 according to the first embodiment. [Figure 6] FIG. 4 is an explanatory diagram of a zone acceptance process according to the first embodiment. [Figure 7] FIG. 4 is an explanatory diagram of an address acquisition process according to the first embodiment. [Figure 8] FIG. 3 is an explanatory diagram of a classification process according to the first embodiment. [Figure 9] FIG. 4 is an explanatory diagram of a state display process according to the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Embodiment 1 ***Configuration Description*** The configuration of a communication control system 1 according to the first embodiment will be described with reference to FIG. The communication control system 1 includes a master device 10 and a plurality of edge devices 20. The master device 10 and each edge device 20 are connected via a network device 90. The master device 10 is installed in a management center or the like, and is a computer for managing the communication control system 1. Each edge device 20 is installed at a site such as a factory or an office, and is a computer to which one or more terminals 30 are connected.

[0010] The configuration of the master device 10 according to the first embodiment will be described with reference to FIG. The master device 10 includes the following hardware components: a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to other hardware components via signal lines and controls these other hardware components.

[0011] The master device 10 comprises, as functional components, a zone acceptance unit 111, a tree display unit 112, an information acquisition unit 113, a terminal classification unit 114, a change acceptance unit 115, a policy setting unit 116, and a setting transmission unit 117. The functions of the functional components of the master device 10 are realized by software. The storage 13 stores a program that realizes the function of each functional component of the master device 10. The program is loaded into the memory 12 by the processor 11 and executed by the processor 11. In this way, the function of each functional component of the master device 10 is realized.

[0012] The configuration of the edge device 20 according to the first embodiment will be described with reference to FIG. The edge device 20 includes the following hardware components: a processor 21, a memory 22, a storage 23, and a communication interface 24. The processor 21 is connected to other hardware components via signal lines and controls the other hardware components.

[0013] The edge device 20 includes, as functional components, an address acquisition unit 211, an information transmission unit 212, a setting reception unit 213, a communication control unit 214, and a log acquisition unit 215. The functions of the functional components of the edge device 20 are realized by software. The storage 23 stores a program for implementing the functions of each functional component of the edge device 20. The program is loaded into the memory 22 by the processor 21 and executed by the processor 21. In this way, the function of each functional component of the edge device 20 is implemented.

[0014] The processors 11 and 21 are integrated circuits (ICs) that perform processing. Processing Unit), DSP (Digital Signal Processor), and GPU (Graphics Processing Unit).

[0015] The memories 12 and 22 are storage devices that temporarily store data. Specific examples of the memories 12 and 22 include SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory).

[0016] The storages 13 and 23 are storage devices that store data. A specific example of the storages 13 and 23 is a hard disk drive (HDD). The storages 13 and 23 may also be portable recording media such as a Secure Digital (SD, registered trademark) memory card, a CompactFlash (CF, registered trademark), a NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a digital versatile disk (DVD).

[0017] The communication interfaces 14 and 24 are interfaces for communicating with external devices, and are, for example, ports for Ethernet (registered trademark), Universal Serial Bus (USB), and High-Definition Multimedia Interface (HDMI, registered trademark).

[0018] ***Explanation of Operation*** The operation of the communication control system 1 according to the first embodiment will be described with reference to FIGS. An operation procedure of the communication control system 1 according to the embodiment 1 corresponds to a communication control method according to the embodiment 1. Moreover, a program for realizing the operation of the communication control system 1 according to the embodiment 1 corresponds to a communication control program according to the embodiment 1.

[0019] The overall operation of the communication control system 1 according to the first embodiment will be described with reference to FIG. As a premise for the process shown in Fig. 4, a plurality of zones 40 are set in a factory, with each zone 40 being an area with the same business content or importance, as shown in Fig. 5. In Fig. 5, a production management zone 40, a production status monitoring zone 40, and a production line 1 zone 40 are set. An edge device 20 is placed in each of the plurality of zones 40. One or more terminals 30 are connected to the edge device 20 placed in each zone 40.

[0020] (Step S11: Zone reception process) The zone reception unit 111 of the master device 10 sets each of the multiple edge devices 20 as a target edge device 20. The zone reception unit 111 receives input of installation information indicating in which of the multiple zones 40 the target edge device 20 is installed. Specifically, the user of the master device 10 inputs installation information of the zone 40 installed for each edge device 20. The zone reception unit 111 then receives the installation information of the zone 40 input for each edge device 20. The zone reception unit 111 stores the identification information of the edge device 20 and the identification information of the zone 40 in association with each other in the memory 12. The identification information of the edge device 20 is, for example, the edge device name which is the name of the edge device 20. The identification information of the zone 40 is, for example, the zone name which is the name of the zone 40.

