JP2016025478A - Relay device, relay method, and relay program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a relay device, a relay method and a relay program that make difficult eavesdropping.SOLUTION: A relay device 100 includes a detector 114 for detecting change from the linking-up state where communication has been established to the linking-down state where communication has not been established between at least one port 140 and a communication device 200 connected therewith, an attribute setting section 112 for setting the attributes indicating to perform non-encrypted communication in a port 140, to which non-encrypted data flows, out of the at least one port 140, and a port control section 113 for bringing the port 140, in which the attributes indicating to perform non-encrypted communication is set by the attribute setting section 112, into unavailable state, when the detector 114 detects change from the linking-up state to the linking-down state.SELECTED DRAWING: Figure 3

Description

  The present invention relates to a relay device, a relay method, and a relay program.

A relay device that relays data communication between communication devices (for example, a server and a PC) is widely used.
Some relay apparatuses have an encryption / decryption function including an encryption function for encrypting plaintext data and a decryption function for decrypting ciphertext data. For example, Patent Document 1 discloses a repeater as a relay apparatus having an encryption / decryption function.

JP 2010-135799 A

The relay device described in Patent Literature 1 includes a plurality of ports, and relays data communication using a cable (for example, a LAN cable) connectable to the ports. When the relay device has an encryption / decryption function, the relay device decrypts ciphertext data received from the transmission source communication device according to the setting, and transmits plaintext data to the transmission destination communication device. In this case, for example, when a malicious person physically changes the connection destination of a cable connected to a port through which plaintext data flows, there is a possibility that the data is wiretapped.
Therefore, a relay device that can prevent data eavesdropping is desired.

  The present invention has been made in view of such circumstances, and an object thereof is to provide a relay device, a relay method, and a relay program that make it difficult to wiretap data.

In order to achieve the above object, a relay device according to the first aspect of the present invention provides:
Detecting means for detecting a change from a link-up state in which communication is established to a link-down state in which communication is not established between at least one port and a communication device connected to the port;
Attribute setting means for setting an attribute indicating performing unencrypted communication to a port through which unencrypted data flows among the at least one port;
If the detection means detects a change from the link-up state to the link-down state with respect to the port in which the attribute setting means sets an attribute indicating that the unencrypted communication is performed, the port is A port control means for disabling,
It is provided with.

The relay method according to the second aspect of the present invention is:
Detecting a change from a link-up state to a link-down state between a port and a communication device connected to the port;
Set an attribute indicating that unencrypted communication is performed on the port through which unencrypted data flows,
When a change from a link-up state to a link-down state is detected for a port in which an attribute indicating non-encrypted communication is set, the port is controlled to an unusable state.

The relay program according to the third aspect of the present invention is:
To a computer with a communication port,
A process for detecting a change from a link-up state to a link-down state between a port and a communication device connected to the port;
A process for setting an attribute indicating that unencrypted communication is performed on a port through which unencrypted data flows,
When a change from a link-up state to a link-down state is detected for a port for which an attribute indicating performing unencrypted communication is set, a process of controlling the port to an unusable state;
Is executed.

  According to the present invention, wiretapping of data can be made difficult.

The block diagram of the communication system comprised from the relay apparatus which concerns on embodiment of this invention, and the communication apparatus connected to this relay apparatus. The hardware block diagram of the relay apparatus which concerns on embodiment of this invention. The functional block diagram of the relay apparatus which concerns on embodiment of this invention. The figure which shows the structural example of an identification information storage part. (A) The figure which shows the structural example of the attribute memory | storage part in an initial state. (B) The figure which shows the structural example of the attribute memory | storage part after performing a communication attribute automatic setting process and a port control process. (A) The figure which shows the structural example of the ARP request which a relay apparatus transmits to a communication apparatus. (B) The figure which shows the structural example of the ARP response which a communication apparatus transmits to a relay apparatus. The flowchart which shows a communication attribute automatic setting process. The flowchart which shows use availability setting change processing. The flowchart which shows a port control process.

  Hereinafter, a relay device, a relay device, and a relay program according to an embodiment of the present invention will be described with reference to the drawings.

  The relay device 100 according to the present embodiment is a device having a plurality of ports for connecting communication devices such as a server device and a client device, and as shown in FIG. 200x).

