Communication interruption device

Abstract

A communication interruption device (100) updates, on the basis of settings of a communication device that handles communication from a terminal device, an interruption determination condition to be used for determining whether or not to interrupt specific communication between the communication device and the terminal device. The communication interruption device (100) determines whether or not to interrupt specific communication between the communication device and the terminal device on the basis of the interruption determination condition and information relating to the specific communication.

Description

Communication interruption device

[0001] The present invention relates to a communication cutoff device that controls traffic when settings are input to devices that make up a communication network.

[0002] Communication networks such as IP (Internet Protocol) networks provided by telecommunications carriers are composed of a large number of diverse communication devices. Devices such as NW (Network) controllers that manage and control the communication devices mechanically generate and change configuration information (hereinafter sometimes referred to as "config") for each communication device by appropriately combining components of the configuration information for each communication device to build or restore the communication network.

[0003] Therefore, when implementing the above-mentioned expansion or preventive maintenance, the telecommunications carrier completes the work of connecting the physical wiring of the communication devices in advance, and then remotely inputs the configuration into the communication devices via the NW controller. As a result, communication devices in progress whose communication settings have not yet been completed may be temporarily connected to the communication network.

[0004] When telecommunications carriers enhance their communication networks or perform preventive maintenance, they are required to do so without affecting end users. However, unexpected communication between a communication device in progress and a terminal device may cause a failure in the communication network or interrupt communication between the end user and the communication device. To address this issue, a technology (Non-Patent Document 1) is known that controls predetermined communications by virtually providing and controlling end-user devices based on technologies such as vCPE (virtual customer premises equipment). Another known technology is one that relocates end-user devices from a specific communication device to a different communication device during maintenance work by a telecommunications carrier (see, for example, Non-Patent Document 2).

[0005] Hiroki Inoue, Toru Okugawa, Akio Masuda, Practical Evaluation of WAN Acceleration Function Virtualization in vCPE, IEICE Technical Report, April 10, 2014, Vol. 114 No. 6, pp. 125-130. Hiroki Hosono, Hiroki Inoue, Shinji Abe, Atsushi Sudo, Yasuyuki Niihara, A Study on a Phased Migration Method for Network Equipment, 2022 IEICE General Conference, March 1, 2022, B-6-67

[0006] However, with the conventional technology, there is a problem that it may be difficult to block unexpected communication between a communication device and a terminal device. For example, with the conventional technology, it is difficult to take into account all devices that may exist beyond a user network interface (UNI) and to perform appropriate control.

[0007] Furthermore, even if a predetermined communication is controlled based on the conventional technology, the communication device must be capable of performing a Config change procedure, such as implementing a communication cutoff setting to prevent unexpected communication by the communication device, changing the Config required for communication, and then canceling its own communication cutoff setting, etc. However, communication devices included in a communication network do not necessarily have the above-mentioned functions, and in practice, it may be difficult to perform control based on the reference technology.

[0008] Therefore, in order to solve the above problems and achieve the objective, the communication blocking device of the present invention is characterized by having an update unit that updates the blocking judgment conditions used to determine whether to block a specified communication between a communication device and a terminal device based on the setting status of the communication device that accommodates communication from the terminal device, and a judgment unit that determines whether the specified communication between the communication device and the terminal device is communication to be blocked based on the blocking judgment conditions and information regarding the specified communication.

[0009] The present invention has an effect of enabling unexpected communication between a communication device and a terminal device to be cut off.

[0010] FIG. 1 is a diagram illustrating a communication cutoff device according to the present embodiment. FIG. 2 is a diagram illustrating an example of Config settings according to the present embodiment. FIG. 3 is a diagram illustrating an example of a reference technology. FIG. 4 is a diagram illustrating an example of the configuration of a communication cutoff device and a communication control device according to a first embodiment. FIG. 5 is a table diagram illustrating an example of cutoff determination conditions according to the first embodiment. FIG. 6 is a table diagram illustrating an example of communication device registration information according to the first embodiment. FIG. 7 is a diagram illustrating an example of a flowchart of a communication cutoff method according to the first embodiment. FIG. 8 is a diagram illustrating an example of the configuration of a communication cutoff device and a communication control device according to a second embodiment. FIG. 9 is a sequence diagram illustrating an example of communication cutoff processing according to the second embodiment. FIG. 10 is a diagram illustrating an example of a computer that executes communication cutoff processing according to the present embodiment.

[0011] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. Note that the embodiments are not limited to the following description.

[0012] <Description of Communication Control Device> Fig. 1 is a diagram illustrating a communication cutoff device 100 according to this embodiment. The communication cutoff device 100 shown in Fig. 1 is an example of a computer that provides a technology for determining whether to cut off a predetermined communication between a communication device and a terminal device based on the setting status of the communication device in a communication network, and cutting off the communication determined to be subject to cutting off. Note that in this embodiment, the "predetermined communication" refers to any communication that takes place between an end-user terminal device and a communication device, and is not limited to a specific communication.

[0013] Conventionally, when a telecommunications carrier performs expansion or preventive maintenance on a communication network such as an IP network, the carrier is required to do so without affecting the end user side. Therefore, the telecommunications carrier completes the work of connecting the physical wiring of the communication devices in advance, and then remotely configures the communication devices via a network controller.

[0014] The above-mentioned communication settings may use Config, which is generated for each device type or target device. Here, the setting of a communication device using Config will be described. Fig. 2 is a diagram showing an example of Config setting according to this embodiment.

[0015] The device that manages and controls the communication device (hereinafter, sometimes referred to as the "communication control device") mechanically combines Config components prepared in advance for each device type to generate and input Config for setting up communication for each communication device 300.

[0016] 2, the communication control device 200 stores a Config component for device type a and a Config component for device type b ((1-1) and (1-2) in FIG. 2). When the communication control device 200 performs communication settings for the communication devices 300A to 300C, the communication control device 200 generates an input Config for each communication device 300.

[0017] Specifically, the communication control device 200 combines multiple Config components for device type a to generate an input Config for communication device 300A and communication device 300B of device type a ((2-1) and (2-2) in FIG. 2). The communication control device 200 also combines multiple Config components for device type b to generate an input Config for communication device 300C of device type b ((2-3) in FIG. 2).

