Communication path establishment system and method

Abstract

To establish secure communication paths in an environment with diversified edge devices and remote locations.SOLUTION: A system determines whether authentication requirements are met for each individual edge device. If a result of the determination is true, the system outputs communication path information to be set in an edge-side relay unit for a communication path to establish the communication path between the edge device and a remote base with which the edge device communicates. The edge-side relay unit is to perform network control of communication between multiple edge devices in multiple edge bases and multiple remote bases based on the set network control information. The network control information includes communication path information for each communication path. For each communication path, the communication path information includes information representing the communication path and information representing an edge device and a remote base that communicate via the communication path.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention generally relates to establishing communication paths between locations. [Background technology]

[0002] In various IoT systems, such as those in industry, logistics, and power generation, the number of IoT devices is diversifying and increasing. The data acquired by these IoT devices is also diversifying and increasing. For these reasons, the load of data communication and processing is also increasing. IoT devices are located at edge locations.

[0003] Therefore, it is being considered to process data at remote locations instead of or in addition to edge locations, depending on the type and purpose of the data. Examples of remote locations include on-premise data centers, public clouds, and data centers near the edge (for example, Multi Access Edge Computing (MEC) located in the core of a 5G network).

[0004] In Patent Document 1, an intermediary server device is provided between terminal devices, and the intermediary server device authenticates the IDs of both terminal devices to establish a secure communication path. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2019-165291 Summary of the Invention [Problem to be solved by the invention]

[0006] With the diversification of IoT devices and remote locations, there is no de facto standard for IoT device authentication. In IoT systems, there may be cases where other authentication methods are required in addition to or instead of the authentication method disclosed in Patent Document 1. For example, in addition to authenticating where an ID was issued, there may be cases where authentication is required to verify that the ID is being used from the intended IoT device. The technology disclosed in Patent Document 1 cannot address such cases.

[0007] Such problems may also occur in systems other than IoT systems, i.e., systems that have edge devices other than IoT devices. [Means for solving the problem]

[0008] The system determines whether authentication requirements are satisfied for each edge device. If the result of the determination is true, the system outputs communication path information to be set in the edge-side relay unit for the communication path in order to establish a communication path between the edge device and a remote base station with which the edge device communicates. The edge-side relay unit performs network control of communications between multiple edge devices at multiple edge bases and multiple remote base stations based on the set network control information. The network control information includes communication path information for each communication path. For each communication path, the communication path information includes information representing the communication path and information representing the edge device and remote base station communicating via the communication path. [Effects of the Invention]

[0009] According to the present invention, a secure communication path can be established in an environment with a variety of edge devices and remote locations. [Brief explanation of the drawings]

[0010] [Figure 1] 1 shows an example of the overall configuration of a system according to a first embodiment. [Figure 2] 3 shows an example of the configuration of a control management table according to the first embodiment. [Figure 3]3 shows an example of the configuration of a device management table according to the first embodiment. [Figure 4] 10 illustrates an example of the configuration of a network control table set for an SD-WAN GW according to the first embodiment. [Figure 5] 1 shows an example of a sequence according to the first embodiment. [Figure 6] 3 shows an example of an information input UI according to the first embodiment. [Figure 7] 4 shows an example of the flow of processing performed by a collaboration unit according to the first embodiment. [Figure 8] 10 shows an example of a sequence according to the second embodiment. [Figure 9] 10 shows an example of an information input UI according to the second embodiment. [Figure 10] 10 shows an example of the configuration of a device management table according to the second embodiment. [Figure 11] 13 shows an example of the configuration of a device management table according to the third embodiment. [Figure 12] 13 shows an example of the configuration of a line management table according to the third embodiment. [Figure 13] 10 shows an example of the flow of processing performed by a collaboration unit according to the third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] In the following description, an "interface apparatus" may refer to one or more interface devices, which may be at least one of the following: One or more I / O (Input / Output) interface devices. The I / O (Input / Output) interface devices are interface devices for at least one of the I / O device and a remote display computer. The I / O interface device for the display computer may be a communications interface device. The at least one I / O device may be a user interface device, for example, either an input device such as a keyboard and a pointing device, or an output device such as a display device. One or more communication interface devices. The one or more communication interface devices may be one or more homogeneous communication interface devices (e.g., one or more NICs (Network Interface Cards)) or two or more heterogeneous communication interface devices (e.g., an NIC and an HBA (Host Bus Adapter)).

[0012] In the following description, "memory" refers to one or more memory devices, which are an example of one or more storage devices, and may typically be a primary storage device. At least one memory device in the memory may be a volatile memory device or a non-volatile memory device.

[0013] In the following description, a "persistent storage device" may refer to one or more persistent storage devices, which are an example of one or more storage devices. A persistent storage device may typically be a non-volatile storage device (e.g., an auxiliary storage device), and specifically may be, for example, a hard disk drive (HDD), a solid state drive (SSD), a non-volatile memory express (NVME) drive, or a storage class memory (SCM).

[0014] In the following description, the term "storage device" may refer to at least one of memory and persistent storage device.

[0015] Furthermore, in the following description, a "processor" may refer to one or more processor devices. The at least one processor device may typically be a microprocessor device such as a CPU (Central Processing Unit), but may also be another type of processor device such as a GPU (Graphics Processing Unit). The at least one processor device may be a single-core or multi-core. The at least one processor device may also be a processor core. The at least one processor device may also be a processor device in a broader sense, such as a circuit that is a collection of gate arrays written in a hardware description language that performs some or all of the processing (for example, an FPGA (Field-Programmable Gate Array), a CPLD (Complex Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit)).

[0016] In the following description, information that provides an output for an input may be described using expressions such as "xxx table." However, this information may be data of any structure (for example, structured data or unstructured data), or may be a neural network that generates an output for an input, or a learning model such as a genetic algorithm or random forest. Therefore, the "xxx table" may be referred to as "xxx information." In the following description, the structure of each table is an example, and one table may be divided into two or more tables, or all or part of two or more tables may be one table.

