JP5930355B1 - Data diode device with specific packet relay function and setting method thereof - Google Patents

Abstract

A data diode device with a specific packet relay function capable of obtaining data at an arbitrary timing from a network protected with a simple configuration and a setting method thereof. A data diode device with a specific packet relay function is connected between an external network and an internal network. The data diode device 14 with the specific packet relay function includes a first unit 21 and a second unit 22 connected by a signal line Q. The first unit 21 connected to the external network 15 includes a plurality of packets. Registration information is registered in the first reference table T1 in association with the signal line Q. The second unit 22 connected to the internal network 16 has a second reference table T2 having the same contents as the first reference table T1. By activating the signal line corresponding to the packet registration information including the transmission source IP address, the destination IP address, and the application data included in the packet received by the first unit 21, the contents of the packet and the internal network are transmitted to the second unit 22. 16 that the packet to be transmitted is received. The second unit 22 generates a packet based on the packet registration information and sends it to the second network. The data diode device 14 with the specific packet relay function relays a packet from the internal computer 12 to the external computer 11 using a one-way transmission path S that transmits data in one direction. [Selection] Figure 2

Description

  The present invention relates to a data diode device with a specific packet relay function and a setting method thereof.

  For example, there is known a data collection system that collects data related to an operation state in a data center for monitoring / maintenance of the operation state of the plant and improvement of operation efficiency. In such a data collection system, an information requesting computer installed in a data center and an information providing computer installed in a plant are connected via a network. The information requesting computer sends a request to the information providing computer via the network to cause the information providing computer to acquire data relating to the operating state or to transmit the data to the information requesting computer. One information providing computer acquires data according to the request, stores the data in a packet, and transmits the data to the information requesting computer via the network.

  In the data collection system as described above, in order to protect the network equipment in the plant including the information providing side computer from unauthorized access, information leakage, invasion of computer viruses, etc., the network (hereinafter referred to as the network equipment) connected to the network equipment in the plant is referred to. Security for the internal network is secured by connecting a firewall to the boundary between the internal network and the external network.

  As a device for ensuring reliable security, a device called a data diode that physically limits communication in one direction is known. The data diode is installed at the boundary between the internal network and the external network, and permits only data transmission from the network device of the internal network to the network device of the external network. Such a data diode does not block data transmission in the direction of the internal network by software communication control, but completely blocks based on a physical principle. For example, the data diode is provided with a light emitting device and a light receiving device for optical communication in only one direction, and is completely limited to data transmission in only one direction. In serial communication such as Ethernet (registered trademark) or RS-232C, a configuration in which one of the bidirectional signal lines is disconnected can be similarly realized.

  By the way, a security device such as the above-mentioned firewall controls the flow of packets by software inside the device. For this reason, the security device becomes a target of a cyber attack, and the control of the security device is illegally altered from the outside, which may allow unauthorized access to the internal network. For this reason, security cannot be maintained over a long period of operation unless proper operations such as periodic password changes and confirmation and handling of abnormal messages are neglected. On the other hand, unlike a device that controls / blocks communication by software, a data diode physically limits communication in one direction, so the function for limiting the communication direction is not altered, and Unauthorized access is not allowed. Accordingly, security can be maintained even during long-term operation.

  However, since the data diode completely blocks communication from the outside to the internal network, when used in the data collection system as described above, the data diode transmits data transmitted from the information providing side computer connected to the internal network. There is a problem that the contents and the transmission timing are limited to predetermined contents and transmission timing. That is, various requests from the information requesting computer connected to the external network cannot be transmitted to the information providing computer. Therefore, even limited requests that can be expected such as external factors such as a temporary data transmission stop request due to a failure of a device on the external network side or a data retransmission request in the event of a reception error It cannot be communicated from outside to inside.

  The present invention has been made in view of the above circumstances, has a simple configuration, secures high security, and allows a specific packet permitted from an external request or the like to a network protected by a data diode. An object of the present invention is to provide a data diode device with a specific packet relay function that can be sent and a setting method thereof.

  The data diode device with a specific packet relay function of the present invention includes a first unit connected to the first network, a second unit connected to the second network, and a packet received from the second network from the second unit. A one-way transmission path that transmits only one direction to one unit, and a packet relay unit that relays only permitted specific packets among packets received from the first network to the second network, The first packet registration information is provided for each of the signal line portion including a plurality of signal lines provided between the first unit and the second unit, and the specific packet that is provided in the first unit and permits relaying. Whether the packet from the first network is registered in advance as the first packet registration information. If the packet is a registered packet, a packet determination unit that activates the signal line corresponding to the first packet registration information for the packet and a second unit and a relay that permits relaying The second packet registration information is registered in advance for each of the packets, and in response to the activation of one of the signal lines, the first packet registration information corresponding to the activated signal line is set based on the first packet registration information. A packet restoring unit that generates a restoration packet corresponding to the packet received by the unit and sends the packet to the second network.

  In the setting method of the data diode device with the specific packet relay function of the present invention, the configuration information for setting is loaded into the first and second programmable logic devices, respectively, and the communication wiring is provided inside the first and second programmable logic devices. By forming the packet transmission path for sending the packet from the first network side to the second network side, the packet registration information including the transmission source information, destination information and application data is acquired from the packet on the packet transmission path. A first forming step of forming an information acquisition unit to be performed in at least one of the first and second programmable logic devices; a transmitting step of transmitting a specific packet permitting relay from the first network device toward the second network device; , Packets sent in the send step Information acquisition step for acquiring the packet registration information from the information acquisition unit, and the packet registration information acquired in the information acquisition step corresponds to either the signal line in the first or second reference table as the first or second packet registration information Information registration step to be registered, and after the information registration step, the first normal configuration information is loaded into the first programmable logic device to form at least a first control unit in the first programmable logic device. A second forming step of configuring at least a second control unit in the second programmable logic device to configure the second unit by configuring one unit and loading the second normal configuration information into the second programmable logic device; It is what has.

  According to the data diode device with a specific packet relay function of the present invention, a packet from the second network to the first network is transmitted using a one-way transmission path, and the relay of the packet from the first network to the second network is performed as follows: When a packet registered as first packet registration information is received on the first unit side, the signal line corresponding to the first packet registration information is activated, and the second packet registration corresponding to the activated signal line is made Since the restoration packet corresponding to the packet received by the first unit is generated from the information and sent to the second network, the network device of the second network in which only a specific packet permitted from outside is protected with a simple configuration The second unit cannot be modified from the first network side. It is possible to ensure a high level of security,

  Further, according to the setting method of the data diode device with the specific packet relay function of the present invention, the setting information is loaded into the first and second programmable logic devices constituting the first and second units and validated. Since packet registration information is acquired from the packets flowing in the packet transmission path and registered in the first and second reference tables, each packet that allows relaying is transmitted through the packet transmission path, so that each packet can be handled. The first and second reference tables in which the packet registration information to be registered can be created, and the setting of the data diode device with the specific packet relay function according to the connected system becomes easy.

