JP2019169773A - Communication control device, information processing system, control method, and program - Google Patents

Abstract

In a system in which a virtual LAN is applied to communication between a plurality of networks having different segments, transmission / reception information communication can be performed even with an information processing apparatus that does not support the virtual LAN. The plurality of networks include a first network for communicating first data not including tag information of a virtual LAN, and a second network for communicating second data including tag information. . The communication control device 30 includes: an acquisition unit configured to acquire transmission / reception information from the information processing device 10 or a network device; If the network device is connected to a network device, the communication device includes communication control means for transmitting the acquired transmission / reception information to the information processing device 10 or the network device as the transmission destination. [Selection diagram] Fig. 1

Description

  The present invention relates to a communication control device, an information processing system, a control method, and a program.

  A network system in an organization such as a company may have a plurality of networks having different segments even in the same organization. In such a case, communication between devices belonging to different networks is performed via a network device such as a router, for example.

  On the other hand, there are cases where it is desired to restrict communication between devices belonging to different networks even within the same organization. For example, there is a network in which information to be concealed such as personal information flows and an OA (Office Automation) network in which information that is not concealed more than personal information such as sales and personnel data exists.

  In such a system, a technique using a tagged VLAN (tagged Virtual Local Area Network: IEEE802.1Q) is known when it is desired to add a network having different segments. By making the devices constituting the network system compatible with the tag VLAN, the network can be flexibly constructed without adding physical resources.

  For example, Patent Document 1 discloses that a network relay device uses a communication packet VLAN based on information on a transmission source network and a destination of a communication packet for the purpose of enabling access to a common device while ensuring network security. A technique for tag processing and source address conversion is disclosed.

  However, Patent Document 1 discloses a method of performing communication without performing both tag processing of a virtual LAN such as VLAN and conversion of a source address (for example, destination information) of a communication packet (for example, transmission / reception information). Absent. Therefore, in the case of a device that does not support the virtual LAN function (for example, an information processing device), there is a problem that communication of transmission / reception information cannot be performed.

  A communication control apparatus according to the present invention is a communication control apparatus that controls communication of transmission / reception information between at least one information processing apparatus and a plurality of network devices connected to each of a plurality of networks having different segments. The plurality of networks include a first network that performs communication of first data that does not include tag information of the virtual LAN, and a second network that performs communication of second data that includes the tag information. , At least one of acquisition means for acquiring the transmission / reception information from the information processing apparatus or the network device, and transmission destination and transmission destination information included in the acquired transmission / reception information is stored in the first network. In the case of a connected network device, the acquired information is sent to the information processing apparatus as the transmission destination. Other and a communication control means for transmitting to the network device.

  According to the present invention, in a system in which a virtual LAN is applied to communication between a plurality of networks having different segments, transmission / reception information can be communicated to an information processing apparatus that does not support the virtual LAN.

It is a figure which shows an example of the system configuration | structure of the information processing system which concerns on one Embodiment. It is a figure which shows an example of the hardware constitutions of the computer which concerns on one Embodiment. It is a figure which shows an example of a function structure of the communication control apparatus which concerns on one Embodiment. It is a figure which shows an example of the network management table which concerns on one Embodiment. It is a figure which shows an example of the destination management table which concerns on one Embodiment. It is a figure for demonstrating the IP address of each part of the communication control apparatus which concerns on one Embodiment. It is a figure for demonstrating the IP address of each part of the communication control apparatus which concerns on one Embodiment. It is a figure which shows an example of a function structure of the bridge | bridging communication control part which concerns on one Embodiment. It is a figure which shows an example of the communication control information which concerns on one Embodiment. It is a figure which shows an example of a function structure of the NAPT communication control part which concerns on one Embodiment. It is a figure which shows an example of the communication path control information of the 1st NAPT communication control part which concerns on one Embodiment. It is a figure which shows an example of the communication path control information of the 2nd NAPT communication control part which concerns on one Embodiment. It is a figure for demonstrating the processing flow of the tag process part which concerns on one Embodiment. It is a flowchart for demonstrating the processing flow at the time of transmitting packet information from a network device to an information processing apparatus in the communication control apparatus which concerns on one Embodiment. It is a flowchart for demonstrating the processing flow at the time of transmitting file information from an information processing apparatus to a network device in the communication control apparatus which concerns on one Embodiment. FIG. 6 is a sequence diagram for explaining a flow of packet information transmitted from a network Net_A system network device to an information processing device in the information processing system according to the embodiment. FIG. 6 is a sequence diagram for explaining a flow of packet information transmitted from a network Net_B system network device to an information processing device in the information processing system according to the embodiment. It is a figure which shows an example of the system configuration | structure of the information processing system which concerns on other embodiment. It is a figure which shows an example of a function structure of the information processing apparatus which concerns on other embodiment.

  Hereinafter, embodiments for carrying out the invention will be described with reference to the drawings. In the description of the drawings, the same elements are denoted by the same reference numerals, and redundant descriptions are omitted.

● Embodiment ●
System Configuration FIG. 1 is a diagram illustrating an example of a system configuration of an information processing system according to an embodiment. The information processing system shown in FIG. 1 supports a virtual LAN in a system in which a virtual LAN such as a tagged VLAN (tagged Virtual Local Area Network: IEEE802.1Q) is applied to communication between a plurality of networks having different segments. This is a system capable of communicating transmission / reception information even with no information processing apparatus 10. Thereby, the information processing system according to the present embodiment connects the information processing apparatus 10 to a larger network that supports the virtual LAN regardless of whether the information processing apparatus 10 supports the virtual LAN. Can do.

  The information processing system shown in FIG. 1 includes an information processing device 10, a communication control device 30, a VLAN-compatible switch 50, and a router 70 (70a, 70b, 70c, hereinafter referred to as a router 70 when it is not necessary to distinguish). Client terminal 80 (80a, 80aa, 80b, 80bb, 80c, 80cc, hereinafter referred to as client terminal 80 when it is not necessary to distinguish) and server device 90 (90a, 90b, 90b, 90c, hereinafter distinguished) When it is not necessary, the server device 90 is used.

  The information processing device 10 is connected to a plurality of networks (Net_A0, Net_B0, Net_C0) via the communication control device 30 and the VLAN compatible switch 50, respectively. The port corresponding to the Native VLAN of the VLAN switch 50 is connected to the network Net_A0. The Native VLAN is a VLAN that can transmit and receive packet information without a VLAN tag (VLAN ID) added thereto.

  The port corresponding to the VLAN 10 of the VLAN switch 50 is connected to the network Net_B0. The port corresponding to the VLAN 30 of the VLAN compatible switch 50 is connected to the network Net_C0. The trunking port (Trunk) of the VLAN compatible switch 50 is connected to the communication control device 30. The information processing apparatus 10 is connected to the communication control apparatus 30. The information processing apparatus 10 is an apparatus that does not support the tag VLAN. Note that the network interface of the information processing apparatus 10 has a MAC address of “00-00-5E-00-53-22”, for example.

  The network Net_A0 is connected to the network Net_A1 via the router 70a. The network Net_B0 is connected to the network Net_B1 via the router 70b. The network Net_C0 is connected to the network Net_C1 via the router 70c. Furthermore, the information processing apparatus 10 is connected to the Internet via the network Net_C0 and the network Net_I.

  The network connected to the information processing apparatus 10 via the communication control device 30 and the VLAN switch 50 includes a network Net_A system in which the network Net_A0 and the network Net_A1 are grouped, a network Net_B system in which the network Net_B0 and the network Net_B1 are grouped, and a network The network Net_C is divided into a network Net_C0 and a network Net_C1.

  In addition, the networks of each system are separated so that IP (Internet Protocol) communication cannot be performed. Note that the network Net_A system and the network Net_B system are configured so that they cannot be connected to the Internet in consideration of communication security, but both may be connectable to the Internet. The network Net_A0 system is an example of a first network. The network Net_B0 system or the network Net_C0 system network is an example of a second network.

  The information processing system according to the present embodiment assumes that the router 70 is provided in a plurality of networks having different segments separated so that they cannot communicate with each other, and a route to a network other than the directly connected network Also controls. Thereby, the information processing system according to the present embodiment enables communication via the router 70 between a plurality of networks, and the information processing apparatus 10 can be used in a large-scale network. Although the present embodiment will be described as being separated so that IP communication is not possible between networks of each system, communication between networks of each system may be possible depending on security requirements and the like. .

  The client terminal 80a, the client terminal 80b, and the client terminal 80c are connected to the network Net_A0, the network Net_B0, and the network Net_C0, respectively. The client terminal 80a and the server device 90a are connected to the network Net_A1. The client terminal 80b and the server device 90b are connected to the network Net_B1. Further, the client terminal 80c and the server device 90c are connected to the network Net_C1. The client terminal 80 and the server device 90 connected to each network can communicate with the information processing device 10 via the communication control device 30 and the VLAN compatible switch 50.

  The information processing apparatus 10 is an image forming apparatus such as a multifunction peripheral that realizes a plurality of functions such as a print function, a copy function, a scanner function, and a FAX function in a single housing. The image forming apparatus may be called an MFP (Multifunction Peripheral), a copier, or the like in addition to a multifunction peripheral. The information processing apparatus 10 may have only one of a print function, a copy function, a scanner function, or a FAX function. In this case, the information processing apparatus 10 is called a printer, a copier, a scanner apparatus, or a FAX apparatus. In the information processing apparatus 10, one or more applications for executing each function are installed.

