JP6286324B2 - Communication device and communication server - Google Patents

Description

  The present invention relates to a communication device and a communication server that restrict communication when there is a fraud to a communication device.

  Conventionally, when a fraud such as a virus infection is detected in a communication device used in a communication network such as the Internet, the communication device is blocked from the network or the function of the communication device is disabled in order to prevent further damage. Has been done. Specifically, there is an example in which a communication device (such as a PC) in which virus infection is recognized is taken to make communication impossible, such as by physically disconnecting a network connection line.

  In a communication system in which a plurality of computers are connected, an alarm module included in a computer in which a worm is detected creates an alarm, and transmits the alarm to one or more computing systems, and information on the detected worm. A technique for sharing is disclosed. In this technique, in order to suppress a situation in which the same alarm message is continuously transmitted, it is described that a transfer number counter that limits the number of times the alarm message is transferred is included (Patent Document 1).

JP 2006-031718 A

  By the way, a system in which an interface for managing a communication device is only a network or a communication device is managed from another communication device (such as a management device or a server) via the network is expanding. In such a system, the method of blocking the communication device that was the target of unauthorized communication from the network and disabling the communication device can prevent the damage from spreading, but it is possible to restore it remotely and manage the communication device. It becomes impossible at all. In addition to the management function, even if there is a function that is not desired to be stopped even in the event of an abnormality, the function cannot be continued.

  In such a case, a method of predetermining an IP address that needs to be communicated even when communication fraud is detected, and permitting communication only to the specific IP address without invalidating the communication function when fraud is detected. There is a need to determine the address in advance. In addition, when the system is operated for a long period of time, the address system in the system is often changed, and it may be difficult to continuously use an appropriate IP address as a specific address. In addition, when managing many communication devices, there is a problem that the address setting process itself becomes complicated.

  One aspect of the present invention includes fraud detection means for detecting fraud to a communication device, storage means for storing a hop number having a value smaller than a normal hop number, which is a hop number during normal communication, as a changed hop number, A communication device comprising: changing means for changing the number of hops of a communication packet transmitted after the fraud is detected by the fraud detection means from the normal hop number to the changed hop number. As a result, when a fraud to a communication device is detected, the communication connection to a distant place in the network that was permitted before the fraud detection is restricted, and there is a possibility that the fraudulent act is inappropriate and far from the network. However, it is possible to prevent the packet from being transmitted.

  Here, it is preferable to measure the number of hops to a communication destination that continues communication after fraud is detected by the fraud detection means, and set the number of changed hops according to the number of hops to the communication destination. is there. As a result, it is possible to ensure communication necessary for device management and recovery operation from fraud at a minimum from the network side.

  In addition, the number of hops to a communication destination that provides a service in a state where there is no fraud to the communication device is measured, and a value obtained by adding a predetermined number of permitted bypasses to the number of hops to the communication destination is the normal hop number. It is preferable to set. Thereby, it is possible to limit the communicable range to a necessary range even during normal times.

  Another aspect of the present invention is a communication server that communicates with the communication device, and obtains a difference between the current value and the initial value of the hop number of the received communication packet, and the difference is less than or equal to the number of permitted bypass hops. If there is, it is determined as a regular communication packet, and if the difference is larger than the number of permitted bypass hops, it is a communication server comprising determination means for determining as an invalid communication packet. As a result, the current value of the number of hops of communication packets transmitted from a communication device that does not know the number of permitted bypass hops that can be known naturally by a communication device that communicates with the server remains large. Can be distinguished from each other, and illegal packets can be discarded or warnings can be output to the administrator.

  Here, it is preferable that the determination unit determines that there is an unauthorized communication to the communication device when the regular communication packet is not received from the communication device for a predetermined time. As a result, the server can detect that the communication device does not receive a communication packet that should be originally received from the communication device, and can output a warning to an administrator on the server side.

  ADVANTAGE OF THE INVENTION According to this invention, even if it is a case where fraud is detected in communication, the expansion of a wide range damage can be suppressed, maintaining the minimum required communication.

1 is a conceptual diagram showing a configuration of a communication system in an embodiment of the present invention. It is a figure which shows the structure of the communication apparatus in embodiment of this invention. It is a figure which shows the structure of the server in embodiment of this invention. It is a flowchart of the process in the communication apparatus in embodiment of this invention. It is a flowchart of the process in the server in embodiment of this invention.