[0017] In the following description, functions are sometimes described using the expression "yyy unit." However, the functions may be realized by one or more computer programs executed by a processor, by one or more hardware circuits (e.g., FPGAs or ASICs), or by a combination thereof. When a function is realized by a program executed by a processor, the specified processing is performed using a storage device and / or an interface device, etc., as appropriate, and therefore the function may be considered to be at least a part of the processor. Processing described using a function as the subject may be processing performed by a processor or a device having the processor. A program may be installed from a program source. The program source may be, for example, a program distribution computer or a computer-readable storage medium (e.g., a non-transitory storage medium). The description of each function is merely an example; multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0018] In addition, in the following description, when describing elements of the same type without distinguishing between them, common reference symbols will be used, and when describing elements of the same type with distinction between them, reference symbols will be used. [First embodiment]

[0019] FIG. 1 shows an example of the overall configuration of a system according to the first embodiment.

[0020] An IoT system is used as an example of a system having edge devices and remote locations. A factory site 170 is equipped with an SD-WAN (Software Defined-Wide Area Network) edge system and an SD-WAN GW 171 (SD-WAN gateway) connected to the edge system and the Internet 105. The SD-WAN GW 171 is realized based on physical computing resources (e.g., an interface device including multiple ports, a storage device including memory, and a processor connected to the interface device and the storage device) of a physical relay device 17 (e.g., a physical network connection device such as a physical router).

[0021] The SD-WAN edge system includes a firewall 172U (e.g., a front-end firewall) connected to an SD-WAN GW 171, a switch system 173 (one or more network switches) connected to the firewall 172U, and a firewall 172D (e.g., a back-end firewall) connected to the switch system 173. The SD-WAN edge system also includes multiple edge bases 181, each including a multiple number of edge devices 191. Specifically, the edge bases 181 include, for example, an OT (Operational Technology) network 181D, an OT data segment 181C, a sensor segment 181B, and a DMZ (DeMilitarized Zone) 181A. The edge bases may also be referred to as "segments" or "network segments."

[0022] The OT network 181D is connected to the firewall 172D and may be a LAN (Local Area Network) or other network. A PLC (Programmable Logic Controller) 175 that controls industrial equipment 176 such as a motor, and a SCADA (Supervisory Control And Data Acquisition) 174 that issues instructions to the PLC 175 and acquires data from the PLC 175 are connected to the OT network 181D. At least one of the PLC 175 and the SCADA 174 may be an example of an edge device.

[0023] The OT data segment 181C may be a segment that includes a network (e.g., a LAN or other network) connected to the firewall 172D and an aggregation server 191C connected to the network. The OT data segment 181C may be a segment where data is aggregated from the OT network 181D (e.g., SCADA 174). This collected data may be referred to as "OT data." The aggregation server 191C aggregates the OT data. The aggregation server 191C may be an example of an edge device.

[0024] The sensor segment 181B may be a segment including a network (e.g., a LAN or other network) connected to the switch system 173, and a sensor device 191Bc, a camera device 191Bb, and an aggregation server 191Ba connected to the network. The sensor device 191Bc outputs sensor data. The camera device 191Bb outputs still image or video data. The aggregation server 191Ba aggregates the sensor data. "Sensor data" is data transmitted and received in the sensor segment 181B, and includes still image or video data. At least one of the sensor device 191Bc, the camera device 191Bb, and the aggregation server 191Ba may be an example of an edge device.

[0025] The DMZ 181A may be a segment including a network (e.g., a LAN or other network) connected to the firewall 172U and an IoT server 191A connected to the network. The IoT server 191A collects data within the factory site 170 (e.g., at least a portion of data from at least one of multiple types of edge locations). The IoT server 191A may be an example of an edge device.

[0026] A plurality of (or one) remote locations 101, a cloud security service 150, an authentication proxy service 140, and a management location 110 are connected to the Internet 105.

[0027] Each remote site 101 has a remote relay unit (network connection point) 102 and a data processing service 103. These elements 102 and 103 are based on physical computing resources (typically, computing resources including an interface device, a storage device, and a processor). The remote relay unit 102 may be a physical network connection device or a logical (e.g., software-defined) network connection device. The data processing service 103 may be a program or a function realized by a processor executing the program.

[0028] Specifically, for example, the remote bases 101 include a public cloud 101A, an on-premise DC (data center) 101B, and an edge DC 101C.

[0029] The public cloud 101A includes an SD-WAN point (SD-WAN connection point) 102A and a cloud service 103A. The public cloud 101A provides service connections via the Internet 105.

[0030] The on-premises DC 101B includes an SD-WAN GW 102B and a DC application 103B. The on-premises DC 101B provides a branch connection via the Internet 105.

[0031] The edge DC 101C includes an SD-WAN GW 102C and a DC application 103C. The edge DC 101C provides a branch connection to a nearby location without going through the Internet 105.

[0032] Cloud security service 150 is a computer system (or a function implemented on a computer system) that provides a security solution for accessing the cloud from an edge device. Examples of cloud security service 150 include broker service 150A that provides a solution such as a Cloud Access Security Broker (CASB) and gateway service 150B that provides a solution such as a Secure Web Gateway (SWG). Cloud security service 150 (e.g., each of services 150A and 150B) is an example of an external network control function.

[0033] The authentication proxy service 140 is a computer system (or a function implemented on a computer system) that performs authentication proxy. For example, IDaaS may be adopted as the authentication proxy service 140.

[0034] The management base 110 includes a NW (network) control system 111 and a communication path establishment system 112. Each of the NW control system 111 and the communication path establishment system 112 is a physical computer system (one or more physical computers) in this embodiment, but may also be a logical computer system based on a physical computer system.

[0035] The NW control system 111 sets communication path information for the communication path in the SD-WAN GW 171 to establish a communication path between the edge device 191 and the remote site 101 with which the edge device 191 communicates. The function of the NW control system 111 is an external function of the communication path establishment system 112 (for example, a function provided by a vendor different from the vendor that provides the communication path establishment system 112), but may be an internal function of the communication path establishment system 112. Furthermore, the communication path information may be set in the SD-WAN GW 171 via the Internet 105 or via a dedicated network.

[0036] The communication path establishment system 112 outputs communication path information of the communication path in order to establish the communication path between the edge device 191 and the remote site 101. The NW control system 111 receives the output communication path information, and the NW control system 111 sets the communication path information in the SD-WAN GW 171. If the function of the NW control system 111 is inside the communication path establishment system 112, the communication path establishment system 112 may set the communication path information in the SD-WAN GW 171 (or may output the communication path information in order to set the communication path information in the SD-WAN GW 171).

[0037] The communication path establishment system 112 includes an interface device 121 , a storage device 122 , and a processor 123 connected to the interface device 121 and the storage device 122 .

