JP6821311B2 - Relay device, communication system, relay method and relay program - Google Patents

Description

The present invention relates to a relay device, a communication system, a relay method, and a relay program for relaying data in data communication.

In recent years, everything has come to be connected to the Internet, as it is collectively called the IoT (Internet of Things). For example, a new protocol is used to connect the control network of a factory or plant that was communicating with the Internet.

By connecting to the Internet in this way, various benefits such as new added value and device management can be obtained, but from malicious persons using means such as unauthorized access and DoS attack (Denial of Service attack). It also puts you at risk.

However, for example, it is not easy to take countermeasures against threats from malicious persons for each of the equipment such as machine tools, sensors and cameras installed in factories and plants. This is because devices such as machine tools, sensors, and cameras may not be equipped with a function for taking such measures in the first place.

Therefore, it is important that the relay device that relays the communication of these devices, not the devices themselves, has a security function for responding to a threat from a malicious person.

An example of a relay device having such a security function is described in Patent Document 1. In the system described in Patent Document 1, a list of IP addresses considered to be related to malware infection or Dos attack is generated in advance.

Then, while monitoring the packet passing through the relay device, the header of the packet is referred to, and when the source IP address or the destination IP address in the header matches the address in the list, a traffic error occurs. Is detected.

By doing so, it becomes possible to respond to a threat from a malicious person.

Japanese Unexamined Patent Publication No. 2013-255196

In a technique for creating a list of communication destinations considered to have a problem, such as the technique described in Patent Document 1 described above, it is necessary to list all IP addresses of communication destinations considered to have a problem.

However, since it is possible to receive a new attack from an unknown IP address, it is very difficult to comprehensively list all the IP addresses of communication destinations that are considered to have problems. Further, in order to do so, it is necessary to update the list frequently, but depending on the environment, it is very difficult to update the list frequently.

Therefore, it is conceivable that an appropriate measure such as discarding a packet in the relay device cannot be sufficiently taken only by the technique described in Patent Document 1.

Therefore, an object of the present invention is to provide a relay device, a communication system, a relay method, and a relay program for performing appropriate processing at the time of relay.

According to the first aspect of the present invention, the first list is a list of data conditions to be processed first, and the second is a list of data conditions to be processed second. A storage means for storing a list, an analysis means for analyzing received data, a first comparison between the analysis result of the analysis means and the first list is performed, and the compared analysis result is the first comparison. If any of the conditions included in the list 1 does not match, the analysis result is added to the second list as a condition of the data to be processed in the second process, and the compared analysis result is the first. A list generation means that does not add the analysis result to the second list if any of the conditions included in the list of
A relay device is provided, which comprises.

According to the second aspect of the present invention, the communication system includes the relay device provided according to the first aspect and the setting-requiring terminal connected to the relay device, and the setting terminal accepts the communication system. Provided is a communication system characterized in that a part or all of the contents of each of the processes and the contents of each of the lists is changed in response to an operation from the user.

According to the third aspect of the present invention, the first list, which is a list of data conditions to be processed in the first process, and the second list, which is a list of data conditions to be processed in the second process. A storage step for storing a list, an analysis step for analyzing received data, and a first comparison, which is a comparison between the analysis result in the analysis step and the first list, are performed, and the compared analysis result is the first. If any of the conditions included in the list 1 does not match, the analysis result is added to the second list as a condition of the data to be processed in the second process, and the compared analysis result is the first. Provided is a relay device comprising: a list generation step of not adding the analysis result to the second list if any of the conditions included in the list is met.

According to the fourth aspect of the present invention, the first list, which is a list of data conditions to be processed in the first process, and the second list, which is a list of data conditions to be processed in the second process. A relay program that causes a computer provided with a storage means for storing a list to function as a relay device, wherein the computer is subjected to an analysis means for analyzing received data, an analysis result of the analysis means, and the first list. The first comparison, which is a comparison, is performed, and if the compared analysis result does not match any of the conditions included in the first list, the analysis result is used as a condition of the data to be the target of the second processing. A list generation means that adds to the second list and does not add the analysis result to the second list if the compared analysis results match any of the conditions included in the first list. Provided is a relay program characterized by functioning as a relay device provided.

According to the present invention, it is possible to perform appropriate processing at the time of relay.

It is a figure which shows the basic structure of each embodiment of this invention. It is a functional block diagram included in the security switch in each embodiment of this invention. It is a figure which shows the example of the prohibition list in each embodiment of this invention, and the example of the operation setting about the prohibition list. It is a figure which shows the example of the permission list in each embodiment of this invention, and the example of the operation setting about the permission list. It is a flowchart which shows the operation in the registration period of the 1st Embodiment of this invention. It is a figure which shows an example of the frame received in the registration period in each embodiment of this invention. It is a flowchart which shows the operation in the operation period of the 1st Embodiment of this invention. It is a figure which shows an example of the frame received in the operation period in each embodiment of this invention. It is a flowchart which shows the operation in the registration period of the 2nd Embodiment of this invention. It is a flowchart which shows the operation in the registration period of the 3rd Embodiment of this invention. It is a figure which shows the example of the permission list and the disposal list in the 3rd Embodiment of this invention, and the example of the operation setting about the disposal list.

First, an outline of an embodiment of the present invention will be described.

As described above, in the technology described in Patent Document 1, it is very difficult to list all the information such as the IP address that identifies the communication destination that is considered to have a problem. Therefore, it is conceivable that such a technique alone cannot sufficiently take appropriate measures such as discarding the frame in the relay device.

Therefore, in the embodiment of the present invention, it is considered that there is no problem as well as a list of information that identifies a communication destination that is considered to have a problem (such a list is hereinafter referred to as a "prohibited list"). Information that identifies the communication destination is made into a list (such a list is hereinafter referred to as "permission list"), transfer is permitted for frames that match this permission list, and frames that do not match this permission list are permitted. Adopt the method of discarding.

Further, embodiments of the present invention also provide the ability to automatically generate at least a portion of such a permission list.

Specifically, the relay device is provided with a registration period and an operation period. Then, the permission list is automatically generated by adding the frame input to the relay device to the permission list during the registration period. At this time, the automatically generated permission list may be manually added or deleted by the user's operation.

After that, the registration period is switched to the operation period, the frame input to the relay device is compared with the permission list automatically generated during the registration period, and if they match, the frame is passed, and if they do not match, the frame is discarded.

As a result, the permission list can be automatically generated and security management can be performed by the permission list.

However, during the registration period, a frame of a malicious person may be input, and in this case, the frame of this malicious person is also added to the permission list. If you switch to the operating state in this state, the frame of the malicious person will be allowed to communicate.

Therefore, in the embodiment of the present invention, during the registration period, when the permission list is generated, the prohibition list is referred to, and even if a frame matching the prohibition list is received, this frame is not added to the permission list. This makes it possible to prevent a malicious person from passing through the frame of a malicious person who matches the prohibition list.

The above is the outline of the embodiment of the present invention.

Next, an embodiment of the present invention will be described in detail with reference to the drawings. Here, three embodiments of the present invention will be described below.

First, the first embodiment is a basic embodiment, and performs the above-described processing as outlined in the present invention.

Next, in the second embodiment, in order to reduce the number of comparisons with the prohibited list during the registration period, the part that analyzes the frame compares with the permitted list being created and does not match the permitted list. The frame is to be compared with the forbidden list.

Further, in the third embodiment, a disposal list is created and used in order to further reduce the number of comparisons with the prohibited list during the registration period.

Hereinafter, these three embodiments will be described in order.

<First Embodiment>
Referring to FIG. 1, the present embodiment includes a security switch 100, a plurality of communication terminals 200, a setting terminal 300, an Internet 400, and a firewall 500.