  The relay device 100 has a function of encrypting or decrypting communication data, decrypts received data according to settings, and outputs unencrypted plaintext data from a specific port. At this time, in order to prevent a malicious person from physically changing the connection destination of the port and causing plaintext data to flow out, the relay device 100 uses, for example, a LAN cable for the port through which plaintext data flows. When the link goes down due to being removed, the port is set to an unusable state.

  As shown in FIG. 2, the relay device 100 includes a control unit 110, a storage unit 120, a memory 130, a port 140, and a management interface 150, and these units are connected by a bus 160.

  The control unit 110 includes a CPU (Central Processing Unit) and the like, and controls the overall operation of the relay device 100 by executing various programs in the storage unit 120.

  The storage unit 120 is a non-volatile memory including a flash ROM (Read Only Memory) or the like, and has a program area and a data area. In the data area of the storage unit 120, the identification information storage unit 121 shown in FIG. 4 and the attribute storage unit 122 shown in FIG. 5 are stored. The program area of the storage unit 120 includes a program for realizing the present embodiment in accordance with operation procedures shown in FIGS. 7 to 9 described later, and an encryption / decryption function for encrypting and decrypting communication data. A program to be realized is stored.

  The memory 130 is a volatile memory including a RAM (Random Access Memory) or the like, and has a work area used when the CPU performs processing.

  The port 140 is a network interface including a LAN port, a serial port, and the like, and is connected to the communication device 200 via a cable. In this embodiment, in order to facilitate understanding, when there are n ports 140 and any one of the ports 140 needs to be specified, it is called a port i (i is a natural number equal to or less than n). Since each port 140 is assigned a unique port number, each unit of the relay apparatus 100 can identify each port 140 by the port number. One or a plurality of ports 140 are provided in the relay device 100.

  The management interface 150 is a serial port, and connects a management terminal (computer) that accepts an operation for registering / updating setting information for managing each port 140.

  The control unit 110 reads the program stored in the storage unit 120 and develops it in the memory 130, and then controls the relay device 100 according to the program. Accordingly, the units illustrated in FIG. 2 function together as the acquisition unit 111, the attribute setting unit 112, the port control unit 113, and the detection unit 114 as illustrated in the functional block diagram of FIG. The storage unit 120 includes an identification information storage unit 121 and an attribute storage unit 122.

As shown in FIG. 4, the identification information storage unit 121 stores the device identification information of the communication device 200 and the encrypted / unencrypted identification information in association with each other. The device identification information is information that can uniquely identify the communication device 200 connected to the relay device 100, such as a MAC (Media Access Control) address and an IP (Internet Protocol) address. The encrypted / unencrypted identification information is information indicating whether to perform encrypted communication or non-encrypted communication (communication in plain text) when the relay device 100 transmits / receives data to / from the communication device 200. Yes, “1” indicates that unencrypted communication is performed, and “0” indicates that encrypted communication is performed.
The administrator operates a management terminal connected to the management interface 150 to set device identification information and encrypted / unencrypted identification information in the identification information storage unit 121 in advance.

  The identification information storage unit 121 functions as a storage unit that stores information indicating whether or not the communication device 200 performs unencrypted communication for each piece of identification information of the communication device 200.

As illustrated in FIG. 5, the attribute storage unit 122 illustrated in FIG. 3 includes, for each port 140, the port number i, the device identification information of the communication device 200 connected to the port 140, and the communication attribute of the port 140. And the availability setting are stored in association with each other.
The communication attribute indicates whether encrypted communication or non-encrypted communication is performed when data is transmitted from the port 140 to the communication apparatus 200. “1” indicates that non-encrypted communication is performed. “0” indicates that non-encrypted communication is not performed (encrypted communication is performed).
The availability setting indicates whether the port 140 can be used (communication is possible) or not (communication is impossible). An administrator can operate the management terminal connected to the management interface 150 to change the availability setting of the port 140.
Even if the port 140 is set to be unavailable, data for acquiring device identification information from the connection destination communication device 200 such as an ARP (Address Resolution Protocol) request or an ARP response can be transmitted and received.

In the initial setting of the attribute storage unit 122, as shown in FIG. 5A, “N / A” is set in the device identification information and communication attribute, and “unusable” is set in the availability setting.
After the communication attribute automatic setting process and the availability setting change process stored in the storage unit 120 are executed, the setting values are stored and updated by the program as shown in FIG. 5B. Is done.