[0038] The interface device 121 is connected to the NW control system 111 and a UI (User Interface) device 113. That is, the communication path establishment system 112 may communicate with devices external to the management base 110 using the NW control system 111 as an interface. The interface device 121 may be connected to the Internet 105 as shown in the figure, and may communicate with devices external to the management base 110 without going through the NW control system 111. The UI device 113 is an input / output console (computer) such as a personal computer or a smartphone. An administrator sets information in the communication path establishment system 112 via the UI device 113. The UI device 113 may be a client, and the communication path establishment system 112 may be a server.

[0039] The storage device 122 stores information and programs. The information includes a control management table 132 and a device management table 131. A linking program is one of the programs executed by the processor 123. When the processor 123 executes the linking program, a function such as a linking unit 133 is realized. Since the function of the NW control system 111 is realized inside the communication path establishment system 112, a program for realizing the function of the NW control system 111 when executed by the processor 123 may be stored in the storage device 122, and the program may be executed by the processor 123.

[0040] In this embodiment, the SD-WAN GW 171 is an example of an edge-side relay unit. The edge-side relay unit may be a relay unit other than the SD-WAN GW 171 (for example, a physical or virtual router), but is preferably the SD-WAN GW 171 as in this embodiment (details will be described later with reference to FIG. 4). Furthermore, even if the edge-side relay unit is the SD-WAN GW 171, the remote-side relay unit 102 at the remote site 101 does not need to be an SD-WAN GW. For example, if communication via CASB is required to be performed by the distribution of LBO (Local Break Out) by the SD-WAN GW 171, the remote-side relay unit 102 does not need to be an SD-WAN GW.

[0041] FIG. 2 shows an example of the configuration of the control management table 132.

[0042] The control management table 132 represents a plurality of communication requirements. Each communication requirement includes a pair of an edge point 181 and a remote point 101, and a requirement for establishing a communication path for that pair. The requirements for establishing a communication path include a communication path requirement and an authentication requirement. If these requirements are met, the communication path is established.

[0043] For example, the control management table 132 has an entry for each communication requirement. The entry has information such as a source 201, a destination 202, a communication path requirement 203, a hardware authentication requirement 204, and a destination authentication requirement 205.

[0044] The source 201 represents the ID (e.g., IP address) of the edge site 181 that is the connection source. The destination 202 represents the ID (e.g., IP address or host name) of the remote site 101 that is the connection destination. The communication path requirement 203 represents the requirement of the communication path. The HW authentication requirement 204 represents the requirement of HW (hardware) authentication of the edge device 191 in the edge site 181 that is the connection source (e.g., what type of information is used for HW authentication, and / or what type of HW authentication is required using that type of information). The destination authentication requirement 205 represents the authentication requirement required by the remote site 101 that is the connection destination (e.g., what type of information (e.g., where is the client certificate issued by) is used for authentication, and / or what type of authentication is required using that type of information).

[0045] According to this embodiment, for example, there are three types of communication paths: a communication path via a VPN (Virtual Private Network), a communication path for communication according to an LBO (Local Break Out), and a communication path via a cloud security service (an example of a service that performs network control).

[0046] According to the control management table 132 illustrated in FIG. 2, for example, the following is true: DMZ181A accesses remote site 101 using VPN or LBO. For example, communications with a small amount of data but requiring high security are performed via VPN, while communications with a large amount of data are performed via LBO. When using a VPN connection that allows direct local communication, both the hardware and software must be highly trustworthy. For example, as shown in the second entry, a direct connection is made over a closed network called a VPN, so it is necessary to prove that the hardware is authorized to connect and has not been modified. The sensor segment 181B accesses the Internet via LBO or a cloud security service. For example, if the amount of data from the sensor is large, a communication path separate from the closed network may be desirable. In addition, the destination public cloud 101A accepts a general-purpose communication protocol, and communication via LBO (or communication via an external network control service) is possible. If secure communication is possible using a certificate corresponding to the destination, a direct connection via LBO is permitted. On the other hand, if it is difficult to store a certificate in the sensor device 191Bc, etc., a connection via the cloud security service is permitted, although there are protocol restrictions. ·Connection to Edge DC101C does not go through Internet 105, so only LBO is allowed. From the OT data segment 181C, only a connection to the edge DC 101C, which is a connection destination that does not go through the Internet 105, is permitted. This is because the data to be communicated is OT data. When high reliability is required for the edge device 191, reliability equivalent to tamper-proofing is required. Examples of realizing tamper-proofing of HW include deploying a certificate that serves as the origin of trust in a secure area such as an HSM (Hardware Security Module), or using HW that is difficult to copy, such as a SIM (Subscriber Identity Module) card.

[0047] FIG. 3 shows an example of the configuration of the device management table 131.

[0048] The device management table 131 holds information about communication path requirements and authentication information for a pair of an edge device 191 and a remote site 101. For example, the device management table 131 has an entry for each pair of an edge device 191, a destination, a communication path requirement, and authentication information. The entry has information such as an edge device 301, a source 302, a destination 303, a communication path requirement 304, HW information 305, and a destination authentication 306.

[0049] The edge device 301 represents the ID (e.g., IP address or host name) of the edge device 191 that is the connection source. The source 302 represents the ID (e.g., IP address) of the edge base 181 that includes the edge device 191 that is the connection source. The destination 303 represents the ID (e.g., IP address) of the remote base 101 that is the connection destination. The communication path requirements 304 represent the communication path requirements. The HW information 305 is authentication information used in HW authentication that complies with the HW authentication requirements defined for the edge base 181 that includes the edge device 191. The destination authentication 306 represents the authentication method that complies with the authentication requirements required by the remote base 101 that is the connection destination (e.g., which authentication agent service 140 will perform the authentication).

[0050] The communication path establishment system 112 has the above-mentioned control management table 132 and device management table 131. Based on these tables 132 and 131, a linking unit 133 generates and outputs communication path information.

[0051] The control management table 132 contains static information. That is, for each pair of an edge site 181 and a remote site 101, the communication path requirements 203, the HW authentication requirements 204, and the destination authentication requirements 205 correspond to the policy for communication between the edge site 181 and the remote site 101, and are usually not changed unless there is a special reason. Furthermore, even if a new edge device 191 is added to the edge site 181, there is no need to update the control management table 132 unless there is a change in the policy between the edge site 181 and the remote site 101 to which it is connected.

[0052] On the other hand, the device management table 131 contains dynamic information, that is, the device management table 131 is updated in response to the addition or deletion of edge devices 191 in the edge base 181.