Here, the security switch 100 is a security switch for relaying communication between communication terminals 200 and communication by the communication terminal 200 via the firewall 500 and the Internet 400.

In this regard, in the present embodiment, as shown in the figure, a firewall 500 is provided between the security switch 200 and the Internet 400. Then, by setting the firewall 500 according to the user's policy, it is possible to prevent the inflow of malicious data such as a virus from the Internet 400 and the outflow of unintended data to the Internet 400. it can.

However, although the firewall 500 functions in communication with devices existing on the Internet 400, it does not function in communication between each communication terminal 200. Therefore, in the present embodiment, in order to prevent inappropriate communication between the communication terminals 200, a security switch 100 equipped with a security function is connected instead of a simple relay device.

Then, the security switch 100 prevents the malicious frame from being transferred by performing the process using the above-mentioned permission list and prohibition list. The security switch 100 is provided with a plurality of connection ports, and each communication terminal 200 and the firewall 500 are connected to such ports.

The plurality of communication terminals 200 are terminals each having a communication function. The communication terminal 200 communicates with another communication terminal 200 via the security switch 100. Such communication is executed in accordance with general protocols such as IP (Internet Protocol), TCP (Transmission Control Protocol), and FTP (File Transfer Protocol). There are no particular restrictions on the content of the data actually exchanged, that is, what kind of content is included in the payload portion.

Further, for example, some communication terminals 200 may have a function of communicating with terminals existing on the Internet 400. Further, the communication terminal 200 may be realized by a terminal that is directly operated by the user, but may be realized by a device such as a machine tool, a sensor, and a camera installed in a factory or a plant. Further, it may be a device such as a PLC (Programmable Logic Controller) that controls a machine tool.

The setting terminal 300 is a terminal for making settings for the security switch 100. The setting terminal 300 is used by an administrator or the like who manages the present embodiment. The setting terminal 300 may be realized by a dedicated terminal for setting the security switch 100, but it may be realized by a general-purpose terminal such as a personal computer to which software or the like for setting the security switch 100 is added. Is also good.

The Internet 400 is connected to the security switch 100 via a firewall 500 in order for the communication terminal 200 and the like to communicate with the outside.

The firewall 500 has a function of monitoring data transmitted to and received from the Internet 400 and discarding data considered to be malicious.

Next, the functional block included in the security switch 100 will be described with reference to FIG. Referring to FIG. 2, the security switch 100 includes a frame analysis unit 110, a permission list generation unit 120, a prohibition list storage unit 130, and a permission list storage unit 140.

The frame analysis unit 110 analyzes the received input frame each time the security switch 100 receives the input frame from the outside. Here, the analysis is to extract predetermined information (hereinafter, referred to as "frame information") from the received input frame.

The frame information is, for example, predetermined information that is defined to be described by each protocol used for communication. As a specific example, it is necessary information of a higher layer than the layer 3 (IP header) information depending on the receiving port number, the layer 2 (MAC header) information, and the frame type. In the present embodiment, by using the frame information conforming to such a general-purpose protocol, it is possible to eliminate the need for processing such as embedding special information or the like in the payload portion.

Further, in the present embodiment, all of these information may be used in the frame information and each list, but a combination of some information may be used. For example, only layer 2 (MAC header) information may be used, or a combination of layer 2 (MAC header) information and layer 3 (IP header) information may be used.

Further, for example, if layer 2 (MAC header) information is used, all layer 2 (MAC header) information may be used, but a destination address (MAC-DA (Destination address)) which is a part of the information may be used. )), The destination address (MAC-SA (Source address)) may be used, or a combination thereof may be used.

The frame analysis unit 110 is set by the setting terminal 300 in two settings, "registration period setting" and "operation setting".

Here, in the present embodiment, as described above, there are two periods, the registration period and the operation period, and the registration period and the operation period are switched by the registration period setting. In addition, when a predetermined time elapses after being set to the registration period once, the operation period is automatically changed. The length of such a predetermined time can be arbitrarily set according to the environment. For example, in an environment where the contents of frames transmitted and received between the communication terminals 200 are limited, if one hour is required and all the limited frames are transmitted and received, the above-mentioned predetermined time Should be 1 hour. If it takes one week for all the limited frames to be transmitted and received, the above-mentioned predetermined time may be set to one week.

Further, in the operation setting, what kind of operation is performed depending on whether the frame information of the received input frame matches each list or does not match each list is set. For example, if it does not match the prohibition list or if it matches the allow list, it can be set to pass the corresponding frame. In addition, if the prohibition list is matched or the permission list is not matched, the corresponding frame can be set to be discarded. Further, here, “passing” means that the received input frame is passed through the frame analysis unit 110 and output, so that the frame is transferred to the destination corresponding to the destination address in the frame.

In addition to this, it is also possible to set whether or not to notify to that effect when the list matches or does not match. The content of the notification may be only that the list matches or does not match, but the frame corresponding to the frame information may be duplicated and the duplicated frame may be included in the notification. Then, for example, a virtual communication system may be created by the setting terminal 300, and the duplication of the frame may be communicated in the virtual communication system so that the influence of the malicious frame can be known.

The notification destination may be, for example, the setting terminal 300, or may be another server device or the like. Further, instead of or together with the notification, the frame corresponding to the frame information may be recorded inside the security switch 100. The administrator or the like who manages the present embodiment can grasp the communication status in the present embodiment by referring to the content of the notification and the content recorded in the security switch 100 as a log.

Note that frames that do not match the prohibited list during the registration period are frames that match the passing list during the operation period, so the same operation settings can be used for frames that do not match the prohibited list and frames that match the passing list. Conceivable. However, different operation settings may be used. For example, frames that do not match the prohibited list during the registration period may be passed and notification may be given, and frames that match the passing list during the operation period may be passed but not notified.

Further, the frame analysis unit 110 extracts the frame information from the received input frame at the time of receiving the input frame and during the registration period, and passes the frame information to the permission list generation unit 120 described later.

Then, after the processing of the permission list generation unit 120 is completed, if the passed frame information matches the prohibition list, the operation is performed according to the instruction of the corresponding operation setting. For example, if the setting is "discard, notify", the frame is discarded and the setting terminal 300 is notified that the frame has been discarded.

On the other hand, if the passed frame information does not match the prohibition list, the operation is performed according to the instruction of the corresponding operation setting. For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame. However, no notification will be given.

Further, when the input frame is received and during the operation period, the frame information is extracted from the received input frame. Then, the extracted frame information is compared with the permission list stored in the permission list storage unit 140.

As a result of comparison, if the frame information matches the permission list, it operates according to the setting of the corresponding operation setting. For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame. However, no notification will be given.

On the other hand, if the frame information does not match the permission list as a result of comparison, the operation is performed according to the setting of the corresponding operation setting. For example, if the setting is "discard, notify", the frame is discarded and the setting terminal 300 is notified that the frame has been discarded.

The permission list generation unit 120 is a part that generates a permission list stored in the permission list storage unit 140 during the registration period. The permission list generated by the permission list generation unit 120 does not initially include frame information, but the permission list generation unit 120 adds frame information to the permission list by performing the following operations. , Update the allow list.

First, the permission list generation unit 120 receives frame information from the frame analysis unit 110 during the registration period.

Then, the permission list generation unit 120 compares the received frame information with the prohibition list stored in the prohibition list storage unit 130. As a result of the comparison, if they match, the permission list generation unit 120 is notified that they match, and the processing for this frame information is completed.

On the other hand, if they do not match as a result of comparison, the permission list is updated by adding the received frame information to the permission list and stored in the permission list storage unit 140. The permission list generation unit 120 refers to the permission list storage unit 140 before storing the information, and when it is found that the same frame information as the frame information once added to the permission list is received again, the permission list generation unit 120 receives the frame information again. The frame information is not newly added to the allow list. This prevents the same frame information from being added to the allow list more than once. If the comparison results do not match, the permission list generation unit 120 is further notified that they do not match, and the processing for this frame information is completed.