  The information processing apparatus 10 is not limited to an image forming apparatus as long as it can perform IP communication. The information processing apparatus 10 includes, for example, a PJ (Projector), an IWB (Interactive White Board), an output device such as a digital signage, and a HUD (Head Up Display) device. , Output devices such as digital signage, industrial machines, imaging devices, sound collectors, medical equipment, network home appliances, notebook PCs (Personal Computers), mobile phones, smartphones, tablet terminals, game machines, PDAs (Personal Digital Assistants), digital It may be a camera, a wearable PC, a desktop PC, or the like.

  The communication control device 30 restricts communication between each system of the network Net_A system, the network Net_B system, and the network Net_C system, and the communication between the network Net_A system and the information processing apparatus 10, and the network Net_B system and the information processing apparatus 10 And communication between the network Net_C system and the information processing apparatus 10.

  The VLAN compatible switch 50 adds or removes a VLAN tag of “10” to / from packet information transmitted / received via the network Net_B0 connected to the port corresponding to the VLAN 10. Further, the VLAN compatible switch 50 adds or removes a VLAN tag of “30” to / from packet information transmitted / received via the network Net_C0 connected to the port corresponding to the VLAN 30. On the other hand, the VLAN compatible switch 50 does not perform VLAN tag processing (addition or removal of a VLAN tag) on packet information transmitted / received via the network Net_A0 connected to the port corresponding to the Native VLAN.

  The client terminal 80 is a communication device connected to each network. The client terminal 80 is a communication device that can be carried or operated by a user such as a notebook PC. The client terminal 80 may be a mobile phone, a smartphone, a tablet terminal, a game machine, a PDA, a digital camera, a wearable PC, a desktop PC, or the like.

  The server device 90 is a server device such as a job server or an authentication server connected to each network. For example, the server apparatus 90 stores a job for the information processing apparatus 10 requested from the client terminal 80. Then, the server apparatus 90 outputs the accumulated job to the information processing apparatus 10. The client terminal 80 and the server device 90 connected to each network are examples of network devices.

  In the information processing system illustrated in FIG. 1, the client terminal 80 performs, for example, a print request to the information processing apparatus 10 and transmission of device information using SNMP (simple network management protocol). The information processing apparatus 10 transmits the file information formed by the scan process to the server apparatus 90 and the like. Note that the print request, transmission of device information by SNMP, transmission of scanned file information, and the like described in the present embodiment are examples, and communication other than these may be used. FIG. 1 illustrates an example in which the information processing apparatus 10 is connected to a three-system network, but the information processing apparatus 10 may be configured to be connected to a two-system network or four or more networks. .

Hardware Configuration Next, the hardware configuration of each device according to the embodiment will be described. The hardware configuration of each apparatus according to the embodiment has a general computer configuration. Here, a hardware configuration example of a general computer will be described. Note that, in the hardware configuration of each device according to the embodiment, components may be added or deleted as necessary.

  FIG. 2 is a diagram illustrating an example of a hardware configuration of a computer according to an embodiment. A computer 1000 includes a CPU (Central Processing Unit) 1001, a ROM (Read Only Memory) 1002, a RAM (Random Access Memory) 1003, a storage 1004, a keyboard 1005, a display interface (I / F) 1006, and a media interface (I / F). 1007, a network interface (I / F) 1008, and a bus 1009.

  The CPU 1001 is an arithmetic device that implements each function of the computer 1000 by reading the program or data according to the present invention stored in the ROM 1002 or the storage 1004 onto the RAM 1003 and executing the processing. For example, the communication control device 30 realizes the control method according to the present invention by executing the program according to the present invention.

  The ROM 1002 is a nonvolatile memory that can retain programs and data even when the power is turned off. The ROM 1002 is configured by, for example, a flash ROM. The ROM 1002 is installed with applications such as SDK (Software Development Kit) and API (Application Programming Interface), and the functions and network connection of the computer 1000 can be realized using the installed applications.

  A RAM 1003 is a volatile memory used as a work area for the CPU 1001. The storage 1004 is a storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The storage 1004 stores, for example, an OS (Operation System), application programs, various data, and the like.

  The keyboard 1005 is a kind of input means having a plurality of keys for inputting characters, numerical values, various instructions, and the like. The input means may be not only the keyboard 1005 but also a mouse, a touch panel, a voice input device, or the like. A display interface (I / F) 1006 controls display of various information such as a cursor, menu, window, character, or image on a display 1006a such as an LCD (Liquid Crystal Display). The display 1006a may be a touch panel display provided with input means.

  A media interface (I / F) 1007 controls reading or writing (storage) of data with respect to a recording medium 1007a such as a USB (Universal Serial Bus) memory, a memory card, an optical disk, or a flash memory.

  A network interface (I / F) 1008 is an interface for connecting the computer 1000 to a network and transmitting / receiving data to / from other computers and electronic devices. The network interface (I / F) 1008 is a communication interface such as a wired or wireless LAN (Local Area Network). The network interface (I / F) 1008 includes 3G (3rd Generation), LTE (Long Term Evolution), 4G (4rd Generation), 5G (5rd Generation), Zigbee (registered trademark), and BLE (Bluetooth (registered trademark)). Low Energy) and millimeter wave wireless communication interfaces may be provided.

  The bus 1009 is commonly connected to the above-described components, and transmits an address signal, a data signal, various control signals, and the like. The CPU 1001, ROM 1002, RAM 1003, storage 1004, keyboard 1005, display interface (I / F) 1006, media interface (I / F) 1007, and network interface (I / F) 1008 are connected to each other via a bus 1009. Yes.

Functional Configuration FIG. 3 is a diagram illustrating an example of a functional configuration of a communication control apparatus according to an embodiment. 3 includes a first transmission / reception unit 11, a tag processing unit 12, a storage unit 13, a bridge communication control unit 14, a first NAPT (Network Address Port Translator) communication control unit 15, and a second The NAPT communication control unit 16 and the second transmission / reception unit 17 are included.

  The first transmission / reception unit 11 has a function of exchanging data with network devices connected to the network Net_A0, the network Net_B0, and the network Net_C0 via the VLAN compatible switch 50. For example, the first transmission / reception unit 11 receives packet information such as a print request from the network device to the information processing apparatus 10. The first transmission / reception unit 11 transmits packet information such as file information scanned by the information processing apparatus 10 to the network device, for example.

  The first transmission / reception unit 11 transmits / receives packet information not including a VLAN tag to / from a network device connected to the network Net_A system. The first transmission / reception unit 11 transmits and receives packet information including a VLAN tag to and from network devices connected to the network Net_B system or the network Net_C system. The packet information that does not include the VLAN tag is an example of first data that does not include the tag information of the virtual LAN. The packet information including the VLAN tag is an example of second data including the virtual LAN tag information. The first transmission / reception unit 11 is realized, for example, by a network interface (I / F) 1008 and a program executed by the CPU 1001 shown in FIG. The first transmission / reception unit 11 communicates with a network device using wired LAN (Ethernet (registered trademark)) communication, wireless LAN communication, PCI Express, USB, or the like.

  The tag processing unit 12 has a function of adding or removing a VLAN tag to / from packet information transmitted / received via the network Net_B system or the network Net_C system. Packet information transmitted / received via the network Net_B system or the network Net_C system includes a VLAN tag.

  For example, the tag processing unit 12 adds or removes the VLAN tag “10” corresponding to the communication port connected to the network Net_B0 to the packet information transmitted / received via the network Net_B0. Further, the tag processing unit 12 adds or removes the VLAN tag “30” corresponding to the communication port connected to the network Net_C0 to, for example, packet information transmitted / received via the network Net_C0.

  On the other hand, the tag processing unit 12 does not perform tag processing (addition or removal of a VLAN tag) on packet information transmitted / received via the network Net_A system that transmits / receives packet information not including a VLAN tag. Specifically, when the VLAN information is not included in the packet information received by the first transmitter / receiver 11, the tag processor 12 receives the packet information received by the bridge communication controller 14 without performing tag processing. Send. When the tag processing unit 12 directly receives packet information from the bridge communication control unit 14, the tag processing unit 12 transmits the received packet information to the first transmission / reception unit 11 without performing tag processing. The tag processing unit 12 is realized by, for example, a program executed by the CPU 1001 shown in FIG. The tag processing unit 12 is an example of a tag processing unit.

  The storage unit 13 has a function of storing various data in the ROM 1002 and the storage 1004 shown in FIG. The storage unit 13 stores a network management table 200 and a destination management table 210. The storage unit 13 is an example of a storage unit. Here, the contents of the network management table 200 and the destination management table 210 will be described with reference to FIGS. 4 and 5. FIG. 4 is a diagram illustrating an example of a network management table according to an embodiment. The network management table 200 shows the network address and netmask (bitmask) of each network. The network address shown in FIG. 4 is an IPv4 address, but the network address is not limited to this.

  As shown in FIG. 4, the network address of the network Net_A0 is “192.168.1.0/24”. The network address of the network Net_A1 is “192.168.10.0/24”. The network address of the network Net_B0 is “172.16.1.0/24”. The network address of the network Net_B1 is 172.16.10.0/24 ". The network address of the network Net_C0 is “10.0.1.0/24”. The network address of the network Net_C1 is “10.0.10.0/24”. The network address of the network Net_I is “203.0.113.0/29”.

  The VLAN tag corresponding to the network Net_B0 is “10”, and the VLAN tag corresponding to the network Net_C0 is “30”. The network Net_I is a segment for establishing an internet connection. As shown in FIG. 4, the network address of each network is set not to overlap. In addition to the setting example shown in FIG. 4, the network address of each network may be such that the IP address of the server device 90 that communicates directly with the communication control device 30 does not overlap. Even if the IP address of the server device 90 that communicates directly with the communication control device 30 is duplicated, it is sufficient that the static NAPT setting is made.