It is explanatory drawing which shows the outline of the data collection system which implemented this invention. It is a block diagram which shows the structure of the data diode apparatus with a specific packet relay function. It is explanatory drawing which shows an example of the content of each reference table. It is explanatory drawing which shows an example of the content of a port number conversion table. It is explanatory drawing which shows an example of a communication sequence. It is explanatory drawing which shows an example of the change of a header. It is explanatory drawing which shows the circuit structure formed in FPGA in normal mode. It is a flowchart which shows the procedure from the setting mode to the operation in the normal mode. It is explanatory drawing which shows the circuit structure formed in FPGA in setting mode.

[First Embodiment]
As shown in FIG. 1, in the data acquisition system 10 embodying the present invention, the first and second external computers 11a and 11b receive the data from the first and second internal computers 12a and 12b as data diodes with a specific packet relay function. This is a system for collecting data via a device (hereinafter simply referred to as a data diode device) 14. For example, the first and second internal computers 12a and 12b are arranged in the plant, and the external computer 11 is arranged outside the plant. The first and second internal computers 12a and 12b acquire various process data such as temperature and pressure measured by the sensors arranged in the plant, and the external computer 11 receives the process data from the first and second internal computers 12a. , 12b. The data acquired from the internal computer 12 is not limited to process data. In the following description, the first and second external computers 11a and 11b are collectively referred to as the external computer 11 when it is not necessary to distinguish between them. The first and second internal computers 12a and 12b are collectively referred to as the internal computer 12 when it is not necessary to distinguish between them.

  The external network 15 as the first network is provided with a plurality of first network devices including the external computer 11. The internal network 16 serving as the second network is provided with a second network device including the internal computer 12. The data diode device 14 is connected to the boundary between the external network 15 and the internal network 16. The data diode device 14 transmits packets from the internal network 16 to the external network 15 and relays only specific packets permitted in advance from the external network 15 to the internal network 16. The internal network 16 is a network protected by the data diode device 14 from unauthorized access from the outside.

  In this example, the external computer 11 and the data diode device 14, and the internal computer 12 and the data diode device 14 all perform communication by TCP / IP, that is, the Internet protocol suite. The data collection system 10 uses, for example, Ethernet (registered trademark) in the network interface layer (corresponding to the first and second layers of the OSI reference model) of the TCP / IP four-layer model. In order to simplify the description, in this example, the packet relayed by the data diode device 14 is a packet using TCP as a protocol in the transport layer. The communication protocol is not particularly limited.

  The external computer 11 transmits and receives packets to and from the internal computer 12 via the external network 15, the data diode device 14, and the internal network 16. As a result, the external computer 11 acquires process data from the internal computer 12. As is well known, a packet is transmitted to a header (in this example, equivalent to the fourth layer of the OSI reference model) in application data generated by processing in the application layer (the fifth to seventh layers of the OSI reference model). A PDU (Protocol Data Unit) in which a header (in this example, an IP header) in the Internet layer (corresponding to the third layer of the OSI reference model) is further added to a segment generated by adding a TCP header) A frame with an Ethernet header added to the packet is transmitted and received.

  When acquiring process data from the internal computer 12, the external computer 11 sends a packet storing a request message described later as application data to the external network 15. Although the data diode device 14 is interposed between the external computer 11 and the internal computer 12, the external computer 11 gives the IP address of the internal computer 12 as the destination IP address of the packet. When the request message is stored in the received packet, the internal computer 12 reads out the process data specified by the request message, and sends the packet storing the read process data to the internal network 16. The external computer 11 extracts application data such as process data stored in the received packet.

  In the following description, when a packet storing a request message is particularly distinguished from other packets, the packet is referred to as a request packet. When a packet storing process data returned in response to a request packet is particularly distinguished from other packets, the packet is referred to as a response packet.

  The data diode device 14 includes a first unit 21 connected to the external network 15 and a second unit 22 connected to the internal network 16. The first unit 21 receives a packet transmitted from the external network 15 toward the internal network 16, and the received packet is a packet in which first packet registration information (to be described later) is registered (hereinafter referred to as a registration packet). It is determined whether or not. If the received packet is a registration packet, the first unit 21 sends signal lines Q1, Q2,... Qn corresponding to the first packet registration information of the registration packet (see FIG. 2, signal lines Q1, Q2,. ..., When there is no need to distinguish Qn, any one of the signal lines Q) is activated. The second unit 22 identifies the content of a registration packet received by the first unit 21 from second packet registration information (to be described later) corresponding to the activated signal line Q, and a packet corresponding to the received registration packet (restoration) Packet) is generated and sent to the internal network 16.

  The data diode device 14 receives a packet from the internal network 16 by the second unit 22 and transmits the packet to the first unit 21 via the one-way transmission path S (see FIG. 2). 21 sends the packet to the external network 15. As a result, the process data addressed to the external computer 11 from the internal computer 12 is sent to the external computer 11. The packet relayed by the data diode device 14 to the internal network 16 is not limited to a request packet for acquiring process data, but in the following, the data diode device 14 has several request packets as relay packets. Is assumed to be registered in advance.

  In FIG. 2, the data diode device 14 is provided between first and second units 21 and 22, a signal line portion 23 including a plurality of signal lines Q, and the first unit 21 and the second unit 22. The transmission line 24 is provided. The first unit 21 includes a first communication unit 31, a first storage unit 32, a first control unit 33, and a reception unit 34. The second unit 22 includes a second communication unit 41, a second storage unit 42, a second control unit 43, and a transmission unit 44.

  The packet determination unit 51 is configured by the first control unit 33 provided in the first unit 21 and the first reference table T1 stored in the first storage unit 32. Further, the packet restoration unit 52 is configured by the second control unit 43 provided in the second unit 22 and the second reference table T2 stored in the second storage unit 42. The packet determination unit 51, the packet restoration unit 52, and the signal line unit 23 constitute a packet relay unit 53. Further, the transmission line 24, the receiving unit 34 of the first unit 21, and the transmitting unit 44 of the second unit 22 constitute a unidirectional transmission path S.

  The first communication unit 31 of the first unit 21 is connected to the external network 15. The first communication unit 31 receives a packet directed to the internal network. In this example, the first communication unit 31 receives a packet to which a destination IP address of the first packet registration information registered in the first reference table T1 is assigned among the packets from the external network 15. Note that the network address of the internal network 16 may be set in advance in the first communication unit 31, for example, and a packet whose destination IP address matches the network address may be received.