After that, if the predetermined time elapses or the operation period is entered by the operation from the setting terminal 300, the permission list generation unit 120 does not need to perform any special processing.

The prohibition list storage unit 130 is a storage unit that stores the prohibition list. The prohibition list stored in the prohibition list storage unit 130 is referred to and used by the permission list generation unit 120.

The content of the prohibition list is set in the "prohibition list setting" from the setting terminal 300. The prohibition list is a list of frame information that is excluded from the permission list generation target. For example, frame information of a frame that is not suitable for passing through the frame analysis unit 110 is set. Specifically, a frame including frame information for specifying a frame of a protocol that is not used in each communication terminal 200 and an address representing a destination or a source that is not used in each communication terminal 200. The frame information for identifying is included in the prohibition list.

An example of the prohibition list stored in the prohibition list storage unit 130 is shown as Table 1-1 in the upper part of FIG. 3-1. Specifically, item No. 1 is an example that matches the case where the received input frame is an IPv6 frame (type). Item No. 2 is an example that matches the case where the received input frame is an IPv4 (type), TCP (protocol), and FTP (20-21) frame. Such information is input from the setting terminal 300 as described above. Such input may be based on the user's operation, and for example, an IP address having a poor score in IP reputation may be input. In addition, a prohibition list may be created based on the information of existing software such as antivirus software.

Further, an example of operation settings for the prohibition list set in the frame analysis unit 110 is shown in Table 1-2 at the bottom of FIG. 3-1. Specifically, when the frame information "matches" the prohibition list, the frame corresponding to the frame information is "discarded" and the notification is "sent". Further, when the frame information "does not match" with the prohibition list, the frame corresponding to the frame information is "passed" and the notification is "not" set.

The permission list storage unit 140 is a storage unit that stores the permission list. The permission list stored in the permission list storage unit 140 is generated by the permission list generation unit 120 during the registration period. Then, the permission list stored in the permission list storage unit 140 is referred to and used by the frame analysis unit 110 during the operation period.

In the permission list, for example, frame information of a frame to be passed through the frame analysis unit 110 is set. Specifically, a frame for specifying a frame of a protocol used in each communication terminal 200 and a frame including an address representing a destination or a source used in each communication terminal 200. The information is included in the allow list.

As described above, the permission list is generated by the permission list generation unit 120 during the registration period. In addition to this, the permission list may be modified by "permission list setting" from the setting terminal 300. For example, the administrator who uses the setting terminal 300 may be able to delete a part of the permission list or add new frame information to the permission list. In this way, for example, when a communication terminal 200 is newly added, it is possible to pass a frame related to the newly added communication terminal 200 without obtaining a registration period again. In addition, for example, when a part of the existing communication terminal 200 is removed, the frame information related to the removed communication terminal 200 can be deleted from the permission list without obtaining the registration period again.

This time, the elements constituting the prohibition list and the permission list are the device, layer 2, layer 3, and layer 4, but as described above, it is not always necessary to include all of them as elements, and some of them are combined. Or you may add other elements.

An example of the permission list stored in the permission list storage unit 140 is shown as Table 2-1 in the upper part of FIG. 3-2. In this example, two frame information is included in the allow list. These two frame information are the frame information of the frame received during the registration period and the frame information that does not match the prohibition list. The method of generating such a passing list will be described later with reference to the flowchart.

Further, an example of operation settings for the permission list set in the frame analysis unit 110 is shown in Table 2-2 at the bottom of FIG. 3-2. Specifically, when the frame information "matches" the permission list, the frame corresponding to the frame information is "passed" and the notification is "not" set. Further, when the frame information "does not match" in the permission list, the frame corresponding to the frame information is "discarded" and the notification is "sent".

Next, the operation of the present embodiment during the registration period will be described with reference to the flowchart of FIG.

The security switch 100 first determines whether or not the frame analysis unit 110 is set in the registration period (step S1). Here, if the registration period is set (Yes in step S1), the process proceeds to step S2. On the other hand, if it is not set in the registration period (No in step S1), that is, if it is set in the operation period, the process proceeds to step S11 in FIG.

In step S2, the frame analysis unit 110 analyzes the received frame and extracts the frame information. Then, the extracted frame information is passed to the permission list generation unit 120 (step S2). Table 0 shows an example of frame information extracted from the frames received during the registration period in FIG. It is assumed that the frame information of the received input frame is passed to the permission list generation unit 120 for 6 frames in the order of Table 0.

Next, the permission list generation unit 120 compares the passed frame information with the prohibition list stored in the prohibition list storage unit 130, and determines whether or not they match (step S3).

Here, for example, it is assumed that the frame information of the frame of the input sequence number 1 and the frame information of the frame of the input sequence number 2 in Table 0 are the targets of the determination. In this case, these frame information do not match the item No. 1 or item No. 2 of the prohibited list stored in the prohibited list storage unit 130 in Table 1-1 (No in step S3). In this case, the process proceeds to step S4.

In step S4, the frame information of the frame of the input sequence number 1 and the frame information of the frame of the input sequence number 2 determined in step S3 to be inconsistent with the prohibited list are added to the permission list by the permission list generation unit 120 and permitted. The permission list stored in the list storage unit 140 is updated (step S4).

Next, the permission list generation unit 120 tells the frame analysis unit 110 that the frame information of the frame of the input sequence number 1 and the frame information of the frame of the input sequence number 2 in Table 0 do not match the prohibition list. Notify (step S5).

Upon receiving such a notification, the frame analysis unit 110 operates when the frame with the input sequence number 1 or the frame with the input sequence number 2 does not match the prohibited list, which corresponds to the frame information that does not match the prohibited list. Process according to the setting instruction (step S6). For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame. However, no notification will be given.

Next, in step S9, it is confirmed whether the predetermined time has elapsed since the registration period was reached. Here, if it has passed (Yes in step S9), the process proceeds to step S11 in FIG.

On the other hand, if it has not elapsed (No in step S9), the process returns to step S2, and each of the above operations is repeated for the newly received frame.

On the other hand, if the frame information matches the prohibition list in step S3 (Yes in step S3), the process proceeds to step S7.

For example, it is assumed that the frame information of the frame of the input sequence number 3 and the frame information of the frame of the input sequence number 4 in Table 0 are the targets of the determination. In this case, these frame information coincides with item No. 1 of the prohibited list stored in the prohibited list storage unit 130 in Table 1-1 (Yes in step S3). Therefore, the process proceeds to step S7.

In addition, for example, it is assumed that the frame information of the frame of the input sequence number 5 and the frame information of the frame of the input sequence number 6 in Table 0 are the targets of the determination. In this case, these frame information coincides with item No. 2 of the prohibited list stored in the prohibited list storage unit 130 in Table 1-1 (Yes in step S3). Therefore, the process proceeds to step S7.

Next, the permission list generation unit 120 sets the frame information of the frame of the input sequence number 3, the frame information of the frame of the input sequence number 4, the frame information of the frame of the input sequence number 5, and the frame information of the input sequence number 6 in Table 0. The frame analysis unit 110 is notified that the frame information of the frame matches the prohibition list (step S7).

Upon receiving such a notification, the frame analysis unit 110 receives the frame of the input sequence number 3, the frame of the input sequence number 4, the frame of the input sequence number 5, and the frame of the input sequence number 6 corresponding to the frame information matching the prohibition list. In response to the above, processing is performed according to the instruction of the operation setting when the prohibition list is matched (step S8). For example, if the setting is "discard, notify", the frame is discarded and the setting terminal 300 is notified that the frame has been discarded.