<System configuration>
A communication system 100 according to the embodiment of the present invention includes a communication device 102, a management terminal 104, and a server 106, as shown in FIG. The communication device 102 is connected to the management terminal 104 through an information communication network 108 such as a LAN so that information can be transmitted. The communication device 102 is connected to the server 106 via an information communication network 110 such as a WAN so that information can be transmitted.

  The communication device 102 is configured to set the device body by receiving a predetermined service from the server 106 via the information communication networks 108 and 110. The communication device 102 receives management such as initial setting from the management terminal 104 via the information communication network 108.

  As shown in FIG. 2, the communication device 102 includes a processing unit 10, a communication unit 12, a storage unit 14, and a timer 16.

  The processing unit 10 includes means for controlling the communication device 102 in an integrated manner. The processing unit 10 functions as a TTL measuring unit 10a, a TTL setting unit 10b, a TTL changing unit 10c, a fraud detecting unit 10d, and an application unit 10e.

  The communication unit 12 is an interface for communicating with other communication devices via the information communication network 108. In this embodiment, it is preferable to use an interface for performing communication according to TCP / IP. For example, the communication unit 12 can be Ethernet (registered trademark) or the like.

  The storage unit 14 includes a memory device such as a semiconductor memory such as a ROM (Read Only Memory) and a RAM (Random Access Memory). The storage unit 14 stores at least the normal hop count 14a and the changed hop count 14b. The normal hop count 14a is a value of a lifetime (TTL: Time to Live) of a communication packet used in a normal state where no illegal communication occurs. In the present embodiment, the normal hop count 14a is set as a default value of the operation system (OS) setting. The changed hop count 14 b is a TTL value used when unauthorized communication is detected in the communication device 102. The changed hop count 14b is set to a value smaller than the normal hop count 14a.

  Here, the number of hops in the embodiment of the present invention indicates a number obtained by adding 1 to the number of routers through which a packet is transferred from one device to another device in the IP communication network. The IP packet is supposed to include a value for limiting the number of hops in the header when the packet is generated. This value is called TTL in IPv4 and called hop limit in IPv6. Hereinafter, this value is expressed as TTL. The TTL is expressed by 8 bits. The value of TTL is decremented by 1 every time an IP packet passes through the router. When the TTL becomes 0, the IP packet is controlled not to be relayed earlier, and an error packet is transmitted to the transmission source communication device.

  By changing the setting value of TTL, the range in which a packet can be transmitted can be limited. For example, it is possible to control the packet transmission range within a rough range such as in a building where a transmission source communication device is installed, in the same provider, or in Japan. When TTL is set to 0, communication is performed within the communication device 102, and communication with other communication devices cannot be performed.

  The TTL measuring unit 10a is a unit that measures the value of the number of hops necessary for the device to be a communication destination. The TTL setting unit 10b is a unit that causes the storage unit 14 to store the normal hop number 14a and the changed hop number 14b determined based on the hop number measured by the TTL measurement unit 10a. The TTL changing unit 10c is a unit that changes the TTL of a packet from the normal hop number 14a to the changed hop number 14b when an unauthorized operation occurs. The fraud detection unit 10d is a unit that detects fraud to the communication device performed on the communication device 102.

  The application unit 10e realizes the original function of the communication device 102 by communicating with other communication devices via the information communication networks 108 and 110. Note that the communication device 102 needs to continue to communicate with the management terminal 104 or the like even if communication is fraudulent due to the nature of the application means 10e.

  The timer 16 is used for measuring the duration of the state where the application means 10e does not function. When the time measured by the timer 16 exceeds a predetermined time (application non-operation determination time), it is determined that the service by the application unit 10e is not provided, and the fraud detection unit 10d is caused to function.

  The management terminal 104 manages devices such as initial settings and maintenance for the communication device 102. In addition, the management terminal 104 performs management at the time of communication fraud such that the communication device 102 is reset when communication with the communication device 102 is fraudulent or information is acquired from the communication device 102 and presented to the administrator. Also bears. The management terminal 104 can be a portable terminal such as a tablet or a smartphone. When determining the overall configuration of the communication system 100, the management terminal 104 is preferably arranged on the information communication network 108 having a smaller number of hops than other communication devices (such as the server 106) communicating with the communication device 102. In the example of FIG. 1, the management terminal 104 is disposed on the same information communication network 108 such as a LAN as the communication device 102. The management terminal 104 communicates with the communication device 102 and manages the communication device 102 in response to an instruction from a user interface unit (not shown) that performs screen display and user operation.

