JP7614306B1 - Master device, communication control method, communication control program, and communication control system - Google Patents

Abstract

The present invention makes it possible to reduce the workload associated with setting communication control in a network.
[Solution] A master device 10 accepts input of installation information indicating in which of a plurality of zones each of a plurality of edge devices 20 is installed. The master device 10 acquires connection information of terminals connected to each of the plurality of edge devices 20. The master device 10 sets each of the plurality of zones as a group for controlling communications, and classifies terminals indicated by the connection information into the group of the zone in which the edge device 20 from which the connection information was acquired is installed.
[Selected Figure] Figure 4

Description

This disclosure relates to technology for controlling communication between terminals.

In control systems that control equipment in factories, including those in the manufacturing industry, the system configuration is generally divided into multiple zones for management, production status monitoring, production line, etc. The same level of security measures are required for protected assets, which are equipment that exists in the same zone.
Here, the Ministry of Economy, Trade and Industry's "Guidelines for Cyber-Physical Security Measures in Factory Systems Ver. 1.0" defines a zone as an area with the same business content or importance, and states that the same level of security measures is required for protected assets that exist in the same zone.

Patent document 1 describes a method of detecting a terminal indicated by an address that does not exist in a group list as an unclassified terminal and specifying the group to which the unclassified terminal belongs. In patent document 1, by detecting unclassified terminals, the burden associated with grouping terminals is reduced.

Patent No. 7209792

The task of configuring communication control to realize a secure network is usually done manually while referring to various information such as network configuration diagrams and individual terminal information, which is a very time-consuming and cumbersome task. This makes it prone to configuration errors and places a burden on operations.
By using the technology described in Patent Literature 1, the effort of searching for unclassified terminals can be eliminated, and the burden of the setting work can be reduced to a certain extent. However, the setting still needs to be performed for each terminal, which is a heavy burden and prone to setting errors.
The present disclosure aims to make it possible to reduce the workload associated with settings.

A master device according to the present disclosure comprises:
a zone receiving unit that receives input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of the plurality of edge devices being a target edge device;
an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device;
The device is equipped with a terminal classification unit that sets each of the multiple zones as a group for controlling communications, and classifies a terminal indicated by the connection information acquired by the information acquisition unit into a group of zones indicated by the installation information accepted by the zone acceptance unit, in which the edge device from which the connection information was acquired is installed.

In this disclosure, a group is set for each zone, and terminals are classified into the group of the zone in which the edge device from which the connection information is obtained is installed. This makes it possible to automatically classify terminals into groups, reducing the workload associated with the settings.

FIG. 1 is a configuration diagram of a communication control system 1 according to a first embodiment. FIG. 2 is a configuration diagram of a master device 10 according to the first embodiment. FIG. 2 is a configuration diagram of an edge device 20 according to the first embodiment. 4 is a flowchart showing the overall operation of the communication control system 1 according to the first embodiment. FIG. 2 is an explanatory diagram of an installation state of the edge device 20 according to the first embodiment. FIG. 4 is an explanatory diagram of a zone acceptance process according to the first embodiment. FIG. 4 is an explanatory diagram of an address acquisition process according to the first embodiment. FIG. 4 is an explanatory diagram of a classification process according to the first embodiment. FIG. 4 is an explanatory diagram of a state display process according to the first embodiment.

Embodiment 1.
***Configuration Description***
The configuration of a communication control system 1 according to the first embodiment will be described with reference to FIG.
The communication control system 1 includes a master device 10 and a plurality of edge devices 20. The master device 10 and each edge device 20 are connected via a network device 90.
The master device 10 is a computer installed in a management center or the like for managing the communication control system 1. Each edge device 20 is a computer installed at a site such as a factory or an office and connected to one or more terminals 30.

The configuration of the master device 10 according to the first embodiment will be described with reference to FIG.
The master device 10 includes the following hardware components: a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to other hardware components via signal lines and controls the other hardware components.

The master device 10 comprises, as functional components, a zone acceptance unit 111, a tree display unit 112, an information acquisition unit 113, a terminal classification unit 114, a change acceptance unit 115, a policy setting unit 116, and a setting transmission unit 117. The functions of the functional components of the master device 10 are realized by software.
The storage 13 stores programs that realize the functions of the functional components of the master device 10. These programs are loaded into the memory 12 by the processor 11 and executed by the processor 11. In this way, the functions of the functional components of the master device 10 are realized.