Next, in step S9, it is confirmed whether the predetermined time has elapsed since the registration period was reached. Here, if it has passed (Yes in step S9), the process proceeds to step S11 in FIG.

On the other hand, if it has not elapsed (No in step S9), the process returns to step S2, and each of the above operations is repeated for the newly received frame.

By the above-described operation, in the present embodiment, the permission list can be generated and updated from the start of the registration period until the predetermined time elapses, and the frame having the frame information matching the prohibition list is discarded by the frame analysis unit 110. , A frame having frame information that does not match the prohibition list can be passed through the frame analysis unit 110.

Next, the operation when the permission list generated and updated in this way is used during the operation period will be described with reference to FIG.

First, when the security switch 100 receives an input frame during the operation period, the frame analysis unit 110 extracts the frame information by analyzing the received input frame (step S11). Here, an example of frame information extracted from the frames received during the operation period is shown in Table 3 in FIG. It is assumed that the frame information of the received input frames is extracted for 6 frames in the order shown in Table 3. The frame information in Table 3 and the frame information in Table 0 are the same. In other words, this time, it is assumed that the same frames were received in the same order during the registration period and the operation period. However, this is just for convenience of explanation, and in reality, different frames may be received in different orders during the registration period and the operation period.

Next, the frame analysis unit 110 compares the extracted frame information with the permission list stored in the permission list storage unit 140, and determines whether or not they match (step S12).

Here, for example, it is assumed that the frame information of the frame of the input sequence number 1 in Table 3 is the target of the determination. In this case, it matches the item number 1 of the permission list stored in the permission list storage unit 140 in Table 2-1 (Yes in step S12). Further, for example, it is assumed that the frame information of the frame of the input sequence number 2 in Table 3 is the target of the determination. In this case, it matches the item number 2 of the permission list stored in the permission list storage unit 140 in Table 2-1 (Yes in step S12).

Therefore, in these cases, the process proceeds to step S13.

In step S13, the frame analysis unit 110 instructs the frame of the input sequence number 1 and the frame of the input sequence number 2 corresponding to the frame information matching the permission list to set the operation when the frame matches the permission list. The process is performed according to (step S13). For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame. However, no notification will be given.

When the process of step S13 is completed, the process returns to step S11, and each of the above operations is repeated for the newly received frame.

On the other hand, if the frame information does not match the permission list in step S12 (No in step S12), the process proceeds to step S14.

For example, in Table 3, the frame information of the frame of the input sequence number 3, the frame information of the frame of the input sequence number 4, the frame information of the frame of the input sequence number 5, and the frame information of the frame of the input sequence number 6 are the targets of the determination. Suppose it was. In this case, these frame information do not match any of the items 1 and 2 of the permission list stored in the permission list storage unit 140 in Table 2-1 (No in step S12). Therefore, the process proceeds to step S14.

In step S14, the frame analysis unit 110 of the frame of the input sequence number 3, the frame of the input sequence number 4, the frame of the input sequence number 5, and the frame of the input sequence number 6 corresponding to the frame information that does not match the permission list. The frame is processed according to the instruction of the operation setting when it does not match the permission list (step S14). For example, if the setting is "discard, notify", the frame is discarded and the setting terminal 300 is notified that the frame has been discarded.

When the process of step S14 is completed, the process returns to step S11, and each of the above operations is repeated for the newly received frame.

According to the above-described operation, in the present embodiment, during the operation period, the frame analysis unit 110 passes the frame having the frame information that matches the permission list, and the frame analysis unit 110 passes the frame having the frame information that does not match the permission list. It can be discarded.

<Embodiment 2>
Next, the second embodiment will be described. In the first embodiment described above, the frame analysis unit 110 that has received the input frame during the registration period extracts frame information for all the input frames, and extracts all the frame information of all the input frames into the permission list generation unit. It was passed to 120 (step S2). That is, the permission list generation unit 120 compares all the frame information of all the input frames with the prohibition list (step S3).

However, when the prohibition list contains a lot of frame information of many item numbers, it is necessary to compare all these frames with the information, so that the processing by the permission list generation unit 120 takes time. It may take. Therefore, in the present embodiment, in order to reduce the number of comparisons with the prohibited list during the registration period, the frame analysis unit 110 first compares the frame information extracted from the input frame with the permitted list being created. Only the frames that do not match the permission list are passed to the permission list generation unit 120 and compared with the prohibition list.

This eliminates the need to compare all frame information of all input frames with the prohibition list, and in some situations, it is possible to speed up the entire processing. This is especially effective when the prohibition list contains a lot of frame information of many item numbers.

In this respect, since the overall configuration of the present embodiment and the configuration of the security switch 100 are the same as those of the first embodiment, the description thereof will be omitted. On the other hand, the operation of the frame analysis unit 110 during the registration period is different from that of the first embodiment, and this point will be described below.

FIG. 8 shows the operation of this embodiment. Here, the steps for performing the same operation as that of the first embodiment described with reference to FIG. 4 are designated by the same reference numerals as those in FIG. 4, and the description thereof will be omitted.

If Yes in step S1, that is, during the registration period, the process proceeds to step S21 instead of step S2. Here, in step S21, the frame analysis unit 110 analyzes the received input frame and extracts the frame information as in step S2 (step S21). Here, in step S2, all the extracted frame information is passed to the permission list generation unit 120, but in the present embodiment, the frame information is not passed to the permission list generation unit 120 at this stage.

Next, in step S22, the frame analysis unit 110 compares the frame information extracted in step S21 with the permission list being created stored in the permission list storage unit 140 (step S22). Here, in the incomplete permission list being created, it is assumed that the information of the item No. 1 of the permission list among the information in Table 2-1 of FIG. 3-2 is already registered in the permission list. .. On the other hand, it is assumed that the information of the item numbers after item 2 of the permission list is not yet registered.

Here, for example, it is assumed that the frame information of the frame of the input sequence number 1 in Table 0 is the target of the determination. In this case, it matches the item No. 1 of the above-mentioned unfinished permission list stored in the permission list storage unit 140 (Yes in step S22).

Therefore, in this case, the process proceeds to step S24.

In step S24, the frame analysis unit 110 processes the frame of the input sequence number 1 corresponding to the frame information matching the permission list according to the instruction of the operation setting when the frame matches the permission list (step S24). .. For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame. However, no notification will be given.

When the process of step S24 is completed, the process returns to step S21, and each of the above operations is repeated for the newly received frame.

On the other hand, if the frame information does not match the permission list in step S22 (No in step S22), the process proceeds to step S23.

For example, in Table 3, the frame information of the input sequence number 2, the frame information of the frame of the input sequence number 3, the frame information of the frame of the input sequence number 4, the frame information of the frame of the input sequence number 5, and the frame information of the input sequence number 6. It is assumed that the frame information of the frame is the target of the judgment. In this case, these frame information do not match any of the above-mentioned unfinished permission list items 1 and 2 stored in the permission list storage unit 140 in Table 2-1 (No in step S22). .. Therefore, the process proceeds to step S23.

Here, as shown in Table 2-2 of FIG. 3-2, in the operation setting of the permission list, if the permission list and the frame information do not match, it is set to "discard, not notify". In this regard, in the operation period of the present embodiment, as shown in Table 2-2, if the permission list and the frame information do not match, it is determined that "discard or not notify". On the other hand, in the registration period, that is, when the result is No in step S22 and the process proceeds to step S23, the frame analysis unit 110 operates as "waiting for notification of the permission list generation unit 120, not notifying". That is, the processing is not performed on the corresponding frame until the permission list generation unit 120 notifies whether or not it matches the prohibition list. Then, in order to receive such a notification, in step S23, the frame analysis unit 110 passes the frame information that does not match the permission list to the permission list generation unit 120.