Returning to FIG. 3, the acquisition unit 111 acquires the device identification information from the communication device 200 connected to the port 140.
When the acquisition unit 111 detects that the communication apparatus 200 is connected to the port 140, the acquisition unit 111 creates an ARP request packet as illustrated in FIG. The ARP request packet has fields for storing a source MAC address, a source IP address, a destination MAC address, and a destination IP address. The acquisition unit 111 sets the MAC address of the relay device 100 as the source MAC address, the IP address of the relay device 100 as the source IP address, “N / A” as the destination MAC address, and the destination IP address as the destination IP address. The IP address of the communication device 200 connected to the port 140 is stored.

  The ARP request packet is transmitted to the communication device 200 connected to the port 140 after the header portion is added in the data link layer. The header part has fields for storing the destination MAC address and the source MAC address. Here, the broadcast address is stored in the destination MAC address, and the MAC address of the relay device 100 is stored in the source MAC address. The broadcast address is stored in the destination MAC address because the destination MAC address is unknown.

  The communication device 200 that has received the ARP request returns an ARP response for notifying the relay device 100 of its own MAC address if the IP address stored in the destination IP address of the ARP request matches its own IP address. Create a packet. As illustrated in FIG. 6B, the ARP response packet includes fields for storing a source MAC address, a source IP address, a destination MAC address, and a destination IP address. The communication device 200 has its own MAC address as the source MAC address, its own IP address as the source IP address, the MAC address of the relay device as the destination MAC address, and the relay device 100 as the destination IP address. Stores the IP address.

  The ARP response packet is transmitted to the relay device 100 after the header portion is added in the data link layer. The header part has fields for storing the destination MAC address and the source MAC address. Here, the MAC address of relay device 100 is stored in the destination MAC address, and the MAC address of communication device 200 is stored in the source MAC address.

  The acquisition unit 111 illustrated in FIG. 3 acquires the device identification information of the communication device 200 by analyzing the received ARP response packet and reading the MAC address of the communication device 200.

  The acquisition unit 111 functions as an acquisition unit that acquires identification information from the communication device 200 for the port 140 to which the communication device 200 is connected among at least one port 140.

The attribute setting unit 112 sets a communication attribute indicating that unencrypted communication is performed in the port 140 through which plaintext data that is not encrypted flows.
When the acquisition unit 111 acquires the device identification information, the attribute setting unit 112 refers to the identification information storage unit 121 and the encrypted / unencrypted identification information associated with the device identification information is “1”. Then, a communication attribute “1” indicating that unencrypted communication is performed is set to the port 140 to which the communication device 200 having the device identification information is connected. In addition, when the encrypted / unencrypted identification information associated with the device identification information is “0”, the attribute setting unit 112 does not connect to the port 140 to which the communication device 200 having the device identification information is connected. A communication attribute “0” indicating that encrypted communication is not performed is set. Such setting information is stored in the attribute storage unit 122.

  For example, when the device identification information acquired from the communication device 200 connected to the port 1 is MAC_c, the attribute setting unit 112 refers to the identification information storage unit 121 and performs encryption / non-connection associated with MAC_c. The value “1” of the encryption identification information is acquired. Since the value of the encrypted / unencrypted identification information is “1”, the attribute setting unit 112 sets the communication attribute “1” for the port 1 as shown in FIG. At this time, the attribute setting unit 112 sets MAC_c in the device identification information permitted to use the port 1, and sets the availability setting to “available”.

  In addition, for example, the port 2 in which “1” is set in the communication attribute is linked down due to a cable being disconnected or the like while transmitting / receiving data to / from the communication device 200 having the identification information of MAC_d. In this case, the detection unit 114 detects that the port 2 is linked down. In response to this detection, the attribute setting unit 122 sets the availability setting of the port 2 to “unusable” as shown in FIG. If the port 2 is linked up again and the device identification information of the connection destination communication device 200 has the device identification information of MAC_d, the attribute setting unit 112 sets the availability setting without using the administrator's operation. Set to possible.

