JP4824100B2 - Network management method, network management apparatus, and program based on device type - Google Patents

Description

  The present invention relates to a network management method based on the type of device, and a network management apparatus and program for executing the method.

  2. Description of the Related Art Conventionally, it is known that a computer connected to a local network can connect to a network after authenticating access permission in order to access the network.

  For example, a method is known in which a portable authentication device such as a USB (Universal Serial Bus) is connected, the computer is authenticated, and then connected to a network (for example, see Patent Document 1).

JP 2006-251857 A

  However, in the method of Patent Document 1, an administrator must individually set connection to a network for each electronic device such as a computer. Furthermore, as will be described below, access to the network cannot be controlled for each type of electronic device such as a computer.

  For example, when a portable game machine or a portable information terminal not purchased in-house is connected to an intranet in a certain company, there is a need to limit the connection to the Internet for these electronic devices. For example, if access to the Internet via an intranet is permitted only with a user ID or password, even if the game machine is used for a purpose not related to business, access to the Internet is permitted. Is made executable.

  Furthermore, there is a need to manage whether or not the electronic devices connected as described above can access other networks having different authentication methods even within the same intranet in the company. That is, it is desirable that a private electronic device that is not authenticated in-house is capable of comprehensive connection management that does not permit access to other networks with different authentication methods.

  In view of such a problem, the present inventor manages access to an electronic device that does not permit network connection, and therefore cannot control the use of the network according to the type of electronic device connected to the network. I focused on the point.

  An object of the present invention is to provide a network management method, a network management device, and a program for managing network connections based on the types of electronic devices.

  (1) A network management apparatus that is communicably connected to an electronic device via a first network, wherein the electronic device is connected to the first network in response to the connection to the first network. Electronic device determination means for determining the type name of the electronic device by receiving the packet, and access determination for determining whether to permit access to the second network based on the determined type name And a network management apparatus comprising: access permission means for permitting access to the second network with respect to the electronic device whose model name is determined when the access is permitted .

  According to the invention according to (1), the network management device (for example, a router 50 described later) receives a predetermined packet (for example, a request packet or a passive packet described later) from the electronic device, thereby the electronic device. When determining whether to permit access to the second network (for example, a public network 3 described later) based on the determined model name, and permitting access, Access to the second network is permitted for the electronic device whose model name is identified.

  Therefore, since it becomes possible to control the use to the second network according to the type of electronic device, the administrator does not need to individually perform network connection settings for each connected electronic device, Depending on the type of electronic device, it is possible to restrict and manage network usage comprehensively.

  (2) The network management device according to (1), wherein the second network is a WAN (Wide Area Network) or another LAN (Local Area Network) that requires authentication. Network management device.

  According to the invention according to (2), since the second network to which access is permitted is a WAN or a LAN having a different segment, the connection of a public line such as the Internet is managed or to another network in the LAN. Can be restricted and managed.

  (3) The network management device according to (1), wherein the access determination unit is configured to determine the type name in response to receiving an input of a permission ID from the electronic device that has determined the type name. A network management device for determining access to the second network for a device.

  According to the invention of (3), the network management device described in (1) receives an input of a permission ID from the electronic device that has identified the model name when access to the second network is not permitted. Accordingly, access to the second network is permitted for the electronic device whose model name is identified. Therefore, if the electronic device has a predetermined model name, access is comprehensively restricted, but an exception can be provided for this.

  (4) A network management method executed by a network management apparatus that is communicably connected to an electronic device via a first network, wherein the electronic device is connected to the first network. An electronic device determination step of determining a type name of the electronic device by receiving a predetermined packet from the electronic device, and whether to permit access to the second network based on the determined type name And an access determining step for permitting access to the second network for the electronic device whose model name is determined when the access is permitted. Network management method.

  According to the invention according to (4), the network management device (for example, a router 50 described later) receives a predetermined packet (for example, a request packet or a passive packet described later) from the electronic device, whereby the electronic device The type name of the electronic device is determined. Based on the determined type name, it is determined whether or not to permit access to the second network. To permit access to the second network.