The configuration of the edge device 20 according to the first embodiment will be described with reference to FIG.
The edge device 20 includes the following hardware components: a processor 21, a memory 22, a storage 23, and a communication interface 24. The processor 21 is connected to other hardware components via signal lines and controls the other hardware components.

The edge device 20 includes, as functional components, an address acquisition unit 211, an information transmission unit 212, a setting reception unit 213, a communication control unit 214, and a log acquisition unit 215. The functions of the functional components of the edge device 20 are realized by software.
The storage 23 stores a program that realizes the function of each functional component of the edge device 20. The program is loaded into the memory 22 by the processor 21 and executed by the processor 21. In this way, the function of each functional component of the edge device 20 is realized.

The processors 11 and 21 are integrated circuits (ICs) that perform processing.
Processing Unit), DSP (Digital Signal Processor), and GPU (Graphics Processing Unit).

Memories 12 and 22 are storage devices that temporarily store data. Specific examples of memories 12 and 22 include SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory).

Storages 13 and 23 are storage devices that store data. A specific example of storages 13 and 23 is a hard disk drive (HDD). Storages 13 and 23 may also be portable recording media such as a Secure Digital (registered trademark) memory card, CompactFlash (registered trademark), NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a Digital Versatile Disk (DVD).

The communication interfaces 14 and 24 are interfaces for communicating with external devices. Specific examples of the communication interfaces 14 and 24 are ports for Ethernet (registered trademark), USB (Universal Serial Bus), and HDMI (registered trademark, High-Definition Multimedia Interface).

*** Operation Description ***
The operation of the communication control system 1 according to the first embodiment will be described with reference to FIGS.
The operation procedure of the communication control system 1 according to the first embodiment corresponds to the communication control method according to the first embodiment. Moreover, the program that realizes the operation of the communication control system 1 according to the first embodiment corresponds to the communication control program according to the first embodiment.

The overall operation of the communication control system 1 according to the first embodiment will be described with reference to FIG.
As a premise for the process shown in Fig. 4, a plurality of zones 40 are set in a factory, with each zone 40 being an area with the same business content or importance, as shown in Fig. 5. In Fig. 5, a production management zone 40, a production status monitoring zone 40, and a production line 1 zone 40 are set. An edge device 20 is disposed in each of the plurality of zones 40. One or more terminals 30 are connected to the edge device 20 disposed in each zone 40.

(Step S11: Zone reception process)
The zone reception unit 111 of the master device 10 sets each of the multiple edge devices 20 as a target edge device 20. The zone reception unit 111 receives input of installation information indicating in which of the multiple zones 40 the target edge device 20 is installed.
Specifically, the user of the master device 10 inputs installation information of the zone 40 installed for each edge device 20. The zone reception unit 111 then receives the installation information of the zone 40 input for each edge device 20. The zone reception unit 111 stores the identification information of the edge device 20 and the identification information of the zone 40 in association with each other in the memory 12. The identification information of the edge device 20 is, for example, the edge device name that is the name of the edge device 20. The identification information of the zone 40 is, for example, the zone name that is the name of the zone 40.

For example, as shown in Fig. 6, the tree display unit 112 displays an asset tree 50, which is tree structure data in which a factory is the root and each zone 40 is represented as a child node with the root as a parent, on the display device. Here, the factory is described as the root, but it may be rephrased that the communication control system 1 is the root. The zone reception unit 111 inputs installation information indicating the location where the edge device 20 is installed into the asset tree 50. Specifically, in Fig. 6, the user places a node representing the target edge device 20 as a child node with the node representing the zone 40 as a parent, and the zone reception unit 111 inputs and accepts the installation information in which each edge device 20 is associated with the zone 40 in which it is installed.
For example, by inputting and accepting the installation information in this manner, an edge device 20 with the edge device name Edge3 is set as a child node with a node representing the zone 40 of production management as a parent. Also, an edge device 20 with the edge device name Edge2 is set as a child node with a node representing the zone 40 of production status monitoring as a parent. Also, an edge device 20 with the edge device name Edge1 is set as a child node with a node representing the zone 40 of the production line 1 as a parent. Here, an example is shown in which the installation information in which each edge device 20 and the installed zone 40 are associated is input and accepted by arranging the node representing the edge device 20 as a child node with a node representing the zone 40 as a parent using the asset tree 50, which is tree structure data. However, the setting data in which each edge device 20 and the installed zone 40 are associated may be prepared by the user, and the zone acceptance unit 111 may accept the input of the installation information by reading the setting data. If each edge device 20 can be associated with the installed zone 40, the installation information may be accepted by another input method.