  FIG. 5 is a diagram illustrating an example of a destination management table according to an embodiment. The destination management table 210 shows the IP addresses, netmasks, and default gateways of the information processing apparatus 10, router 70, client terminal 80, and server apparatus 90 that can communicate with the communication control apparatus 30 via each network.

  The destination management table 210 includes information on “device” that can communicate with the communication control device 30, and information on “Network address / netmask” and “default gateway” of “device”. “Network address / netmask” and “default gateway” are examples of destination information of the information processing apparatus 10, the router 70, the client terminal 80, and the server apparatus 90. The destination management table 210 stores destination information of devices having a communication record with the communication control device 30. Note that the information included in the destination management table 210 may be set not only by information on devices having a communication record with the communication control device 30 but also by an administrator as appropriate.

  In the case of the destination management table 210 shown in FIG. 5, the IP address of the information processing apparatus 10 (MFP) is “192.168.1.10/24”, and the default gateway is “192.168.1.1/ 24 ". The IP address of the client terminal 80a (PC_A0) is “192.168.1.100/24”, and the default gateway is “192.168.1.1/24”. The IP address of the router 70a (R_A) is “192.168.1.1/24”, and the subnet mask is “192.168.10.1/24”.

  The IP address of the client terminal 80aa (PC_A1) is “192.168.10.100/24”, and the default gateway is “192.168.10.1/24”. The IP address of the server apparatus 90a (SV_A1) is “192.168.10.11/24”, and the default gateway is “192.168.10.1/24”. The IP address of the client terminal 80b (PC_B0) is “172.6.1.100/24”, and the default gateway is “172.16.1.1/24”.

  The IP address of the router 70b (R_B) is “172.16.1.1/24”, and the subnet mask is “172.6.10.1/24”. The IP address of the client terminal 80bb (PC_B1) is “172.16.10.100/24”, and the default gateway is “172.6.10.1/24”. The IP address of the server apparatus 90b (SV_B1) is “172.16.10.11/24”, and the default gateway is “172.16.10.1/24”. The IP address of the client terminal 80c (PC_C0) is “10.0.1.100/24”, and the default gateway is “10.0.1 / 24”.

  The IP address and subnet mask of the router 70c (R_C) capable of transmitting packet information to the Internet are “10.0.1 / 24”, “10.0.10.1/24”, and “203. 0.133.2 / 29 ”and the default gateway is“ 203.0.113.1/29 ”. The IP address of the client terminal 80cc (PC_C1) is “10.0.10.100/24”, and the default gateway is “10.0.10.1/24”. The IP address of the server apparatus 90c (SV_C1) is “10.0.10.11/24”, and the default gateway is “10.0.10.1/24”.

  As shown in FIG. 5, each of the information processing apparatus 10, the client terminal 80, and the server apparatus 90 is assigned one IP address that enables communication via a network. A plurality of IP addresses are assigned to the router 70 so as to enable communication via each connected network. Note that the server device 90 and the router 70 may be logically one or may have a redundant configuration with a plurality of devices. Note that the device and destination information included in the destination management table 210 are not limited to this.

  Returning to FIG. 3, the description of the functional configuration of the communication control device 30 is continued. The bridge communication control unit 14 has a function of determining a transmission destination of packet information received via the first transmission / reception unit 11 or the second transmission / reception unit 17 and rewriting the packet information. Details of the bridge communication control unit 14 will be described later.

  The first NAPT communication control unit 15 has a function of determining a transmission destination of packet information received via the first transmission / reception unit 11 or the second transmission / reception unit 17 and rewriting the packet information. The first NAPT communication control unit 15 and the second NAPT communication control unit 16 are realized by, for example, a program executed by the CPU 1001 shown in FIG.

  The first NAPT communication control unit 15 and the second NAPT communication control unit 16 each have a NAPT table for NAPT processing. The first NAPT communication control unit 15 and the second NAPT communication control unit 16 use the NAPT table (the NAPT table 330 and the NAPT table 350 described later) to perform IP address conversion processing and port number conversion processing (NAPT processing). ).

  In addition, the first NAPT communication control unit 15 and the second NAPT communication control unit 16 have different routing tables (communication path control information 320 and communication path control information 320 described later). The first NAPT communication control unit 15 and the second NAPT communication control unit 16 are networks such as a routing table, a NAPT table, and a session table (a table for managing which port of TCP / UDP is communicating with which port). Resources are isolated. That is, the first NAPT communication control unit 15 and the second NAPT communication control unit 16 have different network resources. Details of the first NAPT communication control unit 15 and the second NAPT communication control unit 16 will be described later.

  The second transmission / reception unit 17 has a function of receiving packet information from the information processing apparatus 10 and transmitting the packet information to the information processing apparatus 10. The second transmission / reception unit 17 communicates with the information processing apparatus 10 using wireless communication such as a wireless LAN or Bluetooth (registered trademark). By using wireless communication for communication with the information processing apparatus 10, the communication control apparatus 30 can effectively use a physical space and improve user convenience. Note that the communication method used in the second transmission / reception unit 17 is not limited to wireless communication. The second transmission / reception unit 17 is realized, for example, by a network interface (I / F) 1008 and a program executed by the CPU 1001 shown in FIG. The second transmission / reception unit 17 is an example of an acquisition unit.

  The packet information transmitted / received by the first transmission / reception unit 11 and the second transmission / reception unit 17 includes transmission source and transmission destination network, or transmission destination and transmission destination device destination information (for example, network address, IP address, MAC address). Address). For example, by using an IP address or the like in packet information communication control, the communication control device 30 can perform communication control with a network device in the same manner as an existing security policy for a network administrator.

  Moreover, the packet information transmitted / received by the 1st transmission / reception part 11 and the 2nd transmission / reception part 17 contains the information of the communication port which transmits / receives packet information. The communication port information is, for example, a port number such as UDP (User Datagram Protocol) or TCP (Transmission Control Protocol). For example, the communication control device 30 can perform more detailed communication control with a network device by using information on a communication port in communication control of packet information.

○ IP Address of Each Part of Communication Control Device Here, the IP address of each part of the communication control device 30 will be described with reference to FIGS. 6 and 7. The IP address (BRI_A) of the bridge communication control unit 14 is an address used when packet information received via the first transmission / reception unit 11 is transmitted to the information processing apparatus 10. As shown in FIG. 7, the IP address (BRI_A) of the bridge communication control unit 14 is, for example, “192.168.1.11/24”.

  The IP address (INT) of the bridge communication control unit 14 is an address used only within the communication control device 30 when packet information received from the information processing device 10 is transmitted to the first transmission / reception unit 11. The IP address (INT) of the bridge communication control unit 14 is, for example, “192.0.2.10/24” as illustrated in FIG.

  The IP address (INT_B) of the first NAPT communication control unit 15 is used only inside the communication control device 30 when packet information received via the first transmission / reception unit 11 is transmitted to the bridge communication control unit 14. Address. The IP address (INT_B) of the first NAPT communication control unit 15 is, for example, “192.02.12 / 24” as shown in FIG.

  The IP address (INT_C) of the second NAPT communication control unit 16 is used only inside the communication control device 30 when packet information received via the first transmission / reception unit 11 is transmitted to the bridge communication control unit 14. Address. The IP address (INT_C) of the second NAPT communication control unit 16 is, for example, “192.0.2.13/24” as shown in FIG.

  The IP address (MFP_B) of the first NAPT communication control unit 15 is an address for accessing the information processing apparatus 10 from the network Net_B system. The IP address (MFP_B) of the first NAPT communication control unit 15 is, for example, “172.16.1.10/24” as shown in FIG.

  The IP address (INT_SV_B1) of the first NAPT communication control unit 15 is used only inside the communication control device 30 when packet information received from the bridge communication control unit 14 is transmitted to the server device 90b on the network Net_B system. Address. The IP address (INT_SV_B1) of the first NAPT communication control unit 15 is, for example, “192.0.2.200/24” as shown in FIG.

  The IP address (MFP_C) of the second NAPT communication control unit 16 is an address for accessing the information processing apparatus 10 from the network Net_C system. The IP address (MFP_C) of the second NAPT communication control unit 16 is, for example, “10.0.10.10/24” as shown in FIG.

  The IP address (INT_SV_C1) of the second NAPT communication control unit 16 is used only inside the communication control device 30 when transmitting packet information received from the bridge communication control unit 14 to the server device 90c on the network Net_C system. Address. The IP address (INT_SV_C1) of the second NAPT communication control unit 16 is, for example, “192.0.2.201/24” as illustrated in FIG.

  Here, the IP address “192.0.2.0/24” is reserved for documentation in RFC 5737 (Request for Comments 5737) and is not used in the network. In the information processing system according to the present embodiment, communication is performed in the communication control device 30 using the IP address “192.0.2.0/24”, but the IP used in the network is used. If there is no duplication with the address, the IP address used for communication in the communication control device 30 is not limited to this.

Configuration of Bridge Communication Control Unit FIG. 8 is a diagram illustrating an example of a configuration of a bridge communication control unit according to an embodiment. As illustrated in FIG. 8, the bridge communication control unit 14 includes a communication unit 141, a control unit 142, and a storage unit 143. The communication unit 141 performs transmission of the packet information received from the first transmission / reception unit 11 or the second transmission / reception unit 17 and rewrite of the packet information including the NAPT process according to the control of the control unit 142. The communication unit 141 is realized, for example, by a network interface (I / F) 1008 and a program executed by the CPU 1001 shown in FIG. The control unit 142 controls communication of the communication unit 141 based on the communication control information 300 stored in the storage unit 143. The control unit 142 is realized by, for example, a program executed by the CPU 1001 illustrated in FIG.