  Therefore, since it becomes possible to control the use to the second network according to the type of electronic device, the administrator does not need to individually perform network connection settings for each connected electronic device, Depending on the type of electronic device, it is possible to restrict and manage network usage comprehensively.

  (5) A predetermined packet is sent from the electronic device to the network management apparatus that is communicably connected to the electronic device via the first network in response to the electronic device being connected to the first network. An electronic device determination step of determining a model name of the electronic device by receiving, an access determination step of determining whether to permit access to the second network based on the determined model name; An access permission step for allowing an electronic device whose model name has been identified to permit access to the second network when the access is permitted.

  According to the invention according to (5), the network management device (for example, a router 50 described later) receives a predetermined packet (for example, a request packet or a passive packet described later) from the electronic device, so that the electronic device The type name of the electronic device is determined. Based on the determined type name, it is determined whether or not to permit access to the second network. To permit access to the second network.

  Therefore, since it becomes possible to control the use to the second network according to the type of electronic device, the administrator does not need to individually perform network connection settings for each connected electronic device, Depending on the type of electronic device, it is possible to restrict and manage network usage comprehensively.

  According to the present invention, in order to manage access of electronic devices that are not permitted to connect to the network, it is not necessary to individually perform network connection settings for each connected electronic device, and the types of electronic devices connected to the network can be selected. Accordingly, it is possible to provide a network management method, a network management device, and a program for controlling the use of the network.

FIG. 1 is a diagram showing an overall configuration of a network connection management system 1. FIG. 2 is a diagram illustrating a connection configuration of the network connection management system 1 and a functional configuration of the router 50. FIG. 3 is a diagram showing an access permission flow. FIG. 4 is a diagram illustrating an electronic device determination process. FIG. 5 is a diagram illustrating an example of a MAC address. FIG. 6 is a diagram illustrating an example of the MAC address maker table. FIG. 7 is a diagram illustrating an example of the MAC address model table. FIG. 8 is a diagram illustrating an example of a port number. FIG. 9 is a diagram illustrating an example of a port number table. FIG. 10 is a conceptual diagram illustrating an example of scoring processing and processing for specifying an electronic device. FIG. 11 is a diagram illustrating an access permission flow based on a permission ID. FIG. 12 is a diagram illustrating an electronic device network management table. FIG. 13 is a diagram showing a permission ID table. FIG. 14 is a hardware configuration diagram of the router 50.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[Overview]
The outline of the network connection management system 1 according to the present invention will be described with reference to FIG. FIG. 1 is a diagram showing an overall configuration of a network connection management system 1.

  The network connection management system 1 includes Web servers 100 and 110, a public line network (Internet: WAN (Wide Area Network)) 3, a router 50, a hub 20-a, a wireless LAN access point 20-b, and network functions. The electronic device 10 having a telephone 10-a, a content reproduction / recording apparatus 10-b, a game machine 10-c, and a personal computer 10-d. The hub 20-a and the wireless LAN access point 20-b are not essential components in this embodiment.

  The local network 2 may be a local network (intranet) such as a home network. The local network 2 has two networks with different segments (first local network 5 and second local network 7). Here, networks having different segments are networks having different network addresses of IP addresses used in the network. Networks with different segments are branched by the router 50, and communication between networks becomes possible by the processing of the router 50.

  The devices in the local network 2 include a router 50, a hub 20-a, a wireless LAN access point 20-b, and the electronic devices 10 in the local network 2 include a telephone 10-a, a content playback / recording device 10-b, and a game. Machine 10-c and personal computer 10-d. By connecting the router 50 to the public line network 3 (WAN), the electronic devices 10-a to 10-d can communicate with the Web servers 100 and 110, for example, via the public line network 3 that is an external network. .

  The electronic device 10 is not limited to the above example as long as it is an electronic device having a network function. It is an electronic device that has at least a communication function, has a unique terminal address (MAC (Media Access Control) address) and an IP (Internet Protocol) address, and realizes a network function.

  The wireless LAN access point 20-b is communicably connected to each of the game machine 10-c and the personal computer 10-d. As shown in the figure, the wireless LAN access point 20-b has a wireless area to be the first local network 5 in a predetermined radio wave range.

[Function configuration]
The functional configuration of the router 50 will be described with reference to FIG.