(Step S12: Address acquisition process)
The address acquisition unit 211 of each edge device 20 acquires the address 61 of the terminal 30 connected to the end side of the same network as the edge device 20. The same network refers to a network having the same network address. In this case, the address acquisition unit 211 may acquire the address 61 of the connected terminal 30 for each port.
7, the address acquisition unit 211 acquires an IP address and a MAC address as the address 61 of the terminal 30. IP is an abbreviation for Internet Protocol, and MAC is an abbreviation for Media Access Control.

The information transmitting unit 212 of each edge device 20 transmits the address 61 with the terminal information 62 added thereto as connection information 63 to the master device 10 .
Here, the information transmission unit 212 adds the edge device name, terminal name, and terminal type as the terminal information 62, as shown in Fig. 7. The edge device name is the name of the edge device 20 connected to the network to which the terminal 30 is connected, and here, the name of the edge device 20 equipped with the information transmission unit 212 is set. The terminal name is a name for making it easier to identify the terminal 30. The terminal type is information indicating the type of the terminal 30. The terminal name and terminal type may be set only if they can be extracted from the terminal 30.
In addition to these, the information transmission unit 212 may set manufacturer information of the terminal 30 as the terminal information 62. The manufacturer information is information capable of identifying the manufacturer, such as the manufacturer name of the manufacturer specified from the company code of the MAC address.

(Step S13: Classification process)
The information acquisition unit 113 of the master device 10 receives the connection information 63 transmitted in step S12. In step S12, the address acquisition unit 211 acquires the address 61 of the terminal 30 connected to the end side, so that the address 41 of the same terminal 30 is not transmitted from a plurality of edge devices 20.
The terminal classification unit 114 of the master device 10 sets each of the multiple zones as a group for controlling communication by default. Then, the terminal classification unit 114 classifies the terminal 30 indicated by the connection information 63 acquired by the information acquisition unit 113 by default into the group of the zone 40 in which the edge device 20 from which the connection information 63 was acquired is installed.

As shown in FIG. 6, assume that an edge device 20 is installed in each zone 40 and installation information is received. Then, as shown in FIG. 8, a check is automatically displayed indicating that MES Server and EWS01, which are terminals 30 indicated by connection information 63 received from edge device 20 named Edge3, have been classified into the production management zone 40 group. A check is automatically displayed indicating that SCADA1 and HMI1, which are terminals 30 indicated by connection information 63 received from edge device 20 named Edge2, have been classified into the production status monitoring zone 40 group. A check is automatically displayed indicating that PLC01, F-Device01, F-Device02, and F-Device03, which are terminals 30 indicated by connection information 63 received from edge device 20 named Edge1, have been classified into the production line 1 zone 40 group.

(Step S14: Change acceptance process)
The change acceptance unit 115 displays the groups classified by the terminal classification unit 114 together with the connection information 63 acquired by the information acquisition unit 113 in step S13, and accepts a change to the group.
Specifically, the change receiving unit 115 displays information as shown in Fig. 8. Then, when a group change is input by the user of the master device 10, the input is received and the group of the terminal 30 is changed according to the input. When no group change is input, the group as classified in step S13 is maintained.

(Step S15: Policy setting process)
The policy setting unit 116 of the master device 10 uses the group set in step S14 to set a policy 64 for controlling communication between groups. Specifically, the policy setting unit 116 sets a policy 64 indicating that communication between the same group and different groups is permitted, while communication between different groups is to be logged. The policy setting unit 116 also sets a policy 64 indicating that communication with terminals 30 that do not belong to any group is not permitted.
At this time, the policy setting unit 116 may accept a change to the policy 64 from the user of the master device 10. In other words, the policy setting unit 116 may set the above-mentioned policy 64 as a default, and then change the policy 64 as necessary. At this time, the policy setting unit 116 may set another policy on a group basis.
Then, the configuration transmission unit 117 of the master device 10 transmits the policy 64 to each of the edge devices 20 .