  As illustrated in FIG. 3, the server 106 includes a processing unit 20, a communication unit 22, a storage unit 24, and a time measuring unit 26.

  The processing unit 20 includes means for controlling the server 106 in an integrated manner. The processing unit 20 functions as a packet determination unit 20a, a device abnormality detection unit 20b, a warning output unit 20c, and a service providing unit 20d. The communication unit 22 is an interface for communicating with other communication devices via the information communication network 110. In the present embodiment, like the communication unit 12, it is preferable to use an interface for performing communication in accordance with TCP / IP. The storage unit 24 includes a memory device such as a semiconductor memory such as a ROM (Read Only Memory) and a RAM (Random Access Memory). The storage unit 24 stores at least the bypass allowable hop count 24a and the standby time 24b. The detour permitted hop count 24a is a value indicating a margin of the number of hops that may be detoured as a detour when transferring a packet. The standby time 24b is a setting value for determining that the communication is abnormal when the packet is not received from the communication device 102 and the period becomes equal to or longer than the standby time 24b. The timer unit 26 is a timer for measuring the packet reception interval. The timer 26 is reset at the timing when a new packet is received by the server 106, and starts measuring the time until the next packet is received.

  The packet determination unit 20a is a unit that determines whether the packet is a legitimate packet or an illegal packet when the server 106 receives the packet. The device abnormality detection unit 20b is a unit that determines a communication failure when communication from the communication device 102 has not been performed for a certain period of time. The warning output means 20c is a means for notifying the user of a warning when an unauthorized communication or device abnormality is detected. The service providing unit 20d is a unit that provides a service provided to the communication device 102 via communication. For example, an application program stored in advance in the storage unit 24 is executed, and a service is provided to the user through communication with the communication device 102. The content of the service provided to the user is not particularly limited.

<Communication processing>
The processing in the communication system 100 will be described below along the flowchart shown in FIG.

  In step S10, the number of hops is measured. The processing unit 10 of the communication device 102 functions as the TTL measuring unit 10a, and investigates the number of hops to a communication destination that needs to continue communication even in a state where communication is illegal and abnormality occurs. As such a communication destination, there is a management terminal 104 that manages the communication device 102. In FIG. 1, “hop number 5” is shown as an example of a result obtained by examining the number of hops from the communication device 102 to the management terminal 104.

  The following example can be considered as a method of investigating the number of hops performed by the TTL measuring unit 10a. (1) When the network configuration can be grasped in a LAN environment or a WAN environment, the number of hops from the communication device 102 to the management terminal 104 can be obtained based on the configuration. (2) The number of hops required from the communication device 102 to the management terminal 104 is measured at the initial setting. As a measurement method, the TTL of the packet transmitted from the communication device 102 to the management terminal 104 is increased from 1, and the minimum value in which a response indicating that the packet is received from the management terminal 104 is the hop count. This is a process corresponding to a traceroute command in UNIX (registered trademark). Further, when the TTL at the time of packet transmission from the management terminal 104 is known, the TTL is investigated when the packet from the management terminal 104 is received by the communication device 102, and the TTL at the time of reception is subtracted from the TTL at the time of transmission. You can find the number of hops.

  In step S12, the TTL setting unit 10b causes the storage unit 14 to store the obtained hop count as the changed hop count 14b. Note that the initial value of the TTL of the packet transmitted from the communication device 102 is set from the application via the OS, and when the communication is normal, the normal hop number 14a stored in the storage unit 14 is set. When there is an abnormality, the value is the value obtained by adding the number of changed hops 14b or the number of bypassable hops 24a.

  In step S14, time measurement by the timer 16 is started. In step S <b> 16, it is determined whether the application unit 10 e is performing a process that demonstrates the original function of the communication device 102. If the application means 10e has been processed, the process proceeds to step S20, and if not, the process proceeds to step S18. In step S18, it is determined whether or not the measurement by the timer 16 is up. If the timer 16 that has started measurement in step S14 reaches a predetermined time or more, the process proceeds to step S20, and if not, the process returns to step S16.

