JP2019201247A - Communication system, communication device, and management device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a service at low cost by sharing one security device for a plurality of user networks without impairing the flexibility of address management of each user network. A management device 10 stores a global IP address assigned by a NAT device 20 for each company NW 50 to which each user terminal 40 belongs. Further, the management device 10 instructs the NAT device 20 to allocate a global IP address corresponding to the company NW 50 to which the user terminal 40 belongs in response to a request from the user terminal 40. Then, in response to the request from the user terminal 40, the management device 10 sets the security policy for the global IP address of the company NW 50 to which the user terminal 40 belongs to the security device 30. [Selection diagram] Figure 1

Description

  The present invention relates to a communication system, a communication device, and a management device.

  Conventionally, security devices having a security function such as a firewall (hereinafter referred to as FW) and UTM (Unified Threat Management) are known. The FW and UTM are installed at the boundary between a user network (hereinafter referred to as a company NW as appropriate) such as a company's internal LAN (Local Area Network) and an external network such as the Internet, for example, and used as a security gateway. Note that the user network includes a LAN connected via a VPN (Virtual Private Network).

  The main role of the FW is to block packet filtering based on an IP address and a port number and illegal TCP (Transmission Control Protocol) communication. In addition, UTM has a plurality of security functions in order to implement security measures against viruses and spam mail that are difficult to deal with by FW. In such a system including FW and UTM, one security device is provided for one user network.

JP 2001-306421 A

  However, the conventional method described above cannot provide a service at a low cost by sharing one security device for a plurality of user networks without impairing the flexibility of address management of each user network. It was. That is, in the above-described conventional technology, since one security device is provided for one user network, there is a problem that costs are increased as compared with the case where one security device is shared by a plurality of user networks.

  In order to share a single security device among a plurality of user networks, it may be possible to accommodate a plurality of user networks by specifying an address block for each user network. Since the network cannot be duplicated, there is a problem that the network operation is restricted and the address management flexibility of each user network is impaired.

  In order to solve the above-described problems and achieve the object, a communication system according to the present invention includes a security device provided at a boundary between a user network and an external network, and a NAT device that accommodates the user network. When the NAT device receives an assignment unit for assigning a global IP address for each user network to be accommodated and communication data to the external network from a user terminal belonging to the user network, the NAT device And converting the communication data based on a security policy corresponding to the global IP address converted by the NAT device. line It characterized by having a filtering portion.

  The communication apparatus according to the present invention, when receiving communication data from the user terminal belonging to the user network to the external network, the assigning unit that assigns a global IP address for each user network to be accommodated. A conversion unit that converts the private IP address of the communication IP address into a corresponding global IP address, and a filtering unit that filters the communication data based on a security policy corresponding to the global IP address converted by the conversion unit. Features.

  In addition, the management device of the present invention includes, for each user network to which each user terminal belongs, a storage unit that stores a global IP address assigned by a NAT device that accommodates the user network, and the user according to a request from the user terminal. An instruction unit that instructs the NAT device to assign a global IP address corresponding to the user network to which the terminal belongs, and a security policy for the global IP address of the user network to which the user terminal belongs in response to a request from the user terminal. And a setting unit configured to set a security device provided at a boundary between the user network and the external network.

  According to the present invention, it is possible to provide a service at a low cost by sharing one security device for a plurality of user networks without impairing the flexibility of address management of each user network. .

FIG. 1 is a block diagram illustrating a configuration example of a communication system according to the first embodiment. FIG. 2 is a block diagram illustrating a configuration example of the management apparatus according to the first embodiment. FIG. 3 is a diagram illustrating an example of data stored in the user information storage unit. FIG. 4 is a diagram illustrating an example of data stored in the control information storage unit. FIG. 5 is a diagram illustrating an example of data stored in the policy information storage unit. FIG. 6 is a diagram for explaining processing for instructing a global IP address to be assigned by the NAT device in the management device according to the first embodiment. FIG. 7 is a diagram for explaining processing for setting a security policy in a security device in the management apparatus according to the first embodiment. FIG. 8 is a sequence diagram illustrating an example of a flow of a global IP address issue process in the communication system according to the first embodiment. FIG. 9 is a sequence diagram illustrating an example of a flow of security policy setting processing in the communication system according to the first embodiment. FIG. 10 is a diagram for explaining the configuration of a conventional communication system. FIG. 11 is a diagram for explaining a problem of a conventional communication system. FIG. 12 is a diagram for explaining the effect of the communication system according to the first embodiment. FIG. 13 is a block diagram illustrating a configuration example of a communication system according to another embodiment. FIG. 14 is a diagram illustrating a computer that executes a program.