[0018] The communication control device 200 inputs the input Config for the communication device 300A to the communication device 300A, the input Config for the communication device 300B to the communication device 300B, and the input Config for the communication device 300C to the communication device 300C ((3-1) to (3-3) in FIG. 2).

[0019] Although the above-described configuration generation and input allows remote configuration of communication devices, when expanding a communication network or performing preventive maintenance, a communication device that is in the process of being configured for communication may be physically added, and thus a communication device whose communication configuration has not yet been completed may be temporarily connected to the communication network. In such cases, if communication is attempted with a communication device that is in the process of being configured, unexpected behavior may occur, causing a failure in the communication network or a communication interruption between the end user and the communication device. Alternatively, when a packet is sent from a communication device that is in the process of being configured to the end user, the end user's terminal device may detect the presence of a newly installed device, and the communication device that is not yet ready may intercept the end user's communication, resulting in a communication interruption.

[0020] Here, an example of the above-mentioned failure will be described. Fig. 3 is a diagram showing an example of the reference technology. Fig. 3 shows a failure example <1> in which a failure occurs in the system due to communication from the end user side to the communication device 300 in progress, and a failure example <2> in which the end user is cut off due to communication from the communication device in progress.

[0021] First, we will explain failure example <1>, in which a failure occurs in the system due to communication from the end user side to the communication device 300 in progress. Failure example <1> in Fig. 3 shows the end user's terminal device 400, the communication device 300 that accommodates the communication of the terminal device 400, the upper device 500 that accommodates each communication device, and the service providing server 600. The communication carrier side and the end user side are separated by a UNI.

[0022] The communication devices 300 include communication devices 300a in progress that have limitations on communication due to incomplete communication settings, etc. (hereinafter, may be simply referred to as "communication devices in progress"), and communication devices 300b in operation that have completed communication settings (hereinafter, may be simply referred to as "communication devices in operation"). The host devices 500 include a host device 500a that accommodates the communication devices 300a in progress and a host device 500b that accommodates the communication devices 300b in operation.

[0023] In the case shown in failure example <1>, communication is performed from the terminal device 400 to the service providing server 600. In the situation where communication is performed normally in failure example <1>, the communication of the terminal device 400 is accommodated by the communication device 300b in operation, and is connected to the service providing server 600 via the communication device 300b in operation and the higher-level device 500b. On the other hand, the communication device 300a in preparation is installed in the communication network as a new communication device, and communication settings are incomplete.

[0024] The communication path shown in (1-1) of Fig. 3 is normal because it passes through the communication device 300b in operation. On the other hand, when the communication path shown in (1-2) of Fig. 3 is used, the communication of the terminal device 400 is accommodated under the control of the communication device 300a in operation. Then, the communication passing through the communication device 300a in operation is connected to the service providing server 600 via the higher-level device 500a and the higher-level device 500b ((2) of Fig. 3).

[0025] Consider a case where terminal device 400 transmits a packet based on a broadcast that simultaneously communicates with communication devices 300 included in the communication network ((1-1) and (1-2) in FIG. 3). When communication device 300a receives the packet, it recognizes that terminal device 400 is accommodated under communication device 300a, and transmits this accommodation recognition to host device 500, which recalculates the communication route and switches the communication route ((3) in FIG. 3).

[0026] Next, the service providing server 600 communicates with the terminal device 400 to send a reply ((4) in FIG. 3). At this time, the communication path is switched assuming that the communication of the terminal device 400 is under the control of the in-progress communication device 300a, and the communication is connected to the in-progress communication device 300a via the higher-level device 500b and the higher-level device 500a. Here, the in-progress communication device 300a cannot transmit packets to the terminal device 400 because communication settings have not been completed, and a communication failure occurs ((5) in FIG. 3).

[0027] Next, a failure example <2> will be described in which an end user is cut off due to communication from a communication device in progress. The failure example <2> in Fig. 3 shows a user's terminal device 400, a communication device 300 that accommodates communication from the terminal device 400, and a higher-level device 500 that accommodates each communication device. In the case shown in failure example <2>, the communication device 300 or the like performs an IPv6 RA (Router Advertisement) to distribute information necessary for IPv6 address generation and a default route to the terminal device 400, and an ARP (Address Resolution Protocol) that checks the correspondence between IP addresses and MAC addresses.

[0028] In the situation where normal communication is being performed in the failure example <2>, the communication of the terminal device 400 is accommodated by the communication device 300b in operation, and is connected to the communication device 300b in operation and the higher-level device 500b ((6) in FIG. 3). On the other hand, the communication device 300a in preparation is installed in the communication network as a new communication device, and the communication setting is not yet completed.

[0029] Here, the in-progress communication device 300a transmits packets related to IPv6 RA or ARP to the terminal device 400 ((7) in FIG. 3). Based on this, the terminal device 400 switches the packet transmission destination to the in-progress communication device 300a, so that the communication from the terminal device 400 is accommodated by the in-progress communication device 300a ((8) in FIG. 3). However, because the in-progress communication device 300a has not completed communication settings, it is unable to circulate the packets transmitted from the terminal device 400, resulting in a communication failure ((9) in FIG. 3).

[0030] In response to the above-mentioned communication failures, known reference techniques are to implement settings based on technologies such as vCPE, which virtually provides and controls the end-user's terminal device 400, so that communication is not performed with the target communication device 300, or to re-accommodate the end-user's terminal device 400 from a specified communication device 300 to a different communication device 300.

[0031] In the reference technology described above, settings such as "do not send broadcasts" and "do not communicate with communication device 300a in progress" can be made based on a technology called vCPE, in which a communication carrier virtually provides and controls a communication device (CPE: Customer Premises Equipment) installed on the end user side.

[0032] However, in reality, the communication network on the end user side beyond the UNI (Universal Interface) may include communication devices 300 that are not compatible with vCPE, making it difficult for the communication carrier to control everything. Also, even when re-accommodating the end user's terminal device 400, a different configuration setting process than usual, such as "enabling communication after the configuration setting is completed," is required, which may be difficult to apply from the perspective of strengthening the communication network or preventive maintenance.