In step S20, fraud detection processing is performed. The processing unit 10 of the communication device 102 functions as the fraud detection unit 10d and performs fraud detection processing in communication. The following example can be considered when the fraud detection unit 10d determines that the fraud is illegal.
(Unauthorized 1) When a virus is detected in the communication device 102. At this time, virus detection software may be activated in the communication device 102.
(Unauthorized 2) A program other than a program for realizing a necessary function in the communication device 102 is activated. At this time, the communication device 102 may store a list of programs necessary for realizing the function in advance, and determine whether a program other than the programs registered in the list has been activated.
(Unauthorized 3) When communication is performed from the communication device 102 to a device other than the device that requires communication. At this time, the communication device 102 may store a list of addresses of devices that need communication in advance, and determine whether or not communication has been performed to an address other than those registered in the list.
(Unauthorized 4) When communication is performed with a device that is determined to be dangerous. At this time, the communication device 102 may store a list of addresses of devices determined to be dangerous in advance, and determine whether communication has been performed to the addresses registered in the list.
(Unauthorized 5) When communication with a device that is a normal communication destination is stopped. At this time, applying the same method as obtaining the number of hops to the communication destination required in the event of an abnormality, measuring the number of hops to the device that communicates during normal times, and adding a margin value to the measured value or measured value The value may be a normal TTL, and it may be determined whether or not a transfer cancellation notification is received from a router in the middle when communication is performed with this TTL set in a packet. When a transfer cancellation notification is received, it means that communication has been attempted to a communication destination other than the device that is normally the communication destination, suggesting that something unexpected has occurred in the communication device 102. Furthermore, the margin value may be varied. The reason for this is that some routers may be configured not to send a transfer stop notification, but the router that notifies the transfer stop can be changed by changing the margin value. This is because the communication device 102 can receive a transfer cancellation notification if the notification is set to be notified.
(Unauthorized 6) When there is a policy violation with respect to the forced access control to the OS in the communication device 102. Forcible access control is to set a policy such as whether to use network communication for a program or to access a specific file, and allow it within that policy while the program is running. Only allowed behaviors are allowed.
(Unauthorized 7) When the setting mode is changed by software or a physical switch, and the setting is changed without changing the mode, or when an attempt to change is detected.
(Unauthorized 8) When a physical attack against the communication device 102 such as opening the lid is detected.

  In step S22, if fraud is detected by the fraud detector 10d, the process proceeds to step S24. If no fraud is detected, the process returns to step S14.

  In step S24, processing for changing to TTL when fraud is detected in communication is performed. The processing unit 10 of the communication device 102 functions as the TTL changing unit 10c, and sets the changed hop count 14b as an initial value of the TTL of a packet transmitted thereafter. For example, in FIG. 1, the changed hop count 14b, which is a value obtained by adding 1 to the hop count from the communication device 102 to the management terminal 104, is the initial value of the TTL. As a result, the communication device 102 enters a state where the packet reaches only the management terminal 104.

  Specifically, if the application that is authorized to rewrite the TTL initial value setting value for the packet in the OS is rewritten from the normal hop number 14a to the changed hop number 14b, the TTL initial value setting value is rewritten. Good.

  After the processing in this step, the communication device 102 is in a state of transmitting only a packet with the number of hops that reaches only the minimum necessary management terminal 104, and the communication device 102 cannot communicate with the server 106. The risk that the server 106 is attacked by control can be reduced. For example, it is possible to prevent the communication device 102 from being hijacked by malware or the like and illegally transmitting a packet to an inappropriate communication destination.

  At the same time, communication between the communication device 102 and the management terminal 104 is maintained, and management of the communication device 102 by the management terminal 104 is not hindered, so that it is possible to quickly cope with communication fraud. In addition to the management function, if there is a function that is desired to continue even if there is a fraud, the function can be used continuously.

  In step S26, it is determined whether a recovery command has been received. If the communication device 102 receives a recovery command from the management terminal 104, the communication device 102 proceeds to step S28, and if not, repeats step S26. As a result, the state in which the TTL is changed to the changed hop count 14b due to communication fraud continues until the communication device 102 receives a recovery command from the management terminal 104 after the communication fraud is removed.