For example, the frame analysis unit 110 may use the frame information of the input number order 2, the frame information of the frame of the input order number 3, the frame information of the frame of the input order number 4, the frame information of the frame of the input order number 5, and the input order number. The frame information of the 6 frames is passed to the permission list generation unit 120.

Then, the permission list generation unit 120 to which the frame information is passed executes the processes after step S3 as in the first embodiment.

Next, the permission list generation unit 120 compares the passed frame information with the prohibition list stored in the prohibition list storage unit 130, and determines whether or not they match (step S3).

Here, for example, it is assumed that the frame information of the frame of the input sequence number 2 in Table 0 is the target of the determination. In this case, these frame information do not match the item No. 1 or item No. 2 of the prohibited list stored in the prohibited list storage unit 130 in Table 1-1 (No in step S3). In this case, the process proceeds to step S4.

In step S4, the frame information of the frame of the input sequence number 2 determined in step S3 that does not match the prohibition list is added to the permission list by the permission list generation unit 120, and the permission list stored in the permission list storage unit 140 is stored. Is updated (step S4). As a result, the frame information of the frame of the input sequence number 2 is added to the item of the permission list item 2 in FIG. 3-2.

Next, the permission list generation unit 120 notifies the frame analysis unit 110 that the frame information of the frame of the input sequence number 2 in Table 0 does not match the prohibition list (step S5).

As described above, in step S23, the frame analysis unit 110, which has been waiting for the notification of the permission list generation unit 120 for the frame of the input sequence number 2, responds to the frame information that does not match the prohibition list when receiving such notification. The frame of the input sequence number 2 is processed according to the instruction of the operation setting when it does not match the prohibition list (step S6). For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame. However, no notification will be given.

Next, in step S9, it is confirmed whether the predetermined time has elapsed since the registration period was reached. Here, if it has passed (Yes in step S9), the process proceeds to step S11 in FIG.

On the other hand, if it has not elapsed (No in step S9), the process returns to step S2, and each of the above operations is repeated for the newly received frame.

On the other hand, if the frame information matches the prohibition list in step S3 (Yes in step S3), the process proceeds to step S7.

For example, it is assumed that the frame information of the frame of the input sequence number 3 and the frame information of the frame of the input sequence number 4 in Table 0 are the targets of the determination. In this case, these frame information coincides with item No. 1 of the prohibited list stored in the prohibited list storage unit 130 in Table 1-1 (Yes in step S3). Therefore, the process proceeds to step S7.

In addition, for example, it is assumed that the frame information of the frame of the input sequence number 5 and the frame information of the frame of the input sequence number 6 in Table 0 are the targets of the determination. In this case, these frame information coincides with item No. 2 of the prohibited list stored in the prohibited list storage unit 130 in Table 1-1 (Yes in step S3). Therefore, the process proceeds to step S7.

Next, the permission list generation unit 120 sets the frame information of the frame of the input sequence number 3, the frame information of the frame of the input sequence number 4, the frame information of the frame of the input sequence number 5, and the frame information of the input sequence number 6 in Table 0. The frame analysis unit 110 is notified that the frame information of the frame matches the prohibition list (step S7).

As described above, in step S23, the frame information of the frame of the input sequence number 3, the frame information of the frame of the input sequence number 4, the frame information of the frame of the input sequence number 5, and the frame information of the frame of the input sequence number 6 are permitted. Upon receiving such a notification, the frame analysis unit 110 waiting for the notification of the list generation unit 120 receives the frame information of the input sequence number 3, the frame of the input sequence number 4, and the input order corresponding to the frame information matching the prohibited list. The frame of the number 5 and the frame of the input sequence number 6 are processed according to the instruction of the operation setting when they match the prohibition list (step S8). For example, if the setting is "discard, notify", the frame is discarded and the setting terminal 300 is notified that the frame has been discarded.

Next, in step S9, it is confirmed whether the predetermined time has elapsed since the registration period was reached. Here, if it has passed (Yes in step S9), the process proceeds to step S11 in FIG.

On the other hand, if it has not elapsed (No in step S9), the process returns to step S2, and each of the above operations is repeated for the newly received frame.

By the above-described operation, in the present embodiment, in order to reduce the number of comparisons with the prohibited list during the registration period, the frame analysis unit 110 first compares the frame information extracted from the input frame with the permitted list being created. Is performed, and only the frames that do not match the permission list are passed to the permission list generation unit 120 to be compared with the prohibition list.

This eliminates the need to compare all frame information of all input frames with the prohibition list, and in some situations, it is possible to speed up the entire processing.

<Third embodiment>
In the second embodiment described above, during the registration period, the frame analysis unit 110 compares the extracted frame information with the permission list, thereby reducing the number of comparisons with the prohibition list by the permission list generation unit 120. Was there. Then, in the third embodiment, the permission list is further included in the disposal list in order to further reduce the number of comparisons with the prohibition list during the registration period as compared with the second embodiment.

This eliminates the need to compare all frame information of all input frames with the prohibition list, and in some situations, it is possible to speed up the entire processing. This is especially effective when the prohibition list contains a lot of frame information of many item numbers.

In this respect, since the overall configuration of the present embodiment and the configuration of the security switch 100 are the same as those of the first embodiment and the second embodiment, the description thereof will be omitted. On the other hand, the operation of the frame analysis unit 110 and the permission list generation unit 120 during the registration period is different from that of the first embodiment and the second embodiment, and this point will be described below.

FIG. 9 shows the operation of this embodiment. Here, the steps for performing the same operations as those of the first embodiment described with reference to FIG. 4 and the second embodiment described with reference to FIG. 8 are designated by the same reference numerals as those of FIGS. 4 and 8. Moreover, the description is omitted.

As shown in FIG. 9, in the present embodiment, the permission list generation unit 120 compares the frame information passed to the frame analysis unit 110 with the prohibition list stored in the prohibition list storage unit 130, and prohibits it. If it matches the list (Yes in step S3), step S33 is performed and then the process proceeds to step S7.

In step S33, the frame information that matches the prohibition list is stored in the permission list storage unit 140. In this respect, in the present embodiment, the frame information stored in step S4 and the frame information stored in step S33 are distinguished.

This point will be described with reference to FIG. In the first embodiment and the second embodiment, as shown in Table 2-1 of FIG. 3-2, the frame information stored in step S4 is used as the permission list. Then, the frame corresponding to the frame information that matches the permission list is passed.

On the other hand, in the present embodiment, as shown in Table 4-1 at the upper part of FIG. 10, by providing a type in the list stored in the permission list storage unit 140, the frame information stored in step S4 and the frame information stored in step S33 Realizes the distinction from the frame information to be stored. Specifically, an item called type is provided to distinguish between the "permission list" and the "disposal list". Here, Table 4-1 shows the finally completed list, but since it is necessary to explain the process of creating the list below, it is assumed that the list is incomplete below. Specifically, among the information in Table 4-1 of FIG. 10, the information of each item of item No. 1, item No. 3, item No. 4 and item No. 5 of the permission list is already permitted in the incomplete list. It is assumed that it is registered in the list. On the other hand, it is assumed that the information of the item No. 2 and No. 6 of the permission list is not yet registered. In this case, for example, the information finally registered as item No. 3 is registered as item No. 2 in the unfinished list. In other words, the item number changes fluidly according to the registration status. However, if the same information is called by different item numbers, the explanation becomes unclear. Therefore, in the following, each information will be referred to by the item number in the finally completed list as shown in Table 4-1.

Here, the type of the frame information stored in step S4 is an authorization list. Then, this is treated in the same manner as the permission list shown in Table 2-2 of FIG. 3-2.