[0053] Figure 4 shows an example of the configuration of a network control table set in SD-WAN GW171.

[0054] The network control table 41 has an entry for each communication path. An entry is an example of communication path information. The entry has information such as a source 401, a destination 402, communication details 403, and a communication path 404.

[0055] The source 401 represents the IP address, host name, and port number of the edge device 191. The destination 402 represents the IP address, host name, and port number of the remote site 101.

[0056] Communication details 403 represents details of the communication, specifically, for example, at least one of information representing the protocol used for communication, information representing the application program being communicated, and the type of service (e.g., cloud) to which the network control service through which the communication path passes belongs.

[0057] The communication path 404 indicates the ID of the communication path. The ID may include information indicating the type of the communication path (for example, a communication path via VPN, a communication path for communication according to LBO).

[0058] The SD-WAN GW 171 performs network control of communications between multiple edge devices 191 and multiple remote sites 101 at multiple edge sites 181 based on a network control table 41 set in the SD-WAN GW 171 (specifically, for example, a storage device of the relay device 17 in which the SD-WAN GW 171 is realized). Specifically, for example, the SD-WAN GW 171 searches the network control table 41 for an entry that matches information about the connection source edge device 191, information about the connection destination remote site 101, and information about details of communication by the edge device 191, and performs network control of communications between the edge device 191 and the remote site 101 (specifically, relays the communications) via the communications path indicated by the matching entry. In other words, the SD-WAN GW 171 switches the communications path depending on which edge device 191 is communicating with which remote site 101.

[0059] By applying SD-WAN technology, software-defined virtual communication paths can be overlaid on physical communication paths, making it possible to virtually define communication paths for each communication requirement. The information required to virtually define a communication path is communication path information, a specific example of which is one entry in the network control table 41. Each entry may be equivalent to one entry in a YAML or JSON file. That is, a communication path is assigned to a pair of an edge device 191 and a remote site 101 according to a source 401 (the IP address, host name, and port number of the edge device 191), a destination 402 (the IP address, host name, and port number of the remote site 101), and communication details 403 (information indicating a protocol, application, service, etc.).

[0060] As a comparison, consider a case where SD-WAN is not applied. However, in that case, each time a new communication path is required, a physical or virtual gateway (GW) equivalent must be prepared and communication path information must be configured. Methods for preparing a separate GW equivalent include arranging physical switches (e.g., routers), logically dividing physical switches, and deploying virtual switch appliances, but the scale of the configuration and management become more complex as the number of communication paths increases.

[0061] FIG. 5 shows an example of a sequence according to the first embodiment.

[0062] An information input UI 500 (see FIG. 6) is displayed on the UI device 113. As shown in FIG. 6, the information input UI 500 is typically a GUI (Graphical User Interface). The information input UI 500 may be a UI displayed by executing an application on the UI device 113, or may be a UI provided by the communication path establishment system 112 (for example, a UI displayed by a browser on the UI device 113). The information input UI 500 includes a control management UI 501 and a device management UI 502. The control management UI 501 accepts input of information 201 to 205 of entries in the control management table 132. The device management UI 502 accepts input of information 301 to 306 of entries in the device management table 131.

[0063] Information 201 to 205 input via the control management UI 501 is registered in the control management table 132 (S501). Information 301 to 306 input via the device management UI 502 is registered in the device management table 131 (S502). Note that for both the control management table 132 and the device management table 131, all of the information in the entry does not need to be input via the information input UI 500. For example, when the ID of the edge device 191 is input, information on the edge site 181 may be obtained from a table showing the correspondence between the edge device 191 and the edge site 181 using the ID as a key, and the obtained information may be registered as the source 302 in the device management table 131.

[0064] The SD-WAN GW 171 is connected to the remote-side relay unit 102 in each remote site 101 (S511). The connection in S511 may be via the Internet 105 or may not be via the Internet 105.

[0065] In the following description, one edge device 191 in one edge base 181 will be taken as an example of one connection source edge device 191. For convenience, in the following description, an entry in the device management table 131 will be referred to as a "device entry," and an entry in the control management table 132 will be referred to as a "control entry."

[0066] The source edge device 191 is connected to the SD-WAN GW 171 (S512). The connection here refers to the SD-WAN GW 171 receiving information from the source edge device 191. For example, the source edge device 191 sends a request to the destination remote site 101, and the SD-WAN GW 171 receives the request.

[0067] The SD-WAN GW 171 notifies the coordinating unit 133 of connection information including information indicating the connection source edge device 191 and the connection destination remote site 101, for example, via the NW control system 111 (S513). The coordinating unit 133 receives the connection information from the SD-WAN GW 171 and detects, based on the information, that a connection has been made from the connection source edge device 191 to the SD-WAN GW 171.

[0068] The collaboration unit 133 identifies a device entry (hereinafter, "corresponding device entry") corresponding to information (e.g., IP address and host name) of the connection source edge device 191 and the connection destination remote site 101 identified from the connection information from the device management table 131, and identifies the communication path requirement 304 from the corresponding device entry (S514). The collaboration unit 133 identifies a control entry (hereinafter, "corresponding control entry") corresponding to the identified communication path requirement 304 and information (e.g., IP address and host name) of the connection source edge device 191 and the connection destination remote site 101 identified from the connection information from the control management table 132, and identifies the HW authentication requirement 204 and the destination authentication requirement 205 from the corresponding control entry (S515).

[0069] Thereafter, the coordinating unit 133 determines whether to establish a communication path based on the HW authentication requirements 204 and destination authentication requirements 205 in the identified control entry and the HW information 305 and destination authentication 306 in the device entry, and outputs communication path information if the result of the determination is true (S551). The NW control system 111 sets the communication path information in the SD-WAN GW 171 (S552). This establishes a communication path between the connection source edge device 191 and the connection destination remote site 101. The determination of whether to establish a communication path may include determining whether the HW authentication requirements 204 in the control entry are satisfied by the HW information 305 in the device entry.

[0070] After the communication path is established, communication between the connection source edge device 191 and the connection destination remote site 101 via the SD-WAN GW 171 is possible without the cooperation unit 133 (S560).

[0071] Between S514 and S515 and S551 and S552, for example, either of the following process 1 or process 2 may be performed based on the identified corresponding control entry and corresponding device entry. Either process 1 or process 2 may be included in the determination of whether to establish a communication path. Specifically, either process 1 or process 2 may include the determination of whether the destination authentication 306 in the corresponding device entry satisfies the destination authentication requirements 205 in the corresponding control entry.