[0021] For example, as shown in Fig. 6, the tree display unit 112 displays an asset tree 50, which is tree structure data in which a factory is the root and each zone 40 is represented as a child node with the root as a parent, on the display device. Here, the factory is described as the root, but it may be rephrased that the communication control system 1 is the root. The zone reception unit 111 inputs installation information indicating the location where the edge device 20 is installed into the asset tree 50. Specifically, in Fig. 6, the user places a node representing the target edge device 20 as a child node with the node representing the zone 40 as a parent, and the zone reception unit 111 inputs and accepts the installation information in which each edge device 20 is associated with the zone 40 in which it is installed. For example, by inputting and accepting the installation information in this manner, an edge device 20 with an edge device name of Edge3 is set as a child node having a parent node representing the production management zone 40. Also, an edge device 20 with an edge device name of Edge2 is set as a child node having a parent node representing the production status monitoring zone 40. Also, an edge device 20 with an edge device name of Edge1 is set as a child node having a parent node representing the production line 1 zone 40. Here, an example has been shown in which installation information associating each edge device 20 with the installed zone 40 is input and accepted by arranging nodes representing edge devices 20 as child nodes with a node representing a zone 40 as a parent using an asset tree 50, which is tree-structured data. However, setting data associating each edge device 20 with the installed zone 40 may be prepared by a user, and the zone acceptance unit 111 may accept the input of the installation information by reading the setting data. As long as it is possible to associate each edge device 20 with the installed zone 40, the installation information may be accepted by another input method.

[0022] (Step S12: Address acquisition process) The address acquisition unit 211 of each edge device 20 acquires the address 61 of the terminal 30 connected to the end side, which is a terminal 30 connected in the same network as the edge device 20. The same network refers to a network having the same network address. In this case, the address acquisition unit 211 may acquire the address 61 of the connected terminal 30 for each port. 7, the address acquisition unit 211 acquires an IP address and a MAC address as the address 61 of the terminal 30. IP is an abbreviation for Internet Protocol. MAC is an abbreviation for Media Access Control.

[0023] The information transmitting unit 212 of each edge device 20 transmits the address 61 with the terminal information 62 added thereto as connection information 63 to the master device 10 . 7, the information transmission unit 212 adds an edge device name, a terminal name, and a terminal type as the terminal information 62. The edge device name is the name of the edge device 20 connected to the network to which the terminal 30 is connected, and here, the name of the edge device 20 equipped with the information transmission unit 212 is set. The terminal name is a name for making it easier to identify the terminal 30. The terminal type is information indicating the type of the terminal 30. The terminal name and terminal type may be set only if they can be extracted from the terminal 30. In addition to these, the information transmission unit 212 may set manufacturer information of the terminal 30 as the terminal information 62. The manufacturer information is information capable of identifying the manufacturer, such as the manufacturer name specified from the company code of the MAC address.

[0024] (Step S13: Classification process) The information acquisition unit 113 of the master device 10 receives the connection information 63 transmitted in step S12. In step S12, the address acquisition unit 211 acquires the address 61 of the terminal 30 connected on the end side, so that the address 41 of the same terminal 30 is not transmitted from a plurality of edge devices 20. The terminal classification unit 114 of the master device 10 sets each of the multiple zones as a group for controlling communication by default. Then, the terminal classification unit 114 classifies the terminal 30 indicated by the connection information 63 acquired by the information acquisition unit 113 by default into the group of the zone 40 in which the edge device 20 from which the connection information 63 was acquired is installed.

[0025] Assume that an edge device 20 is installed in each zone 40 and installation information is received as shown in Fig. 6. Then, as shown in Fig. 8, a check mark is automatically displayed indicating that the MES Server and EWS01, which are terminals 30 indicated in the connection information 63 received from the edge device 20 named Edge3, have been classified into the group of the production management zone 40. A check mark is automatically displayed indicating that the SCADA1 and HMI1, which are terminals 30 indicated in the connection information 63 received from the edge device 20 named Edge2, have been classified into the group of the production status monitoring zone 40. A check mark is automatically displayed indicating that the PLC01, F-Device01, F-Device02, and F-Device03, which are terminals 30 indicated in the connection information 63 received from the edge device 20 named Edge1, have been classified into the group of the production line 1 zone 40.