  The first communication unit 31 extracts a transmission source IP address, a destination IP address, application data (hereinafter collectively referred to as reception packet information) and a transmission source port number from the received packet, and sends them to the first control unit 33. In addition, the first communication unit 31 sends out the packet from the receiving unit 34 configuring the one-way transmission path S to the external network 15. As a result, the response packet is transmitted to the external computer 11 which is the transmission source of the corresponding request packet.

  The first storage unit 32 stores the first reference table T1 and the port number conversion table Tp described above. As shown in FIG. 3, the first reference table T1 includes first packet registration information for each specific packet permitted to be relayed and a signal indicating one signal line Q corresponding to the first packet registration information. A plurality of records including a line number and an interval time are registered. The signal line number of each record and the first packet registration information correspond one-to-one. The first packet registration information in this example is stored in a source IP address, a destination IP address, a source port number stored in a TCP header, a destination port number, and a TCP data part stored in the IP header in the packet. Consists of application data. In this example, the source IP address in the first packet registration information is the source information, the destination IP address is the destination information, and it is used to determine whether the combination of these and application data is a registration packet. It is done.

  The transmission source IP address, destination IP address, destination port number, and application data of the first packet registration information are registered in the request packet that is actually transmitted from the external computer 11 to the internal computer 12. On the other hand, as the transmission source port number of the first packet registration information, a unique port number is assigned in advance to each first packet registration information.

  In this example, Modbus / TCP is used as an application protocol. For this reason, a message compliant with TCP / Modbus is registered as application data of the first packet registration information. As is well known, the TCP / Modbus message is composed of data such as a function code for instructing reading and writing of data (process data) to a register provided in the internal computer 12 and an address range at the time of reading and writing. If the process data to be read is the same, the TCP / Modbus request message is the same.

  In the port number conversion table Tp, as shown in FIG. 4, the first control unit 33 registers a conversion record in which the port number before conversion and the port number after conversion are associated with each other. This port number conversion table Tp is used to convert the destination port number of the response packet to the transmission source port number of the corresponding request packet when the response packet is sent to the external computer 11.

  In FIG. 2, the first control unit 33 determines whether or not the packet received by the first communication unit 31 is a registration packet as described above. In this determination, the first control unit 31 checks whether the received packet information is included in any of the first packet registration information in the first reference table T1. In this determination, when the received packet information is included in any one of the first packet registration information, that is, all of the transmission source IP address, the destination IP address, and the application data are included in any one of the first packet registration information. If it is included, it is determined that the packet is a registration packet. The first control unit 33 acquires the signal line number corresponding to the first packet registration information (hereinafter referred to as the first corresponding packet registration information) including them, and activates the signal line Q of the acquired signal line number. To.

  Moreover, the 1st control part 33 registers a conversion record into the port number conversion table Tp whenever it determines with a registration packet. In this registration, the transmission source port number of the registration packet is set as a pre-conversion port number, and the transmission source port number of the first relevant packet registration information is set as a post-conversion port number. The conversion record is deleted by the first control unit 33 after elapse of the interval time of the first relevant packet registration information that is the basis of the converted port number, for example.

  Note that the destination port number of the packet transmitted from the information requesting external computer 11 to the information providing internal computer 12 is generally fixed for each communication partner application. For this reason, in this example, when the application data of the received packet and the first packet registration information match, it is considered that the destination port number also matches, and the destination port number is used to determine whether or not it is a registration packet. Not. Of course, the destination port number may be used for determination as one piece of destination information. On the other hand, as the transmission source port number of the packet transmitted by the external computer 11, an arbitrary port number is generally given by the external computer 11. Therefore, in this example, the transmission source port number is not used for determining whether or not the packet is a registration packet. Of course, when the transmission source port number is fixed, it can be one of the transmission source information. In this case, it is not necessary to create the port number conversion table Tp.

  When the first control unit 33 receives a new packet having the same received packet information as the previously received packet, the first control unit 33 activates the signal line Q in response to the previously received packet. Is within the interval time of the first packet registration information corresponding to, the signal line Q is not activated for a new packet. Thereby, the internal computer 12 is protected from a so-called flood attack in which a large number of packets are transmitted in a short time. Note that the starting point for counting the interval time may be the time when the previously received packet is received.

  The number of signal lines Q may be equal to or more than the same number as the first packet registration information registered in the first reference table T1. In this example, a metal line is used as the signal line Q. The first control unit 33 includes a plurality of switches connected to each of the signal lines Q, and turns on the switch connected to the signal line number corresponding to the first corresponding packet registration information. As a result, the signal line Q corresponding to the first corresponding packet registration information is made active, in this example, high level. Note that the signal line Q may be active at a low level. The signal line Q only needs to be able to tell the second unit 22 whether or not it is active. As the signal line Q, for example, a light emitting diode and a light receiving element are used, and when activated, the first unit 21 lights the light emitting diode, and the second unit 22 detects the light emitting diode lighting by the light receiving element. Good.

  The receiving unit 34 receives a packet from the second unit 22 via the transmission line 24. The receiving unit 34 refers to the port number conversion table Tp and converts the destination port number of the packet received from the second unit 22. That is, the receiving unit 34 uses the destination port number of the received packet as the post-conversion port number of the port number conversion table Tp, and replaces the pre-conversion port number corresponding to the post-conversion port number with the destination port number of the received packet. Thereby, the destination port number of the response packet is converted into the transmission source port number of the corresponding request packet. The receiving unit 34 sends a packet with the destination port number replaced to the first communication unit 31.

  Each signal line Q is connected to the second control unit 43 of the second unit 22. As shown in FIG. 3, a second reference table T2 having the same contents as the first reference table T1 is written in the second storage unit 42. In the second reference table T2, the packet registration information of each record is the second packet registration information. The second packet registration information includes the signal line Q (signal line number) of the first packet registration information having the same content. It is associated. Thus, the first and second packet registration information for the same packet is registered so as to correspond to the same signal line Q.

  The second control unit 43 responds to the activation of one of the signal lines Q, the second packet registration information associated with the signal line number of the activated signal line Q, that is, the first corresponding Second packet registration information having the same content as the packet registration information (hereinafter referred to as second relevant packet registration information when specifically distinguished from other second packet registration information) is read from the second reference table T2, and the second relevant packet is read. A packet to which application data, a source IP address, a destination IP address, a source port number, and a destination port number of registration information are assigned is generated. As a result, a restoration packet corresponding to the packet received by the first unit 21 is generated based on the second corresponding packet registration information. The packet generated by the second control unit 43 is sent to the second communication unit 41. In the second reference table T2, the interval time can be omitted.