[0072] Process 1 is the process indicated by the dashed line. That is, when the destination authentication requirements 205 in the corresponding control entry indicate authentication by an authentication proxy server, the coordinating unit 133 transmits a request (e.g., a certificate request) including information about the source edge device 191 (e.g., an IP address or a host name) to the authentication proxy service 140 indicated by the destination authentication 306 in the corresponding device entry (S521). The coordinating unit 133 receives a response to the request from the authentication proxy service 140 (S522). The coordinating unit 133 installs the certificate in the response in the source edge device 191 (S523). For example, the coordinating unit 133 may determine whether the certificate satisfies the destination authentication requirements 205 in the corresponding control entry, and perform S523 if the result of this determination is true.

[0073] Process 2 is the process indicated by the dashed dotted line. That is, when the destination authentication requirements 205 in the corresponding control entry indicate client authentication compatible with remote locations, the coordinating unit 133 transmits a request (e.g., a certificate request) including information (e.g., an IP address or a host name) of the source edge device 191 to the destination remote location 101 (S531). The coordinating unit 133 receives a response to the request from the remote location 101 (S532), and installs the certificate in the response in the source edge device 191 (S533). For example, the coordinating unit 133 may determine whether the certificate satisfies the destination authentication requirements 205 in the corresponding control entry, and perform S533 if the result of this determination is true.

[0074] Instead of S531 to S533, process 3 indicated by the two-dot chain line may be performed (for example, process 3 may be performed before the sequence shown in FIG. 5 is executed). That is, the cooperation unit 133 may provide the UI device 113 with a UI that accepts input and confirmation of authentication information, accept the authentication information via the UI (S541), and set the authentication information in the source edge device 191 (S542). Note that with regard to this process, the cooperation unit 133 may determine whether a certificate is installed in the source edge device 191 as a determination as to whether the destination authentication requirement 205 in the control entry is satisfied.

[0075] FIG. 7 shows an example of the flow of processing performed by the collaboration unit 133 according to the first embodiment.

[0076] The cooperation unit 133 detects the connection source edge device 191 and the connection destination remote site 101 from the above-mentioned connection information from the SD-WAN GW 171 (S701). In S701, the edge site 181 of the connection source edge device 191 may also be detected based on the connection information.

[0077] The linking unit 133 refers to the device management table 131 and identifies the relevant device entry that corresponds to the detection in S701 (the connection source edge device 191 and the connection destination remote site) (S702).

[0078] The linking unit 133 refers to the control management table 132 and identifies the relevant control entry that corresponds to the source 302, destination 303, and communication path requirement 304 in the relevant device entry (S703).

[0079] The linking unit 133 determines whether the HW information 305 in the corresponding device entry satisfies the HW authentication requirements 204 of the corresponding control entry (S704). If the corresponding control entry does not exist or the HW information 305 in the corresponding device entry does not satisfy the HW authentication requirements 204 of the corresponding control entry, the determination result in S704 is false.

[0080] If the determination result in S704 is false (S704: No), the linking unit 133 does not establish a communication path and contacts the administrator (S708). The administrator may be contacted by email, a messenger service, or the like.

[0081] If the judgment result of S704 is true (S704: Yes), and if the destination authentication 306 in the corresponding device entry represents an authentication agency service, the collaboration unit 133 obtains a certificate of the source edge device for the destination remote site 101 from the corresponding authentication agency service 140, for example, using the account information of the person in charge (S705).

[0082] The linking unit 133 determines whether the certificate acquired in S705 satisfies the requirements indicated by the destination authentication requirements 205 in the control entry (S706). If the determination result in S706 is false (S706: No), S708 is performed.

[0083] If the determination result in S706 is true (S706: Yes), the cooperation unit 133 outputs communication path information of the communication path between the connection source edge device and the connection destination remote site 101 (S707). [Second embodiment]

[0084] The second embodiment will be described, focusing mainly on the differences from the first embodiment, and explanations of the commonalities with the first embodiment will be omitted or simplified.

[0085] FIG. 8 shows an example of a sequence according to the second embodiment.

[0086] The same processing as in S501 is performed (S801). Also, the same processing as in S511 to S513 is performed (S811 to S813).

[0087] The linking unit 133 displays the device connection information included in the connection information from the SD-WAN GW 171 on the UI device 113 (S814). For example, the information input UI 900 illustrated in FIG. 9 is an input UI for information to be registered in the device management table 131 (an input UI for information to be registered in the control management table 131 may exist separately, for example, it may be a UI for inputting S801). The information input UI 900 displays device information 921 as at least a part of the connected device information in the connection information from the SD-WAN GW 171. If the administrator permits the connection, the administrator presses a connection permit button 911 (S815), and if the administrator does not permit the connection, the administrator presses a disconnect button 912.

[0088] If the connection is permitted, the linking unit 133 registers the device information 921 in the device management table 131 (S816). For example, the linking unit 133 registers the IP address (and host name) in the device information 921 as the edge device 301, registers the information of the connection segment in the device information 921 as the source 302, registers the IP address (and host name) in the device information 921 as the edge device 301, and registers the information of the connection destination in the device information 921 as the destination 303. For this reason, as shown in FIG. 9, the device management UI 502 does not have an input UI (for example, a GUI component) for information as the edge device 301, the source 302, and the destination 303.

[0089] After S816, although not shown, the same processing as that from S514 onwards in FIG. 5 is carried out.

[0090] FIG. 10 shows an example of the configuration of the device management table 131 according to the second embodiment.

[0091] In addition to the above-described information 301 to 306, a device entry in the device management table 131 includes a connection time 901, an approver 902, and an approval time 903. The connection time 901, the approver 902, and the approval time 903 may or may not affect the determination of whether or not to establish a communication path. For example, the connection time 901, the approver 902, and the approval time 903 may be used as a kind of log information.

[0092] The connection time 901 indicates the time when the edge device 191 was connected. The connection time 901 may be information indicating the time identified from the connection information from the SD-WAN GW 171 (the time when the SD-WAN GW 171 was connected from the edge device 191).

[0093] The approver 902 indicates the ID of the administrator who permitted the connection of the edge device 191. The approval time 1003 indicates the time when the connection was permitted by the administrator. [Third embodiment]

[0094] The third embodiment will be described below, focusing mainly on the differences from the first embodiment, and explanations of the commonalities with the first embodiment will be omitted or simplified.