[0033] Therefore, the communication cutoff device 100 according to the present embodiment updates the cutoff determination conditions used to determine whether to cut off a predetermined communication between a communication device and a terminal device, based on the setting status of the communication device that accommodates the communication from the terminal device. The communication cutoff device 100 determines whether the predetermined communication between the communication device and the terminal device is a communication to be cut off, based on the cutoff determination conditions and information related to the predetermined communication.

[0034] Specifically, as shown in Figure 1, the above-mentioned communication blocking process is realized by installing a communication blocking device 100 between a terminal device 400 located on the end user side from the responsibility demarcation point (UNI) and a communication device 300 located on the telecommunications carrier side from the responsibility demarcation point (UNI).

[0035] 1 shows, as an example, a communication cutoff device 100, a communication control device 200, a communication device 300, a terminal device 400, and an upper network on a predetermined communication network. The communication control device 200 controls communication between the communication devices 300a and 300b ((1-1) in FIG. 1). The communication control device 200 also issues instructions to the communication cutoff device 100 to cut off or release the cutoff between the communication device 300 and the terminal device 400 ((1-2) in FIG. 1).

[0036] 1, the communication cutoff device 100 determines that the communication between the terminal device 400 and the communication device 300b in operation is not to be cut off ((2-1) in FIG. 1). On the other hand, the communication cutoff device 100 determines that the communication between the terminal device 400 and the communication device 300a in progress is to be cut off ((2-2) in FIG. 1).

[0037] For example, the communication cutoff device 100 updates the cutoff determination conditions used to determine communication cutoff at a predetermined timing ((3-2) in Figure 1) based on the setting status, such as when only planned installation is registered but not yet installed, when installation is complete but communication settings are not complete, or when a cutoff instruction has been received from the communication control device 200 ((3-1) in Figure 1).

[0038] The communication cutoff device 100 determines whether the communication is to be cut off or not using the above-mentioned cutoff determination conditions and information regarding the specified communication, such as header information related to the communication between the terminal device 400 and the communication device 300a in progress, the interface number used, arbitrary information contained in the packet, and the communication wavelength band ((4-1) and (4-2) in Figure 1).

[0039] In this way, the communication cutoff device 100 according to the present embodiment determines that a predetermined communication between the terminal device 400 and the communication device 300 included in the communication network is to be cut off based on the setting status of the communication device 300 and the cutoff determination conditions. Therefore, the communication cutoff device 100 makes it easy to prevent unexpected communication with the communication device 300a that is in progress, etc.

[0040] First Embodiment In the first embodiment, the communication cutoff device 100 updates the cutoff determination conditions based on the setting status of the communication device 300 received from the communication control device 200. Then, the communication cutoff device 100 determines whether the communication is to be cut off using the cutoff determination conditions and information related to a predetermined communication between the terminal device 400 and the communication device 300, and an example will be described in which the communication cutoff device 100 cuts off the communication to be cut off.

[0041] (Communication Cutoff Device 100) First, the configuration of the communication cutoff device 100 will be described. FIG. 4 is a diagram showing an example of the configuration of the communication cutoff device 100 and the communication control device 200 according to the first embodiment. As shown in FIG. 4, the communication cutoff device 100 has a communication unit 110, a storage unit 120, and a cutoff control unit 130. Although not shown in FIG. 4, the communication cutoff device 100 may also include an input unit such as a keyboard or mouse for receiving input such as operations by an administrator or the like. The communication cutoff device 100 may also include a display unit such as a display for displaying information related to the communication cutoff, such as the history of communication cutoff and errors, to an administrator or the like.

[0042] (Communication Unit 110) The communication unit 110 performs data communication related to the reception of packets and the like from user terminal devices and the like, and the reception of information related to the setting status of the communication device and information related to a communication cutoff instruction or a communication cutoff cancellation instruction from the communication control device 200. The communication unit 110 is realized by a network interface card (NIC) or the like, and controls communication via a telecommunication line such as a local area network (LAN) or the Internet. The communication unit 110 is connected to a network via a wired or wireless connection as necessary, and can transmit and receive information bidirectionally. For example, the communication unit 110 can perform bidirectional data communication with the communication unit 210 of the communication control device 200.

[0043] (Storage Unit 120) The storage unit 120 stores data and programs used for various processes by the shutdown control unit 130, and various data acquired through operation of the shutdown control unit 130. The storage unit 120 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. As shown in FIG. 4 , the storage unit 120 has a device status management DB 121.

[0044] (Device Status Management DB 121) The device status management DB 121 is a database that stores cutoff determination conditions and communication device registration information. The cutoff determination conditions here are conditions used by the cutoff control unit 130 (described later) to determine whether or not a communication is subject to cutoff. The communication device registration information is information about communication devices installed in a specified communication network, and is information used by the cutoff control unit 130 (described later) to determine whether or not a communication device in progress exists.

[0045] As described above, the device status management DB 121 stores, as blocking determination conditions, No., the communication device side interface number of the communication blocking device, the terminal device side interface number of the communication blocking device, VLAN ID, EtherType, source MAC address, destination MAC address, protocol number, source IP address, source port number, destination IP address, destination port number, and pass / block, each in association with the other.

[0046] The above-mentioned No. is a unique number for identifying each condition of the blocking judgment conditions. The communication device side interface number of the communication blocking device is a number for identifying the interface through which the communication blocking device 100 connects to the communication device on the provider side. The terminal device side interface number of the communication blocking device is a number for identifying the interface through which the communication blocking device 100 connects to the terminal device on the end user side. The VLAN ID is identification information for identifying each VLAN (Virtual LAN). The EtherType is identification information for identifying the type of communication protocol (type of network layer) used for transmission. The source MAC address and the destination MAC address are identification information for identifying the device that is the source or destination of the packet. The protocol number, the source IP address, the source port number, the destination IP address, and the destination port number are information included in the 5-tuple. Pass / Block is information indicating whether the communication that meets the above-mentioned conditions is to be passed or blocked.