  The second communication unit 41 is connected to the internal network 16. The second communication unit 41 sends the packet generated by the second control unit 43 to the internal network 16. Thereby, the packet generated by the second control unit 43 is sent to the internal computer 12. In addition, the second communication unit 41 sends the packet received from the internal network 16 to the transmission unit 44.

  When generating a packet from the second relevant packet registration information, the transmission source port number may be replaced with an arbitrary port number, and the transmission source IP address may be replaced with the IP address of the second unit 22. In this case, the destination port number and destination IP address of the packet returned by the internal computer 12 correspondingly are replaced with the source port number and source port number of the second relevant packet registration information, and then the packet is sent to the first unit. 21 is transmitted.

  As described above, the unidirectional transmission path S is composed of the receiving unit 34 of the first unit 21, the transmitting unit 44 of the second unit 22, and the transmission line 24, and the communication direction is from the second unit 22 side. The data diode is physically limited to one direction toward the first unit 21. For example, the transmission unit 44 includes a light emitting element, a modulation circuit that modulates light output from the light emitting element according to input data, a transmission side circuit for error correction, and the like. It comprises a demodulation circuit that demodulates data according to the received light intensity, a receiving side circuit for error correction, and the like. The transmission line 24 uses an optical fiber that connects between the light emitting element of the transmitting unit 44 and the light receiving element of the receiving unit 34. The one-way transmission path S is input to the transmission unit 44 as data to be transmitted by the packet from the second communication unit 41, and the input data is sent to the reception unit 34 via the transmission line 24.

  The one-way transmission line S is not limited to the above-described configuration as long as it is limited to one-way communication. From the viewpoint of ensuring one-way transmission, for example, the communication direction is physically set as described above. Preferably, the configuration is limited to the above. For error correction, it is preferable to use a forward error correction method that does not require a data retransmission request when an error occurs.

  As described above, the packet received by the receiving unit 34 is sent to the first communication unit 31 after the destination port number is converted, and the first communication unit 31 sends the packet to the external network 15. As a result, a response packet of the requested process data is transmitted to the external computer 11 that has requested the process data from the internal computer 12.

  The transmission mode of application data is not limited to the above mode. For example, application data obtained from each response packet may be temporarily stored in a buffer or the like and then transmitted together via the one-way transmission line S, and information such as a destination IP address and a destination port number may be transmitted. In this case, on the first unit 21 side, a packet to be transmitted to the external computer 11 is reconstructed from the collectively received application data, information such as the destination IP address and destination port number, and transmitted.

  From the second unit 22 to the first unit 21, at least application data and information that enables the first unit 21 to identify the destination of application data may be sent using the one-way transmission path S. For example, the application data extracted from the packet and the destination port number may be sent. In this case, the source IP address of the first packet registration information whose source port number matches the destination port number may be used as the destination IP address of the response packet.

  The first unit 21 configured as described above is for the first network device on the external network 15, and the second unit 22 is for the second network device on the internal network 16 below the transport layer. The operation below the transport layer does not change depending on the application, the connected device, etc., so that a fixed function may be realized and a simple configuration can be achieved.

  The functions of the first and second units 21 and 22 constituting the data diode device 14 can be configured by using, for example, a personal computer. In this case, for example, two personal computers are arranged, a program for realizing the functions of the first and second units 21 and 22 is introduced, and one is the first unit 21 and the other is the second unit 22. . As the signal line Q, connection between terminals such as general-purpose input / output ports provided in each personal computer is used. As the unidirectional transmission line S, only one direction of bidirectional signal lines such as RS-232C of each personal computer is connected.

  On the other hand, the first and second units 21 and 22 are represented by, for example, an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array) as in a second embodiment described later. It can also be realized using a programmable logic device (PLD) or the like. The PLD can have an arbitrary circuit configuration by combining a plurality of circuit blocks and can form various processing circuits. However, it is difficult to change the processing circuit itself after the circuit configuration. Therefore, the aspect using ASIC or PLD in this way makes it impossible to modify the function, for example, rewrite the contents of the first reference table T1, and make it difficult to change the operation contents of the first control unit 33. . As a result, the risk of unauthorized access from the external network 15 to the internal computer 12 can be extremely reduced.

  Next, the operation of the above configuration will be described by taking as an example a case where process data is acquired from the first internal computer 12a by operating the second external computer 11b. In the following description, as shown in FIG. 1, the IP address of the first external computer 11a is “192.168.100.1”, and the IP address of the second external computer 11b is “192.168.100. 2 ”. Also, the IP address of the first internal computer 12a is “192.168.1.1”, and the IP address of the second internal computer 12b is “192.168.1.2”. Furthermore, it is assumed that the contents shown in FIG. 3 are registered in the first reference table T1 and the second reference table T2.

  First, the second external computer 11b is operated to instruct acquisition of process data from the first internal computer 12a. In response to this instruction, the second external computer 11b establishes a TCP connection with the first internal computer 12a. Therefore, the second external computer 11b first broadcasts an ARP request that stores the IP address of the first internal computer 12a as the destination IP address.

  The first communication unit 31 of the first unit 21 registers the first packet registration information in which the IP address of the first internal computer 12a is the destination IP address in the first reference table T1, and thus the ARP request In response to this, the ARP reply storing its own MAC address is returned to the ARP request source. Accordingly, the second external computer 11b acquires the MAC address of the first communication unit 31 from the ARP reply. Thereafter, when the second external computer 11b sends a packet using the IP address of the first internal computer 12a as the destination IP address, the MAC address of the first communication unit 31 is set as the destination MAC address. Then, the second external computer 11b transmits a SYN packet using the IP address of the first internal computer 12a as the destination IP address. As a result, as shown in FIG. 5, the SYN packet, the ACK + SYN packet, and the ACK packet are transmitted / received between the second external computer 11b and the first communication unit 31, and a TCP connection is established. Is done. Note that, when the external computer 11, the internal computer 12, and the first and second communication units 31 and 41 transmit packets, the source MAC addresses are their own MAC addresses.

  After the TCP connection is established, the second external computer 11b generates a request packet P1 (see FIGS. 5 and 6) in which a request message corresponding to the process data to be acquired is stored in the TCP data portion, and the request packet P1 Is sent to the external network 15. As shown in FIG. 6, the source IP address given to the request packet P1 is the IP address “192.168.100.2” of the second external computer 11b, and the destination IP address is the first internal computer 12a. The IP address is “192.168.1.1”. The request packet is assigned a port number corresponding to TCP / Modbus (502 in this example) as the destination port number, and an arbitrary port number (1501 in this example) is assigned to the source port number. Yes.