[0095] FIG. 11 shows an example of the configuration of the device management table 131 according to the third embodiment.

[0096] In addition to the above-mentioned information 301 to 306, the device entry in the device management table 131 includes an average bandwidth usage 1101 and a peak bandwidth usage 1102. For example, it is conceivable that the sensor data aggregating server 191Ba, which has a large bandwidth, aggregates and transmits sensor data with a large amount of information, such as from a vibration sensor.

[0097] The average bandwidth used 1101 and the peak bandwidth used 1102 are examples of information representing line usage, and are registered in advance. The average bandwidth used 1101 represents an expected average value of the bandwidth used in communication between the edge device 191 and the remote site 101. The peak bandwidth used 1102 represents an expected peak value of the bandwidth used in communication between the edge device 191 and the remote site 101.

[0098] FIG. 12 shows an example of the configuration of a line management table according to the third embodiment.

[0099] The storage device 122 of the communication path establishment system 112 stores a line management table 1200 shown in the figure in addition to a device management table 131 and a control management table 132 .

[0100] The line management table 1200 holds information about each of the multiple lines included in the Internet 105. The line management table 1200 has an entry for each combination of source, destination, and communication path. The entry has information such as a source 1201, a destination 1202, a communication path 1203, a primary line 1204, a line bandwidth 1205, an average bandwidth used 1206, a peak bandwidth used 1207, an average bandwidth threshold 1208, and a peak bandwidth threshold 1209.

[0101] A source 1201 represents the edge point 181. A destination 1202 represents the remote point 101. A communication path 1203 represents the communication path between the edge point 181 and the remote point 101. A main line 1204 represents one of multiple lines through which the communication path passes. A line bandwidth 1205 represents the line bandwidth.

[0102] The average bandwidth used 1206 represents a value based on one or more average bandwidths used 1101 for the line (for example, the sum of one or more average bandwidths used 1101). The "average bandwidth used 1101" here refers to the average bandwidth used 1101 corresponding to the pair of source 302 and destination 303 that matches the pair of source 1201 and destination 1202 corresponding to the line.

[0103] The peak usage bandwidth 1207 represents a value based on one or more peak usage bandwidths 1102 for the line (for example, the sum of one or more peak usage bandwidths 1102). The "peak usage bandwidth 1102" here refers to the peak usage bandwidth 1102 corresponding to the pair of source 302 and destination 303 that matches the pair of source 1201 and destination 1202 corresponding to the line.

[0104] The average bandwidth threshold 1208 is the base of the threshold of the average used bandwidth 1206, and specifically, this threshold is a value (for example, 1 Gbps x 30% = 300 Mbps) determined based on the line bandwidth 1205 and the average bandwidth threshold 1208.

[0105] The peak bandwidth threshold 1209 is the base of the threshold for the peak bandwidth used 1207, and specifically, this threshold is a value (for example, 1 Gbps x 80% = 800 Mbps) determined based on the line bandwidth 1205 and the peak bandwidth threshold 1209.

[0106] Each of the average bandwidth used 1206 and the peak bandwidth used 1207 is an example of a value obtained based on the line usage of all edge devices to which a communication path via the line has already been established.

[0107] The threshold obtained based on the line bandwidth 1205 and the average bandwidth threshold 1208, and the threshold obtained based on the line bandwidth 1205 and the peak bandwidth threshold 1209 are each an example of a usage threshold.

[0108] Each time a communication path via a line is added, the average usage bandwidth 1101 and peak usage bandwidth 1102 corresponding to the edge device 191 corresponding to the added communication path for that line increase, and therefore the average usage bandwidth 1206 and peak usage bandwidth 1207 corresponding to that line increase. Lines may be managed in the following three ways, for example. Secure connections between locations such as VPN. · General communication route via the Internet via LBO and Cloud Secure Services. Access to the edge DC via direct connection to the carrier's core network (access to a specific edge DC requires the use of a specific carrier's line).

[0109] FIG. 13 shows an example of the flow of processing performed by the collaboration unit 133 according to the third embodiment.

[0110] After S806: Yes, the cooperation unit 133 refers to the line management table 1200 and determines whether the average bandwidth used 1206 and the peak bandwidth used 1207 of the primary line are below their respective thresholds even after the communication path is established (S1300). The determination in S1300 includes the following two determinations. If the result of at least one of the following two determinations is false, the result of the determination in S1300 is false. The coordination unit 133 updates the average bandwidth used 1206 by adding the average bandwidth used 1101 in the device entry to the average bandwidth used 1206 corresponding to the main line 1204 for the device entry. The coordination unit 133 determines whether the updated average bandwidth used 1206 is equal to or less than a threshold obtained based on the line bandwidth 1205 and the average bandwidth threshold 1208. The coordination unit 133 updates the peak usage bandwidth 1207 for the main line 1204 corresponding to the device entry by adding the peak usage bandwidth 1102 in the device entry to the peak usage bandwidth 1207 corresponding to the main line 1204. The coordination unit 133 determines whether the updated peak usage bandwidth 1207 is equal to or less than the threshold obtained based on the line bandwidth 1205 and the peak bandwidth threshold 1209.

[0111] If the determination result of S1300 is false (S1300: No), S808 is performed. If the determination result of S1300 is true (S1300: Yes), S807 is performed.

[0112] Although several embodiments have been described above, these are merely examples for explaining the present invention, and the scope of the present invention is not limited to these embodiments. The present invention can be implemented in various other forms.

[0113] The above description can be summarized, for example, as follows: The following summary may include supplementary explanations and explanations of variations of the above description.

[0114] The communication path establishment system 112 includes an interface device 121 , a storage device 122 , and a processor 123 connected to the interface device 121 and the storage device 122 .

[0115] The storage device 122 stores management information, which includes control management information (for example, a control management table 132) that indicates communication path requirements and authentication requirements between the edge points 181 and the remote points 101.

[0116] An edge-side relay unit (e.g., SD-WAN GW17) performs network control of communications between multiple edge devices 191 at multiple edge sites 181 and multiple remote sites 101 based on network control information (e.g., network control table 41) set in the edge-side relay unit. The network control information includes communication path information for each communication path. For each communication path, the communication path information (e.g., an entry in network control table 41) includes information representing the communication path (e.g., communication details 403 and communication path 404) and information representing the edge device and remote site communicating via the communication path (e.g., source 401 and destination 402).