[0047] Here, an example of the cutoff determination conditions stored in the device status management DB 121 will be described. Fig. 5 is a table diagram showing an example of the cutoff determination conditions according to the first embodiment. As shown in Fig. 5, the device status management DB 121 stores, as cutoff determination conditions, the communication device side interface number of the communication cutoff device "any", the terminal device side interface number of the communication cutoff device "2", the VLAN ID "any", the EtherType "any", the source MAC address "any", the destination MAC address "any", the protocol number "any", the source IP address "any", the source port number "any", the destination IP address "any", the destination port number "any", the pass / block "block", etc., all of which are identified by No. "1".

[0048] The above-mentioned "any" is a character string representing a condition such as "any value is acceptable." In other words, the blocking judgment condition identified by No. "1" means that if the terminal device-side interface number of the communication blocking device is "2," "communication is determined to be a communication to be blocked" regardless of the values ​​of the other items. Similarly, the blocking judgment condition identified by No. "2" means that if the communication device-side interface number of the communication blocking device is "1," "communication is determined to be a communication to be passed (not to be blocked)" regardless of the values ​​of the other items. Similarly, the blocking judgment condition identified by No. "3" means that if the communication device-side interface number of the communication blocking device is "2" and the destination MAC address is "FF:FF:FF:FF:FF:FF," "communication is determined to be a communication to be passed (not to be blocked)" regardless of the values ​​of the other items.

[0049] In addition to the above items, the device status management DB 121 can store, for example, information related to optical communication including an LLID or a communication wavelength band.

[0050] The device status management DB 121 also stores, as communication device registration information, a number, a communication device-side interface number of the communication cutoff device, and a VLAN ID, each associated with the number. Note that the number is a unique number for identifying each piece of communication device registration information.

[0051] Here, an example of communication device registration information stored in the device status management DB 121 will be described. Fig. 6 is a table diagram showing an example of communication device registration information according to the first embodiment. As shown in Fig. 6, the device status management DB 121 stores, as communication device registration information, a communication device-side interface number "1" of the communication cutoff device identified by No. "1", a VLAN ID "any", etc.

[0052] The above-mentioned "any" is a character string that indicates the condition that "any value is acceptable." In other words, it means that the communication device is connected to the interface identified by the interface numbers "1," "2," and "3" of the communication cutoff device as the communication device registration information identified by No. "1."

[0053] (Shutdown Control Unit 130) The shutdown control unit 130 has an internal memory for temporarily storing processing data and a program that defines the shutdown processing procedure of the communication shutdown device 100, and is realized by electronic circuits such as a CPU (Central Processing Unit) and an MPU (Micro Processing Unit), and integrated circuits such as an ASIC (Application Specific Integrated Circuit) and an FPGA (Field Programmable Gate Array). As shown in FIG. 4 , the shutdown control unit 130 has a reception unit 131, an update unit 132, a determination unit 133, and a shutdown unit 134.

[0054] (Reception Unit 131) The reception unit 131 receives information transmitted from an external device and stores it in the storage unit 120.

[0055] Specifically, the reception unit 131 receives packets transmitted from end-user terminal devices and stores header information, etc. included in the packets. The reception unit 131 also receives and stores information related to predetermined communications, such as port numbers and interface numbers, collected from communication devices, etc.

[0056] The reception unit 131 also receives and stores registration information (communication device registration information) related to communication devices installed in the communication network from the communication control device 200. The reception unit 131 also receives and stores information such as a predetermined communication shutdown instruction or shutdown release instruction output from the communication control device 200. Note that the reception unit 131 is not limited to the above-mentioned information, and can receive any information related to communication shutdown processing.

[0057] (Update unit 132) The update unit 132 updates the blocking determination conditions used to determine whether to block a predetermined communication between a communication device and a terminal device, based on the setting status of the communication device that accommodates communication from the terminal device. Note that in this embodiment, the "setting status of the communication device" includes setting statuses such as a device that is registered as being scheduled for installation but not yet installed, a device that has been installed but not yet configured for communication, a device that has been instructed to set or cancel blocking from the communication control device 200, and a device that is set to block or allow predetermined communication related to the communication device.

[0058] Specifically, when the setting status of a communication device indicates at least one of incomplete communication setting and receipt of a blocking setting instruction, the update unit 132 updates the blocking determination condition so that the communication device is determined to be a blocking target. For example, when information on the setting status, such as "communication setting is incomplete for the communication device 300 connected to the terminal device-side interface number "2" of the communication blocking device" or "communication blocking is being implemented for the communication device connected to the terminal device-side interface number "2" of the communication blocking device," is received from the communication control device 200, the update unit 132 updates the pass / block item to "block" for the blocking determination condition identified by No. "1" in FIG. 5 so that the predetermined communication related to the communication device is determined to be a blocking target.

[0059] The update unit 132 updates the cutoff determination condition so that the communication device is determined not to be cut off when at least one of the communication setting is completed or an instruction to cancel the cutoff setting is received. For example, when information on the setting status such as "communication setting is completed for the communication device connected to the terminal device-side interface number "2" of the communication cutoff device" or "communication cutoff for the communication device connected to the terminal device-side interface number "2" of the communication cutoff device" is received from the communication control device 200, the update unit 132 updates the pass / cutoff item to "pass" for the cutoff determination condition identified by No. "1" in FIG. 5 so that it is determined that the predetermined communication related to the communication device is not to be cut off.

[0060] (Determination unit 133) The determination unit 133 determines whether or not a predetermined communication between the communication device and the terminal device is a communication to be blocked, based on the blocking determination conditions updated by the update unit 132 and information about the predetermined communication between the terminal device 400 and the communication device. For example, the determination unit 133 determines that the communication is a communication to be blocked when the information about the predetermined communication satisfies a blocking determination condition including one or more combinations of an interface number, a 5-tuple, arbitrary information included in a packet such as a VLAN ID and EtherType, and information about optical communication including an LLID or a communication wavelength band.

[0061] Specifically, the determination unit 133 determines that a communication is to be blocked when information about a predetermined communication between a communication device and a terminal device satisfies a combination of communication targets included in a preset blocking determination condition. For example, if the information about the predetermined communication between a communication device and a terminal device includes information such as "terminal device side interface number of communication blocking device: 2," the determination unit 133 determines that the communication is to be blocked based on the blocking determination condition identified by No. "1" described in FIG. 5. Furthermore, based on information about optical communication including an LLID or a communication wavelength band, when optical communication is performed using a certain optical wavelength, the determination unit 133 determines that communication using an optical wavelength other than the specified optical wavelength is to be blocked.