  Hereinafter, an embodiment of a communication system according to the present application will be described in detail with reference to the drawings. The communication system according to the present application is not limited by this embodiment.

[First Embodiment]
In the following embodiments, the configuration of the communication system 100 according to the first embodiment, the configuration of the management apparatus 10, and the processing flow of the communication system 100 will be described in order, and finally the effects of the first embodiment will be described. .

[Configuration of communication system]
FIG. 1 is a block diagram illustrating a configuration example of a communication system according to the first embodiment. The communication system 100 according to the first embodiment includes a management device 10, a NAT device 20, a security device 30, and a plurality of user terminals 40. The NAT device 20 accommodates a plurality of companies NW50A to 50X. The security device 30 is installed at the connection point of the Internet 60. The configuration illustrated in FIG. 1 is merely an example, and the specific configuration and the number of devices are not particularly limited. In addition, when a plurality of companies NW50A to 50X are described without particular distinction, they are described as company NW50.

  The management device 10 manages a global IP address assigned by the NAT device for each company NW 50 to which each user terminal 40 belongs. In response to a request from the user terminal 40, the management apparatus 10 instructs the NAT apparatus 20 to assign a global IP address corresponding to the company NW 50 to which the user terminal 40 belongs. Further, in response to a request from the user terminal 40, the management apparatus 10 sets a security policy for the global IP address of the company NW 50 to which the user terminal 40 belongs to the security device 30. The specific configuration of the management apparatus 10 will be described later with reference to FIG.

  The NAT device 20 accommodates a plurality of companies NWs 50A to 50X, and executes an address conversion process between a private IP address and a global IP address. For example, the NAT device 20 converts the private IP address of the packet received from the user terminal 40 into a global IP address, and transmits the packet after the address conversion to the security device 30. Further, the NAT device 20 converts the global IP address of the packet received from the security device 30 into a private IP address, and transmits the packet after the address conversion to the user terminal 40.

  The NAT device 20 includes an allocation unit 21 and a conversion unit 22. The allocation unit 21 allocates a global IP address for each company NW 50 to be accommodated. Specifically, the assigning unit 21 assigns a global IP address to each company NW 50 to be accommodated based on the global IP address instructed by the management apparatus 10.

  When receiving communication data from the user terminal 40 belonging to the company NW 50 to the Internet 60, the conversion unit 22 converts the private IP address of the communication data into a corresponding global IP address.

  The security device 30 is a device having a security function such as FW or UTM installed at the boundary between the companies NW 50A to 50X and the Internet 60. The security device 30 has a filtering unit 31. The filtering unit 31 filters communication data based on a security policy corresponding to the global IP address converted by the NAT device.

  The user terminal 40 is an information processing apparatus such as a desktop PC, a tablet PC, a notebook PC, a smartphone, a mobile phone, and a PDA (Personal Digital Assistant). The user terminal 40 transmits a packet to the Internet 60 via the NAT device 20, the security device 30, and the company NW 50. Further, the user terminal 40 receives a packet from the Internet 60 via the NAT device 20, the security device 30, and the corporate NW 50. In addition, the user terminal 40 logs in from the portal site of the management apparatus 10 and notifies the management apparatus 10 of a request for opening and a request for changing a security policy setting.