  The router 50 includes a control unit 51 and a communication I / F (interface) unit 60. The control unit 51 includes an electronic device determination unit 52, an access determination unit 53, and an access permission unit 54.

  The router 50 may realize the above functions as a module executed on the OSGi platform in the OSAP (OSGi Service Aggregation Platform).

  As shown in FIG. 14, the control unit 51 includes a CPU (Central Processing Unit) 40, a ROM (Read Only Memory) 41, and a RAM (Random Access Memory) 42. The communication I / F unit 60 includes LAN ports 62 and 63 to which a LAN is connected and a WAN port 61 to which the public line network 3 is connected. The hard disk 65 stores data such as a table described below, and the control unit 51 accesses the hard disk 65 and refers to the table.

  The electronic device discriminating means 52, the access discriminating means 53, and the access permitting means 54 are realized by these hardware reading a program for realizing this function and cooperating with each other.

  The electronic device discriminating means 52 has a function of discriminating the model name (manufacturer name and product model name) of the electronic device 10 connected to the LAN ports 62 and 63 by electronic device discrimination processing. As will be described later, the electronic device determination process determines the type name of the electronic device based on a request packet transmitted from the router 50 to the electronic device 10 and a response packet from the electronic device.

  Note that the electronic device determination unit 52 receives a broadcast packet and a multicast packet (passive packet) transmitted from the electronic device 10 without transmitting a request packet, and based on these packets, the electronic device 10 You may determine the type name.

  The access determination unit 53 determines whether to permit access to the second network based on the determined model name of the electronic device 10. Here, as will be described with reference to FIG. 11, the access determination unit 53 determines the access to the second network in response to receiving the permission ID input from the electronic device 10 that has determined the model name. There is also.

  The second network is a terminal that is different from the first network, a network that can be connected to a server such as a Web server, or a network that requires authentication different from that of the first network.

  As an example of the former, for example, the second network may be a WAN or a LAN with different segments. As an example of the latter, for example, the second network can be connected to the first network with a setting of WEP (Wired Equivalent Privacy). In addition, the second network can be connected to an authentication server (for example, Radius). Network that is connected after authentication by a server).

  Based on the determination by the access determination unit 53, the access permission unit 54 permits the electronic device 10 that has determined the model name to access the second network.

  The communication I / F unit 60 includes a WAN port 61, a LAN port 1-62, and a LAN port 2-63. The WAN port 61 is connected to the public line network 3 that is an external network (second network), and is connected to the Web servers 100 and 110 so as to be communicable. The Web servers 100 and 110 are Web servers having a function of providing a Web page to the electronic device 10 that has requested a predetermined Web page.

  The LAN port 1-62 and the LAN port 2-63 are ports for the local network 2, and local networks (first local network 5 and second local network 7) having different segments are connected to different ports. Has been.

  When the electronic device 10-c is connected to the first local network 5 (first network), the router 50 accesses the second local network 7 or the public line network 3 (second network). Determine whether to allow.

  FIG. 3 is a diagram illustrating an access permission flow executed by the router 50 and the electronic device 10-c. When the electronic device 10-c is connected to a first network (for example, the first local network 5) (including not only a physical priority connection but also a wireless communication connection) (step S01), the router 50 Executes electronic device determination processing (step S02), which will be described later with reference to FIG.

  Through the electronic device determination process, the type name of the connected electronic device 10-c is determined, and the router 50 stores the type name. During this time, the electronic device 10-c determines whether there is a request for access to the second network (NW) (step S03). Here, the request means that the user operating the electronic device 10-c starts up a Web browser to request access to an external network, or specifies a directory to access another network with a different segment. Is to request.

  When there is a request for access to the second network (NW), the electronic device 10-c accesses the router 50 and attempts to access the second network. Here, the router 50 It is determined whether or not this access is permitted (step S04).

  For example, access permission is determined based on an electronic device network management table shown in FIG. Based on the model name of the electronic device determined by the electronic device determination processing, the electronic device network management table is referred to, WAN connection, network segment 1 (corresponding to the first local network 5), network segment 2 (second For the local network 7). The electronic device network management table may be set and stored in advance by the administrator of the router 50.