(Step S16: Communication control process)
The setting receiver 213 of each edge device 20 receives the policy 64 transmitted in step S15.
The communication control unit 214 of each edge device 20 controls communication between the terminals 30 based on the policy 64. That is, if the communication is between the terminals 30 that belong to a group set in the policy 64 to allow communication, the communication control unit 214 allows the communication and allows the data to pass. On the other hand, if the communication is between the terminals 30 that belong to a group set in the policy 64 to not allow communication, the communication control unit 214 does not allow the communication and does not allow the data to pass.
Furthermore, if policy 64 specifies that a log should be acquired, log acquisition unit 215 acquires a communication log.

(Step S17: Status display process)
9, the tree display unit 112 monitors the state of each terminal 30 as a target terminal 30, and changes the color, etc. of the node corresponding to the target terminal 30 in the asset tree 50 according to the state of the target terminal 30. The state of the terminal 30 is, for example, a state in which the terminal 30 is operating normally, a state in which an error has occurred, etc. In FIG. 9, the node of F-Device01 is hatched to indicate that it is not normal.
In the asset tree 50, each terminal 30 is displayed divided by zone 40. Therefore, for each zone 40, the state of the terminal 30 in that zone 40 can be easily confirmed.
The display of the node of the zone 40 to which the target terminal 30 belongs may be changed depending on the state of the target terminal 30. This makes it easier to grasp the state of each zone 40.

When the communication control system 1 is introduced, the processes from step S11 to step S16 are executed in order. After that, the processes from step S15 to step S16 are executed continuously, and the communication between the terminals 30 is controlled.
When the processes of steps S15 and S16 are being executed, the process of step S13 may be executed as an interrupt. That is, a group may be changed during communication control. Also, when the processes of steps S15 and S16 are being executed, a change to the policy 64 described in step S14 may be accepted.

***Advantages of First Embodiment***
As described above, the communication control system 1 according to the first embodiment sets a group by default for each zone 40, and classifies the terminal 30 by default into the group of the zone 40 in which the edge device 20 from which the connection information is obtained is installed. This makes it possible to automatically classify the terminal 30 into groups, thereby reducing the workload associated with the settings.

The communication control system 1 according to the first embodiment also sets a policy 64 for controlling communication between groups based on the automatically classified groups. The communication control system 1 then controls communication between the terminals 30 in accordance with the policy 64. This results in the same communication control being applied to each terminal 30 that exists in the same zone 40. Therefore, with regard to communication control, the same level of security measures are applied to the terminals 30 that exist in the same zone 40.

The communication control system 1 according to the first embodiment also displays the status of each terminal 30 using an asset tree 50 that displays the terminals 30 classified by zone 40. This makes it easy to check the status of the terminals 30 in each zone 40.

***Other configurations***
<Modification 1>
In the first embodiment, it is assumed that the user of the master device 10 inputs the installation information of the zone 40 installed for each edge device 20 in step S11 of FIG.
However, for each edge device 20, installation information of the zone 40 installed by a user who installs the edge device 20 may be set in the edge device 20. In this case, each edge device 20 transmits the installation information of the set zone 40 to the master device 10. Then, the zone reception unit 111 receives the installation information of the zone 40 transmitted and input from each edge device 20.
This eliminates the need for the user of the master device 10 to check in which zone 40 each edge device 20 is installed, by setting in the edge device 20 which zone 40 it is installed in when the edge device 20 is installed.

<Modification 2>
In the first embodiment, it is assumed that the installation information of which zone 40 the edge device 20 is installed is input for all edge devices 20 in step S11 in Fig. 4. However, there is a possibility that the installation information of which zone 40 the edge device 20 is installed is not input for some edge devices 20. In this case, the terminal 30 from which the edge device 20 for which the installation information was not input is not classified into a group in step S13 in Fig. 4.
Therefore, after the terminals 30 are classified into groups in step S13, the information acquisition unit 113 may extract the terminals 30 that are not classified into any group as unclassified terminals. Then, in step S14 of Fig. 4, the terminal classification unit 114 may cause the user to specify the group to which the unclassified terminal belongs.