  The storage unit 143 stores communication control information 300 and a NAPT table 310. The storage unit 143 is realized by, for example, a program executed by the ROM 1002, the storage 1004, and the CPU 1001 illustrated in FIG. The storage unit 143 is an example of a storage unit. The communication control information 300 and the NAPT table 310 are routing tables used for communication control by the control unit 142.

  Here, the communication control information 300 stored in the storage unit 143 will be described. FIG. 9 is a diagram illustrating an example of communication control information according to an embodiment. The communication control information 300 shown in FIG. 9 is a routing table showing packet processing rules of the bridge communication control unit 14. The communication control information 300 is an example of process determination information.

  The bridge communication control unit 14 scans the packet processing rules of the communication control information 300 in order from the top using the received packet information. The bridge communication control unit 14 detects a packet processing rule that matches the received packet information. Then, the bridge communication control unit 14 executes actions (actions) corresponding to the received packet information indicated by the detected packet processing rule. The bridge communication control unit 14 ends the scanning of the communication control information 300 when the action is executed.

  As shown in FIG. 9, the packet processing rule of the communication control information 300 includes an input source (In port), a type (type), a transmission source (src: source), a transmission destination (dst: destination), and an operation (actions). It consists of each condition. The bridge communication control unit 14 detects a packet processing rule that matches all the conditions of the received packet information as a packet processing rule corresponding to the received packet information. The condition “ANY” in FIG. 9 means that any packet information matches. When there is no packet processing rule that matches all the conditions, the bridge communication control unit 14 executes default processing (discard: drop) shown in the lowermost stage of FIG.

  The “input source” condition illustrated in FIG. 9 indicates a port that has received packet information. Specifically, the “input source” is the first transmission / reception unit 11, the tag processing unit 12, the second transmission / reception unit 17, the first NAPT communication control unit 15, the second NAPT communication control unit 16, and the like. . The “type” condition shown in FIG. 9 indicates the type of communication. Specifically, the “type” is data link layer communication or network layer communication. When the packet information is IP communication, the bridge communication control unit 14 processes that the “type” matches the IP condition.

  The “transmission source” condition shown in FIG. 9 indicates a transmission source address. Further, the “transmission destination” condition indicates a transmission destination address. Specifically, the “source” and “destination” may be a single IP address, a network address, or a MAC address related to the data link layer. The bridge communication control unit 14 can set the packet information from a specific device as a target of the NAPT process by using the MAC address as a condition for the matching process. Therefore, the bridge communication control unit 14 can prevent inconvenience that packets are transmitted from an unintended device to a network device. The bridge communication control unit 14 may not use the MAC address as a condition for the matching process.

  The operation shown in FIG. 9 shows the operation when the packet information matches each condition. Note that the bridge communication control unit 14 may execute a plurality of operations. Of the operations shown in FIG. 9, “drop” means an operation of discarding packet information. “NAPT” means execution of NAPT processing. When the bridge communication control unit 14 detects SNAT (Source Network Address Translation) in the first argument of the packet information, the bridge communication control unit 14 performs source address translation (SNAT) as NAPT processing. Further, when the bridge communication control unit 14 detects DNAT (Destination Network Address Translation) in the first argument of the packet information, the bridge communication control unit 14 performs destination address conversion processing (DNAT) as NAPT processing. In either case, the second argument is the IP address to be replaced.

  When executing the NAPT process, the bridge communication control unit 14 rewrites the contents of the NAPT table so that the NAPT process can be performed correctly. In this case, the bridge communication control unit 14 confirms an unauthorized TCP session or the like, and prevents unauthorized packet transmission.

  “Mod_mac” in the operation illustrated in FIG. 9 indicates an operation of replacing the MAC address. Further, “output” in the operation illustrated in FIG. 9 indicates an operation of outputting packet information to a designated port. The bridge communication control unit 14 has a default operation of dropping all packet information.

  “1” and “2” in FIG. 9 indicate operations when the condition of “transmission source” is an IP address of “192.0.2.0/24” used inside the communication control device 30. In this case, the bridge communication control unit 14 drops the packet information. Thereby, the communication control apparatus 30 can prevent the inconvenience of receiving the packet information of the IP address used inside the communication control apparatus 30 from the outside, and can prevent the transmission of unintended packet information.

  “3” in FIG. 9 indicates an operation of outputting all packet information received from the tag processing unit 12 to the (ANY) second transmitting / receiving unit 17. Further, “4” in FIG. 9 indicates that the packet information received from the first NAPT communication control unit 15 uses the IP address of “192.20.10 (INT)” of the bridge communication control unit 14 as the transmission destination. It shows the operation when doing. In this case, the bridge communication control unit 14 converts the transmission source address to the IP address (BRI_A) of the bridge communication control unit 14 and converts the transmission destination address to the IP address (MFP) of the information processing apparatus 10 by NAPT processing. . Then, the bridge communication control unit 14 transmits the packet information to the second transmission / reception unit 17 using the MAC address as the MAC address of the router 70a.

  “5” in FIG. 9 is a case where the packet information received from the second NAPT communication control unit 16 uses the IP address (INT) of “192.20.10” of the bridge communication control unit 14 as the transmission destination. Shows the operation. In this case, the bridge communication control unit 14 converts the transmission source address to the IP address (BRI_A) of the bridge communication control unit 14 and converts the transmission destination address to the IP address (MFP) of the information processing apparatus 10 by NAPT processing. . Then, the bridge communication control unit 14 transmits the packet information to the second transmission / reception unit 17 using the MAC address as the MAC address of the router 70a.

  “6” in FIG. 9 indicates an operation when the transmission destination of the packet information (for example, packet information generated by the scanning process) received via the second transmission / reception unit 17 is the server apparatus 90b. Yes. In this case, the bridge communication control unit 14 converts the transmission source address to the IP address (INT_SV_B1) of the server device 90b by the NAPT process, and converts the transmission destination address to the IP address (INT_B) of the first NAPT communication control unit 15. Convert. Then, the bridge communication control unit 14 transmits the packet information to the first NAPT communication control unit 15.

  In the case of “7” in FIG. 9, when the transmission destination of the packet information (for example, packet information generated by the scanning process) received via the second transmission / reception unit 17 is the server device 90 c, the bridge communication control The unit 14 converts the source to the IP address (INT_SV_C1) of the server device 90c and converts the destination to the IP address (INT_C) of the second NAPT communication control unit 16 by the NAPT process, An operation of transmitting to the NAPT communication control unit 16 is shown.

  In the case of “8” in FIG. 9, an operation in which the bridge communication control unit 14 transmits the packet information received by the second transmission / reception unit 17 to the tag processing unit 12 with any packet information (ANY) is shown. Yes. Basically, the bridge communication control unit 14 can communicate with the first transmission / reception unit 11 and the second transmission / reception unit 17, but for example, internal communication, the first NAPT communication control unit 15, The bridge communication control unit 14 performs a bridge process except for some pieces of packet information such as packet information related to the second NAPT communication control unit 16.

  Here, the order of the packet processing rules of the communication control information 300 shown in FIG. 9 is, for example, an order that considers security, the probability of matching, and ease of control. In the information processing system according to the present embodiment, for example, it is assumed that communication between the first transmission / reception unit 11 and the second transmission / reception unit 17 is performed most frequently. In this case, the packet processing rule corresponding to the communication between the first transmission / reception unit 11 and the second transmission / reception unit 17 is set as the packet processing rule to be scanned first in the communication control information 300 shown in FIG. Is done. In this example, scanning is performed in order from packet processing rules having a high probability of matching. As in this example, when the packet processing rules are scanned in order from the packet processing rule having the highest probability of matching, the packet processing rule that matches at higher speed can be detected.

Configuration of NAPT Communication Control Unit FIG. 10 is a diagram illustrating an example of a functional configuration of a NAPT communication control unit according to an embodiment. FIG. 10 shows the configuration of the first NAPT communication control unit 15 and the second NAPT communication control unit 16. As illustrated in FIG. 10, the first NAPT communication control unit 15 includes a communication unit 151, a control unit 152, and a storage unit 153.

  The communication unit 151 performs transmission of packet information received from the first transmission / reception unit 11 or the second transmission / reception unit 17 and rewrite of packet information including NAPT processing in accordance with the control of the control unit 152. The communication unit 151 is realized by, for example, a program executed by the network interface (I / F) 1008 and the CPU 1001 shown in FIG. The control unit 152 controls the communication unit 151 based on the communication path control information 320 stored in the storage unit 153 and the information stored in the NAPT table 330. The control unit 152 is realized by, for example, a program executed by the CPU 1001 shown in FIG.

  The storage unit 153 stores communication path control information 320 and a NAPT table 330. The storage unit 153 is realized by, for example, a program executed by the ROM 1002, the storage 1004, and the CPU 1001 illustrated in FIG. The storage unit 153 is an example of a storage unit. Communication path control information 320 and NAPT table 330 are routing tables used for communication control by control unit 152. The communication path control information 320 and the NAPT table 330 store control information for performing internal communication or external communication such as a flow table and an ARP (Address Resolution Protocol) table shown in FIG. Here, the contents of the communication path control information 320 and the NAPT table 330 stored in the storage unit 153 will be described.

  FIG. 11A is an example of the NAPT table 330 stored in the storage unit 153 of the first NAPT communication control unit 15. In the NAPT table 330 shown in FIG. 11A, the default gateway is “172.16.1.1 [router 70b (R_B)]”. Although FIG. 11A shows an example in which there is only one gateway, a plurality of routers may be set according to the network configuration.