[Configuration of management device]
Next, the configuration of the management apparatus 10 will be described with reference to FIG. FIG. 2 is a block diagram illustrating a configuration example of the management apparatus according to the first embodiment. As illustrated in FIG. 2, the management device 10 includes a communication processing unit 11, a control unit 12, and a storage unit 13. The processing of each unit included in the management apparatus 10 will be described below. Note that each function of the management apparatus 10 may be distributed among a plurality of apparatuses.

  The communication processing unit 11 controls communication related to various types of information. For example, the communication processing unit 11 controls communication performed between the NAT device 20, the security device 30, and the user terminal 40.

  The storage unit 13 stores data and programs necessary for various types of processing by the control unit 12, and particularly those closely related to the present invention include a user information storage unit 13a, a control information storage unit 13b, and a policy information storage unit. 13c. For example, the storage unit 13 is a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.

  The user information storage unit 13a stores the company NW 50 to which the user terminal 40 of each user belongs. For example, as illustrated in FIG. 3, the user information storage unit 13 a includes a “user ID” that uniquely identifies each user, and a “NW ID” that uniquely identifies the company NW 50 to which the user terminal 40 of each user belongs. Are stored in association with each other. FIG. 3 is a diagram illustrating an example of data stored in the user information storage unit.

  The control information storage unit 13b stores a global IP address assigned by the NAT device 20 for each company NW 50 to which each user terminal 40 belongs. In addition, the control information storage unit 13b stores a security policy to be applied in association with the global IP address. For example, as illustrated in FIG. 4, the control information storage unit 13 b performs the “NW ID” for uniquely identifying the company NW 50, the “global IP address” assigned to the company NW 50, and the packet with the corresponding global IP address. Are stored in association with the “security policy” indicating the policy ID to be applied.

  The policy information storage unit 13c stores the contents of the security policy. For example, as illustrated in FIG. 5, the policy information storage unit 13 c performs filtering with “policy ID” indicating an ID for uniquely identifying a security policy, “global IP address” indicating an application target of the security policy, and filtering "Access destination URL" indicating the URL of the access destination to be filtered, "Access destination IP address" indicating the IP address of the access destination performing filtering, and "Access destination port number" indicating the port number of the access destination performing filtering And “operation” indicating the content of the filtering operation are stored in association with each other. Note that only one or a plurality of “access destination URL”, “access destination IP address”, and “access destination port number” may be set in one policy. For example, in the example of FIG. 5, only “access destination URL” is set as an access destination for executing filtering in “Policy 1”. In the example of FIG. 5, only the global IP address is described as the information for specifying the security policy application target. However, information such as the traffic direction, port number, and URL may be referred to. Good.

  The control unit 12 has an internal memory for storing a program that defines various processing procedures and necessary data, and performs various processes using them, and particularly as closely related to the present invention, It has a reception unit 12a, an instruction unit 12b, and a setting unit 12c. Here, the control unit 12 is an electronic circuit such as a CPU (Central Processing Unit) or MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

  The accepting unit 12 a displays a screen corresponding to the company NW 50 to which the user terminal 40 belongs to the user terminal 40, and accepts a request for the company NW 50 from the user terminal 40. For example, when the user terminal 40 logs in from the portal site, the reception unit 12a reads out the NW ID of the company NW 50 corresponding to the user ID used for login from the user information storage unit 13a, and the page corresponding to the NW ID Is displayed on the user terminal 40. And the reception part 12a receives the opening request of the company NW50 from the page displayed on the user terminal 40.

  In response to a request from the user terminal 40, the reception unit 12 a displays a setting screen for setting a security policy for each company NW 50 on the user terminal 40, and receives a setting instruction regarding the security policy from the user terminal 40.

  For example, when the user terminal 40 logs in from a portal site in order for the user to change the security policy, the reception unit 12a displays the NW ID of the company NW 50 corresponding to the user ID used for login as the user information storage unit The setting screen including the contents of the security policy currently set in the company NW 50 corresponding to the acquired NW ID is displayed on the user terminal 40. That is, the content of the security policy of the other company NW50 to which the own device does not belong is not displayed on the user terminal 40, but only the content of the security policy of the company NW50 to which the own device belongs is displayed.