[0062] The determination unit 133 determines that the communication is to be blocked when the information about the predetermined communication does not include registration information of a communication device installed in the communication network. For example, when the information about the predetermined communication between the communication device and the terminal device includes information such as "terminal device side interface number of the communication blocking device: 4," the determination unit 133 determines that the communication is to be blocked because the corresponding interface number is not included in the communication device registration information described in FIG. 6.

[0063] (Shutdown unit 134) The shutdown unit 134 shuts down communications that have been determined by the determination unit 133 to be communications to be shut down. Specifically, the shutdown unit 134 performs shutdown processing, such as discarding packets or not transmitting packets, for communications that include "terminal device side interface number: 2 of communication shutdown device" that have been determined by the determination unit 133 to be communications to be shut down.

[0064] (Communication control device 200) Next, the configuration of the communication control device 200 will be described. The communication control device 200 is an example of an information processing device that controls communication devices and the like using Config and instructs the communication cutoff device 100 to cut off or cancel cutoff. As shown in FIG. 4, the communication control device 200 has a communication unit 210, a storage unit 220, a control unit 230, and a cutoff control unit 240. Although not shown in FIG. 4, the communication control device 200 can also have an input unit such as a keyboard or mouse for receiving input such as operations by an administrator or the like. The communication control device 200 can also have a display unit such as a display for displaying information related to communication cutoff, such as the history and results of communication control, errors, etc., to an administrator or the like.

[0065] (Communication Unit 210) The communication unit 210 performs data communication such as issuing instructions to the communication cutoff device 100 to cut off or cancel the cutoff of communication, and inputting configuration information into the communication device. The communication unit 210 is implemented by a NIC or the like, and controls communication via a telecommunication line such as a LAN or the Internet. The communication unit 210 is connected to the communication cutoff device 100 or the communication device or the like via a wired or wireless network as necessary, and can transmit and receive information bidirectionally.

[0066] (Storage unit 220) The storage unit 220 stores data and programs used for various processes by the control unit 230, and various data acquired through operation of the control unit 230. The storage unit 220 is realized by a semiconductor memory element such as RAM or flash memory, or a storage device such as a hard disk or optical disk. As shown in FIG. 4 , the storage unit 220 has a config storage DB 221.

[0067] (Configuration Storage DB 221) The configuration storage DB 221 is a database that stores configuration components (templates) used by a configuration generation unit 231 (described later) and generated input configurations.

[0068] (Control unit 230) The control unit 230 has an internal memory for temporarily storing programs and processing data that define various processing procedures and the like of the communication control device 200, and is realized by electronic circuits such as a CPU or MPU, or integrated circuits such as an ASIC or FPGA. As shown in FIG. 4 , the control unit 230 has a config generation unit 231 and a config input unit 232.

[0069] (Config Generation Unit 231) The Config generation unit 231 generates an input Config for a Config corresponding to each communication device to be controlled by combining Config components stored in the Config storage DB 221. Note that the Config generation unit 231 can generate the input Config using a known method.

[0070] (Configuration Input Unit 232) The configuration input unit 232 performs communication settings by inputting the input configuration generated by the configuration generation unit 231 to each communication device to be controlled. For example, when the configuration input unit 232 receives an instruction to input a configuration from the control unit 230 of the communication control device 200, it inputs the generated configuration to the target communication device to perform communication settings.

[0071] (Shutdown control unit 240) The shutdown control unit 240 has an internal memory for temporarily storing processing data and a program that defines the shutdown processing procedure of the communication control device 200, and is realized by an electronic circuit such as a CPU or MPU, or an integrated circuit such as an ASIC or FPGA. The shutdown control unit 240 also has a shutdown setting instruction unit 241, as shown in FIG. 4 .

[0072] (Shutdown Setting Instructing Unit 241) The shutdown setting instructing unit 241 instructs the communication shutdown device 100 to shut down or release the shutdown of predetermined communication between a communication device and a terminal device.

[0073] For example, when the config setting for the communication device in progress is completed, the cutoff setting instruction unit 241 outputs an instruction to "cancel cutoff" to the communication cutoff device 100. On the other hand, when the config to be applied to the communication device in progress is generated but the config setting is not completed, the cutoff setting instruction unit 241 outputs an instruction to "perform cutoff" to the communication cutoff device 100.

[0074] Also, for example, when a new communication device is added to the communication network, the blocking setting instruction unit 241 outputs an instruction to "block" a specified communication between the communication device and an end user's terminal device, etc., based on the operation of an administrator, etc.

[0075] (Procedure of communication cutoff processing) Hereinafter, the procedure of communication cutoff processing realized by the communication cutoff device 100 according to this embodiment will be described. Fig. 7 is a diagram showing an example of a flowchart of the communication cutoff method according to the first embodiment. Note that the steps may be interchanged within a consistent range, and some steps may not be performed.

[0076] The receiving unit 131 receives information relating to the setting status of the communication device (S101). The updating unit 132 updates the cutoff determination condition based on the received information relating to the setting status of the communication device (S102).

[0077] The determination unit 133 determines whether a predetermined communication between the terminal device and the communication device is to be blocked (S103). If it is determined that the communication is to be blocked (Yes in S104), the blocking unit 134 blocks the predetermined communication determined to be to be blocked (S105). Then, the communication blocking device 100 ends the process.

[0078] On the other hand, if it is determined that the communication is not to be cut off (No in S104), the communication cutoff device 100 continues the communication without cutting off (S106).Then, the communication cutoff device 100 ends the process.

[0079] (Effects) Hereinafter, a description will be given of the effects provided by the communication cutoff device 100 according to the first embodiment. A problem that has been encountered up until now is that it is sometimes difficult to prevent unexpected communication from occurring with a communication device that is in progress.