On the other hand, the type of frame information stored in step S33 is a discard list. Then, as shown in Table 4-2 at the bottom of FIG. 10, the frame corresponding to the frame information matching the discard list is "discarded" by the frame analysis unit 110, and a notification to that effect is "discarded". ..

The frame corresponding to the frame information that does not match the discard list is set to "wait for notification of the permission list generation unit 120", and the notification to that effect is set to "not".

In order to perform these processes, the frame analysis unit 110 not only compares the extracted frame information with the permission list as in step S22, but also compares the extracted frame information with the discard list (step S31). .. If none of the above matches, the frame analysis unit 110 operates as "waiting for notification of the permission list generation unit 120, not notifying", as in the case where the result is No in step S22 and the process proceeds to step S23. That is, the processing is not performed on the corresponding frame until the permission list generation unit 120 notifies whether or not it matches the prohibition list. Then, in order to receive such a notification, the process proceeds to step S23 in the same manner as in step S22, and the frame information is passed to the permission list generation unit 120.

As described above, in the present embodiment, not only the permission list but also the discard list is compared in step S31. Therefore, the possibility of matching frame information is higher than that in step S22 in which only the permission list is compared.

Then, if the list matches either the permission list or the discard list (Yes in step S31), the frame analysis unit 110 performs processing according to the instruction of the operation setting corresponding to the matched list (step S32).

For example, since the frame information corresponding to the frame of the input sequence number 1 matches the unfinished permission list described above, processing is performed according to the instruction of the operation setting when the frame information matches the permission list (step S32). For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame. However, no notification will be given.

On the other hand, the frame information of the frame of the input sequence number 3, the frame information of the frame of the input sequence number 4, and the frame information of the frame of the frame information of the input sequence number 5 match the above-mentioned unfinished discard list. Therefore, the process is performed according to the instruction of the operation setting when it matches the discard list (step S32). For example, if the setting is "discard, notify", the frame is discarded and the setting terminal 300 is notified that the frame has been discarded. The operation setting when it matches the discard list is set from the setting terminal 300 or the like in the same manner as the operation setting when it matches the permission list.

On the other hand, if the frame information does not match either the permission list or the discard list in step S31 (No in step S31), the process proceeds to step S23.

For example, it is assumed that the frame information of the input number order 2 and the frame information of the frame of the input order number 6 in Table 3 are the targets of the determination. In this case, these frame information can be any of the above-mentioned unfinished permission list and the above-mentioned unfinished disposal list stored in the permission list storage unit 140, item 1, item 3, and item 4 item 5. Also does not match (No in step S22). Therefore, the process proceeds to step S23.

Here, as shown in Table 2-2 of FIG. 3-2, in the operation setting of the permission list, if the permission list and the frame information do not match, it is set to "discard, not notify". In this regard, in the operation period of the present embodiment, as shown in Table 2-2, if the frame information does not match the permission list or the disposal list, it is set as "discard or not notify". On the other hand, in the registration period, that is, when the result is No in step S22 and the process proceeds to step S23, the frame analysis unit 110 operates as "waiting for notification of the permission list generation unit 120, not notifying". That is, the processing is not performed on the corresponding frame until the permission list generation unit 120 notifies whether or not it matches the prohibition list. Then, in order to receive such a notification, in step S23, the frame analysis unit 110 passes the frame information that does not match the permission list to the permission list generation unit 120.

For example, the frame analysis unit 110 passes the frame information of the input number order 2 and the frame information of the frame of the input order number 6 to the permission list generation unit 120.

Then, the permission list generation unit 120 to which the frame information is passed executes the processes after step S3 as in the first embodiment.

Next, the permission list generation unit 120 compares the passed frame information with the prohibition list stored in the prohibition list storage unit 130, and determines whether or not they match (step S3).

Here, for example, it is assumed that the frame information of the frame of the input sequence number 2 in Table 0 is the target of the determination. In this case, these frame information do not match the item No. 1 or item No. 2 of the prohibited list stored in the prohibited list storage unit 130 in Table 1-1 (No in step S3). In this case, the process proceeds to step S4.

In step S4, the frame information of the frame of the input sequence number 2 determined in step S3 that does not match the prohibition list is added to the permission list by the permission list generation unit 120, and the permission list stored in the permission list storage unit 140 is stored. Is updated (step S4). As a result, the frame information of the frame of the input sequence number 2 is added as the type "permission list" to the item No. 2 of the list of FIG.

Next, the permission list generation unit 120 notifies the frame analysis unit 110 that the frame information of the frame of the input sequence number 2 in Table 0 does not match the prohibition list (step S5).

As described above, in step S23, the frame analysis unit 110, which has been waiting for the notification of the permission list generation unit 120 for the frame of the input sequence number 2, responds to the frame information that does not match the prohibition list when receiving such notification. The frame of the input sequence number 2 is processed according to the instruction of the operation setting when it does not match the prohibition list (step S6). For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame. However, no notification will be given.

Next, in step S9, it is confirmed whether the predetermined time has elapsed since the registration period was reached. Here, if it has passed (Yes in step S9), the process proceeds to step S11 in FIG.

On the other hand, if it has not elapsed (No in step S9), the process returns to step S2, and each of the above operations is repeated for the newly received frame.

On the other hand, if the frame information matches the prohibition list in step S3 (Yes in step S3), the process proceeds to step S33.

For example, it is assumed that the frame information of the frame of the input sequence number 6 in Table 0 is the target of the determination. In this case, these frame information coincides with item No. 2 of the prohibited list stored in the prohibited list storage unit 130 in Table 4-1 (Yes in step S3). Therefore, the process proceeds to step S33.

In step S33, the frame information of the frame of the input sequence number 6 determined to match the prohibition list in step S3 is added to the discard list by the permission list generation unit 120, and the discard list stored in the permission list storage unit 140 is displayed. It is updated (step S4). As a result, the frame information of the frame of the input sequence number 6 is added to the item of item 6 of the list of FIG. 10 as the type "discard list".

Next, the permission list generation unit 120 notifies the frame analysis unit 110 that the frame information of the frame of the input sequence number 6 in Table 0 matches the prohibition list (step S7).

As described above, in step S23, the frame analysis unit 110, which has been waiting for the notification of the permission list generation unit 120 for the frame information of the frame of the input sequence number 6, receives the notification and changes the frame information to match the prohibition list. The corresponding frame of the input sequence number 6 is processed according to the instruction of the operation setting when it matches the prohibition list (step S8). For example, if the setting is "discard, notify", the frame is discarded and the setting terminal 300 is notified that the frame has been discarded.

Next, in step S9, it is confirmed whether the predetermined time has elapsed since the registration period was reached. Here, if it has passed (Yes in step S9), the process proceeds to step S11 in FIG.

On the other hand, if it has not elapsed (No in step S9), the process returns to step S2, and each of the above operations is repeated for the newly received frame.

The above is the operation of this embodiment. Here, as described above in the description of step S31, in the present embodiment, the frame analysis unit 110 also compares with the discard list. That is, the frame analysis unit 110 can also make a determination on the frame information determined by the permission list generation unit 120 once it matches the prohibition list. Therefore, the possibility of matching is higher than that of step S22, which compares only with the permission list.

Therefore, in the present embodiment, the number of comparisons with the prohibited list during the registration period can be further reduced as compared with the second embodiment.

In the operation period, the permission list is used in step S12, but it is not necessary to use the disposal list.

Each of the above-mentioned security switch, communication terminal, and setting terminal can be realized by hardware, software, or a combination thereof. Further, the relay method performed by the above-mentioned security switch, communication terminal and setting terminal can also be realized by hardware, software or a combination thereof. Here, what is realized by software means that it is realized by a computer reading and executing a program.