  Then, the accepting unit 12 a accepts a setting instruction related to the security policy from the user terminal 40 based on a user operation on the setting screen displayed on the user terminal 40. In this way, the management portal of one security device 30 is divided into a configuration that can be used by a plurality of users, and the settings of the divided management portal are reflected on one security device 30 in a unified manner.

  In response to a request from the user terminal 40, the instruction unit 12b instructs the NAT device 20 to assign a global IP address corresponding to the company NW 50 to which the user terminal 40 belongs. For example, when the acceptance request is accepted by the acceptance unit 12a, the instruction unit 12b instructs the NAT device 20 to assign a global IP address corresponding to the company NW 50 to which the user terminal 40 belongs.

  Here, a process of instructing the NAT device 20 about a global IP address that the management device 10 assigns to each company NW 50 will be described with reference to FIG. FIG. 6 is a diagram for explaining processing for instructing a global IP address to be assigned by the NAT device in the management device according to the first embodiment. In FIG. 6, the management device 10 and the user terminal 40 are not shown.

  As illustrated in FIG. 6, the management apparatus 10 stores in advance a global IP address assigned to each company NW 50 in the NAT apparatus 20. More specifically, the management apparatus 10 stores “210.100.10.3” as the global IP address assigned by the NAT apparatus 20 for the NW ID “1001” corresponding to the company NW1. Then, for the NW ID “1002” corresponding to the company NW2, “210.100.10.4” is stored as the global IP address assigned by the NAT device 20, and for the NW ID “2000” corresponding to the company NWx, the NAT device “210.100.13.240” is stored as the global IP address to be assigned at 20.

  Then, the management device 10 instructs the NAT device 20 about a global IP address to be assigned to each of the companies NW1 to NWx. The NAT device 20 assigns a global IP address to each of the enterprises NW1 to NWx to be accommodated based on the global IP address designated by the management device 10. When the NAT device 20 receives communication data from the user terminals 40 belonging to the company NW1 to the company NWx to the Internet 60, the NAT device 20 converts the private IP address of the communication data into a corresponding global IP address.

  Returning to the description of FIG. 2, in response to a request from the user terminal 40, the setting unit 12 c sets a security policy for the global IP address of the company NW 50 to which the user terminal 40 belongs to the security device 30. For example, the setting unit 12c sets a security policy for the security device 30 in accordance with the setting instruction received by the receiving unit 12a.

  For example, the setting unit 12c may set a security policy common to each company NW50 in the security device 30 when the company NW50 opens as a recommended setting prepared in advance. Further, the setting unit 12c may dynamically add a security policy based on the security policy set for each company NW 50 with reference to the policy information storage unit 13c. For example, the setting unit 12c periodically refers to the policy information storage unit 13c, and in the security policy of each company NW50, what is commonly set at a certain ratio (for example, 90% or more) You may make it add automatically as a security policy common in all the company NW50.

  Here, a process in which the management apparatus 10 sets a security policy in the security device will be described with reference to FIG. FIG. 7 is a diagram for explaining processing for setting a security policy in a security device in the management apparatus according to the first embodiment. In FIG. 7, the management device 10 and the user terminal 40 are not shown.

  As illustrated in FIG. 7, in response to a request from the user terminal 40, the management apparatus 10 sets a security policy for the global IP address of the company NW 50 to which the user terminal 40 belongs to the security device 30. Specifically, the management apparatus 10 sets N security policies of Policy 1 to Policy N in the security device 30.

  Here, for example, in the “Policy 1” security policy, “www.xxxxx.com” is accessed as a URL (Uniform Resource Locator) for the global IP address “210.100.10.3” corresponding to the company NW1. It is stipulated that the first communication is permitted. In addition, for example, in the “Policy 2” security policy, communication with the access destination “8.8.8.8” as the IP address of the global IP address “210.100.10.4” corresponding to the company NW2 is permitted. It is prescribed to do. Further, for example, in the “Policy N” security policy, communication with “445 port” as the access destination port number is performed for the global IP address “210.100.13.240” corresponding to the company NWx. Prohibition is stipulated. Thus, in the communication system 100, it is possible to set a security policy in units of global IP addresses, that is, in units of corporate NWs 50.