[0080] Therefore, the update unit 132 of the communication cutoff device 100 according to the first embodiment updates the cutoff determination conditions used to determine whether to cut off a predetermined communication between a communication device and a terminal device, based on the setting status of the communication device that accepts communication from the terminal device. The determination unit 133 of the communication cutoff device 100 determines whether the communication between the communication device and the terminal device is communication to be cut off, based on the cutoff determination conditions and information about the predetermined communication. Therefore, the communication cutoff device 100 according to the first embodiment has the effect of enabling unexpected communication between a communication device and a terminal device to be cut off.

[0081] The determination unit 133 determines that a communication is to be blocked if the information about the predetermined communication satisfies a blocking determination condition including one or more combinations of information about optical communication including an interface number, 5-tuple, arbitrary information contained in a packet such as a VLAN ID and EtherType, and information about optical communication including an LLID or a communication wavelength band. In this way, the communication blocking device 100 determines whether a communication is to be blocked using information about the predetermined communication of a communication device or a terminal device. Therefore, the communication blocking device 100 can block only the communication to be blocked without previously configuring the communication device to block the predetermined communication.

[0082] Furthermore, the determination unit 133 determines that a communication is to be blocked if the information about the predetermined communication does not include registration information for a communication device installed in the communication network. In this way, the communication blocking device 100 determines whether a predetermined communication related to the communication device is to be blocked based on whether the communication device is registered in the communication control device 200 or the like. Therefore, when a communication device is newly added to the communication network but its information is not registered and it is unusable, the communication blocking device 100 can determine that communication with the communication device is to be blocked. Furthermore, the communication blocking device 100 can detect an unknown communication device whose information is not registered and determine that communication with the communication device is to be blocked.

[0083] The update unit 132 updates the blocking judgment conditions so that the communication device is determined to be a target for blocking when the setting status of the communication device indicates at least one of incomplete communication configuration and receipt of a blocking setting instruction. Furthermore, the judgment unit 133 updates the blocking judgment conditions so that the communication device is determined not to be a target for blocking when at least one of complete communication configuration and receipt of a cancellation instruction for blocking setting is received. In this way, the communication blocking device 100 updates the blocking judgment conditions based on the setting status of the communication device in the communication network. Therefore, the communication blocking device 100 can flexibly change the communications to be blocked in accordance with changes in the setting status of the communication device.

[0084] As described above, the communication cutoff device 100 performs cutoff processing for a specific communication between a target communication device and a terminal device based on cutoff determination conditions that are updated according to the setting status of the communication device. As a result, the communication cutoff device 100 can prevent unwanted packets from reaching the communication device in preparation from the end user side, thereby preventing the communication device in preparation from performing unexpected operations. Furthermore, the communication cutoff device 100 can prevent the end user's terminal device from detecting the presence of a newly installed device, thereby preventing the communication device that is not yet ready from being cut off due to the interception of the end user's communication, etc.

[0085] Furthermore, the communication blocking device 100 can flexibly control the determination of communication to be blocked using the interface number, 5tuple, VLAN ID, EtherType, etc., so it is possible to appropriately determine and block communication to be blocked even when the communication blocking device 100 and the communication device in progress are not directly connected or when multiple VLANs are superimposed on one interface using VLANs for each end user.

[0086] Furthermore, since the communication cutoff device 100 can cut off predetermined communications, it can cut off all communications or a portion of communications. Therefore, in cases where the communication device in progress is configured to prepare for switching in advance or where the end-user's terminal device is configured to automatically switch communication paths, the communication cutoff device 100 cuts off only communications from the communication device in progress to the end-user's terminal device and allows communications in the reverse direction to pass, thereby enabling quick path switching after the communication settings of the communication device are completed.

[0087] Furthermore, when a telecommunications carrier provides a communication service that allows end users to occupy a certain optical wavelength, the communication blocking device 100 can block communications using any optical wavelength other than the specified one, thereby preventing communication failures that may occur when the end user's terminal device uses an unexpected optical wavelength.

[0088] Furthermore, while conditions for determining which communications are to be blocked were previously set by an administrator or the like, the communication blocking device 100 automatically changes the communications to be blocked in accordance with changes in the setting status of the communication device, thereby reducing the computer processing required to determine which communications are to be blocked.

[0089] <Second embodiment> In the second embodiment, an example is described in which the communication control device 200 performs the process of updating the blocking judgment conditions in the first embodiment and determining whether a specific communication is to be blocked, and outputs a blocking instruction to the communication blocking device 100 to block the communication to be blocked.

[0090] (Communication cutoff device 100) First, the configuration of the communication cutoff device 100 will be described. Fig. 8 is a diagram showing an example of the configuration of the communication cutoff device 100 and the communication control device 200 according to the second embodiment. As shown in Fig. 8, the communication cutoff device 100 has a communication unit 110, a storage unit 120, and a cutoff control unit 130. Note that since the communication cutoff device 100 according to the second embodiment has the same functions as the communication cutoff device 100 according to the first embodiment, the communication unit 110, the storage unit 120, etc., whose functions overlap between the first and second embodiments, will be omitted as appropriate in the description.

[0091] (Shutdown Control Unit 130) As shown in FIG. 8, the shutdown control unit 130 includes a reception unit 131, a shutdown unit 134, and a query unit 135.

[0092] (Reception Unit 131) The reception unit 131 receives information such as a predetermined communication cutoff instruction or cutoff release instruction output from the communication control device 200.

[0093] (Shutdown unit 134) The shutdown unit 134 shuts down communications to be shut down based on a predetermined communication shutdown instruction output from the communication control device 200 and accepted by the acceptance unit 131. Specifically, the shutdown unit 134 performs shutdown processing such as discarding packets or not transmitting packets for communications including "terminal device side interface number of communication shutdown device: 2" determined by the communication control device 200 to be shut down. On the other hand, when a shutdown cancellation instruction is output from the communication control device 200, the shutdown unit 134 does not perform shutdown processing.

[0094] (Communication control device 200) Next, the configuration of the communication control device 200 will be described. As shown in Fig. 8, the communication control device 200 has a communication unit 210, a storage unit 220, a control unit 230, and a cutoff control unit 240. Note that the communication control device 200 according to the second embodiment has the same functions as the communication control device 200 according to the first embodiment, and therefore the communication unit 210, the storage unit 220, and the control unit 230, whose functions overlap between the first and second embodiments, will be described only briefly as appropriate.