  When the access is permitted by the access determination process (“YES” in step S04), the router 50 executes an access permission process (step S05).

  For example, when a WAN connection is requested, a process for converting a private address in the local network 5 into a global address (NAT (Network Address Translation) or IP masquerade) is not performed until an access permission process is performed. In the standby state, when the access is permitted by the access determination process, the conversion process to the global address is executed. Similarly, in the case of local networks with different segments, the router 50 does not perform routing to the target party until permission is determined. Thereby, the router 50 can restrict | limit the access to the 2nd network of the electronic device 10-c.

  As a result of the access permission process, the electronic device 10-c starts access to the second network (step S06) (in the case of WAN, starts access to the Web servers 100 and 110) and ends the process. To do.

  In the access determination process (step S04), when access is not permitted ("NO" in step S04), the router 50 displays an access restriction display indicating this on the electronic device 10-c, indicating that access is not permitted. Then, an access restriction display process is performed (step S07), and the process ends. In this case, the electronic device 10-c cannot be communicably connected to the second network.

[Electronic device identification processing]
Next, the electronic device determination process in step S02 will be described. FIG. 4 is a flowchart of the electronic device determination process. First, the router 50 transmits a request packet to the electronic device 10 (step S20).

  The request packet is packet data that the router 50 transmits to the electronic device 10 in order to receive a response packet for determining the model name of the electronic device 10.

  The request packet may be, for example, a command such as ARP (Address Resolution Protocol), ICMP (Internet Control Message Protocol), or SNMP (Simple Network Management Protocol), and uPnP (UniversalPlD) ) May be a compliant protocol.

  Note that the router 50 may be configured to periodically transmit request packets to the electronic device 10. That is, the router 50 detects the electronic device 10 connected so as to be communicable at a predetermined timing by transmitting a request packet every several tens of seconds, every few minutes, or every several hours.

  That is, when a new electronic device 10 is connected to the network system 1, the router 50 periodically transmits a request packet at a predetermined timing in order to detect the electronic device 10. According to this, since the router 50 can obtain information (electronic device information) regarding the electronic device 10 when the user connects a new electronic device 10, the electronic device in the network connection management system 1 can be obtained. 10 management becomes easy.

  The electronic device information is information related to the electronic device, and is information including at least a model name of the electronic device (a model name for specifying the type of the electronic device, indicating a manufacturer name and a product model name). is there.

  Note that the router 50 does not need to transmit a request packet when receiving passive packets such as broadcast packets and multicast packets from the electronic device 10 (step S20 is not executed).

  Next, the router 50 receives a response packet from the predetermined electronic device 10 (step S21).

  The response packet is a packet transmitted from the electronic device 10 and is packet data that is used to determine the type name of the electronic device 10 or to determine the type name of the electronic device 10. That is, the response packet is a response packet transmitted from the electronic device 10 that has received the request packet transmitted from the router 50. Here, the response packet is not a response packet of the request packet, but also includes a passive packet transmitted from the electronic device 20 by broadcast or multicast.

  Next, the router 50 performs a definition file reference process (step S22). The control unit 51 of the router 50 refers to the definition file stored in the hard disk 65, compares it, and performs the following scoring process (step S23).

  The definition file is data predetermined for each electronic device 10 and is necessary for specifying the model name of the electronic device 10. Referring to FIG. 10 to be described later, the definition file (electronic device A definition file) is composed of one or more definition items (X5, Y2, Z3). Each definition item is scored and compared, and the electronic device 10 (in this case, electronic device A) is specified. The definition item is definition data for specifying the type name of the electronic device 10 with one request packet and one response packet.

  Next, the router 50 compares the definition file and the response packet, and performs scoring (scoring) (step S23).

  The scoring will be described with reference to FIG. The router 50 transmits one or more request packets (A1, B1, C1) and receives response packets (X5, Y8, Z9) corresponding thereto. Then, the router 50 refers to the definition items of the definition files for each electronic device (electronic device A definition file, electronic device B definition file, and electronic device C definition file) and compares them with the response packet.

  For example, a case where an ARP command is transmitted as a request packet and this response is received from an electronic device 10 will be described. By transmitting the ARP command to the target electronic device 10, a packet including the MAC address information of the target electronic device 10 is received as a response packet.