  FIG. 11B is an example of communication path control information 320 stored in the storage unit 153 of the first NAPT communication control unit 15. Communication path control information 320 shown in FIG. 11B indicates packet processing rules of the first NAPT communication control unit 15. The communication path control information 320 is an example of process determination information. Similar to the bridge communication control unit 14, the first NAPT communication control unit 15 uses the received packet information to scan the packet processing rules of the communication path control information 320 in order from the top to match the received packet information. The packet processing rule to be detected is detected. The first NAPT communication control unit 15 executes an action corresponding to the received packet information indicated by the detected packet processing rule. The first NAPT communication control unit 15 ends the scanning of the communication path control information 320 when the action is executed.

  Specifically, the operation shown as “default” in FIG. 11B is an operation in which the first NAPT communication control unit 15 drops unexpected packet information. In “2” and “3” illustrated in FIG. 11B, the first NAPT communication control unit 15 performs the NAPT process on the packet information received from the network Net_B system, and sends the packet information to the bridge communication control unit 14. The operation | movement which transmits is shown. In this case, the first NAPT communication control unit 15 restricts the source IP address by the access control setting. However, the source IP address need not be restricted.

  In FIG. 11B, “4” indicates that the first NAPT communication control unit 15 receives “192” of the first NAPT communication control unit 15 from the network Net_B server device 90b via the bridge communication control unit 14. .0.2.12: 445 "shows the operation when receiving packet information having a transmission destination. In this case, the first NAPT communication control unit 15 performs a NAPT process on the received packet information so as to perform communication for transmitting file information and the like from the information processing apparatus 10 to the server apparatus 90b, and converts the packet information into the first information. Is transmitted to the transmission / reception unit 11.

  When performing the NAPT process, the first NAPT communication control unit 15 detects the state of a TCP (Transmission Control Protocol) session, and does not accept a packet in the middle of the TCP session for a session that has not yet started. When the TCP session is not started, the first NAPT communication control unit 15 can prevent unintended packet transmission such as an attack by accepting a handshake for establishing the TCP session.

  Next, the functional configuration of the second NAPT communication control unit 16 will be described. The second NAPT communication control unit 16 includes a communication unit 161, a control unit 162, and a storage unit 163. Under the control of the control unit 162, the communication unit 161 transmits packet information received from the first transmission / reception unit 11 or the second transmission / reception unit 17 and rewrites packet information including NAPT processing. The communication unit 161 is realized, for example, by a network interface (I / F) 1008 and a program executed by the CPU 1001 shown in FIG. The control unit 162 controls the communication unit 161 based on the communication path control information 340 stored in the storage unit 163 and the information stored in the NAPT table 350. The control unit 162 is realized by, for example, a program executed by the CPU 1001 shown in FIG.

  The storage unit 163 stores communication path control information 340 and a NAPT table 350. The storage unit 163 is realized by, for example, a program executed by the ROM 1002, the storage 1004, and the CPU 1001 illustrated in FIG. The storage unit 163 is an example of a storage unit. Communication path control information 340 and NAPT table 350 are routing tables used for communication control by control unit 162. The communication path control information 340 and the NAPT table 350 store control information for performing internal communication or external communication such as a flow table and an ARP (Address Resolution Protocol) table shown in FIG. Here, the contents of the communication path control information 340 and the NAPT table 350 stored in the storage unit 163 will be described.

  FIG. 12A is an example of the NAPT table 350 stored in the storage unit 163 of the second NAPT communication control unit 16. In the NAPT table 350 shown in FIG. 12A, the default gateway is “10.0.1.1 [router 70c (R_C)]”. Although FIG. 12A shows an example in which there is only one gateway, a plurality of routers may be set according to the network configuration.

  FIG. 12B is an example of the communication path control information 340 stored in the storage unit 163 of the second NAPT communication control unit 16. Communication path control information 340 shown in FIG. 12B indicates packet processing rules of the second NAPT communication control unit 16. The communication path control information 340 is an example of process determination information. Similar to the bridge communication control unit 14, the second NAPT communication control unit 16 uses the received packet information to scan the packet processing rules of the communication path control information 340 in order from the top to match the received packet information. The packet processing rule to be detected is detected. The second NAPT communication control unit 16 executes an action corresponding to the received packet information indicated by the detected packet processing rule. The second NAPT communication control unit 16 ends the scanning of the communication path control information 340 when the action is executed.

  Specifically, the operation shown as “default” in FIG. 12B is an operation in which the second NAPT communication control unit 16 drops unexpected packet information. In “2” and “3” shown in FIG. 12B, the second NAPT communication control unit 16 performs the NAPT process on the packet information received from the network Net_C system, and sends the packet information to the bridge communication control unit 14. The operation | movement which transmits is shown. In this case, the second NAPT communication control unit 16 restricts the IP address of the transmission source by the access control setting. However, the source IP address need not be restricted.

  In FIG. 12B, “4” indicates that the second NAPT communication control unit 16 receives “192” of the second NAPT communication control unit 16 from the network Net_C system server device 90 c via the bridge communication control unit 14. ... 0.2.13: 445 ”shows the operation when the packet information having the transmission destination is received. In this case, the second NAPT communication control unit 16 performs a NAPT process on the received packet information so as to perform communication for transmitting file information and the like from the information processing apparatus 10 to the server apparatus 90c, and converts the packet information into the first information. Is transmitted to the transmission / reception unit 11.

  When performing the NAPT process, the second NAPT communication control unit 16 detects the state of the TCP session, and does not accept a packet in the middle of the TCP session for a session that has not yet started. When the TCP session is not started, the second NAPT communication control unit 16 can prevent unintended packet transmission such as an attack by accepting a handshake for establishing the TCP session.

  In the communication control device 30, the example in which the NAPT conversion of the packet information is performed by the first NAPT communication control unit 15 and the second NAPT communication control unit 16 has been described, but the NAT (network address translator) conversion of the packet information is performed. You may make it the structure performed. Further, although the communication control device 30 is provided with the first NAPT communication control unit 15 and the second NAPT communication control unit 16, three or more NAPT communication control units may be provided.

○ Flow table of tag processing unit Next, processing contents of the tag processing unit 12 will be described with reference to FIG. 13. FIG. 13 is a diagram for explaining the processing flow of the tag processing unit according to the embodiment. A flow table 230 illustrated in FIG. 13 is a routing table showing packet processing rules in the tag processing unit 12. The flow table 230 is an example of processing determination information. The flow table 230 shown in FIG. 13 assumes trunking processing in IEEE 802.1Q. For example, the flow table 230 illustrated in FIG. 13 is stored in the storage unit 13. FIG. 13 simply describes the processing contents in the tag processing unit 12, and input / output of packet information is performed on preset destination information (for example, each part of the communication control apparatus 30 shown in FIG. 7). IP address).

  The tag processing unit 12 scans the packet processing rules shown in the flow table 230 in order from the top using the received packet information. The tag processing unit 12 detects a packet processing rule that matches the received packet information. Then, the tag processing unit 12 executes an action corresponding to the detected packet processing rule. When the tag processing unit 12 executes an action, the tag processing unit 12 ends the scanning of the flow table 230.

  Specifically, as shown in FIG. 13, the “default” operation of the tag processing unit 12 is an operation of dropping unexpected packet information. In the condition “1” shown in FIG. 13, the tag processing unit 12 receives packet information to which a VLAN tag is not added via the first transmission / reception unit 11, that is, packet information by a communication port corresponding to Native VLAN. Is received, the received packet information is not processed. Then, the tag processing unit 12 transmits the received packet information to the bridge communication control unit 14.

  In the condition “4” illustrated in FIG. 13, when the tag processing unit 12 receives packet information from the bridge communication control unit 14, the tag processing unit 12 performs the first transmission / reception of the received packet information without processing the received packet information. To the unit 11. Here, in the case of the conditions “1” and “4” shown in FIG. 13, the tag processing unit 12 outputs the received packet information without processing, but the native VLAN of the information processing apparatus 10 and the VLAN corresponding switch 50 is output. IDs must be prepared in advance. For example, the native VLAN ID is set to “1”.

  In the condition “2” illustrated in FIG. 13, when the tag processing unit 12 receives packet information with the VLAN tag “10” via the first transmission / reception unit 11, the tag processing unit 12 extracts the VLAN tag with “10” from the packet information. Remove. The tag processing unit 12 then outputs the packet information from which the VLAN tag has been removed to the first NAPT communication control unit 15.

  In the condition “3” shown in FIG. 13, when the tag processing unit 12 receives packet information with the VLAN tag “30” via the first transmission / reception unit 11, the tag processing unit 12 extracts the VLAN tag with “30” from the packet information. Remove. Then, the tag processing unit 12 outputs the packet information from which the VLAN tag has been removed to the second NAPT communication control unit 16.

  When the packet processing unit 12 receives packet information from the first NAPT communication control unit 15 under the condition “5” illustrated in FIG. 13, the tag processing unit 12 adds a VLAN tag “10” to the received packet information. Then, the tag processing unit 12 outputs packet information to which the VLAN tag “10” is added to the first transmission / reception unit 11.

  In the condition “6” shown in FIG. 13, when the tag processing unit 12 receives packet information from the second NAPT communication control unit 16, the tag processing unit 12 adds a VLAN tag “30” to the received packet information. Then, the tag processing unit 12 outputs packet information to which the VLAN tag “30” is added to the first transmission / reception unit 11.

Communication Control Processing in Communication Control Device Next, communication control processing in the communication control device 30 will be described. FIG. 14 is a flowchart for explaining a processing flow when packet information is transmitted from the network device to the information processing apparatus in the communication control apparatus according to the first embodiment.

  In step S101, when the first transmission / reception unit 11 of the communication control device 30 receives packet information from the network device, the process proceeds to step S102 (an example of an acquisition step). On the other hand, the first transmission / reception unit 11 of the communication control device 30 repeats the process of step S101 when packet information is not received from the network device.