[0095] 8, the shutdown control unit 240 has a shutdown setting instruction unit 241, a reception unit 242, an update unit 243, and a determination unit 244. Note that the reception unit 242 has the same function as the reception unit 131 according to the first embodiment, and the update unit 243 has the same function as the update unit 132 according to the first embodiment, and therefore a description thereof will be omitted in this section.

[0096] (Shutdown Setting Instructing Unit 241) The shutdown setting instructing unit 241 instructs the communication shutdown device 100 to shut down or release the shutdown of predetermined communication between a communication device and a terminal device based on the determination result of the determining unit 244 described below.

[0097] (Determination unit 244) The determination unit 244 determines whether the communication between the communication device and the terminal device is communication to be blocked based on the blocking determination conditions updated by the update unit 243, information regarding the specified communication related to the communication between the terminal device and the communication device, and information regarding the setting status of the communication device.

[0098] (Example of communication cutoff processing) Here, an example of communication cutoff processing by the communication cutoff device 100 and the communication control device 200 according to the second embodiment will be described. Fig. 9 is a sequence diagram illustrating an example of communication cutoff processing according to the second embodiment. Fig. 9 illustrates (1) before installation of the communication device 300, (2) when installing the communication device 300, (3) after installation of the communication device 300 and before completion of configuration, (4) configuration of the communication device 300, and (5) after installation of the communication device 300 and after completion of configuration.

[0099] First, (1) the state before the installation of the communication device 300 will be described. As shown in (1) of Fig. 9, the communication cutoff device 100 queries the cutoff control unit 240 about cutoff (S1-1). Next, the cutoff control unit 240 refers to the communication device registration information stored in the device status management DB 222 (S1-2).

[0100] Here, since the communication device 300 has not yet been installed, the device status management DB 222 does not store communication registration information for the target communication device 300 (S1-3). Therefore, the cutoff control unit 240 instructs the communication cutoff device 100 to cut off predetermined communications between the communication device 300 and a terminal device or the like (S1-4). Then, the communication cutoff device 100 cuts off the predetermined communications (S1-5).

[0101] Next, (2) the process of installing the communication device 300 will be described. As shown in (2) of Fig. 9, when the communication device 300 is installed (S2-1), the control unit 230 issues an instruction to register a block of a predetermined communication related to the communication device 300 based on an operation by an administrator or the like (S2-2).

[0102] Based on the instruction from the control unit 230, the cutoff control unit 240 performs cutoff registration to update the cutoff determination conditions so as to set the communication device 300 to cutoff (S2-3).

[0103] Next, (3) the process after installation and before the completion of configuration of the communication device 300 will be described. As shown in (3) of Fig. 9, the communication cutoff device 100 queries the cutoff control unit 240 about cutoff (S3-1). Next, the cutoff control unit 240 refers to the communication device registration information stored in the device status management DB 222 (S3-2).

[0104] Here, the device status management DB 222 stores the communication registration information and cutoff judgment conditions of the target communication device 300 (S3-3). Then, the cutoff control unit 240 instructs the communication cutoff device 100 to cut off predetermined communications between the communication device 300 and the terminal device, etc., based on the communication registration information and the cutoff judgment conditions (S3-4). Then, the communication cutoff device 100 cuts off the predetermined communications (S3-5).

[0105] Next, a description will be given of (4) setting of the communication device 300. In (4) of Fig. 9, the installation of the communication device 300 has been completed, and communication settings of the communication device 300 are now being implemented.

[0106] The control unit 230 issues an instruction to generate an input Config (S4-1). Next, the Config generation unit 231 generates an input Config (S4-2) and stores the generated input Config in the Config storage DB 221 (S4-3).

[0107] The control unit 230 instructs the cutoff control unit 240 to set the communication device to cutoff (S4-4). Then, based on the instruction from the control unit 230, the cutoff control unit 240 performs cutoff registration to update the cutoff determination conditions so as to set the communication device 300 to cutoff (S4-5).

[0108] Here, the device status management DB 222 stores the cutoff determination condition registered as "cutoff performed" for the target communication device 300 (S4-6). Based on the cutoff determination condition, the cutoff control unit 240 instructs the communication cutoff device 100 to cut off a specific communication between the communication device 300 and a terminal device or the like (S4-7). The communication cutoff device 100 then cuts off the specific communication (S4-8). The cutoff control unit 240 also notifies the control unit 230 that the cutoff has been completed (S4-9).

[0109] The control unit 230, which has received the shutdown completion notification, issues an instruction to input the generated input Config (S4-10). The Config input unit 232 then acquires the input Config stored in the Config storage DB 221 (S4-11) and inputs the Config to the target communication device 300 (S4-12).

[0110] The communication device 300 reflects the input Config (S4-13) and notifies the control unit 230 that the input of the Config has been completed (S4-14).

[0111] The control unit 230, which has received the notification that the configuration has been entered, instructs the cutoff control unit 240 to uncut the predetermined communication related to the communication device 300 (S4-15). Then, based on the instruction from the control unit 230, the cutoff control unit 240 performs cutoff unblocking registration, which updates the cutoff determination conditions so as to uncut the communication device 300 (S4-16).

[0112] Here, the device status management DB 222 stores the "cutoff cancellation" of the target communication device 300 as the registered cutoff judgment condition (S4-17). Then, the cutoff control unit 240 instructs the communication cutoff device 100 to cut off a predetermined communication between the communication device 300 and a terminal device or the like based on the cutoff judgment condition (S4-18). Then, the communication cutoff device 100 cancels the cutoff of the predetermined communication (S4-19). In addition, the cutoff control unit 240 notifies the control unit 230 that the cutoff cancellation registration has been completed (S4-20).

[0113] Next, (5) the process after the installation and configuration of the communication device 300 is explained. As shown in (5) of Fig. 9, the communication cutoff device 100 queries the cutoff control unit 240 about cutoff (S5-1). Next, the cutoff control unit 240 refers to the communication device registration information stored in the device status management DB 222 (S5-2).