  As shown in FIG. 5, the MAC address is composed of a 48-bit code, the upper 24 bits are assigned as a vendor ID, a vendor-specific ID is given, and the next 8 bits is a model ID.

  The router 50 may store a table for configuring a definition file for each electronic device 10. For example, as shown in FIG. 6, as a MAC address maker table, the code of the upper 24 bits and the manufacturer name of the electronic device 10 (not necessarily the vendor name of the manufacturer, but the vendor of the electronic device 10 having the communication I / F). (May be a (manufacturer) name), a point for scoring, and an ID. Further, as shown in FIG. 7, as the MAC address model table, the upper 24 bits code, the model name of the electronic device 10, the points for scoring, and the ID are associated with each other.

  By extracting each element of the MAC address maker table and the MAC address model table, it becomes a definition item and constitutes a definition file for each electronic device 10. For example, ID001 in the MAC address maker table corresponds to X5 (see FIG. 10) (definition item X5) of the electronic device A definition file, and ID010 in the MAC address device table corresponds to Y2 (definition item Y2 in the electronic device A definition file). )

  Upon receiving the A1 packet transmitted as the request packet, the electronic device 10 transmits a response packet. The response packet (X5) is compared with the definition items in the definition file of the electronic device A. If they are the same, points are given with reference to each table.

  For example, in the above example, the case where the response packet X5 is a packet including information on the target MAC address and the 48-bit code is “04-A3-43-5F-43-23” will be described. Since the upper 24 bits are the same as the definition item X5 (ID001), 0.3 points are given. Further, in the next 8 bits, since it is the same as the definition item (ID010), 0.3 points are given. Therefore, the electronic device A definition file can obtain a total of 0.6 points.

  In the above example, one request packet (A1) is scored for two definition items (ID001, ID010) by a response packet (X5). A plurality of definition items may be scored from the packet.

  Next, the router 50 compares the response packet Y8 with Y2 of the electronic device A definition file, compares the response packet Z9 with Z3 of the electronic device A definition file, and acquires each point (see FIG. 10). ). The total score of the electronic device A definition file is the sum of all the points thus obtained. This is obtained for the electronic device A definition file, the electronic device B definition file, the electronic device C definition file, and the definition files for all the electronic devices.

  In the above description, the case where the response packet X5 and the definition item X5 are the same has been described.

  As an example of judging by similarity, a mode in which 0.2 points are given if the upper 16 bits of the upper 24 bits of the response packet X5 are the same, and 0.1 points are given if the upper 8 bits are the same (packet) It may be determined by the degree of similarity of the character string. In this way, the point value can be adjusted such that the point is increased when the similarity between the response packet and the definition item is high.

  The router 50 receives a plurality of response packets from the electronic device 10 by transmitting a plurality of types of request packets.

  Next, the router 50 determines the model name of the electronic device 10 (step S24). That is, scoring as described above is performed on the definition files of all the electronic devices, the obtained scores are compared, and a definition file with a high score is extracted to determine the type name of the electronic device 10.

  For example, as described above, the electronic device A definition file, the electronic device B definition file, the electronic device C definition file,... The definition file of the high electronic device is extracted, and the electronic device 10 is specified.

  Referring to FIG. 10, for example, since the response packet (X5, Y8, Z9) and X5 of the electronic device A definition file (X5, Y2, Z3) are the same, the electronic device A definition file has 0.6. Suppose you get points. On the other hand, each definition item (X1, Y7, Z1) of the electronic device B definition file is not the same as the response packet (X5, Y8, Z9), but considering the similarity, 0. Suppose you have 3 points.

  The electronic device C definition file (X5, Y8, Z8) has 0.9 points in the electronic device A definition file because the response packet (X5, Y8, Z9) and the definition item Y8 are the same. And In this case, among the definition files for electronic devices A to C, the definition file for electronic device C is determined to be the highest overall point (0.9 points), and the definition file C is extracted. Is determined to be the electronic device C.