  In step S102, the tag processing unit 12 of the communication control device 30 identifies whether or not a VLAN tag is added to the packet information received by the first transmission / reception unit 11. If the VLAN tag is added to the received packet information, the communication control device 30 moves the process to step S103.

  In step S103, the tag processing unit 12 of the communication control device 30 removes the VLAN tag from the packet information to which the VLAN tag is added. Specifically, the packet information transmitted from the network Net_B system and the network Net_C system includes VLAN tags corresponding to the received communication ports. The tag processing unit 12 of the communication control apparatus 30 removes the VLAN tag included in the received packet information in order to transmit the packet information to the information processing apparatus 10 that does not support the tag VLAN.

  When the VLAN tag included in the packet information is “10”, that is, when the destination information of the transmission source included in the packet information is a network device connected to the network Net_B system, the tag processing unit 12 The packet information from which is removed is transmitted to the first NAPT communication control unit 15. On the other hand, if the VLAN tag included in the packet information is “30”, that is, if the destination information of the transmission source included in the packet information is a network device connected to the network Net_C system, the tag processing unit 12 The packet information from which the tag is removed is transmitted to the second NAPT communication control unit 16.

  In step S104, the first NAPT communication control unit 15 or the second NAPT communication control unit 16 of the communication control device 30 performs a NAPT process on the received packet information. Specifically, the control unit 152 of the first NAPT communication control unit 15 uses the communication path control information 320 stored in the storage unit 153 to perform a NAPT process on the packet information received by the communication unit 151. . In this case, since the packet information received by the communication unit 151 corresponds to the condition “2” or “3” of the communication path control information 320 illustrated in FIG. Execute. As indicated by “2” or “3” of the communication path control information 320, the communication unit 151 outputs the packet information subjected to the NAPT process by the control unit 152 to the bridge communication control unit 14.

  On the other hand, the control unit 162 of the second NAPT communication control unit 16 uses the communication path control information 340 stored in the storage unit 163 to perform a NAPT process on the packet information received by the communication unit 161. In this case, since the packet information received by the communication unit 161 corresponds to the condition “2” or “3” of the communication path control information 340 illustrated in FIG. Execute. As indicated by “2” or “3” of the communication path control information 340, the communication unit 161 outputs the packet information subjected to the NAPT process by the control unit 162 to the bridge communication control unit 14.

  In step S105, the bridge communication control unit 14 of the communication control device 30 uses the communication control information 300 shown in FIG. 9 to receive the packet received from the first NAPT communication control unit 15 or the second NAPT communication control unit 16. Perform information processing. Specifically, when the packet information transmitted from the first NAPT communication control unit 15 is received by the communication unit 141, the control unit 142 of the bridge communication control unit 14 includes the communication control information 300 illustrated in FIG. Since the condition “4” is met, the operation for the condition “4” is executed. As indicated by “4” in the communication control information 300, the control unit 142 executes a NAPT process on the packet information received by the communication unit 141. Then, the communication unit 141 outputs the packet information subjected to the NAPT process by the control unit 142 to the second transmission / reception unit 17.

  When the packet information transmitted from the second NAPT communication control unit 16 is received by the communication unit 141, the control unit 142 of the bridge communication control unit 14 sets “5” of the communication control information 300 illustrated in FIG. Therefore, the operation for the condition “5” is executed. As indicated by “5” in the communication control information 300, the control unit 142 performs a NAPT process on the packet information received by the communication unit 151. Then, the communication unit 141 outputs the packet information subjected to the NAPT process by the control unit 142 to the second transmission / reception unit 17.

  On the other hand, when the VLAN tag is not added to the packet information received by the first transmission / reception unit 11 in step S102, the communication control device 30 shifts the processing to step S106.

  In step S <b> 106, the bridge communication control unit 14 of the communication control device 30 executes processing of the packet information received from the tag processing unit 12 using the communication control information 300 illustrated in FIG. 9. Specifically, when the packet information transmitted from the tag processing unit 12 is received by the communication unit 141, the control unit 142 of the bridge communication control unit 14 sets “2” of the communication control information 300 illustrated in FIG. Since the condition is met, the operation for the condition “2” is executed. As indicated by “2” in the communication control information 300, the communication unit 141 transmits the received packet information to the second transmission / reception unit 17. That is, in the process of step S106, the bridge communication control unit 14 transmits the packet information received directly from the tag processing unit 12 to the second transmission / reception unit 17 without performing the NAPT process of the received packet information.

  In step S107, the second transmission / reception unit 17 of the communication control device 30 transmits the packet information transmitted from the bridge communication control unit 14 to the information processing device 10 (an example of a communication control step). Thereby, in the information processing system according to the present embodiment, the communication control device 30 transmits packet information to the information processing device 10 when receiving either packet information including a VLAN tag or packet information not including a VLAN tag. Transmission control can be performed.

  FIG. 15 is a flowchart for explaining a processing flow when transmitting file information from the information processing apparatus to the network device in the communication control apparatus according to the embodiment. The process shown in FIG. 15 uses process determination information such as the communication control information 300, the communication path control information 320, the communication path control information 340, and the flow table 230 of the tag processing unit 12 in the same manner as the process shown in FIG. Executed. The information transmitted from the information processing apparatus 10 to the network device is not limited to file information.

  In step S201, when the second transmission / reception unit 17 receives file information from the information processing apparatus 10, the communication control apparatus 30 shifts the process to step S202 (an example of an acquisition step). On the other hand, the communication control apparatus 30 repeats the process of step S201, when the 2nd transmission / reception part 17 has not received file information.

  In step S <b> 202, the communication control device 30 executes processing of file information received by the second transmission / reception unit 17. Specifically, the communication unit 141 of the bridge communication control unit 14 receives the file information transmitted from the second transmission / reception unit 17. Then, the control unit 142 of the bridge communication control unit 14 performs processing of the file information received by the communication unit 141 based on the communication control information 300 stored in the storage unit 143.

  In step S203, when the transmission destination of the file information is the network Net_A system, the control unit 142 shifts the process to step S208. Specifically, if the destination information included in the file information received by the communication unit 141 is a network device connected to the network Net_A system, the control unit 142 shifts the process to step S208.

  In step S208, the communication control device 30 uses the first transmission / reception unit 11 to transmit file information to the network device (an example of a communication control step). Specifically, the communication unit 141 of the bridge communication control unit 14 transmits file information to the tag processing unit 12. The tag processing unit 12 does not add or delete the tag information to the file information because the destination information of the transmission destination included in the received file information is the network Net_A system. The tag processing unit 12 transmits the received file information to the first transmission / reception unit 11. Then, the first transmission / reception unit 11 transmits file information to a network device connected to the network Net_A system.

  On the other hand, if the transmission destination of the file information is not the network Net_A system in step S203, the communication control device 30 shifts the process to step S204. In step S204, when the transmission destination of the file information is the network Net_B system, the communication control device 30 shifts the process to step S205.

  In step S <b> 205, the communication control apparatus 30 executes a NAPT process for file information in the first NAPT communication control unit 15. Specifically, the communication unit 141 of the bridge communication control unit 14 transmits file information to the first NAPT communication control unit 15. Then, the control unit 152 of the first NAPT communication control unit 15 uses the communication path control information 320 stored in the storage unit 153 to perform a NAPT process on the file information received by the communication unit 151.

  In this case, since the file information received by the communication unit 151 corresponds to the condition “4” of the communication path control information 320 illustrated in FIG. 11, the control unit 152 performs an operation for the condition “4”. . As indicated by “4” in the communication path control information 320, the control unit 152 executes a NAPT process on the file information received by the communication unit 151. Then, the communication unit 151 transmits the packet information subjected to the NAPT process by the control unit 152 to the first transmission / reception unit 11.

  On the other hand, in step S204, when the transmission destination of the file information is not the network Net_B system, the communication control device 30 shifts the process to step S206. In step S <b> 206, the communication control apparatus 30 executes a NAPT process for file information in the second NAPT communication control unit 16.

  Specifically, the communication unit 141 of the bridge communication control unit 14 transmits file information to the second NAPT communication control unit 16. Then, the control unit 162 of the second NAPT communication control unit 16 uses the communication path control information 340 stored in the storage unit 163 to perform a NAPT process on the file information received by the communication unit 161.

  In this case, since the file information received by the communication unit 161 corresponds to the condition “4” of the communication path control information 340 illustrated in FIG. 12, the control unit 162 performs an operation for the condition “4”. . As indicated by “4” in the communication path control information 340, the control unit 162 performs a NAPT process on the file information received by the communication unit 161. Then, the communication unit 161 transmits the packet information subjected to the NAPT process by the control unit 162 to the first transmission / reception unit 11.

  In step S207, the tag processing unit 12 of the communication control device 30 adds a VLAN tag to the file information transmitted from the first NAPT communication control unit 15 or the second NAPT communication control unit 16. Specifically, when the file information is transmitted from the first NAPT communication control unit 15, the tag processing unit 12 satisfies the condition “5” of the flow table 230 illustrated in FIG. A VLAN tag “10” is added to the information. Then, the tag processing unit 12 transmits file information to which the VLAN tag “10” is added to the first transmission / reception unit 11 as indicated by “5” in the flow table 230 illustrated in FIG. 13.

  When the file information is transmitted from the second NAPT communication control unit 16, the tag processing unit 12 satisfies the condition “6” of the flow table 230 illustrated in FIG. 13, and therefore the VLAN tag “ 30 "is added. Then, the tag processing unit 12 transmits the file information with the VLAN tag “30” added to the first transmission / reception unit 11 as indicated by “6” in the flow table 230 shown in FIG.