  In step S28, processing for changing to TTL when communication is normally restored is performed. The processing unit 10 of the communication device 102 functions as the TTL changing unit 10c, and returns the initial value of the TTL of the packet transmitted thereafter to the normal hop count 14a. As a result, the packet can be transmitted not only to the management terminal 104 but also to a communication device such as the server 106 as a transmission destination in normal communication.

  In step S30, it is determined whether or not to end the communication process. The processing unit 10 of the communication device 102 returns the process to step S14 if the communication process is not ended, and ends the process otherwise.

  On the other hand, the server 106 can detect that an abnormality in communication or fraud to the communication device 102 has occurred, and notify the user of a warning. Hereinafter, a method for detecting communication abnormality and fraud in the server 106 will be described with reference to the flowchart shown in FIG. Note that when the server 106 detects fraud to the communication device 102, the timer 26 is reset at the timing when a new packet is received from the communication device 102, and the time measurement is repeated.

  In step S40, it is determined whether a packet has been received before the time is up. The processing unit 20 of the server 106 functions as the device abnormality detection unit 20b and determines whether or not the time measured by the time measuring unit 26 has exceeded the standby time 24b. The standby time 24b is set to a value equal to or greater than the period at which packets are periodically transmitted from the communication device 102 to the server 106. If the time measured by the time measuring unit 26 exceeds the standby time 24b, the communication device 102 and the server It can be considered that an abnormality has occurred in communication with the network 106. Therefore, if the time measured by the time measuring unit 26 exceeds the standby time 24b, the process proceeds to step S48, and if not, the process proceeds to step S42.

  In step S42, it is determined whether or not the received packet is illegal. The processing unit 20 of the server 106 functions as the packet determination unit 20a, obtains a difference between the current TTL value of the received packet and the initial value of the TTL, and determines whether the packet is a regular packet or an illegal packet based on the difference. judge.

  If communication from the communication device 102 to the server 106 is not illegal, the number of hops of a packet from the communication device 102 to the server 106 is within a certain range even if a possible detour route is considered. Therefore, when the difference between the current TTL value of the packet received from the communication device 102 received by the server 106 and the initial value of the TTL is larger than the normal range, it is determined that the communication is invalid. Can do.

  Therefore, if the difference between the current TTL value of the received packet and the initial value of the TTL is less than or equal to the allowable bypass hop count 24a, the packet determining unit 20a determines that the packet is a normal communication packet, and the difference is the allowable bypass hop count. If it is larger than 24a, it is determined as an illegal communication packet.

  In step S44, if it is determined that the packet is invalid, the process proceeds to step S46. If it is determined that the packet is normal, the process returns to step S40, and the process is repeated for the next packet.

  In step S46, the user is notified of a warning indicating that the communication is illegal. The processing unit 20 of the server 106 functions as a warning output unit 20c and outputs a warning indicating to the user that an illegal packet has been communicated. For example, a warning message such as “Illegal packet received” is displayed on the display. Further, a packet determined to be illegal may be discarded.

  In step S48, the user is notified of a warning indicating that there was an abnormality in communication. The processing unit 20 of the server 106 functions as a warning output unit 20c and outputs a warning indicating to the user that the communication is abnormal. For example, a warning message such as “Communication status is abnormal” is displayed on the display.

  As described above, according to the communication system 100, when fraud is detected in communication with the communication device 102, the TTL of the packet transmitted from the communication device 102 is set to a value smaller than the normal value. Thus, communication to the server 106 that is remote from the communication device 102 is restricted to prevent the damage from spreading, and communication to the management terminal 104 near the communication device 102 can be continued. Then, the recovery operation of the communication device 102 can be performed from the management terminal 104 via the information communication network 108 close to the communication device 102 such as a LAN. Even if the communication device 102 is illegally hijacked, information in the communication device 102 is maliciously attacked by a DoS attack on the server 106 or the like connected to the information communication network 110 far from the communication device 102 using the communication device 102 as a stepping stone. Can be prevented from being transmitted to the server 106 or the like.

<Modification 1>
In the above embodiment, the normal hop count 14a is set as a default value of the operation system (OS) setting, but an appropriate TTL value may be obtained for the communication system 100 by the TTL measuring unit 10a.