[0117] For each edge device 191, the processor 123 performs requirement determination, which is a determination as to whether or not the authentication requirements are satisfied, based on the management information. If the result of the requirement determination is true, the processor 123 outputs, via the interface device 121, communication path information to be set in the edge-side relay unit for the communication path in order to establish a communication path between the edge device 191 and the remote site 101 with which the edge device 191 communicates. The NW control system 111 (or a function as the NW control system 111) receives the output communication path information and sets the communication path information in the edge-side relay unit.

[0118] This makes it possible to establish a secure communication path in an environment where edge devices 191 and remote locations 108 are diversified.

[0119] In such an environment, communication requirements vary depending on the pair of edge device 191 and remote site 101. In this embodiment, the communication requirements are separated into communication path requirements and authentication requirements, and the communication path requirements and authentication requirements can be set separately depending on the pair of edge device 191 and remote site 101. For the communication path requirements, it is possible to adopt a requirement such as via an external network control service, and for the authentication requirements, it is possible to adopt a requirement such as using an authentication proxy service. In other words, the communication path establishment system 112 does not need to take on both the control that satisfies the communication path requirements and the authentication that satisfies the authentication requirements.

[0120] The control management information may represent each of a plurality of communication requirements. Each of the plurality of communication requirements may include a set of an edge site, a remote site, a communication path requirement, and an authentication requirement. For each edge device 191, the processor may identify, based on the control management information, a communication requirement including the edge site 181 including the edge device 191 and the remote site 101 with which the edge device 191 communicates (e.g., identify the relevant control entry). The authentication requirement subject to requirement determination may be the authentication requirement in the identified communication requirement. The communication path information output when the result of the requirement determination is true may be information representing a communication path that satisfies the communication path requirement in the identified communication requirement. In this way, a communication path that satisfies the authentication requirement and the communication path requirement can be established.

[0121] The management information may include device management information (e.g., device management table 131) including authentication information, which is information related to authentication for each of the multiple edge devices 191. For each edge device 191, the requirement determination may be a determination of whether or not the authentication information corresponding to that edge device 191 satisfies the authentication requirements in the identified communication requirements. In this way, it can be determined whether or not the edge device 191 satisfies the authentication requirements.

[0122] Each of the multiple communication requirements may be as follows. That is, the authentication requirements in the communication requirements may include hardware authentication requirements and destination authentication requirements. The hardware authentication requirements may be requirements on hardware information, which is information for identifying an edge device. The destination authentication requirements may be requirements on destination authentication information, which is information on an authentication method for permitting communication with a remote site in the communication requirements. For each of the multiple edge devices 191, the authentication information may include hardware information of the edge device 191 and destination authentication information corresponding to the remote site 101 with which the edge device 191 can communicate. For each edge device 191, the requirement determination may include a first determination and a second determination. The first determination may be a determination of whether the hardware information of the edge device 191 satisfies the hardware authentication requirements in the specified communication requirements. The second determination may be a determination of whether the destination authentication information of the edge device 191 satisfies the destination authentication requirements in the specified communication requirements. The result of the requirement determination being true may be that the result of the first determination is true and the result of the second determination is true. In this way, it can be determined whether the edge device 191 satisfies the authentication requirements.

[0123] The device management information in the management information may include information indicating the expected line usage of each of the edge devices 191 (for example, at least one of the average usage bandwidth 1101 and the peak usage bandwidth 1102) for each of the edge devices 191.

[0124] The management information may include line management information (e.g., line management table 1200). The line management information may include information representing, for each of a plurality of lines, a pair of an edge point 181 and a remote point 101 that communicate via the line, and a usage threshold that is a threshold related to line usage. The information representing the usage threshold may be, for example, line bandwidth 1205 and average bandwidth threshold 1208, and / or line bandwidth 1205 and peak bandwidth threshold 1209.

[0125] For each edge device 191, the processor 123 may identify, based on the management information, a line corresponding to a pair of the edge base 181 including the edge device 191 and the remote base 101 with which the edge device 191 communicates. Based on the management information, the processor 123 may perform a usage determination, which is a determination of whether a value (e.g., the average bandwidth used 1206 and / or the peak bandwidth used 1207) obtained based on the line usage of all edge devices 191 with which communication paths via the identified line have been established is less than a usage threshold of the identified line. If the result of the requirement determination is true and the result of the usage determination is also true, the processor 123 may output, via the interface device 121, communication path information to be set in the edge-side relay unit for the communication path via the identified line between the edge device 191 and the remote base 101 with which the edge device 191 communicates. This makes it possible to increase the number of communication paths via the line for each line within a range in which the line usage is equal to or less than the usage threshold of the line. [Explanation of symbols]

[0126] 112: Communication path establishment system

Claims

1. an interface device; a storage device that stores management information including control management information that indicates communication path requirements and authentication requirements between a plurality of edge points and a plurality of remote points; a processor connected to the interface device and the storage device, and configured to output communication path information set in the edge-side relay unit through the interface device; Equipped with the edge-side relay unit performs network control of communications between a plurality of edge devices in the plurality of edge bases and the plurality of remote bases based on network control information set in the edge-side relay unit, the network control information includes communication path information for each communication path; For each communication path, the communication path information includes information representing the communication path, and information representing an edge device and a remote location that communicate via the communication path; The processor, for each edge device, performing a requirement determination based on the management information to determine whether or not authentication requirements are met; If the result of the requirement determination is true, outputting, via the interface device, communication path information to be set in the edge-side relay unit for the communication path in order to establish a communication path between the edge device and a remote site with which the edge device communicates; the control management information represents a communication requirement for each of a plurality of communication requirements; each of the plurality of communication requirements includes a set of an edge site, a remote site, a communication path requirement, and an authentication requirement; For each of the edge devices, The processor identifies communication requirements including an edge base including the edge device and a remote base with which the edge device communicates based on the control and management information; the authentication requirements to be subjected to the requirement determination are authentication requirements in the identified communication requirements, the communication path information output when the result of the requirement determination is true is information representing a communication path that satisfies the communication path requirements in the identified communication requirements, the management information includes device management information including authentication information that is information regarding authentication of each of the plurality of edge devices, For each of the plurality of communication requirements, The authentication requirement in the communication requirement includes a hardware authentication requirement and a destination authentication requirement; the hardware authentication requirement is a requirement regarding hardware information that is information for identifying an edge device, the destination authentication requirement is a requirement on destination authentication information, which is information on an authentication method for permitting communication with a remote location in the communication requirement; For each of the plurality of edge devices, the authentication information includes hardware information of the edge device and destination authentication information corresponding to a remote location with which the edge device can communicate; For each of the edge devices, The requirement determination is a first determination of whether hardware information of the edge device satisfies a hardware authentication requirement in the identified communication requirement; a second determination of whether the destination authentication information of the edge device satisfies the destination authentication requirements in the identified communication requirements; Including, The result of the requirement determination being true means that the result of the first determination is true and the result of the second determination is true. Communication channel establishment system.