  The first communication unit 31 receives the request packet P1 and sends the received packet information extracted from the request packet P1 and the transmission source port number to the first control unit 33. Upon receiving the received packet information and the source port number, the first control unit 33 checks whether any of the first packet registration information registered in the first reference table T1 includes the received packet information. Then, it is determined whether or not the request packet P1 is a registration packet.

  When the first packet registration information including the received packet information is not in the first reference table T1, it is determined that the request packet P1 is not a registration packet. When it is determined that the packet is not a registration packet in this way, the first control unit 33 disconnects the connection between the first communication unit 31 and the second external computer 11b, for example. On the other hand, when the first packet registration information including the received packet information, that is, the first corresponding packet registration information is in the first reference table T1, the request packet P1 is determined to be a registration packet. In this case, the signal line Q corresponding to the first packet registration information is activated (high level) for a predetermined time.

  For example, when the content of the application data of the request packet P1 is “0001 0000 0006 11 03 008A 00E3”, the first packet registration information corresponding to the signal line number “2” of the first reference table T1 is the first. It becomes the corresponding packet registration information. Accordingly, the first control unit 33 activates the signal line Q2 of the signal line number “2”. As a result, as indicated by a broken line in FIG. 5, the first control unit 33 sends a packet including the first packet registration information corresponding to the signal line number “2” to the second control unit 43 through the signal line Q2. It is transmitted that one unit 21 has received.

  Further, the first control unit 33 registers a conversion record corresponding to the request packet P1 in the port number conversion table Tp. As shown in FIG. 6, the conversion record R1 in which the transmission source port number “1501” of the request packet P1 is the port number before conversion and the transmission source port number “3002” of the first relevant packet registration information is the conversion port number. Is registered.

  On the other hand, when any one of the signal lines Q becomes active as described above, the second control unit 43 identifies the signal line number of the activated signal line Q. Then, the second packet registration information corresponding to the specified signal line number, that is, the second corresponding packet registration information having the same content as the first corresponding packet registration information is read from the second reference table T2. Then, the second communication unit 41 is allowed to establish a TCP connection with the network device having the destination IP address of the second corresponding packet registration information as the IP address. The second communication unit 41 uses the ARP to acquire the MAC address corresponding to the destination IP address of the second corresponding packet registration information, and then uses the destination IP address of the second corresponding packet registration information to use the SYN packet and ACK + SYN. A TCP connection is established by transmitting and receiving a packet and an ACK packet.

  When the TCP connection is established, the second control unit 43 includes, in the application data of the second corresponding packet registration information, a TCP header having the destination port number and the source port number of the second corresponding packet registration information, and the second corresponding A packet to which an IP header having the destination IP address and the source IP address of the packet registration information is added is generated. Then, the generated packet is sent from the second communication unit 41 to the internal network 16.

  When the signal line Q2 is activated as described above, the second packet registration information corresponding to the signal line number “2” becomes the second corresponding packet registration information. Since the destination IP address of the second relevant packet registration information is the same as that of the first internal computer 12a as the request packet P1, a TCP connection is established between the second communication unit 41 and the first internal computer 12a. Since the second corresponding packet registration information has the same content as the first corresponding packet registration information, the second control unit 43 causes the request packet P2 having substantially the same content as the request packet P1 (FIG. 5, Is generated). That is, the request packet P2 has the same source IP address, destination IP address, destination port number, and request message (application data) as that of the request packet P1, and the source port number corresponds to the first and second sources. This is the transmission source port number “3002” of the packet registration information.

  In this way, with a simple configuration using the signal line Q, the contents of the packet to be transmitted to the internal network 16 and the transmission timing of the packet are transmitted from the first unit 21 to the second unit 22, and the second corresponding A packet corresponding to the packet received by the first unit 21 from the packet registration information is restored and sent to the internal network 16.

  The request packet P2 sent to the internal network 16 is received by the first internal computer 12a. The first internal computer 12a extracts the request message from the request packet P2, and processes it with a predetermined application corresponding to the destination port number. As a result, the process data corresponding to the request message is extracted from the designated address range, and a response packet P3 (see FIGS. 5 and 6) storing this is generated. The response packet P3 is sent from the first internal computer 12a to the internal network 16. For example, although an ACK flag for an acknowledgment response to the request packet P2 is set in the response packet P3, an ACK packet may be transmitted separately from the response packet P3.

  In the response packet P3, since the request packet P2, the transmission source, and the destination are reversed, as shown in FIG. 6, the IP address “192.168.1.1” of the first internal computer 12a as the transmission source IP address. And the IP address “192.168.100.2” of the second external computer 11b is assigned as the destination IP address. Further, in the response packet P3, the destination port number “502” of the request packet P2 is assigned to the source port number, and the source port number “3002” of the request packet P2 is assigned to the destination port number.

  The response packet P3 sent to the internal network 16 is received by the second communication unit 41 because the destination MAC address is the MAC address of the second communication unit 41. The second communication unit 41 returns an ACK packet in response to the reception of the response packet P3, and sends the response packet P3 to the transmission unit 44. The response packet P3 is sent from the transmission unit 44 to the reception unit 34 of the first unit 21 via the transmission line 24. When a plurality of response packets are returned in response to one request packet, each response packet may be sequentially transmitted from the second unit 22 to the first unit 21 via the one-way transmission path S.

  When receiving the response packet P3, the receiving unit 34 refers to the port number conversion table Tp and converts the response packet P4 (see FIGS. 5 and 6) obtained by converting the destination port number of the response packet P3 into the first communication unit. Send to 31. Since the response packet P3 has the destination port number “3002”, the conversion record R1 having the converted port number “3002” is referred to, and the response packet P3 is sent to the port number “1501” before conversion of the conversion record R1. The destination port number of is replaced. As a result, as shown in FIG. 6, the destination port number of the response packet P4 is converted to “1501”, which is the same as the source port number of the original request packet P1.

  As shown in FIG. 5, the response packet P <b> 4 is sent from the first communication unit 31 to the external network 15. At this time, the first communication unit 31 corrects the information of the IP header and the TCP header, for example, the sequence number and the confirmation response number so that the response packet P4 is a packet in response to the previous request packet P1. If the application data of the response packet P4 cannot be transmitted in one packet, it may be divided into a plurality of packets and transmitted.

  The response packet P4 is received by the second external computer 11b because its destination IP address is the IP address of the second external computer 11b. In response to receiving the response packet P4, an ACK packet is returned from the second external computer 11b, and the ACK packet is received by the first communication unit 31. On the other hand, the second external computer 11b extracts process data from the received response packet P4 and passes it to the requesting application according to the destination port number. Since the destination port number of the response packet P4 is the same as the source port number assigned to the request packet P1, the process data is passed to the request source application.