  For example, if communication to the server 106 having the largest number of hops from the communication device 102 in providing a service in the communication system 100 is established, the normal hop number 14a is not a value specified by the OS, The number of hops is such that the packet can reach the server 106. Specifically, the number of hops from the communication device 102 to the server 106 is measured by the TTL measuring unit 10a, and the normal hop number 14a is a margin value that is allowed as a detour for the hop number or the hop number (for example, detouring) The value is set by adding the allowable hop count 24a). In FIG. 1, “hop count 10” is shown as an example of a result obtained by measuring the hop count from the communication device 102 to the server 106.

  By setting the initial value of the TTL of a packet sent from the communication device 102 in normal communication to the normal hop count 14a, the range accessible from the communication device 102 can be set to a range that can reach the server 106.

<Modification 2>
In the above embodiment, the same changed hop count 14b is applied when fraud occurs in communication. However, the values of a plurality of changed hop counts 14b corresponding to the type and degree of fraud are stored. Alternatively, the TTL setting value may be changed according to the type and degree of fraud that has occurred.

  For example, in the case of fraud in which there is a possibility that damage such as virus infection may be wide-ranging, the initial value of TTL is the number of hops that can be accessed from the communication device 102 to the management terminal 104 that requires minimum communication. Set to. On the other hand, when it is considered unlikely that the damage is widespread, such as when a program other than the program for realizing the necessary function is started in the communication device 102, access to the communication device other than the management terminal 104 is performed. However, the number of hops smaller than normal may be set as the initial value of TTL.

  Further, the initial value of the TTL may be changed according to the elapsed time from the time when the fraud occurs. For example, when a fraud occurs, the initial value of the TTL is set to a value that is smaller than the normal hop count 14a but maintains a certain wide access range. You may make it make the initial value of TTL small so that a range may become narrow.

  10 processing unit, 10a TTL measurement unit, 10b TTL setting unit, 10c TTL changing unit, 10d fraud detection unit, 10e application unit, 12 communication unit, 14 storage unit, 14a normal hop count, 14b changed hop count, 16 timer, 20 Processing unit, 20a packet determination unit, 20b device abnormality detection unit, 20c warning output unit, 20d service providing unit, 22 communication unit, 24 storage unit, 24a bypass allowable hop count, 24b waiting time, 26 timing unit, 100 communication system, 102 Communication equipment, 104 Management terminal, 106 Server, 108, 110 Information communication network.

Claims (5)

Fraud detection means for detecting fraud to communication devices;
Storage means for storing the number of hops smaller than the number of normal hops, which is the number of hops during normal communication, as the changed hop number;
Changing means for changing the number of hops of a communication packet transmitted after fraud is detected by the fraud detection means from the normal hop number to the changed hop number;
Equipped with a,
A communication device that measures the number of hops to a communication destination that continues communication after fraud is detected by the fraud detection means, and sets the changed hop number according to the number of hops to the communication destination . Fraud detection means for detecting fraud to communication devices;
Storage means for storing the number of hops smaller than the number of normal hops, which is the number of hops during normal communication, as the changed hop number;
Changing means for changing the number of hops of a communication packet transmitted after fraud is detected by the fraud detection means from the normal hop number to the changed hop number;
With
Measures the number of hops to a communication destination that provides a service in a state where there is no fraud to the communication device, and sets a value obtained by adding a predetermined number of permitted bypasses to the number of hops to the communication destination as the normal hop number Communication equipment characterized by this. The communication device according to claim 1 ,
Measures the number of hops to a communication destination that provides a service in a state where there is no fraud to the communication device, and sets a value obtained by adding a predetermined number of permitted bypasses to the number of hops to the communication destination as the normal hop number Communication equipment characterized by this. Fraud detection means for detecting fraud to communication devices;
Storage means for storing the number of hops smaller than the number of normal hops, which is the number of hops during normal communication, as the changed hop number;
A communication server that communicates with a communication device comprising: a changing unit that changes the number of hops of a communication packet that is transmitted after fraud is detected by the fraud detection unit from the normal hop number to the changed hop number;
The difference between the current value and the initial value of the hop count of the received communication packet is obtained, and if the difference is less than or equal to the allowable bypass hop count, it is determined as a regular communication packet. A communication server comprising determination means for determining as a valid communication packet. A communication server that communicates with the communication device according to any one of claims 1, 2, and 3,
  The difference between the current value and the initial value of the hop count of the received communication packet is obtained, and if the difference is less than or equal to the allowable bypass hop count, it is determined as a regular communication packet. A communication server comprising determination means for determining as a valid communication packet.

Images