[Processing procedure of communication system]
Next, an example of a processing procedure performed by the communication system 100 according to the first embodiment will be described with reference to FIG. FIG. 8 is a sequence diagram illustrating an example of a flow of a global IP address issue process in the communication system according to the first embodiment. FIG. 9 is a sequence diagram illustrating an example of a flow of security policy setting processing in the communication system according to the first embodiment.

  First, the flow of a global IP address issue process in the communication system 100 will be described using the example of FIG. As illustrated in FIG. 8, the user terminal 40 of the communication system 100 logs in from the portal site of the management apparatus 10 when making a request for opening the company NW 50 (step S <b> 101).

  Then, when the user terminal 40 logs in from the portal site, the receiving unit 12a of the management apparatus 10 reads out the NW ID of the company NW 50 corresponding to the user ID used for the login from the user information storage unit 13a, and the NW ID A page corresponding to the above is displayed on the user terminal 40 (step S102). Then, the accepting unit 12a accepts the opening request of the company NW 50 from the page displayed on the user terminal 40 (step S103), and notifies the setting unit 12 to the instruction unit 12b (step S104).

  Subsequently, the instruction unit 12b instructs the NAT device 20 to set a global IP address corresponding to the company NW 50 to which the user terminal 40 belongs (step S105). That is, in other words, the instruction unit 12 b pays out to the NAT device 20 a global IP address corresponding to the company NW 50 to which the user terminal 40 belongs.

  Thereafter, when the NAT device 20 assigns a global IP address to the company NW 50, it is confirmed that the assignment of the global IP address to the user terminal 40 is completed via the receiving unit 12a and the instruction unit 12b of the management device 10. A notification of completion of notification is transmitted (steps S106 to S108).

  Next, the flow of security policy setting processing in the communication system 100 will be described using the example of FIG. As illustrated in FIG. 9, the user terminal 40 of the communication system 100 logs in from the portal site of the management apparatus 10 when changing the security policy setting (step S201).

  When the user terminal 40 logs in from the portal site, the reception unit 12a of the management apparatus 10 acquires the NW ID of the company NW 50 corresponding to the user ID used for login from the user information storage unit 13a, and acquires the acquired NW The setting unit 12c is inquired about setting information regarding various settings including the contents of the security policy corresponding to the ID (step S202).

  The setting unit 12c acquires the security policy ID corresponding to the NW ID from the control information storage unit 13b, and acquires the contents of the security policy corresponding to the security policy ID from the policy information storage unit 13c. Then, the setting unit 12c returns setting information including the content of the acquired security policy to the receiving unit 12a (step S203).

  And the reception part 12a displays on the user terminal 40 the page containing the content of the security policy currently set to the company NW50 corresponding to user ID as a page according to NW ID (step S204). Then, the accepting unit 12a accepts a setting change regarding the security policy from the user terminal 40 based on the user's operation on the setting screen displayed on the user terminal 40 (step S205), and sends a setting change request to the setting unit. 12c is notified (step S206).

  Then, the setting unit 12c sets the security device 30 to change the security policy for the global IP address of the company NW 50 to which the user terminal 40 belongs in response to the change request from the receiving unit 12a ( Step S207).

  Thereafter, when the security device 30 changes the security policy, the security device 30 transmits a completion notification for notifying that the security policy has been changed to the user terminal 40 via the receiving unit 12a and the instruction unit 12b of the management apparatus 10. (Steps S208 to S210).