  As an example, the electronic device A definition file is defined as a definition file up to the manufacturer name A company, and the electronic device B definition file is one of the device model names in addition to the manufacturer name A company (AB-01). ) Definition file that can be specified up to In this case, when an electronic device 10 is manufactured by Company A and has a model name of AB-01, the electronic device B definition file has a higher point than the electronic device A definition file. Therefore, the electronic device 10 is determined to be the electronic device B (AB-01 of company A) that has a high overall score.

  Conversely, when a certain electronic device 10 is manufactured by Company A and has a new product type name of BC-03, it can be specified by the definition file of Electronic Device A or Electronic Device B up to the product manufactured by Company A. Therefore, although the device name cannot be specified, at least the manufacturer name can be specified, and the electronic device information can be specified step by step.

  As an example of a determination factor for scoring other than the MAC address, an example in which the determination is made based on the TCP / IP port will be described with reference to FIGS. Electronic device 10 well-known port The model name of the electronic device 10 is specified according to the usage status of the port number that is specially used (bound) in the electronic device 10.

  As shown in FIG. 8, in the electronic device X, port numbers 5000 and 5002 are in use, and number 5001 is not used. For example, this status is detected by a NETSTAT command. Then, as shown in FIG. 9, the port number table stored in the router 50 is referred to, the port numbers being used (bind) are compared, the identity with the definition item of ID100 is determined, and the point Is granted. In this case, 0.2 points are given as AB-01 manufactured by Company A.

  When the NETSTAT command is used, the NETSTAT command may transmit a packet to the electronic device 10 as a request packet as a request packet. However, the router 50 receives a broadcast or multicast packet from the electronic device 10 in advance. The NETSTAT command result may be obtained using these received packets.

  That is, even if the router 50 does not transmit a NETSTAT command serving as a request packet to the electronic device 10, a broadcast or multicast packet (port number binding) transmitted from the electronic device 10 that has been received so far. The scoring process may be performed based on a packet for notifying a state).

  Note that points are assigned not only when the port numbers in the port number table and the binding status are completely the same, but also what percentage of existing ports are in use and what percentage is not in use. The points may be given according to the degree of use (the degree of use is not completely the same but is similar).

  For example, it is assumed that the usage degree of a port and points are stored in advance as a table. In this case, port numbers 5000 and 5002 are in use, and when port 5001 is not in use, 66% of the ports are in use. Therefore, when 66% of the ports are in use, the processing is such that a predetermined point is given with reference to the table.

  Further, the OS (Operating System) version may be determined and the point may be assigned. For example, an nbns (Net BIOS Name Server) packet is received from the electronic device 10 as a passive packet to be transmitted in broadcast, the OS version information is acquired, the OS is identified based on this, and the identified OS Points may be awarded based on the version of.

  For example, in the definition file of the electronic device AB-01 of Company C, the definition item “If the OS version is“ X type ”is used, 0.5 is added as a point” is registered. And At this time, if the OS version is specified as “X type” by the nbns packet, 0.5 is added to the point of the electronic device AB-01 of company C.

[Access permission flow with permission ID]
Next, processing executed by the router 50 and the electronic device 10-c based on the access permission flow with the permission ID of FIG. 11 will be described. When the electronic device 10-c does not permit access to the second network in the access determination process (step S04) in FIG. 3 (“NO” in step S04), the router 50 assumes that access is not permitted. An access restriction display indicating this is displayed on the electronic device 10-c, and an access restriction display process is performed (step S07).

  In this case, the electronic device 10-c prompts the user to input a permission ID (step S08). The permission ID is a character string (password) for canceling access restrictions, and is managed by an administrator who manages the network, a supervisor at work, or a guardian at home.

  When the permission ID is input from the electronic device 10-c, the router 50 receives this and determines whether or not the permission ID is appropriate (step S09). Whether or not the permission ID is appropriate is referred to, for example, by referring to a permission ID table (see FIG. 13) stored in the router 50, and a match between character strings that are input IDs is compared.

  If the input character is appropriate (step S09: YES), the router 50 executes an access permission process (step S10: the same as step S05 in FIG. 3), and if not correct (step S09: NO) Returning to S07, access restriction display processing indicating that access is not possible is performed.