  In step S208, the first transmission / reception unit 11 of the communication control device 30 transmits the file information transmitted from the tag processing unit 12 to each of the destination network devices indicated by the destination information included in the file information. Specifically, the first transmission / reception unit 11 transmits the file information added with the VLAN tag “10” transmitted from the tag processing unit 12 to a network device connected to the network Net_B system. The first transmission / reception unit 11 transmits the file information to which the VLAN tag “30” is added, transmitted from the tag processing unit 12, to the network device connected to the network Net_C system.

  Accordingly, in the information processing system according to the present embodiment, the communication control device 30 includes a network (network Net_A system) that transmits and receives packet information including a VLAN tag and a network (network that transmits and receives packet information that does not include a VLAN tag). Control can be performed to transmit packet information transmitted from the information processing apparatus 10 to any network (Net_B system or network Net_C system).

Flow of packet information transmitted from network device of network Net_A system to information processing apparatus Next, flow of packet information transmitted from client terminal 80a provided in network Net_A system shown in FIG. 1 to information processing apparatus 10 Will be described with reference to the sequence diagram of FIG. In FIG. 16, the description “PC_A1: 3000” in the packet information indicates the IP address and port number of the client terminal 80a (PC_A1) that is the transmission source (SRC). That is, “PC_A1” indicates the IP address of the client terminal 80a (PC_A1), and “3000” indicates the port number.

  Similarly, “MFP: 9100” in the packet information indicates the IP address and port number of the information processing apparatus 10 (MFP) serving as the transmission destination (DST). That is, the description “MFP” indicates the IP address of the information processing apparatus 10 that is the transmission destination (DST), and the description “9100” indicates the port number.

  When transmitting packet information from the client terminal 80 a provided in the network Net_A system to the information processing apparatus 10, the communication control apparatus 30 transmits packet information via the tag processing unit 12 and the bridge communication control unit 14. In this case, the tag processing unit 12 of the communication control device 30 does not perform the tag processing of the packet information because the condition “1” in the flow table 230 illustrated in FIG. 13 is satisfied. Further, since the bridge communication control unit 14 of the communication control device 30 satisfies the condition “3” of the communication control information 300 illustrated in FIG. 9, the bridge communication control unit 14 does not perform packet processing such as NAPT processing of packet information.

  For this reason, as shown in FIG. 16, the packet information is not subjected to tag processing and NAPT processing, but is subjected to client terminal 80a (PC_A1) → router 70a (R_A) → VLAN compatible switch 50 → first transmission / reception unit 11 → Tag processing unit 12 → bridge communication control unit 14 → second transmission / reception unit 17 → information processing apparatus 10 (MFP).

  Similarly, when the packet information is transmitted from the information processing apparatus 10 to the client terminal 80a (PC_A1) provided in the network Net_A system, the communication control apparatus 30 passes through the tag processing unit 12 and the bridge communication control unit 14. Send packet information. For this reason, as shown in FIG. 16, the packet information in which the transmission source (SRC) is “MFP: 9100” and the transmission destination (DST) is “PC_A1: 3000” is information processing apparatus 10 (MFP) → second Transmission / reception unit 17 → bridge communication control unit 14 → tag processing unit 12 → first transmission / reception unit 11 → VLAN switch 50 → network Net_A router 70a (R_A) → client terminal 80a (PC_A1).

  Note that the transmission source port of the device serving as the client is changed according to an upper layer such as a session layer or an application layer when focusing on the packet.

Flow of packet information transmitted from network device of network Net_B system to information processing apparatus Next, flow of packet information transmitted from client terminal 80b provided in network Net_B system shown in FIG. 1 to information processing apparatus 10 Will be described with reference to the sequence diagram of FIG. In FIG. 17, “PC_B1: 3000” in the packet information indicates the IP address and port number of the client terminal 80b (PC_B1) serving as the transmission source (SRC). That is, “PC_B1” indicates an IP address of the client terminal 80b (PC_B1), and “3000” indicates a port number.

  Similarly, “MFP: 9100” in the packet information indicates the IP address and port number of the information processing apparatus 10 (MFP) serving as the transmission destination (DST). That is, the description “MFP” indicates the IP address of the information processing apparatus 10 that is the transmission destination (DST), and the description “9100” indicates the port number.

  When transmitting packet information from the client terminal 80b (PC_B1) provided in the network Net_B system to the information processing apparatus 10, the communication control apparatus 30 includes the tag processing unit 12, the first NAPT communication control unit 15, and bridge communication. Packet information is transmitted via the control unit 14. Therefore, as shown in FIG. 17, the packet information includes the client terminal 80b (PC_B1) → the router 70b (R_B) → the VLAN switch 50 → the first transmission / reception unit 11 → the tag processing unit 12 → the first NAPT communication control. The data is transmitted in the order of unit 15 → bridge communication control unit 14 → second transmission / reception unit 17 → information processing apparatus 10 (MFP).

  The VLAN compatible switch 50 adds a VLAN tag “10” to the packet information transmitted to the communication control device 30. When the tag processing unit 12 receives the packet information with the VLAN tag, the tag processing unit 12 removes the VLAN tag (in this case, the VLAN tag of “10”) from the packet information and transmits the packet information to the first NAPT communication control unit 15. To do.

  When transmitting packet information to the bridge communication control unit 14, the first NAPT communication control unit 15 performs processing (operation) corresponding to the condition “3” of the communication path control information 320 illustrated in FIG. Execute. The first NAPT communication control unit 15 performs a NAPT process in which the transmission source is “INT_B: 4000” for the packet information in which the transmission source is “PC_B1: 3000” and the transmission destination is “MFP: 9100”. Execute. The first NAPT communication control unit 15 transmits the packet information subjected to the NAPT process to the bridge communication control unit 14.

  Here, the meaning of converting the IP address of the transmission source into “INT_B” is that when the packet information is returned to the transmission source (in this case, the server device 90b (PC_B1)), the IP address of the second NAPT communication control unit 16 This is so that it can be distinguished from the address INT_C (packet information from the IP address INT_B returns to the IP address INT_B, and packet information from the IP address INT_C returns to the IP address INT_C).

  When transmitting packet information to the second transmission / reception unit 17, the bridge communication control unit 14 executes processing (operation) corresponding to the condition “4” of the communication control information 300 illustrated in FIG. 9. Specifically, the bridge communication control unit 14 performs NAPT processing with the transmission source “BRI_A: 5000” on the packet information whose transmission source is “INT_B: 4000”. The bridge communication control unit 14 transmits the packet information subjected to the NAPT process to the second transmission / reception unit 17. Accordingly, packet information from the client terminal 80b (PC_B1) provided in the network Net_B system is transmitted to the information processing apparatus 10.

  The information processing system according to the present embodiment performs a NAPT process on “INT_B: 4000”, which is an IP address used in the communication control apparatus 30, to “BRI_A: 5000”, which is an IP address used outside the communication control apparatus 30. Therefore, the information processing system according to the present embodiment can prevent inconvenience that an IP address used in the communication control device 30 such as “INT_B” is used outside.

  Further, the bridge communication control unit 14 converts the source MAC address into the MAC address of the router 70a (R_A) provided on the network Net_A system. Thereby, the information processing apparatus 10 recognizes that the packet information is transmitted from the router 70a (R_A) which is the default gateway. Therefore, the network Net_B system client terminal 80b (PC_B1) can be handled as if it were provided at the end of the router 70a (R_A).

  On the other hand, when transmitting packet information from the information processing apparatus 10 to the client terminal 80b (PC_B1) provided in the network Net_B system, the communication control apparatus 30 includes the bridge communication control unit 14, the first NAPT communication control unit 15, and Packet information is transmitted via the tag processing unit 12. For this reason, as shown in FIG. 10, the packet information is stored in the information processing apparatus 10 (MFP) → second transmission / reception unit 17 → bridge communication control unit 14 → first NAPT communication control unit 15 → tag processing unit 12 → first. 1 transmission / reception unit 11 → VLAN compatible switch 50 → router 70b (R_B) → client terminal 80b (PC_B1).

  When transmitting packet information to the first NAPT communication control unit 15, the bridge communication control unit 14 executes processing (operation) corresponding to the condition “6” of the communication control information 300 illustrated in FIG. 9. Specifically, for the packet information in which the transmission source is “MFP: 9100” and the transmission destination is “BRI_A: 5000”, the bridge communication control unit 14 sets the transmission source to “INT: 9100” and the transmission destination. NAPT processing with “INT_B4000” is executed. Then, the bridge communication control unit 14 transmits the packet information subjected to the NAPT process to the first NAPT communication control unit 15.

  When transmitting packet information to the tag processing unit 12, the first NAPT communication control unit 15 executes processing (operation) corresponding to the condition “4” of the communication path control information 320 illustrated in FIG. 11. Specifically, the first NAPT communication control unit 15 sets the transmission source to “MFP: 9100” for the packet information in which the transmission source is “INT: 9100” and the transmission destination is “INT_B: 4000”. , NAPT processing is executed with the transmission destination being “PC_B1: 3000”. Then, the first NAPT communication control unit 15 transmits the packet information subjected to the NAPT process to the tag processing unit 12.

  The tag processing unit 12 executes processing corresponding to the condition “3” in the flow table 230 illustrated in FIG. 13 in order to transmit the packet information to the VLAN compatible switch 50 via the first transmission / reception unit 11. Specifically, the tag processing unit 12 adds a VLAN tag of “10” to the packet information whose transmission source is “MFP: 9100” and whose transmission destination is “PC_B1: 3000”. Then, the tag processing unit 12 transmits packet information to which the VLAN tag “10” is added to the first transmission / reception unit 11.