  Further, for example, when the device identification information acquired from the communication device 200 connected to the port 3 is MAC_b, the attribute setting unit 112 refers to the identification information storage unit 121 and encrypts associated with MAC_b. / The value “0” of the unencrypted identification information is acquired. Since the value of the encrypted / unencrypted identification information is “0”, the attribute setting unit 112 sets the communication attribute “0” to the port 3. At this time, the attribute setting unit 112 uses “ANY” indicating that any communication device 200 is allowed to communicate with the port 140 in the device identification information permitted to use the port 3. Set “Available” in the availability setting. “ANY” is an identifier indicating that any device identification information may be used. In this case, even if the communication of the port 3 is linked down, the attribute setting unit 112 keeps the availability setting “available”.

  The attribute setting unit 112 functions as an attribute setting unit that sets an attribute indicating that unencrypted communication is performed to a port 140 through which unencrypted data flows out of at least one port 140.

The port control unit 113 controls whether each port 140 can be used or not.
The port control unit 113 refers to the attribute storage unit 122 to make the port 140 having the port number whose use permission setting is “available” available, and to change the port 140 having the port number “unavailable”. Make it unavailable.

  When the port controller 113 detects a change from the link-up state to the link-down state for the port 140 for which the attribute setting unit 112 has set an attribute indicating that unencrypted communication is performed. The port 140 functions as a port control means for disabling the port 140.

The detection unit 114 monitors the link state of each port 140 and detects the change when the state changes from link up to link down or from link down to link up.
Note that the link-up is a state where communication is established, and the link-down is a state where communication is not established.

  As a method for the detection unit 114 to monitor the link state, for example, a specific pin (for example, a GND pin or a power supply pin) constituting the LAN port is in a high impedance state, and a watchdog timer (Watchdog Timer) is set for a predetermined time. There is a method for detecting that a communication is not performed as described above, and detecting that a micro switch or an optical switch provided in a LAN port detects a disconnection of a LAN cable as a link-down state.

  The detection unit 114 switches from a link-up state in which communication is established to a link-down state in which communication is not established between at least one port 140 and the communication device 200 connected to the port 140. It functions as detection means for detecting a change.

  Next, the operation of the relay apparatus according to this embodiment will be described with reference to the flowcharts shown in FIGS. Here, each function described in these flowcharts is stored in the storage unit 120 in the form of a readable program code, and the controller 110 sequentially executes operations according to the program code.

(Setting operation)
When the administrator adds / changes the communication device 200 that performs communication via the relay device 100 and changes the communication mode (whether encrypted communication or non-encrypted communication), the administrator The contents of the identification information storage unit 121 shown in FIG. 4 are updated by operating the terminal.
For example, when the communication device 200 is newly connected to the relay device 100, a pair of device identification information and encrypted / unencrypted identification information of the communication device 200 is registered in the identification information storage unit 121. Also, for example, for the communication device 200a whose device identification information is MAC_a, the setting for performing unencrypted communication (encrypted / unencrypted identification information is 1) is changed to the setting for performing encrypted communication. In this case, the encrypted / unencrypted identification information whose device identification information corresponds to MAC_a is updated to “0”.

  In addition, when adding or exchanging a communication device, the vacant port 140 and the communication device 200 are connected by a LAN cable.

After performing such an operation, the administrator designates the port i whose information has been updated and starts the communication attribute automatic setting program.
When the communication attribute automatic setting program is activated, it starts the process shown in FIG. First, the acquisition unit 111 generates an ARP request for inquiring about device identification information, transmits it from the designated port i (step S101), and waits until an ARP response is received (step S102; No).
When the acquisition unit 111 receives an ARP response from the communication device 200 connected to the port i (step S102; Yes), the acquisition unit 111 extracts the device identification information, that is, the source MAC address.
The attribute setting unit 112 accesses the identification information storage unit 121 (see FIG. 4), reads the encrypted / unencrypted identification information associated with the device identification information, and which value is the value? Is determined (step S103).

  If the encrypted / unencrypted identification information associated with the device identification information is “1” (step S103; Yes), the attribute setting unit 112 accesses the attribute storage unit 122 (see FIG. 5), and For port i, the communication attribute is set to “1”, the device identification information is set to “usable” in the device identification information of the connected communication device 200 (step S104).

When the encrypted / unencrypted identification information associated with the device identification information is “0” (step S103; No), the attribute setting unit 112 accesses the attribute storage unit 122 and communicates with the port i. The attribute is set to “0”, the device identification information is set to “ANY”, and the availability setting is set to “available” (step S104).
When the attribute acquisition unit 141 sets any communication attribute to the port 140 to which the communication device 200 is connected, the communication attribute automatic setting process ends.