Programs can be stored and supplied to a computer using various types of non-transitory computer readable media. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-temporary computer-readable media include magnetic recording media (eg, flexible disks, magnetic tapes, hard disk drives), photomagnetic recording media (eg, photomagnetic discs), CD-ROMs (Read Only Memory), CD- Includes R, CD-R / W, semiconductor memory (eg, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (random access memory)).

Further, although the above-described embodiment is a preferred embodiment of the present invention, the scope of the present invention is not limited to the above-described embodiment, and various modifications have been made without departing from the gist of the present invention. It can be implemented in the form.

For example, each embodiment can be modified as follows.

In each of the above embodiments, the security switch is connected to the Internet, but it is not always necessary to connect to the Internet. Even when not connected to the Internet, it is possible to detect a malicious frame that occurs when, for example, a malicious user connects an unauthorized terminal to the corporate network.

In each of the above-described embodiments, the operation period is reached after a predetermined time has elapsed after the registration period, and the operation is continued. In this case, the operation period may be changed to the registration period again, and if a predetermined time elapses after the transition, the operation period may be changed again. That is, the permission list may be updated by re-registering.

For example, when a new communication terminal is added after the transition of the operation period, the frame related to the added communication terminal may be added to the permission list by re-registering. In this case, the permission list may be left blank and the permission list may be recreated from scratch, or new frame information may be added to the existing permission list.

Although it has been described that the disposal list is created in the third embodiment, a list other than the disposal may be created. For example, instead of discarding the frame, a list may be created to transfer the frame to a device other than the original destination (for example, a server for storing logs). Then, the frame whose frame information matches this list may be transferred to a device other than the original destination (for example, a server for storing a log).

Further, although the disposal list is stored in the permission list storage unit in the third embodiment, a separate storage unit may be provided and this storage unit may store the disposal list.

Further, in the description of the operation of each embodiment, the six received frame information is described in parallel with reference to the flowchart, but the frame information is not performed for a plurality of frames at once in this way. The operation may be performed each time one is received. That is, each of the above steps may be executed each time one frame is received.

Some or all of the above embodiments may also be described, but not limited to:

(Appendix 1) A storage means for storing a first list, which is a list of data conditions to be processed in the first process, and a second list, which is a list of data conditions to be processed in the second process. ,
Analysis means to analyze the received data and
The analysis result of the analysis means is compared with the first list, which is the first comparison, and if the compared analysis result does not match any of the conditions included in the first list, the analysis result is obtained. If the condition of the data to be the target of the second processing is added to the second list and the comparison analysis result matches any of the conditions included in the first list, the analysis result is referred to as the above. List generation means that is not added to the second list,
A relay device characterized by being provided with.

(Appendix 2) The second process includes transferring the data targeted for the second process to the destination of the transmission data.
The relay device according to Appendix 1, wherein the first process does not include transferring the data targeted for the process to the destination of the transmission data.

(Appendix 3) The analysis means corresponds to the analysis result if the result of the first comparison by the list generation means and the comparison analysis result match any of the conditions included in the first list. The first process is performed on the received data to be performed, and if the compared analysis result does not match any of the conditions included in the first list, the received data corresponding to the analysis result is subjected to the first process. The relay device according to Appendix 1 or 2, wherein the process of 2 is performed.

(Appendix 4) The analysis means performs a second comparison, which is a comparison between the analysis result of the received data and the second list, prior to the execution of the first comparison by the list generation means, and the comparison is performed. If the analysis result is consistent with any of the conditions included in the second list, the second process is performed on the received data corresponding to the analysis result, and the compared analysis result is the second. The relay device according to any one of Supplementary note 1 to 3, wherein if the analysis result does not match any of the conditions included in the list, the analysis result is subject to the first comparison by the list generation means.

(Appendix 5) The storage means is a third process, which is a process that does not include transferring the data targeted for the process to the destination of the transmitted data, and is a list of conditions for the data targeted for the third process. Remember the list further,
If the analysis result targeted for the first comparison matches any of the conditions included in the first list, the list generating means sets the analysis result as the target data for the third process. Add to the third list as a condition of
When the second comparison is performed, the analysis means further compares the analysis result with the third list, and if the compared analysis result matches the conditions included in the third list. For example, the relay device according to any one of Supplementary Provisions 1 to 4, wherein the third process is performed on the received data corresponding to the analysis result.

(Appendix 6) After the second list is generated by operating the list generation means for a predetermined time, the first comparison and the second comparison are not performed, and thereafter, the analysis means , The analysis result of the received data is compared with the second list, and if the compared analysis result matches the conditions included in the second list, the received data corresponding to the analysis result is described. The second process is performed, and if the compared analysis result does not match the conditions included in the second list, the first process is performed on the received data corresponding to the analysis result. The relay device according to any one of Supplementary notes 1 to 5.

(Appendix 7) If a predetermined operation is received from the user after the first comparison and the second comparison are not performed, the first comparison and the second comparison are performed again. The relay device according to Appendix 6, further comprising generating the second list.

(Appendix 8) A communication system including the relay device according to any one of Supplementary notes 1 to 7 and a setting-requiring terminal connected to the relay device.
A communication system characterized in that a part or all of the contents of each of the processes and the contents of each of the lists is changed according to an operation from a user received by the setting terminal.

(Appendix 9) A storage step for storing a first list, which is a list of data conditions to be processed in the first process, and a second list, which is a list of data conditions to be processed in the second process. ,
Analysis steps to analyze the received data and
The analysis result in the analysis step is compared with the first list, which is the first comparison, and if the compared analysis result does not match any of the conditions included in the first list, the analysis result is obtained. If the condition of the data to be the target of the second processing is added to the second list and the comparison analysis result matches any of the conditions included in the first list, the analysis result is referred to as the above. List generation steps that are not added to the second list,
A relay device characterized by being provided with.

(Appendix 10) A storage means for storing a first list, which is a list of data conditions to be processed in the first process, and a second list, which is a list of data conditions to be processed in the second process. It is a relay program that makes the equipped computer function as a relay device.
The computer
Analysis means to analyze the received data and
The analysis result of the analysis means is compared with the first list, which is the first comparison, and if the compared analysis result does not match any of the conditions included in the first list, the analysis result is obtained. If the condition of the data to be the target of the second processing is added to the second list and the comparison analysis result matches any of the conditions included in the first list, the analysis result is referred to as the above. List generation means that is not added to the second list,
A relay program characterized in that it functions as a relay device provided with.

The present invention is suitable for security measures in a relay device.

100 Security switch 110 Frame analysis unit 120 Permission list generation unit 130 Prohibition list storage unit 140 Permission list storage unit 200 Communication terminal 300 Setting terminal 400 Internet

Claims (10)