  The VLAN switch 50 removes the VLAN tag “10” from the packet information received via the first transmission / reception unit 11, so that the transmission source is “MFP: 9100” and the transmission destination is “PC_B1: 3000”. Is transmitted to the client terminal 80b (PC_B1) via the router 70b (R_B). Thus, the packet information can be transmitted from the information processing apparatus 10 to the client terminal 80b (PC_B1) provided in the network Net_B system.

Advantages of Embodiment As described above, in the information processing system according to the present embodiment, the communication control device 30 includes packet information (an example of first data) that does not include a VLAN tag (an example of virtual LAN tag information). Network Net_A system (an example of the first network) that performs communication of the network, and network Net_B system or network Net_C system (an example of the second network) that performs communication of packet information (an example of the second data) including the VLAN tag Communication control of packet information (an example of transmission / reception information) between the network device connected to each of the information processing apparatuses 10 is performed.

  When the communication control device 30 receives packet information that does not include a VLAN tag from the information processing device 10 or the network device, that is, at least one of transmission destination and transmission source destination information included in the received packet information is transmitted to the network Net_A. In the case of a network device connected to the system, the information processing apparatus 10 that is the transmission destination of the packet information without executing the tag processing of the packet information, the NAPT processing, and the port conversion processing (an example of the destination information conversion processing) or Send packet information to network devices.

  On the other hand, when the communication control device 30 receives the packet information including the VLAN tag from the information processing device 10 or the network device, that is, at least one of the transmission destination and the transmission destination destination information included in the received packet information, When the network device is connected to the network Net_B system or the network Net_C system, the packet information tag processing and NAPT processing are executed. Then, the communication control device 30 transmits the packet information subjected to the tag processing, the NAPT processing, and the port conversion processing to the information processing device 10 or the network device that is the transmission destination of the packet information.

  As a result, the information processing system according to the present embodiment applies to the information processing apparatus 10 that does not support a virtual LAN in a system in which a virtual LAN such as a VLAN is used for communication between a plurality of networks having different segments. Communication of transmission / reception information can be performed. Therefore, the information processing system according to the present embodiment can form a larger network that supports the virtual LAN regardless of whether the information processing apparatus 10 supports the virtual LAN.

● Other embodiments ●
Next, information processing systems according to other embodiments will be described. Note that the same configurations and functions as those of the above-described embodiment are denoted by the same reference numerals, and the description thereof is omitted. In an information processing system according to another embodiment, as illustrated in FIGS. 18 and 19, the information processing apparatus 10 and the communication control apparatus 30 are integrated. For example, the information processing apparatus 10A may include the communication control apparatus 30 as an expansion board.

  FIG. 19 is a diagram illustrating an example of a functional configuration of an information processing apparatus according to another embodiment. The communication control device 30 built in the information processing device 10A opens the first transmission / reception unit 11 to the outside, and is connected to each network via the VLAN compatible switch 50. The second transmission / reception unit 17 is connected to a third transmission / reception unit 18 that the information processing apparatus 10 originally has. Therefore, the information processing apparatus 10A can perform the same processing as in the above-described embodiment even if the communication control apparatus 30 is incorporated therein.

  Note that information processing systems according to other embodiments may have a configuration in which a part of the communication control device 30 is provided inside the information processing device 10A. In addition, the information processing system according to other embodiments may be configured such that the VLAN compatible switch 50 is provided inside the information processing apparatus 10A together with the communication control apparatus 30 or independently.

● Supplement ●
The functions of the embodiments can be realized by a computer-executable program written in a legacy programming language such as an assembler, C, C ++, C #, Java (registered trademark), an object-oriented programming language, or the like. The program for executing the function can be distributed through a telecommunication line.

  In addition, programs for executing the functions of the embodiments are ROM, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM (Erasable Programmable Read-Only Memory), flash memory, flexible disk, CD (Compact Disc) − Store and distribute in device-readable recording media such as ROM, CD-RW (Re-Writable), DVD-ROM, DVD-RAM, DVD-RW, Blu-ray Disc, SD card, MO (Magneto-Optical disc), etc. You can also.

  Furthermore, part or all of the functions of each embodiment can be mounted on a programmable device (PD) such as an FPGA (Field Programmable Gate Array), or can be mounted as an ASIC. Circuit configuration data (bitstream data) downloaded to the PD in order to realize the above functions on the PD, HDL (Hardware Description Language) for generating the circuit configuration data, VHDL (Very High Speed Integrated Circuits Hardware Description Language), It can be distributed on a recording medium as data described in Verilog-HDL or the like.

  The communication control device, the information processing system, the control method, and the program according to one embodiment of the present invention have been described so far, but the present invention is not limited to the above-described embodiment, and other embodiments are added. Any change can be made within the range that can be conceived by those skilled in the art, such as changes or deletions, and any embodiment is included in the scope of the present invention as long as the effects and advantages of the present invention are exhibited.

DESCRIPTION OF SYMBOLS 10 Information processing apparatus 30 Communication control apparatus 50 VLAN corresponding switch 70 Router 80 Client terminal (an example of network equipment)
90 Server device (an example of network equipment)
11 1st transmission / reception part (an example of an acquisition means)
12 Tag processing unit (an example of tag processing means)
13 Storage unit (an example of storage means)
14 Bridge communication control unit (an example of communication control means)
15 First NAPT communication control unit (an example of communication control means)
16 Second NAPT communication control unit (an example of communication control means)
17 2nd transmission / reception part (an example of an acquisition means)
143 storage unit (an example of storage means)
153 Storage unit (an example of storage means)
163 Storage unit (an example of storage means)

International Publication No. 2003/098880

Claims (14)

A communication control device that controls communication of transmission / reception information between at least one information processing device and a plurality of network devices connected to each of a plurality of networks having different segments,
The plurality of networks includes a first network that performs communication of first data that does not include tag information of a virtual LAN, and a second network that performs communication of second data that includes the tag information,
Obtaining means for obtaining the transmission / reception information from the information processing apparatus or the network device;
When at least one of the transmission destination and the transmission destination information included in the acquired transmission / reception information is a network device connected to the first network, the acquired transmission / reception information is transmitted to the transmission destination. Communication control means for transmitting to the information processing apparatus or the network device,
A communication control device comprising: The communication control device according to claim 1, further comprising:
When the destination information of the transmission source included in the acquired transmission / reception information is a network device connected to the second network, the tag information included in the acquired transmission / reception information is removed and the acquired A communication control device comprising tag processing means for adding the tag information to the acquired transmission / reception information when the destination information included in the transmission / reception information is a network device connected to the second network. .   The tag processing means, when at least one of transmission destination and transmission destination information included in the acquired transmission / reception information is a network device connected to the first network, the acquired transmission / reception The communication control device according to claim 2, wherein the tag information is not removed or added to the information. The communication control device according to any one of claims 1 to 3, further comprising:
Storage means for storing processing determination information for determining processing of the transmission / reception information;
The communication control unit is configured to control communication of the transmission / reception information between the information processing apparatus and the network device by executing a process corresponding to the stored process determination information.   The communication control according to claim 4, wherein the communication control unit detects the corresponding processing determination information using at least one of transmission source and transmission destination destination information included in the acquired transmission / reception information. apparatus. The processing determination information includes a processing rule for each network,
The communication control unit controls communication of the transmission / reception information between the information processing apparatus and the network device using a processing rule corresponding to a network that is a transmission source or a transmission destination of the transmission / reception information. The communication control device according to claim 4 or 5.   The communication control unit performs destination information conversion processing for converting the destination information included in the transmission / reception information into destination information used inside the communication control device when the transmission / reception information is communicated inside the communication control device. And executing destination information conversion processing for converting the destination information included in the transmission / reception information into destination information used for communication with the external device when the transmission / reception information is transmitted to the external device. The communication control apparatus according to any one of claims 6 to 6.   The communication control apparatus according to claim 7, wherein the communication control unit determines whether or not to execute the destination information conversion processing according to a state of a network session.   The communication control device according to claim 7 or 8, wherein the communication control unit determines whether or not to execute the destination information conversion process according to destination information of a transmission source included in the transmission / reception information.   When at least one of transmission destination and transmission destination information included in the acquired transmission / reception information is a network device connected to the first network, the communication control unit performs the destination information conversion process. The communication control device according to claim 7, wherein no communication is performed. The virtual LAN is an IEEE 802.1Q protocol,
The communication control apparatus according to any one of claims 1 to 10, wherein the first network corresponds to Native VLAN. Information comprising: at least one information processing device; and a communication control device that controls communication of transmission / reception information between a plurality of network devices connected to each of a plurality of networks having different segments from the information processing device. A processing system,
The plurality of networks includes a first network that performs communication of first data that does not include tag information of a virtual LAN, and a second network that performs communication of second data that includes the tag information,
Obtaining means for obtaining the transmission / reception information from the information processing apparatus or the network device;
When at least one of the transmission destination and the transmission destination information included in the acquired transmission / reception information is a network device connected to the first network, the acquired transmission / reception information is transmitted to the transmission destination. Communication control means for transmitting to the information processing apparatus or the network device,
An information processing system comprising: A control method executed by a communication control device that controls communication of transmission / reception information between at least one information processing device and a plurality of network devices connected to each of a plurality of networks having different segments,
The plurality of networks includes a first network that performs communication of first data that does not include tag information of a virtual LAN, and a second network that performs communication of second data that includes the tag information,
The communication control device includes:
An acquisition step of acquiring the transmission / reception information from the information processing apparatus or the network device;
When at least one of transmission destination and transmission destination information included in the acquired transmission / reception information is a network device connected to the first network, the acquired transmission / reception information is transmitted to the information processing apparatus or A communication control step for transmitting to the network device;
Control method to execute.   A program that causes a computer to execute the control method according to claim 13.