  If the received packet information of the request packet sent from the external computer 11 to the internal computer 12 is the same as that of the first packet registration information registered in advance in the first table T1 by the same procedure as described above, A corresponding request packet is generated by the second unit 22 and transmitted to the internal computer 12. The external computer 11 receives a response packet corresponding to the request packet from the internal computer 12 via the data diode device 14.

  In this way, the external computer 11 can acquire process data corresponding to the request data from the internal computer 12 by transmitting a request packet at a necessary timing.

  On the other hand, when the received packet information of the packet received by the first communication unit 31 from the external network 15 is not included in any of the first packet registration information registered in the first reference table T1, Thus, since the first control unit 33 does nothing, no packet is transmitted from the second unit 22 to the internal network 16 and the internal computer 12. As a result, it is not possible to access the internal computer 12 from an unauthorized computer on the external network 15, access the unauthorized internal computer 12, or obtain unauthorized process data. Therefore, unauthorized access cannot be made and no information leakage occurs.

  In the data diode device 14, as described above, the packet contents are transmitted from the external network 15 side to the internal network 16 side, that is, from the first unit 21 to the second unit 22 by using the signal line Q corresponding to the contents. The first unit 21 is activated and the second packet registration information corresponding to the signal line Q is specified on the second unit 22 side. In addition, a unidirectional transmission path S with a limited communication direction is used for packet transmission from the second unit 22 to the first unit 21. For this reason, even if an unauthorized modification of the data diode device 14 is attempted from a computer on the external network 15 side, it is difficult to operate the second unit 22 and an unauthorized packet cannot be sent to the internal computer 12. Therefore, unauthorized access to the internal computer 12 is reliably prevented.

  In the above description, Modbus / TCP is used as the application protocol, but the application protocol is not particularly limited. Further, the application data of the plurality of first and second packet registration information registered in the first and second reference tables T1 and T2 may be of different types of application protocols. That is, the data diode device 14 can handle packets with different application protocols without distinction.

  In addition, the data diode device 14 relays a TCP packet as a protocol in the transport layer. For example, when TCP and UDP are used together, information for specifying the protocol type is the first information. , Added to the second packet registration information. In this case, the second unit 22 generates a packet by adding a header according to the protocol type of the second packet registration information, and controls communication according to the protocol indicated by the protocol type. Since this protocol type is necessary for the second unit 22 to generate a packet, it can be omitted in the first packet registration information. Of course, when determining whether or not the packet is a registration packet including the protocol type, it is also necessary for the first packet registration information.

[Second Embodiment]
The data diode device (data diode device with a specific packet relay function) of the second embodiment may be configured as an arbitrary circuit configuration by combining a plurality of internal circuit blocks according to configuration information as an example of a programmable logic device. The first and second units are configured using possible FPGAs, and have a normal mode for relaying specific packets and a setting mode for acquiring packet registration information and creating a reference table. Except for the details described below, the second embodiment is the same as the first embodiment, and substantially the same members are denoted by the same reference numerals and detailed description thereof is omitted.

  As shown in FIG. 7, the data diode device 14 includes first and second FPGAs 60 and 70. As is well known, the first and second FPGAs 60 and 70 are configured as processing circuits having various functions by combining a plurality of internal circuit blocks according to the configuration information. The data diode device 14 has a setting mode and a normal mode as operation modes, and the operation mode can be selected. The first and second FPGAs 60 and 70 load the configuration information of the selected operation mode every time the data diode device 14 is activated. In FIG. 7, circuits formed in the normal mode in the first and second FPGAs 60 and 70 are depicted.

  The first and second FPGAs 60 and 70 are mounted on the printed circuit board PS at a predetermined interval. A plurality of signal lines Q and a communication line L0 used in the setting mode are formed on the printed circuit board PS between the first FPGA 60 and the second FPGA 70. The communication wiring L0 is composed of a plurality of wiring patterns that connect the first FPGA 60 and the second FPGA 70. Note that a cable that is detachable from the printed circuit board PS may be used as the communication wiring L0, and the cable may be attached only in the setting mode.

  On the printed circuit boards PS around the first and second FPGAs 60 and 70, configuration memories 61 and 71, ETH-PHY (Ethernet (registered trademark) Physical Layer) chips 31a and 41a, optical PHY chips 34a and 44a, and memory cards, respectively. Mounting units 62 and 72, DRAMs 63 and 73, clock generators 64 and 74, and displays 65 and 75 are arranged. The ETH-PHY 31 a constitutes a part of the first communication unit 31, and the external network 15 is connected via the connector 66. The ETH-PHY 41 a constitutes a part of the second communication unit 41 and is connected to the internal network 16 via the connector 76.

  The memory card mounting units 62 and 72 are configured by a memory slot in which the memory cards 62a and 72a are mounted, an interface circuit for reading and writing data to and from the memory cards 62a and 72a, and the like. The memory card 62a is a first storage unit that stores a first reference table T1 and a port number conversion table Tp, and the memory card 72a is a second storage unit that stores a second reference table T2. The optical PHY chip 34 a constitutes a part of the reception unit 34, and the optical PHY chip 44 a constitutes a part of the transmission unit 44. An optical fiber is connected as a transmission line 24 between the optical PHY chips 34a and 44a.

  The DRAMs 63 and 73 are used as buffer memories for temporarily storing packets and the like. The clock generators 64 and 74 supply operation clock signals to the first FPGAs 60 and 70. The displays 65 and 75 display the operation information of the corresponding first and second units 21 and 22.

  In the configuration memory 61 connected to the first FPGA 60, normal configuration information 61a and setting configuration information 61b for the first FPGA 60 are written. A mode selection unit 68 for selecting an operation mode is connected between the first FPGA 60 and the configuration memory 61. By operating the mode selection unit 68, either the normal mode or the setting mode can be selected. The mode selection unit 68 loads the configuration information of the selected operation mode onto the first FPGA 60 by switching the area of the configuration memory 61 read by the first FPGA 60 according to the selected operation mode. Thus, the first FPGA 60 is loaded with the normal configuration information 61a when the normal mode is selected, and with the setting configuration information 61b when the setting mode is selected.

  In the configuration memory 71 connected to the second FPGA 70, normal configuration information 71a and setting configuration information 71b for the second FPGA 70 are written. A mode selection unit 78 is connected between the second FPGA 70 and the configuration memory 71. The mode selection unit 78 is linked to the mode selection unit 68 and selects the same operation mode as the mode selection unit 68. Thus, the normal configuration information 71a is loaded into the second FPGA 70 when the normal mode is selected, and the configuration information 71b for setting is loaded into the second FPGA 70 when the setting mode is selected.