(Effects of the first embodiment)
The communication system 100 according to the first embodiment includes a security device 30 provided at the boundary between the corporate NW 50 and the Internet 60, a NAT device 20 that accommodates the corporate NW 50, and a management that controls the security device 30 and the NAT device 20. Device 10. The management device 10 stores a global IP address assigned by the NAT device 20 for each company NW 50 to which each user terminal 40 belongs. In response to a request from the user terminal 40, the management apparatus 10 instructs the NAT apparatus 20 to assign a global IP address corresponding to the company NW 50 to which the user terminal 40 belongs. Then, in response to a request from the user terminal 40, the management device 10 sets a security policy for the global IP address of the company NW 50 to which the user terminal 40 belongs to the security device 30.

  The NAT device 20 assigns a global IP address to each company NW 50 accommodated based on the global IP address instructed by the management device 10. Further, when the NAT device 20 receives communication data from the user terminal 40 belonging to the company NW 50 to the Internet 60, the NAT device 20 converts the private IP address of the communication data into a corresponding global IP address. The security device 30 filters communication data based on the security policy corresponding to the global IP address converted by the NAT device 20. For this reason, in the communication system 100 according to the first embodiment, a single security device is shared for a plurality of user networks and the service is provided at a low cost without impairing the flexibility of address management of each user network. Can be done.

  Here, the configuration and problems of a conventional communication system will be described using the examples of FIGS. 10 and 11. As illustrated in FIG. 10, in the conventional communication system, one security device 300 is provided at the connection point of the Internet 600 for one company NW 500. In addition, as illustrated in FIG. 11, in the conventional communication system, in order to share one security device 300 among a plurality of enterprises NWs 500500A to 500X, a range of 10.11.0.0/16 for a private IP address Therefore, there is a problem that addresses cannot be duplicated between user networks because each company NW 500500A to 500X designates and accommodates an address block.

  On the other hand, in the communication system 100 according to the first embodiment, as illustrated in FIG. 12, the NAT device 20 accommodates a plurality of companies NW 50 </ b> A to 50 </ b> X, and the security device 30 is converted by the NAT device 20. Since filtering is performed based on the global IP address, duplication of addresses is possible between the corporate NWs 50A to 50X, and a plurality of corporate NWs 50A to 50X can be combined into one security device without impairing the flexibility of private IP address management for each user. 30 can be available. A security device such as UTM monitors both internal threats and external threats. If address translation by the NAT device 20 is performed, threat detection will be affected. The structure was not taken.

  Thus, in the communication system 100 according to the first embodiment, the security device 30 can be shared and used without changing the network environment of the user. In addition, this makes it possible for a provider providing security services to provide services to a plurality of users by using one security device 30, and to provide services at a reduced cost.

(System configuration etc.)
Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. Further, all or any part of each processing function performed in each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic.

  For example, in the example of FIG. 1, the case where the NAT device 20 and the security device 30 exist independently as separate hardware has been described, but the functions of the NAT device 20 and the security device 30 are included in one hardware. You may be made to do. Therefore, a system including the communication device 70 having the functions of the NAT device 20 and the security device 30 will be described as a communication system 100A according to another embodiment, using the example of FIG.

  FIG. 13 is a block diagram illustrating a configuration example of a communication system according to another embodiment. As illustrated in FIG. 13, the communication device 70 of the communication system 100 </ b> A is installed at the boundary between the corporate NWs 50 </ b> A to 50 </ b> X and the Internet 60 and includes an assignment unit 21, a conversion unit 22, and a filtering unit 31. The assignment unit 21, the conversion unit 22, and the filtering unit 31 are the same as those described above, and thus the description thereof is omitted. Such a communication device 70 has a security function and also has a function of accommodating a plurality of companies NWs 50A to 50X and executing an address conversion process between a private IP address and a global IP address.

  In addition, among the processes described in this embodiment, all or part of the processes described as being automatically performed can be manually performed, or the processes described as being manually performed All or a part of the above can be automatically performed by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above-described document and drawings can be arbitrarily changed unless otherwise specified.

(program)
In addition, it is possible to create a program in which processing executed by each device described in the above embodiment is described in a language that can be executed by a computer. For example, it is possible to create a program in which processing executed by the management apparatus 10 according to the embodiment is described in a language that can be executed by a computer. In this case, the same effect as the above-described embodiment can be obtained by the computer executing the program. Further, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read by the computer and executed to execute the same processing as in the above embodiment.