[0026] (Step S14: Change acceptance process) The change acceptance unit 115 displays the groups classified by the terminal classification unit 114 together with the connection information 63 acquired by the information acquisition unit 113 in step S13, and accepts a change to the group. Specifically, the change acceptance unit 115 displays information as shown in Fig. 8. Then, when a group change is input by the user of the master device 10, the input is accepted and the group of the terminal 30 is changed according to the input. When no group change is input, the group as classified in step S13 is maintained.

[0027] (Step S15: Policy setting process) The policy setting unit 116 of the master device 10 uses the group set in step S14 to set a policy 64 for controlling communication between groups. Specifically, the policy setting unit 116 sets a policy 64 indicating that communication between the same group and different groups is permitted, while communication between different groups is to be logged. The policy setting unit 116 also sets a policy 64 that does not permit communication with terminals 30 that do not belong to any group. At this time, the policy setting unit 116 may accept a change to the policy 64 from the user of the master device 10. In other words, the policy setting unit 116 may set the above-mentioned policy 64 as a default, and then change the policy 64 as necessary. At this time, the policy setting unit 116 may set another policy on a group basis. Then, the configuration transmission unit 117 of the master device 10 transmits the policy 64 to each of the edge devices 20 .

[0028] (Step S16: Communication control process) The setting receiver 213 of each edge device 20 receives the policy 64 transmitted in step S15. The communication control unit 214 of each edge device 20 controls communication between the terminals 30 based on the policy 64. That is, if the communication is between the terminals 30 that belong to a group set in the policy 64 to allow communication, the communication control unit 214 allows the communication and allows the data to pass. On the other hand, if the communication is between the terminals 30 that belong to a group set in the policy 64 to not allow communication, the communication control unit 214 does not allow the communication and does not allow the data to pass. Furthermore, if policy 64 specifies that a log should be acquired, log acquisition unit 215 acquires a communication log.

[0029] (Step S17: Status display process) 9, the tree display unit 112 monitors the state of each terminal 30 as a target terminal 30, and changes the color, etc., of the node corresponding to the target terminal 30 in the asset tree 50 according to the state of the target terminal 30. The state of the terminal 30 is, for example, a state in which it is operating normally, a state in which an error has occurred, etc. In FIG. 9, the node of F-Device01 is hatched to indicate that it is not normal. In the asset tree 50, each terminal 30 is displayed divided by zone 40. Therefore, for each zone 40, the state of the terminal 30 in that zone 40 can be easily confirmed. The display of the node of the zone 40 to which the target terminal 30 belongs may be changed according to the state of the target terminal 30. This makes it easier to grasp the state of each zone 40.

[0030] When the communication control system 1 is introduced, the processes from step S11 to step S16 are executed in order. After that, the processes from step S15 to step S16 are executed continuously, and the communication between the terminals 30 is controlled. When the processes of steps S15 and S16 are being executed, the process of step S13 may be executed as an interrupt. That is, the group may be changed during communication control. Also, when the processes of steps S15 and S16 are being executed, the change of policy 64 described in step S14 may be accepted.

[0031] ***Advantages of the First Embodiment*** As described above, the communication control system 1 according to the first embodiment sets a group by default for each zone 40, and classifies the terminal 30 by default into the group of the zone 40 in which the edge device 20 from which the connection information is acquired is installed. This makes it possible to automatically classify the terminal 30 into groups, and reduces the workload associated with the settings.

[0032] Furthermore, the communication control system 1 according to the first embodiment sets a policy 64 for controlling communication between groups based on the automatically classified groups. Then, the communication control system 1 controls communication between the terminals 30 in accordance with the policy 64. This results in the same communication control being applied to each terminal 30 present in the same zone 40. Therefore, with regard to communication control, security measures of the same level are applied to the terminals 30 present in the same zone 40.

[0033] Furthermore, the communication control system 1 according to the first embodiment displays the state of each terminal 30 using an asset tree 50 that displays the terminals 30 classified by zone 40. This makes it possible to easily check the state of the terminals 30 in each zone 40.

[0034] ***Other configurations*** <Variation 1> In the first embodiment, it is assumed that the user of the master device 10 inputs the installation information of the zone 40 installed for each edge device 20 in step S11 of FIG. However, for each edge device 20, installation information of the zone 40 set by a user who installs the edge device 20 may be set in the edge device 20. In this case, each edge device 20 transmits the installation information of the set zone 40 to the master device 10. Then, the zone reception unit 111 receives the installation information of the zone 40 transmitted and input from each edge device 20. This eliminates the need for the user of the master device 10 to check in which zone 40 each edge device 20 is installed, by setting in the edge device 20 which zone 40 it is installed in at the time of installation.