  By loading the normal configuration information 61a, as shown in FIG. 7, the first FPGA 60 forms therein a first communication unit 31, a first control unit 33, and a reception unit 34, and the first FPGA 60 and peripheral circuits A first unit 21 is configured. In addition, by loading the normal configuration information 71a, the second FPGA 70 forms a second communication unit 41, a second control unit 43, and a transmission unit 44 therein, and the second FPGA 22 and peripheral circuits make the second unit 22 Composed. Since the configurations and operations of the first and second units 21 and 22 and the data diode device 14 configured using the first and second FPGAs 60 and 70 in this normal mode are the same as those in the first embodiment, description thereof will be given. Is omitted.

  Although the memory cards 62a and 72a are the first and second storage units, these may be formed inside the first and second FPGAs 60 and 70. In this case, the first and second reference tables T1 and T2 can be duplicated or moved between the memory cards 62a and 72a and the first and second storage units, and the first and second references are made using a computer or the like. It is preferable that the contents of the tables T1 and T2 can be edited.

  The setting mode is an operation mode for creating the first and second reference tables T1 and T2. Hereinafter, creation of the first and second reference tables T1 and T2 using the setting mode will be described. The data diode device 14 is connected to the external network 15 and the internal network 16. If the network addresses of the external computer 11 and the internal computer 12 are different, for example, a router is connected between the data diode device 14 and the internal network 16 to enable communication. A router function may be provided. Further, the memory card 62 a is mounted in the memory card mounting unit 62.

  A setting computer corresponding to the external computer 11 or the internal computer 12 may be connected to the connectors 66 and 76. In this case, if the same IP address as that of the external computer 11 or the internal computer 12 is assigned to the setting computer, the source IP address and destination IP address of the first and second reference tables T1 and T2 are corrected. It becomes unnecessary. The mode using the setting computer is preferable because unauthorized access to the internal computer 12 can be prevented in the setting mode.

  As shown in FIG. 8, the mode selection unit 68 is operated to select the setting mode, and the data diode device 14 is activated in the setting mode (step S1). In conjunction with the mode selection unit 68 becoming the setting mode, the mode selection unit 78 also selects the setting mode. Accordingly, the first and second FPGAs 60 and 70 load the setting configuration information 61b and 71b from the corresponding configuration memories 61 and 71, respectively (step S2).

  By loading the configuration information for setting 61b and 71b, as shown in FIG. 9, the information acquisition unit 80, the relay unit 81, and the ETH-PHY chip 31a communicate with the first FPGA 60 via the relay unit 81. An internal communication line L1 connected to the use line L0 is formed. Further, in the second FPGA 70, an internal communication line L2 for connecting the communication line L0 to the ETH-PHY chip 41a is formed. The relay unit 81 relays a packet received by one of the ETH-PHY chip 31a and the ETH-PHY chip 41a to the other. Thereby, the packet transmission path L which can transmit a packet between the connector 66 and the connector 76 is formed. That is, the packet transmission path L for sending the packet from the external network 15 side to the internal network 16 side is validated. The packet transmission path L is bidirectional so that packets from the internal network 16 side can also be transmitted to the external network 15 side, but the unidirectional transmission path S (see FIG. 7) is formed even in the setting mode, The one-way transmission path S may be used for transmission of packets from the internal network 16 side to the external network 15 side.

  The information acquisition unit 80 is connected to a communication line that transmits a packet from the ETH-PHY chip 31 a to the ETH-PHY chip 41 a in the packet transmission path L, and is transmitted from the external network 15 toward the internal network 16. Capture the packet. The information acquisition unit 80 extracts a packet that satisfies the extraction condition from the captured packets, acquires a source IP address, a destination IP address, a destination port number, and application data from the extracted packet as packet registration information. The first reference table T1 is created by writing the destination port number and the interval time given to the memory card 62a in correspondence with the signal line number. As the extraction condition, for example, it is set in the information acquisition unit 80 that application data is stored in the TCP data portion.

  After the start of the data diode device 14 in the setting mode, the external computer 11 is operated to acquire process data, and a request packet is transmitted from the external computer 11 to the internal computer 12 (step S3). The combination of the external computer 11 operated at this time, the process data to be acquired, and the internal computer 12 from which the process data is acquired is a combination that permits relaying. By this operation, a request transmission packet including a combination of relaying the destination IP address, the source IP address, and the request message from the external computer 11 and having the destination port number actually used is included in the packet transmission path including the relay unit 81 To the internal computer 12 via L.

  When the internal computer 12 receives the request packet, the internal computer 12 sends a response packet storing process data to the external computer 11 that is the transmission source of the request packet. The response packet is sent to the external computer 11 through the reverse path of the request packet and received. In this way, packets are transmitted and received between the external computer 11 and the internal computer 12. When a packet is transmitted / received between the external computer 11 and the internal computer 12, for example, an ARP or a packet for establishing a connection is also transmitted / received.

  Of the packets transmitted and received between the external computer 11 and the internal computer 12 as described above, a packet sent from the external network 15 side to the internal network 16 side is captured by the information acquisition unit 80. Then, the information acquisition unit 80 extracts a packet that satisfies the above extraction conditions from the captured packets, and acquires a transmission source IP address, a destination IP address, a destination port number, and application data from the extracted packet as packet registration information ( Step S4). As a result, ARP packets, SYN packets and ACK packets in which application data is not stored are excluded, and the source IP address, destination IP address, destination port number, and application data of the request packet storing the request message are registered in the packet. Obtained as information. Although packet registration information may be obtained from a packet other than the request packet, such first packet registration information is manually created by confirming the contents of the first reference table T1 after the creation of the first reference table T1. Delete it.

  The information acquisition unit 80 generates registration packet registration information in which a unique transmission source port number and interval time are added to the acquired packet registration information, and the packet registration information is associated with the signal line number in the memory. It is written on the card 62a. Thereby, the first packet registration information corresponding to the signal line number is registered in the first reference table T1 (step S5).

  If transmission for all request packets to be registered with the first packet registration information has not been completed (NO in step S6), an operation for acquiring process data is performed again on the external computer 11, A request packet is transmitted to the internal computer 12 (step S3). In this way, transmission of the request packet is repeated, and packet registration information obtained by the same procedure is sequentially registered in the first reference table T1 (steps S4 and S5).

  If transmission of all the request packets is completed (YES in step S6), the data diode device 14 is temporarily stopped, and then the memory card 62a removed from the memory card mounting unit 62 and the memory card 72a are connected to the data copying device. (Not shown), the data of the first reference table T1 is copied to the memory card 72a. Thereby, the second reference table T2 is created in the memory card 72a (step S7). Thereafter, the memory cards 62a and 72a are mounted on the memory card mounting portions 62 and 72, respectively. For example, a personal computer can be used as the data copying apparatus. Further, the contents of the first reference table T1 created by the information acquisition unit 80 may be manually edited.