<Modification 3>
In the first embodiment, each functional component is realized by software. However, as a third modification, each functional component may be realized by hardware. The following describes the third modification, focusing on the differences from the first embodiment.

When each functional component is realized by hardware, the master device 10 includes an electronic circuit instead of the processor 11, the memory 12, and the storage 13. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 12, and the storage 13.
Similarly, when each functional component is realized by hardware, the edge device 20 includes an electronic circuit instead of the processor 21, the memory 22, and the storage 23. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 22, and the storage 23.

The electronic circuits may be a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.
Each functional component may be realized by one electronic circuit, or each functional component may be realized by distributing it among a plurality of electronic circuits.

<Modification 4>
As a fourth modification, some of the functional components may be realized by hardware, and other functional components may be realized by software.

The processor 11, memory 12, storage 13, and electronic circuitry are collectively referred to as the processing circuit. In other words, the functions of each functional component are realized by the processing circuit.

In addition, the word "part" in the above description may be read as "circuit," "process," "procedure," "processing," or "processing circuit."

Various aspects of the present disclosure are summarized below as appendices.
(Appendix 1)
a zone receiving unit that receives input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of the plurality of edge devices being a target edge device;
an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device;
a master device that sets each of the multiple zones as a group for controlling communications, and that is equipped with a terminal classification unit that classifies a terminal indicated by the connection information acquired by the information acquisition unit into a group of zones indicated by the installation information accepted by the zone acceptance unit, in which the edge device from which the connection information was acquired is installed.
(Appendix 2)
The master device further comprises:
2. The master device according to claim 1, further comprising a policy setting unit that sets a policy for controlling communication between groups using the groups set by the terminal classification unit.
(Appendix 3)
3. The master device according to claim 2, wherein the policy indicates that communication between the same group and between different groups is permitted, while a log is to be acquired for communication between the different groups.
(Appendix 4)
The master device further comprises:
4. The master device according to claim 1, further comprising: a change receiving unit that displays a group classified by the terminal classification unit together with connection information acquired by the information acquisition unit for the terminal, and receives changes to the group.
(Appendix 5)
The master device further comprises:
A master device as described in any one of Appendices 1 to 4, comprising a tree display unit that displays tree structure data in which each of the multiple zones is a node, each of the multiple edge devices is a child node with the node of the zone in which it is installed as a parent, and the terminal is a child node with the node of the edge device from which the connection information was obtained as a parent.
(Appendix 6)
6. The master device according to claim 5, wherein the tree display unit changes the display of the node of the terminal according to a state of the terminal.
(Appendix 7)
The computer accepts an input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of a plurality of edge devices being a target edge device;
A computer acquires connection information of a terminal connected to the target edge device from the target edge device;
A communication control method in which a computer sets each of the multiple zones as a group for controlling communications, and classifies a terminal indicated by the connection information into a group of zones indicated by the installation information in which the edge device from which the connection information was obtained is installed.
(Appendix 8)
a zone reception process for receiving input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of the plurality of edge devices being a target edge device;
an information acquisition process for acquiring connection information of a terminal connected to the target edge device from the target edge device;
A communication control program that causes a computer to function as a master device that sets each of the multiple zones as a group for controlling communications, and performs a terminal classification process that classifies a terminal indicated by the connection information acquired by the information acquisition process into a zone group indicated by the installation information accepted by the zone acceptance process, in which the edge device from which the connection information was acquired is installed.
(Appendix 9)
A communication control system including a plurality of edge devices and a master device,
The master device
a zone receiving unit configured to receive input of installation information indicating in which of a plurality of zones the target edge device is installed, the target edge device being regarded as a target edge device;
an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device;
a terminal classification unit that sets each of the plurality of zones as a group for controlling communication, and classifies a terminal indicated by the connection information acquired by the information acquisition unit into a zone group indicated by the installation information accepted by the zone acceptance unit, the zone group including an edge device that has acquired the connection information;
a policy setting unit that sets a policy for controlling communication between the groups by using the groups set by the terminal classification unit;
a setting transmission unit that transmits the policy set by the policy setting unit to each of the plurality of edge devices,
Each of the plurality of edge devices
A communication control system comprising a communication control unit that controls communication between terminals based on the policy transmitted by the setting transmission unit.