  FIG. 14 is a diagram illustrating a computer that executes a program. As illustrated in FIG. 14, the computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012 as illustrated in FIG. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090 as illustrated in FIG. The disk drive interface 1040 is connected to the disk drive 1100 as illustrated in FIG. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120 as illustrated in FIG. The video adapter 1060 is connected to a display 1130, for example, as illustrated in FIG.

  Here, as illustrated in FIG. 14, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the above-described program is stored in, for example, the hard disk drive 1090 as a program module in which an instruction to be executed by the computer 1000 is described.

  In addition, various data described in the above embodiment is stored as program data in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 as necessary, and executes various processing procedures.

  The program module 1093 and the program data 1094 related to the program are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive or the like. . Alternatively, the program module 1093 and the program data 1094 related to the program are stored in another computer connected via a network (LAN, WAN (Wide Area Network), etc.) and read by the CPU 1020 via the network interface 1070. May be.

  The above embodiments and modifications thereof are included in the invention disclosed in the claims and equivalents thereof as well as included in the technology disclosed in the present application.

DESCRIPTION OF SYMBOLS 10 Management apparatus 11 Communication processing part 12 Control part 12a Reception part 12b Instruction part 12c Setting part 13 Storage part 13a User information storage part 13b Control information storage part 13c Policy information storage part 20 NAT apparatus 21 Allocation part 22 Conversion part 30 Security apparatus 31 Filtering unit 40 User terminal 50A-50X Corporate NW
60 Internet 70 Communication device 100, 100A Communication system

Claims (6)

A communication system having a security device provided at a boundary between a user network and an external network, and a NAT device accommodating the user network,
The NAT device is
An assigning unit that assigns a global IP address to each user network accommodated;
A conversion unit that converts a private IP address of the communication data to a corresponding global IP address when receiving communication data from the user terminal belonging to the user network to the external network;
The security device is:
A communication system, comprising: a filtering unit configured to filter the communication data based on a security policy corresponding to a global IP address converted by the NAT device. A storage unit for storing a global IP address assigned by the NAT device for each user network to which each user terminal belongs;
An instruction unit for instructing the NAT device to assign a global IP address corresponding to a user network to which the user terminal belongs, in response to a request from the user terminal;
A management device further comprising: a setting unit configured to set a security policy for the global IP address of the user network to which the user terminal belongs in response to a request from the user terminal;
The communication system according to claim 1, wherein the assigning unit assigns a global IP address to each user network to be accommodated based on the global IP address instructed by the instructing unit. The management device
The user terminal further includes a reception unit that displays a screen corresponding to a user network to which the user terminal belongs, and receives a request for the user network from the user terminal,
The instruction unit, when the request is received by the reception unit, instructs the NAT device to assign a global IP address corresponding to a user network to which the user terminal belongs. 2. The communication system according to 2. The management device
In response to a request from the user terminal, a setting screen for setting a security policy for each user network is displayed on the user terminal, and further includes a reception unit that receives a setting instruction regarding the security policy from the user terminal,
The communication system according to claim 2, wherein the setting unit sets a security policy for the security device in accordance with a setting instruction received by the receiving unit. An assigning unit that assigns a global IP address to each user network accommodated;
A conversion unit that converts a private IP address of the communication data into a corresponding global IP address when receiving communication data from the user terminal belonging to the user network to the external network;
And a filtering unit that filters the communication data based on a security policy corresponding to the global IP address converted by the conversion unit. For each user network to which each user terminal belongs, a storage unit that stores a global IP address assigned by a NAT device that accommodates the user network;
An instruction unit for instructing the NAT device to assign a global IP address corresponding to a user network to which the user terminal belongs, in response to a request from the user terminal;
A setting unit that sets a security policy for a global IP address of a user network to which the user terminal belongs to a security device provided at a boundary between the user network and an external network in response to a request from the user terminal. Management device characterized by.

Images