  After the memory cards 62a and 72a are installed, the mode selection unit 68 is operated to select the normal mode (step S8). By this operation, the mode selection unit 78 is also in a state where the normal mode is selected. After this, the data diode device 14 is started again. Since the normal mode is selected, the first and second FPGAs 60 and 70 load normal configuration information, respectively (step S9). By loading the normal configuration information, the first communication unit 31, the first control unit 33, and the reception unit 34 are formed inside the first FPGA 60, and the first unit 21 is configured by the first FPGA 60 and peripheral circuits. Composed. In addition, a second communication unit 41, a second control unit 43, and a transmission unit 44 are formed inside the second FPGA 70, and the second FPGA 22 and peripheral circuits constitute the second unit 22. Thereafter, the data diode device 14 operates in the normal mode.

  By the way, it is necessary to create records of the first and second reference tables T1 and T2 in accordance with the difference in the request message and the difference in the IP address. However, if the setting mode is used as described above, the creation of each record of the first and second reference tables T1 and T2 is simple, and the setting of the data diode device 14 according to the connected system is facilitated.

  The extraction conditions are not limited thereto, and various conditions can be set. For example, a destination port number, a destination IP address, a source IP address, etc. can be used as the extraction condition. A plurality of conditions may be combined as extraction conditions. The first reference table T1 may be created by forming the information acquisition unit 80 in the second FPGA 70 and creating the second reference table T2, and then copying the second reference table T2 to the memory card 62a. The information acquisition units 80 may be formed in both the first and second FPGAs 60 and 70, and the first and second reference tables T1 and T2 may be created in the corresponding memory cards.

  Further, in each of the above embodiments, the case of acquiring process data has been described, but the data to be acquired is not limited to this. The data diode device 14 can also be used when, for example, a command or data for controlling the operation of plant equipment or the operation of the internal computer 12 itself is sent to the internal computer 12.

  In each of the above embodiments, the destination IP address of the packet registration information in the first and second reference tables T1 and T2 is the IP address (unicast address) of each internal computer 12, but this is not a limitation. As a destination IP address of the packet registration information, for example, a multicast address may be used so that packets can be simultaneously transmitted to a plurality of internal computers 12.

  In each of the above embodiments, the transmission source IP address is used as the transmission source information for specifying the transmission source, and the destination IP address is used as the destination information for specifying the destination. However, the transmission source information and the destination information are limited to these. Instead, information corresponding to the communication protocol may be used. In addition, the packet registration information includes a source IP address, a destination IP address, a source port number, a destination port number, and application data. However, the packet registration information is not limited thereto, and includes information according to a communication protocol. do it.

11, 12 Computer 14 Data diode device with specific packet relay function 15, 16 Network 21, 22 Unit 23 Signal line unit 31, 41 Communication unit 33, 43 Control unit 53 Packet relay unit 60, 70 FPGA
S one-way transmission line T1, T2 reference table

Claims (5)

A first unit connected to a first network;
A second unit connected to the second network;
A one-way transmission path for transmitting packets received from the second network in only one direction from the second unit to the first unit;
A packet relay unit that relays only permitted specific packets among the packets received from the first network to the second network;
The packet relay unit
A signal line portion composed of a plurality of signal lines provided between the first unit and the second unit;
The first packet registration information is registered in advance for each of the specific packets that are provided in the first unit and permit relaying, and a packet from the first network is registered as the first packet registration information. A packet determination unit that activates a signal line corresponding to the first packet registration information for the packet when the packet is a registered packet,
The second unit registration information is registered in advance for each of the specific packets that are provided in the second unit and permitted to be relayed, and the signal that has become active in response to any of the signal lines becoming active A packet restoration unit that generates a restoration packet corresponding to the packet received by the first unit based on second packet registration information corresponding to the line, and sends the packet to the second network. Data diode device with relay function. The first unit includes a first communication unit that receives a packet from a first network device on the first network and transmits the packet received via the one-way transmission path to the first network device. And
The packet determination unit includes a first reference table in which each of the first packet registration information including transmission source information, destination information, and application data of a packet is registered corresponding to one of the signal lines, and the first When the source information, destination information, and application data of a packet received from the network are included in any one of the first packet registration information registered in the first reference table, the first packet registration information is included in the first packet registration information. A first control unit that activates the corresponding signal line;
The second unit sends the restoration packet to the second network, receives a packet from a second network device on the second network, and receives the received packet via the one-way transmission path. A second communication unit for sending to the first unit;
The packet restoration unit may be configured such that each of the second packet registration information including packet transmission source information, destination information, and application data corresponds to the same signal line with the first and second packet registration information for the same packet. A second control table that generates the restored packet having source information, destination information, and application data based on the second packet registration information corresponding to the activated signal line, The data diode device with a specific packet relay function according to claim 1. A first programmable logic device and a second programmable logic device capable of arbitrary circuit configuration by combining a plurality of circuit blocks;
In the first programmable logic device, at least the first control unit of the first unit is formed by a combination of the circuit blocks,
In the second programmable logic device, at least the second control unit of the second unit is formed by a combination of the circuit blocks,
The data diode device with a specific packet relay function according to claim 2, wherein the signal line unit connects the first programmable logic device and the second programmable logic device. In the setting method of the data diode device with a specific packet relay function according to claim 3,
The configuration information for setting is loaded into each of the first and second programmable logic devices, and a communication wiring is formed inside the first and second programmable logic devices, so that packets from the first network side can be received. An information acquisition unit that validates a packet transmission path to be sent to the second network side and acquires packet registration information including transmission source information, destination information, and application data from a packet on the packet transmission path. A first forming step of forming on at least one of the two programmable logic devices;
A transmission step of transmitting a specific packet permitting relay from the first network device to the second network device;
An information acquisition step of acquiring the packet registration information from the packet transmitted in the transmission step by the information acquisition unit;
An information registration step of registering the packet registration information acquired in the information acquisition step as first and second packet registration information in association with any one of the signal lines in the first and second reference tables;
The first unit is configured by forming at least the first control unit in the first programmable logic device by loading first normal configuration information into the first programmable logic device, which is executed after the information registration step. And forming a second unit by forming at least the second control unit in the second programmable logic device by loading the second normal configuration information into the second programmable logic device; A method of setting a data diode device with a specific packet relay function, comprising: In the first forming step, the information acquisition unit is formed in one of the first or second programmable logic devices,
The information acquisition step includes a first information registration step of storing packet registration information acquired by the information setting unit in one reference table of the first or second reference table, and contents of the one reference table. 5. The method for setting a data diode device with a specific packet relay function according to claim 4, further comprising a second information registration step of copying to the other reference table.

Images