The above describes the embodiments and modifications of the present disclosure. Some of these embodiments and modifications may be combined and implemented. Also, one or some of them may be implemented partially. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as necessary.

1 Communication control system, 10 Master device, 11 Processor, 12 Memory, 13 Storage, 14 Communication interface, 111 Zone reception unit, 112 Tree display unit, 113 Information acquisition unit, 114 Terminal classification unit, 115 Change reception unit, 116 Policy setting unit, 117 Setting transmission unit, 20 Edge device, 21 Processor, 22 Memory, 23 Storage, 24 Communication interface, 211 Address acquisition unit, 212 Information transmission unit, 213 Setting reception unit, 214 Communication control unit, 215 Log acquisition unit, 30 Terminal, 40 Zone, 50 Asset tree, 61 Address, 62 Terminal information, 63 Connection information, 64 Policy, 90 Network device.

Claims (10)

a zone receiving unit that receives input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of the plurality of edge devices being a target edge device;
an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device;
a master device that sets each of the multiple zones as a group for controlling communications, and that is equipped with a terminal classification unit that classifies a terminal indicated by the connection information acquired by the information acquisition unit into a group of zones indicated by the installation information accepted by the zone acceptance unit, in which the edge device from which the connection information was acquired is installed. The master device further comprises:
The master device according to claim 1 , further comprising a policy setting unit that uses the groups set by the terminal classification unit to set a policy for controlling communication between groups. The master device according to claim 2 , wherein the policy indicates that communications between the same group and between different groups are permitted, while a log is to be acquired for communications between the different groups. The master device further comprises:
The master device according to claim 1 , further comprising: a change acceptance unit that displays, for the terminal, the group classified by the terminal classification unit together with the connection information acquired by the information acquisition unit, and accepts a change to the group. The master device further comprises:
A display unit that displays structure data in which each of the plurality of edge devices is treated as a child of a zone in which the device is installed as a parent, and the terminal is treated as a child of an edge device that is a source of the connection information.
The master device of claim 1 . The master device further comprises:
The master device according to claim 1, further comprising a tree display unit that displays tree structure data in which each of the plurality of zones is a node, each of the plurality of edge devices is a child node with the node of the zone in which it is installed as a parent, and the terminal is a child node with the node of the edge device from which the connection information was obtained as a parent. 7. The master device according to claim 6 , wherein the tree display section changes the display of the node of the terminal according to the state of the terminal. The computer accepts input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of a plurality of edge devices being a target edge device;
A computer acquires connection information of a terminal connected to the target edge device from the target edge device;
A communication control method in which a computer sets each of the multiple zones as a group for controlling communications, and classifies a terminal indicated by the connection information into a group of zones indicated by the installation information in which the edge device from which the connection information was obtained is installed. a zone reception process for receiving input of installation information indicating in which of a plurality of zones the target edge device is installed, with each of the plurality of edge devices being a target edge device;
an information acquisition process for acquiring connection information of a terminal connected to the target edge device from the target edge device;
A communication control program that causes a computer to function as a master device that sets each of the multiple zones as a group for controlling communications, and performs a terminal classification process that classifies a terminal indicated by the connection information acquired by the information acquisition process into a zone group indicated by the installation information accepted by the zone acceptance process, in which the edge device from which the connection information was acquired is installed. A communication control system including a plurality of edge devices and a master device,
The master device
a zone receiving unit configured to receive input of installation information indicating in which of a plurality of zones the target edge device is installed, the target edge device being regarded as a target edge device;
an information acquisition unit that acquires connection information of a terminal connected to the target edge device from the target edge device;
a terminal classification unit that sets each of the plurality of zones as a group for controlling communication, and classifies a terminal indicated by the connection information acquired by the information acquisition unit into a zone group indicated by the installation information accepted by the zone acceptance unit, the zone group including an edge device that has acquired the connection information;
a policy setting unit that sets a policy for controlling communication between the groups by using the groups set by the terminal classification unit;
a setting transmission unit that transmits the policy set by the policy setting unit to each of the plurality of edge devices,
Each of the plurality of edge devices
A communication control system comprising a communication control unit that controls communication between terminals based on the policy transmitted by the setting transmission unit.

Images