2. For each of the edge devices, the processor provides a user interface (UI) that accepts information related to authentication for the edge device. The communication path establishment system according to claim 1 .

3. At least one communication path is a communication path via a VPN (Virtual Private Network), a communication path for communication according to an LBO (Local Break Out), or a communication path via a service that performs network control. The communication path establishment system according to claim 1 .

4. At least one authentication requirement is the installation of a corresponding certificate at the remote site or the use of an authentication proxy service; The communication path establishment system according to claim 1 .

5. The device management information includes information input via the UI, For at least one edge device, the processor receives information about the edge device from the edge-side relay unit connected from the edge device, The information about the edge device in the device management information includes the information received by the processor. The communication path establishment system according to claim 2 .

6. The management information is the device management information including information representing an expected line usage of each of the plurality of edge devices; line management information including information indicating, for each of a plurality of lines, a pair of an edge point and a remote point that communicate via the line and a usage threshold that is a threshold related to line usage; Including, For each of the edge devices, the processor: Based on the management information, a line corresponding to a pair of an edge base including the edge device and a remote base with which the edge device communicates is identified; Based on the management information, a usage determination is performed to determine whether a value obtained based on the line usage of all edge devices to which a communication path via the specified line has been established is less than a usage threshold of the specified line; When the result of the requirement determination is true and the result of the usage determination is true, communication path information set in the edge-side relay unit for the communication path via the specified line between the edge device and the remote base with which the edge device communicates is output through the interface device. The communication path establishment system according to claim 1 .

7. The edge-side relay unit is a gateway of a SD-WAN (Software Defined-Wide Area Network), The communication path establishment system according to claim 1 .

8. For each edge device, the computer performs a requirement determination based on the management information, the requirement determination being a determination of whether the authentication requirement is met; When the result of the requirement determination is true, the computer outputs communication path information to be set in the edge-side relay unit for the communication path in order to establish a communication path between the edge device and a remote site with which the edge device communicates; the management information includes control management information that indicates communication path requirements and authentication requirements between a plurality of edge points and a plurality of remote points, the edge-side relay unit performs network control of communications between a plurality of edge devices in the plurality of edge bases and the plurality of remote bases based on network control information set in the edge-side relay unit, the network control information includes communication path information for each communication path; For each communication path, the communication path information includes information representing the communication path, and information representing an edge device and a remote location that communicate via the communication path; the control management information represents a communication requirement for each of a plurality of communication requirements; each of the plurality of communication requirements includes a set of an edge site, a remote site, a communication path requirement, and an authentication requirement; For each of the edge devices, The computer identifies communication requirements including an edge base including the edge device and a remote base with which the edge device communicates based on the control and management information; the authentication requirements to be subjected to the requirement determination are authentication requirements in the identified communication requirements, the communication path information output when the result of the requirement determination is true is information representing a communication path that satisfies the communication path requirements in the identified communication requirements, the management information includes device management information including authentication information that is information regarding authentication of each of the plurality of edge devices, For each of the plurality of communication requirements, The authentication requirement in the communication requirement includes a hardware authentication requirement and a destination authentication requirement; the hardware authentication requirement is a requirement regarding hardware information that is information for identifying an edge device, the destination authentication requirement is a requirement on destination authentication information, which is information on an authentication method for permitting communication with a remote location in the communication requirement; For each of the plurality of edge devices, the authentication information includes hardware information of the edge device and destination authentication information corresponding to a remote location with which the edge device can communicate; For each of the edge devices, The requirement determination is a first determination of whether hardware information of the edge device satisfies a hardware authentication requirement in the identified communication requirement; a second determination of whether the destination authentication information of the edge device satisfies the destination authentication requirements in the identified communication requirements; Including, The result of the requirement determination being true means that the result of the first determination is true and the result of the second determination is true. How to establish a communication path.

9. For each edge device, conducting a requirement determination based on the management information, which is a determination of whether the certification requirements are met; If the result of the requirement determination is true, output communication path information to be set in the edge-side relay unit for the communication path in order to establish a communication path between the edge device and a remote site with which the edge device communicates. Let the computer do that, the management information includes control management information that indicates communication path requirements and authentication requirements between a plurality of edge points and a plurality of remote points, the edge-side relay unit performs network control of communications between a plurality of edge devices in the plurality of edge bases and the plurality of remote bases based on network control information set in the edge-side relay unit, the network control information includes communication path information for each communication path; For each communication path, the communication path information includes information representing the communication path and information representing an edge device and a remote location that communicate via the communication path. the control management information represents a communication requirement for each of a plurality of communication requirements; each of the plurality of communication requirements includes a set of an edge site, a remote site, a communication path requirement, and an authentication requirement; For each of the edge devices, The computer identifies communication requirements including an edge base including the edge device and a remote base with which the edge device communicates based on the control and management information; the authentication requirements to be subjected to the requirement determination are authentication requirements in the identified communication requirements, the communication path information output when the result of the requirement determination is true is information representing a communication path that satisfies the communication path requirements in the identified communication requirements, the management information includes device management information including authentication information that is information regarding authentication of each of the plurality of edge devices, For each of the plurality of communication requirements, The authentication requirement in the communication requirement includes a hardware authentication requirement and a destination authentication requirement; the hardware authentication requirement is a requirement regarding hardware information that is information for identifying an edge device, the destination authentication requirement is a requirement on destination authentication information, which is information on an authentication method for permitting communication with a remote location in the communication requirement; For each of the plurality of edge devices, the authentication information includes hardware information of the edge device and destination authentication information corresponding to a remote location with which the edge device can communicate; For each of the edge devices, The requirement determination is a first determination of whether hardware information of the edge device satisfies a hardware authentication requirement in the identified communication requirement; a second determination of whether the destination authentication information of the edge device satisfies the destination authentication requirements in the identified communication requirements; Including, The result of the requirement determination being true means that the result of the first determination is true and the result of the second determination is true. Computer program.

Images