  According to the processing using this permission ID, if the electronic device 10 is a predetermined model name, the access is comprehensively restricted, but it is possible to provide an exception to this by permission of an administrator or the like. .

[Hardware configuration of router 50]
FIG. 14 is a diagram showing a hardware configuration of the router 50 according to the embodiment of the present invention. The apparatus in which the present invention is implemented may be a standard computer, and an example of the configuration is shown below.

  The router 50 includes a control unit 51, a communication I / F unit (I / F: interface) 60, and a hard disk 65.

  The control unit 51 is a part that comprehensively controls the router 50, and includes a CPU (Central Processing Unit) 40, a ROM (Read Only Memory) 41, and a RAM (Random Access Memory) 42, and is stored in the hard disk 65. By appropriately reading and executing the various programs, the various functions according to the present invention are realized in cooperation with the hardware described above.

  The communication I / F unit 60 is a network adapter for transmitting and receiving information via a network. The communication I / F unit 60 may include LAN ports 62 and 63 and a WAN port 61.

  The hard disk 65 stores various programs for causing the hardware to function, a program for executing the functions of the invention, and the tables and records described above. It should be noted that a hard disk (not shown) provided separately outside can also be used as an external storage device.

  The embodiment of the present invention has been described above, but the present invention is not limited to the present embodiment, and modifications, improvements, and the like within the scope that can achieve the object of the present invention are included in the present invention.

DESCRIPTION OF SYMBOLS 1 Network connection management system 2 Local network 3 Public line network 10 Electronic device 50 Router 100,110 Web server

Claims (6)

A network management device that is communicably connected to an electronic device via a first network,
A packet receiving means for receiving a packet for determining a model name of the electronic device in response to the electronic device being connected to the first network ;
Storage means for storing a definition file defined for each electronic device;
A scoring means for comparing and scoring the definition file for each packet and the electronic device;
An electronic device discriminating unit that discriminates the type name of the electronic device by extracting a definition file having a high score of the scoring unit and setting the electronic device information of the definition file as electronic device information of the electronic device ;
Access discriminating means for discriminating whether or not to permit access to the second network based on the discriminated model name;
An access permission means for permitting access to the second network for the electronic device that has determined the model name when the access is permitted;
A network management apparatus comprising:   2. The network management apparatus according to claim 1, wherein the second network is a WAN (Wide Area Network) or another LAN (Local Area Network) that requires authentication. Management device. The network management device according to claim 1,
The access discriminating means, when access to the second network is not permitted, the electronic device that discriminates the type name in response to receiving the permission ID input from the electronic device that discriminates the type name. A network management device for determining access to the second network for a device.   The network management device according to claim 1,
  The packet receiving means receives a packet indicating a usage status of a communication port of the electronic device,
  The storage means stores a definition file that defines the usage status of the communication port of the electronic device,
  The scoring means is a network management device that performs scoring using the received packet and a definition file defining a communication port usage status as one element. A network management method executed by a network management apparatus that is communicably connected to an electronic device via a first network,
A packet receiving step of receiving a packet for determining a model name of the electronic device in response to the electronic device being connected to the first network ;
A storage step of storing a definition file defined for each electronic device;
A scoring step of comparing and scoring the definition file for each packet and the electronic device;
An electronic device determination step of determining a model name of the electronic device by extracting a definition file having a high score by the scoring step and making electronic device information of the definition file electronic device information of the electronic device ;
An access determination step of determining whether to permit access to the second network based on the determined model name;
An access permission step for permitting access to the second network for the electronic device that has determined the model name when the access is permitted;
A network management method comprising: To a network management device connected to the electronic device via the first network so as to be communicable,
A packet receiving step of receiving a packet for determining a model name of the electronic device in response to the electronic device being connected to the first network ;
A storage step of storing a definition file defined for each electronic device;
A scoring step of comparing and scoring the definition file for each packet and the electronic device;
An electronic device determination step of determining a model name of the electronic device by extracting a definition file having a high score by the scoring step and making electronic device information of the definition file electronic device information of the electronic device ;
An access determination step of determining whether to permit access to the second network based on the determined model name;
An access permission step for permitting access to the second network for the electronic device that has determined the model name when the access is permitted;
A program for running

Images