A storage means for storing a prohibition list , which is a list of data conditions to be processed in the first process, and an allow list , which is a list of data conditions to be processed in the second process.
Analysis means to analyze the received data and
The first comparison, which is a comparison between the analysis result of the analysis means and the prohibition list , is performed, and if the comparison analysis result does not match any of the conditions included in the prohibition list , the analysis result is referred to as the second. A list generation means that adds to the permission list as a condition of data to be processed, and does not add the analysis result to the permission list if the compared analysis result matches any of the conditions included in the prohibition list. And with
Prior to the execution of the first comparison by the list generation means, the analysis means makes a second comparison between the analysis result of the received data and the permission list , and the comparison analysis result is the permission. If any of the conditions included in the list is matched, the second process is performed on the received data corresponding to the analysis result, and the compared analysis result matches any of the conditions included in the allowed list. If not, the analysis result is used as the target of the first comparison by the list generation means .
The storage means further stores a third list, which is a list of conditions for the data to be processed, which is a process of not transferring the data to be processed to the destination of the received data.
If the analysis result targeted for the first comparison matches any of the conditions included in the prohibited list , the list generation means sets the analysis result as a condition for data subject to the third processing. To the third list above,
When the second comparison is performed, the analysis means further compares the analysis result with the third list, and if the compared analysis result matches the conditions included in the third list. For example, a relay device characterized in that the third process is performed on the received data corresponding to the analysis result. The second process includes transferring the data targeted for the second process to the destination of the received data.
The relay device according to claim 1, wherein the first process does not transfer the data targeted for the process to the destination of the received data. The analysis means refers to the received data corresponding to the analysis result if the result of the first comparison by the list generation means matches any of the conditions included in the prohibited list . The first process is performed, and if the compared analysis result does not match any of the conditions included in the prohibited list , the second process is performed on the received data corresponding to the analysis result. The relay device according to claim 1 or 2. A storage means for storing a prohibition list , which is a list of data conditions to be processed in the first process, and an allow list , which is a list of data conditions to be processed in the second process.
Analysis means to analyze the received data and
The first comparison, which is a comparison between the analysis result of the analysis means and the prohibition list , is performed, and if the comparison analysis result does not match any of the conditions included in the prohibition list , the analysis result is referred to as the second. A list generation means that adds to the permission list as a condition of data to be processed, and does not add the analysis result to the permission list if the compared analysis result matches any of the conditions included in the prohibition list. And with
Prior to the execution of the first comparison by the list generation means, the analysis means makes a second comparison between the analysis result of the received data and the permission list , and the comparison analysis result is the permission. If any of the conditions included in the list is matched, the second process is performed on the received data corresponding to the analysis result, and the compared analysis result matches any of the conditions included in the allowed list. If not, the analysis result is used as the target of the first comparison by the list generation means .
After the permission list is generated by operating the list generation means for a predetermined time, the first comparison and the second comparison are not performed, and thereafter, the analysis means of the received data. The analysis result is compared with the permission list , and if the comparison analysis result matches the conditions included in the permission list , the second process is performed on the received data corresponding to the analysis result, and the comparison is performed. A relay device characterized in that the first process is performed on the received data corresponding to the analysis result if the analysis result does not match the conditions included in the permission list . If a predetermined operation is received from the user after the first comparison and the second comparison are not performed, the first comparison and the second comparison are performed again to further obtain the above. The relay device according to claim 4 , wherein the permission list is generated. A communication system including the relay device according to any one of claims 1 to 5 and a setting terminal connected to the relay device.
A communication system characterized in that a part or all of the contents of each of the processes and the contents of each of the lists is changed according to an operation from a user received by the setting terminal. The prohibition list , which is a list of data conditions to be processed in the first process, and the allow list , which is a list of data conditions to be processed in the second process, are stored.
Analyze the received data and
The first comparison, which is a comparison between the analysis result and the prohibited list , is performed, and if the compared analysis result does not match any of the conditions included in the prohibited list , the analysis result is set as the target of the second process. Add as a condition of data to the authorization list, without adding if the analysis result obtained by said comparison matches any of the conditions included in the prohibited list the analysis result to the authorization list,
Prior to executing the first comparison, a second comparison is performed between the analysis result of the received data and the permission list , and the comparison analysis result matches any of the conditions included in the permission list. If so, the second process is performed on the received data corresponding to the analysis result, and if the compared analysis result does not match any of the conditions included in the permission list , the analysis result is referred to as the first. To be compared with
A third list, which is a list of conditions for the data to be processed, is further stored, which is a process of not transferring the data to be processed to the destination of the received data.
If the analysis result targeted for the first comparison matches any of the conditions included in the prohibited list , the third list is used as the condition for the data subject to the third processing. Add to
When performing the second comparison, the analysis result and the third list are further compared, and if the compared analysis result matches the conditions included in the third list, the analysis result is selected. A relay method comprising performing the third process on the corresponding received data. A computer having a storage means for storing a prohibition list , which is a list of data conditions to be processed in the first process, and an allow list , which is a list of data conditions to be processed in the second process, functions as a relay device. It ’s a relay program
The computer
Analysis means to analyze the received data and
The first comparison, which is a comparison between the analysis result of the analysis means and the prohibition list , is performed, and if the comparison analysis result does not match any of the conditions included in the prohibition list , the analysis result is referred to as the second. A list generation means that adds to the permission list as a condition of data to be processed, and does not add the analysis result to the permission list if the compared analysis result matches any of the conditions included in the prohibition list. and, to function as,
Prior to the execution of the first comparison by the list generation means, the analysis means makes a second comparison between the analysis result of the received data and the permission list , and the comparison analysis result is the permission. If any of the conditions included in the list is matched, the second process is performed on the received data corresponding to the analysis result, and the compared analysis result matches any of the conditions included in the allowed list. If not, the analysis result is used as the target of the first comparison by the list generation means.
The storage means further stores a third list, which is a list of conditions for the data to be processed, which is a process of not transferring the data to be processed to the destination of the received data.
If the analysis result targeted for the first comparison matches any of the conditions included in the prohibited list , the list generation means sets the analysis result as a condition for data subject to the third processing. To the third list above,
When the second comparison is performed, the analysis means further compares the analysis result with the third list, and if the compared analysis result matches the conditions included in the third list. For example, a relay program characterized in that the third process is performed on the received data corresponding to the analysis result. The prohibition list , which is a list of data conditions to be processed in the first process, and the allow list , which is a list of data conditions to be processed in the second process, are stored.
Analyze the received data and
The first comparison, which is a comparison between the analysis result and the prohibited list , is performed, and if the compared analysis result does not match any of the conditions included in the prohibited list , the analysis result is set as the target of the second process. Add as a condition of data to the authorization list, without adding if the analysis result obtained by said comparison matches any of the conditions included in the prohibited list the analysis result to the authorization list,
Prior to executing the first comparison, a second comparison is performed between the analysis result of the received data and the permission list , and the comparison analysis result matches any of the conditions included in the permission list. If so, the second process is performed on the received data corresponding to the analysis result, and if the compared analysis result does not match any of the conditions included in the permission list , the analysis result is referred to as the first. To be compared with
After generating the permission list for a predetermined time, and it is not performed the first comparison and the second comparison, thereafter, the comparison of the analysis results and the permission list for the received data, the comparison If the analysis result matches the condition included in the permission list , the second process is performed on the received data corresponding to the analysis result, and the compared analysis result matches the condition included in the permission list. If not, the relay method is characterized in that the first processing is performed on the received data corresponding to the analysis result. A computer having a storage means for storing a prohibition list , which is a list of data conditions to be processed in the first process, and an allow list , which is a list of data conditions to be processed in the second process, functions as a relay device. It ’s a relay program
The computer
Analysis means to analyze the received data and
The first comparison, which is a comparison between the analysis result of the analysis means and the prohibition list , is performed, and if the comparison analysis result does not match any of the conditions included in the prohibition list , the analysis result is referred to as the second. A list generation means that adds to the permission list as a condition of data to be processed, and does not add the analysis result to the permission list if the compared analysis result matches any of the conditions included in the prohibition list. And let it function as
Prior to the execution of the first comparison by the list generation means, the analysis means makes a second comparison between the analysis result of the received data and the permission list , and the comparison analysis result is the permission. If any of the conditions included in the list is matched, the second process is performed on the received data corresponding to the analysis result, and the compared analysis result matches any of the conditions included in the allowed list. If not, the analysis result is used as the target of the first comparison by the list generation means.
After the permission list is generated by operating the list generation means for a predetermined time, the first comparison and the second comparison are not performed, and thereafter, the analysis means of the received data. The analysis result is compared with the permission list , and if the comparison analysis result matches the conditions included in the permission list , the second process is performed on the received data corresponding to the analysis result, and the comparison is performed. A relay program characterized in that the first processing is performed on the received data corresponding to the analysis result if the analysis result does not match the conditions included in the permission list .

Images