[0035] <Variation 2> In the first embodiment, it is assumed that the installation information of which zone 40 the edge device 20 is installed is input for all edge devices 20 in step S11 in Fig. 4. However, there is a possibility that the installation information of which zone 40 the edge device 20 is installed is not input for some edge devices 20. In this case, the terminal 30 from which the edge device 20 for which the installation information was not input is not classified into a group in step S13 in Fig. 4. Therefore, after the terminals 30 are classified into groups in step S13, the information acquisition unit 113 may extract the terminals 30 that are not classified into any group as unclassified terminals. Then, in step S14 of Fig. 4, the terminal classification unit 114 may cause the user to specify the group to which the unclassified terminal belongs.

[0036] <Variation 3> In the first embodiment, each functional component is realized by software. However, as a third modification, each functional component may be realized by hardware. The following describes the third modification, focusing on the differences from the first embodiment.

[0037] When each functional component is realized by hardware, the master device 10 includes an electronic circuit instead of the processor 11, the memory 12, and the storage 13. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 12, and the storage 13. Similarly, when each functional component is realized by hardware, the edge device 20 includes an electronic circuit instead of the processor 21, the memory 22, and the storage 23. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 22, and the storage 23.

[0038] The electronic circuits include single circuits, composite circuits, programmed processors, parallel programmed processors, logic ICs, GAs, ASICs, and FPGAs. GA stands for Gate Array. ASIC stands for Application Specific Integrated Circuit. FPGA stands for Field-Programmable Gate Array. Each functional component may be realized by one electronic circuit, or each functional component may be realized by distributing it among a plurality of electronic circuits.

[0039] <Modification 4> As a fourth modification, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0040] The processor 11, the memory 12, the storage 13, and the electronic circuitry are collectively referred to as a processing circuit. In other words, the functions of the functional components are realized by the processing circuit.

[0041] Furthermore, the term "part" in the above description may be read as a "circuit," "step," "procedure," "processing," or "processing circuit."

[0042] Various aspects of the present disclosure are summarized below as appendices. (Appendix 1) a zone receiving unit that receives input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of the plurality of edge devices being a target edge device; an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device; a terminal classification unit that sets each of the plurality of zones as a group for controlling communication, and classifies a terminal indicated by the connection information acquired by the information acquisition unit into a zone group indicated by the installation information accepted by the zone acceptance unit, the zone group including an edge device that has acquired the connection information; A master device comprising: (Appendix 2) The master device further comprises: a policy setting unit that uses the group set by the terminal classification unit to set a policy for controlling communication between the groups; 2. The master device of claim 1, comprising: (Appendix 3) The policy indicates that communication between the same group and between different groups is permitted, while communication between the different groups is to be logged. 3. A master device as described in claim 2. (Appendix 4) The master device further comprises: a change receiving unit that displays the group classified by the terminal classifying unit together with the connection information acquired by the information acquiring unit for the terminal and receives a change to the group; 4. The master device of claim 1, further comprising: (Appendix 5) The master device further comprises: a tree display section for displaying tree-structured data in which each of the plurality of zones is a node, each of the plurality of edge devices is a child node with the node of the zone in which the edge device is installed as a parent, and the terminal is a child node with the node of the edge device from which the connection information is obtained as a parent; 5. The master device of claim 1, further comprising: (Appendix 6) 6. The master device according to claim 5, wherein the tree display unit changes the display of the node of the terminal according to a state of the terminal. (Appendix 7) The computer accepts an input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of a plurality of edge devices being a target edge device; A computer acquires connection information of a terminal connected to the target edge device from the target edge device; A communication control method in which a computer sets each of the multiple zones as a group for controlling communications, and classifies a terminal indicated by the connection information into a group of zones indicated by the installation information in which the edge device from which the connection information was obtained is installed. (Appendix 8) a zone reception process for receiving input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of the plurality of edge devices being a target edge device; an information acquisition process for acquiring connection information of a terminal connected to the target edge device from the target edge device; a terminal classification process for setting each of the plurality of zones as a group for controlling communication, and classifying a terminal indicated by the connection information acquired by the information acquisition process into a zone group indicated by the installation information accepted by the zone acceptance process, the zone group including an edge device that has acquired the connection information; A communication control program that causes a computer to function as a master device. (Appendix 9) A communication control system including a plurality of edge devices and a master device, The master device a zone receiving unit configured to receive input of installation information indicating in which of a plurality of zones the target edge device is installed, the target edge device being regarded as a target edge device; an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device; a terminal classification unit that sets each of the plurality of zones as a group for controlling communication, and classifies a terminal indicated by the connection information acquired by the information acquisition unit into a zone group indicated by the installation information accepted by the zone acceptance unit, the zone group including an edge device that has acquired the connection information; a policy setting unit that sets a policy for controlling communication between the groups by using the groups set by the terminal classification unit; a setting transmission unit that transmits the policy set by the policy setting unit to each of the plurality of edge devices; Equipped with Each of the plurality of edge devices a communication control unit that controls communication between terminals based on the policy transmitted by the setting transmission unit; A communication control system comprising:

[0043] The above describes the embodiments and modifications of the present disclosure. Some of these embodiments and modifications may be combined and implemented. Also, one or some of them may be partially implemented. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as necessary. [Explanation of symbols]

[0044] 1 communication control system, 10 master device, 11 processor, 12 memory, 13 storage, 14 communication interface, 111 zone reception unit, 112 tree display unit, 113 information acquisition unit, 114 terminal classification unit, 115 change reception unit, 116 policy setting unit, 117 setting transmission unit, 20 edge device, 21 processor, 22 memory, 23 storage, 24 communication interface, 211 address acquisition unit, 212 information transmission unit, 213 setting reception unit, 214 communication control unit, 215 log acquisition unit, 30 terminal, 40 zone, 50 asset tree, 61 address, 62 terminal information, 63 connection information, 64 policy, 90 network equipment.

Claims

1. a zone receiving unit that receives input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of the plurality of edge devices being a target edge device; an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device; a terminal classification unit that sets each of the plurality of zones as a group for controlling communication, and classifies a terminal indicated by the connection information acquired by the information acquisition unit into a zone group indicated by the installation information accepted by the zone acceptance unit, the zone group including an edge device that has acquired the connection information; A master device comprising:

2. The master device further comprises: a policy setting unit that uses the group set by the terminal classification unit to set a policy for controlling communication between the groups; The master device of claim 1 .

3. The policy indicates that communication between the same group and between different groups is permitted, while communication between the different groups is to be logged. The master device of claim 2.

4. The master device further comprises: a change receiving unit that displays the group classified by the terminal classifying unit together with the connection information acquired by the information acquiring unit for the terminal and receives a change to the group; The master device of claim 1 .

5. The master device further comprises: A display unit that displays structure data in which each of the plurality of edge devices is treated as a child of a zone in which the device is installed as a parent, and the terminal is treated as a child of an edge device that is a source of the connection information. The master device of claim 1 .

6. The master device further comprises: a tree display section for displaying tree-structured data in which each of the plurality of zones is a node, each of the plurality of edge devices is a child node with the node of the zone in which the edge device is installed as a parent, and the terminal is a child node with the node of the edge device from which the connection information is obtained as a parent; The master device of claim 1 .

7. 7. The master device according to claim 6, wherein the tree display section changes the display of the node of the terminal according to the state of the terminal.

8. The computer accepts an input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of a plurality of edge devices being a target edge device; A computer acquires connection information of a terminal connected to the target edge device from the target edge device; A communication control method in which a computer sets each of the multiple zones as a group for controlling communications, and classifies a terminal indicated by the connection information into a group of zones indicated by the installation information in which the edge device from which the connection information was obtained is installed.

9. a zone reception process for receiving input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of the plurality of edge devices being a target edge device; an information acquisition process for acquiring connection information of a terminal connected to the target edge device from the target edge device; a terminal classification process for setting each of the plurality of zones as a group for controlling communication, and classifying a terminal indicated by the connection information acquired by the information acquisition process into a zone group indicated by the installation information accepted by the zone acceptance process, the zone group including an edge device that has acquired the connection information; A communication control program that causes a computer to function as a master device.

10. A communication control system including a plurality of edge devices and a master device, The master device a zone receiving unit configured to receive input of installation information indicating in which of a plurality of zones the target edge device is installed, the target edge device being regarded as a target edge device; an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device; a terminal classification unit that sets each of the plurality of zones as a group for controlling communication, and classifies a terminal indicated by the connection information acquired by the information acquisition unit into a zone group indicated by the installation information accepted by the zone acceptance unit, the zone group including an edge device that has acquired the connection information; a policy setting unit that sets a policy for controlling communication between the groups by using the groups set by the terminal classification unit; a setting transmission unit that transmits the policy set by the policy setting unit to each of the plurality of edge devices; Equipped with Each of the plurality of edge devices a communication control unit that controls communication between terminals based on the policy transmitted by the setting transmission unit; A communication control system comprising:

Images