[0114] Here, the device status management DB 222 stores the cutoff determination condition for the target communication device 300, with the information updated to "cutoff canceled" (S5-3). Then, the cutoff control unit 240 instructs the communication cutoff device 100 to cancel the cutoff of a specific communication between the communication device 300 and a terminal device, etc., based on the cutoff determination condition (S5-4). Then, the communication cutoff device 100 cancels the cutoff setting for the specific communication (S5-5).

[0115] (Effect) As described above, the communication cutoff process according to the second embodiment can be realized by separating it into a plurality of devices, namely, the communication cutoff device 100 and the communication control device 200. Therefore, it is possible to realize the communication cutoff process based on a flexible device configuration without being limited by the configuration or restrictions of the communication network.

[0116] <Modifications> Modifications realized by the communication cutoff device 100 and the communication control device 200 according to this embodiment will be described below.

[0117] (Data, etc.) The blocking judgment conditions, communication device registration information, names of functional parts of the communication blocking device 100 and communication control device 200, steps, processes, names of steps or processes, etc. used in the description of the above embodiment are merely examples and can be changed as desired.

[0118] For example, the items of the blocking determination conditions such as No., the interface number of the communication device side of the communication blocking device, the interface number of the terminal device side of the communication blocking device, the VLAN ID, the EtherType, the source MAC address, the destination MAC address, the protocol number, the source IP address, the source port number, the destination IP address, the destination port number, and pass / block, which are stored in the device status management DB121 or the device status management DB221, etc., can be changed as desired.

[0119] In addition, the items of the communication device registration information stored in the device status management DB 121 or the device status management DB 221, such as the No., the communication device side interface number of the communication cutoff device, and the VLAN ID, can be changed as desired.

[0120] (Subject of Performing Cutoff Processing, etc.) In the first embodiment, the cutoff processing is described as being performed by the communication cutoff device 100, and in the second embodiment, by the communication cutoff device 100 and the communication control device 200. However, the present invention is not limited to this. For example, a functional unit that performs the cutoff processing may be implemented in another information processing device having a function different from that of the communication cutoff device 100 and the communication control device 200.

[0121] (Configuration of communication path, etc.) As described above, the communication blocking device 100 has been described as being configured to be directly connected to the end user's terminal device or communication device, but this is not limited to this and the device may be installed at any location on the communication path between the end user's terminal device and the communication device.

[0122] In addition, if there is already another communication device such as an L2 switch on the communication path between the end user's terminal device and the communication device, a communication device having the function of blocking specified communications may be placed in place of the communication blocking device 100.

[0123] (Communications to be blocked, etc.) As described above, the communication blocking device 100 blocks predetermined communications between the terminal device 400 and the communication device 300, but the communications to be blocked are not particularly limited. For example, the predetermined communications for the communication blocking device 100 or the communication control device 200 may be "all communications between the communication device in progress and the terminal device on the end user side," or "only communications including predetermined destination information," "only broadcast communications that reach the communication device in progress," "only communications related to RA or ARP from the communication device in progress," etc.

[0124] (System) The information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0125] Furthermore, the components of each device shown in the figure are conceptual functional components and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown. In other words, all or part of the devices can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0126] <Hardware Configuration> The components of each device shown in the figure are conceptual functional components and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0127] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can also be performed manually using known methods. In addition, the information including the processing procedures, control procedures, specific names, various data, and parameters shown in the drawings can be changed as desired unless otherwise specified.

[0128] <Program> In one embodiment, the various devices constituting the communication cutoff device 100 and the communication control device 200 can be implemented by installing a communication cutoff program as package software or online software on a desired computer. For example, by executing the communication cutoff program on an information processing device, the various devices constituting the communication cutoff device 100 and the communication control device 200 can function. The information processing device referred to here includes desktop and notebook personal computers. Furthermore, other information processing devices also include mobile communication terminals such as smartphones and mobile phones, as well as slate terminals such as PDAs (Personal Digital Assistants).

[0129] 10 is a diagram showing an example of a computer that executes the communication cutoff process according to this embodiment. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0130] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0131] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines the processes of the various devices that constitute the communication cutoff device 100 and the communication control device 200 is implemented as a program module 1093 in which computer-executable code is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to those of the functional configurations of the various devices that constitute the communication cutoff device 100 and the communication control device 200 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0132] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0133] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a LAN or a WAN (Wide Area Network)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0134] Although the present embodiment has been described above, the present embodiment is not limited by the descriptions and drawings that form a part of the disclosure. In other words, other embodiments, examples, operational techniques, etc. that are made by those skilled in the art based on the present embodiment are all included in the scope of the present embodiment.

[0135] REFERENCE SIGNS LIST 100 Communication cutoff device 110, 210 Communication unit 120, 220 Storage unit 121, 222 Device status management DB 130, 240 Cutoff control unit 131, 242 Reception unit 132, 243 Update unit 133, 244 Determination unit 134 Cutoff unit 135 Inquiry unit 200 Communication control device 221 Config storage DB 230 Control unit 231 Config generation unit 232 Config input unit 241 Cutoff setting instruction unit

Claims

1. A communication cutoff device comprising: an update unit that updates cutoff judgment conditions used to judge whether or not to cut off a specific communication between a communication device and a terminal device based on the setting status of the communication device that accommodates communication from the terminal device; and a judgment unit that judges whether or not the specific communication between the communication device and the terminal device is a communication to be cut off based on the cutoff judgment conditions and information regarding the specific communication.

2. The communication blocking device described in claim 1, characterized in that the judgment unit judges that the communication is to be blocked if the information regarding the specified communication satisfies the blocking judgment condition including one or more combinations of an interface number, arbitrary information contained in a packet, information regarding optical communications including an LLID or a communication wavelength band, or if the information regarding the specified communication does not include registration information of the communication device installed in the communication network.

3. The communication blocking device described in claim 1, characterized in that the update unit updates the blocking judgment conditions so that the communication device is determined to be a target for blocking when the setting status of the communication device is at least one of communication setting incomplete or an instruction to cancel the blocking setting, and updates the blocking judgment conditions so that the communication device is determined to not be a target for blocking when the setting status of the communication device is at least one of communication setting completion or an instruction to cancel the blocking setting.

4. A communication cutoff device as claimed in any one of claims 1 to 3, further comprising a cutoff unit that cuts off the specified communication that is determined by the determination unit to be the communication to be cut off.