  When changing the availability setting of an arbitrary port from “unavailable” to “available” and when changing from “available” to “unusable”, the administrator specifies the target port i, The management terminal instructs to change the availability setting to “available” or “unusable”. In response to the instruction, the control unit 110 activates the availability setting change program stored in the storage unit 120.

  When activated, the availability setting change program starts the processing shown in FIG. 8. First, the attribute setting unit 112 determines whether or not the setting for changing the availability setting is “available”. (Step S201). If the setting of the change destination of the availability setting is “available” (step S201; Yes), the attribute setting unit 112 accesses the attribute storage unit 122 and sets the availability setting of the port i to “available”. (Step S202). When the availability setting is set to “available”, the port control unit 113 starts communication between the port i and the communication device 200 connected to the port i (step S203). When communication is started, the availability setting change process ends.

  If the setting of the change destination of the availability setting is “unusable” (step S203; No), the attribute setting unit 112 accesses the attribute storage unit 122 and sets the availability setting of the port i to “unusable”. (Step S204). When the availability setting is set to “unusable”, the port control unit 113 ends the communication between the port i and the communication device 200 connected to the port i (step S205). When the communication ends, the availability setting change process ends.

(Communication operation)
The relay apparatus 100 performs non-encrypted communication with the connection destination communication apparatus 200 for the port 140 in which the communication attribute is set to “1” in the attribute storage unit 122 and the availability setting is set to “available”. For the port 140 in which the communication attribute is set to “0” and the availability setting is set to “available” in the attribute storage unit 122, the encrypted communication is performed with the connection destination communication apparatus 200.
However, for the port 140 set to “unusable” in the attribute storage unit 122, communication is not performed and communication is blocked. The interruption of communication here means that, as described above, communication such as an ARP packet is possible, but data transmitted from another communication apparatus 200 is not sent.

  During this time, the port control unit 113 executes the port control process to be controlled shown in FIG. 9 as an interrupt process or every predetermined time (for example, once every 10 msec) in order to prevent information leakage. .

First, the detection unit 114 determines whether or not there is a link state change for each port 140 for which “1” is set as a communication attribute on the attribute storage unit 122 (that is, unencrypted communication is set). Is monitored (step S301). When the detection unit 114 does not detect a change in the link state (step S301; No), the current process ends.
On the other hand, when the detection unit 114 detects a change in the link state for any one of the ports 140 (Step S301; Yes), the detection unit 114 identifies which port 140 is the port 140 that has detected the change in the link state. (Step S302). When the detection unit 114 identifies the port 140 that has detected the change in the link state, it is determined whether or not the change is a change from link up to link down (step S303). If it is determined that the link is down (step S303; No), the attribute setting unit 112 sets “unusable” in the availability setting of the port 140 on the attribute storage unit 122 (step S304) and the port. The communication via 140 is blocked (step S305). As a result, unencrypted communication via the port 140 is blocked and communication is impossible.

On the other hand, when the detection unit 114 detects a change from link-down to link-up for any of the ports 140 (step S303; Yes), the acquisition unit 111 is a communication device connected to the port 140 that has detected the change. 200 pieces of device identification information are acquired. When the acquisition unit 111 acquires the device identification information of the connection destination communication device 200, the attribute setting unit 112 refers to the attribute storage unit 122, and the device identification information in which the acquired device identification information is set to 141 for the port. It is determined whether or not (step S306). If the acquired device identification information is the device identification information set for the port 140 (step S306; Yes), the attribute setting unit 112 sets the availability setting of the port 140 to “available” ( Step S307) Unencrypted communication via the port 140 is started (Step S308).
If the acquired device identification information is not the device identification information set for the port 140 (step S306; No), the attribute setting unit 112 keeps the availability setting of the port 140 as “unusable” Unencrypted communication through the port 140 is blocked, and communication cannot be performed (step S309).

  In this way, when a situation such as when the cable is disconnected or when the cable is disconnected for some reason during the plaintext communication between the relay apparatus 100 and the communication apparatus 200, Communication is not possible. Thereby, leakage of information is prevented.

  In response to an offer from the user of the communication device 200 that has become unable to communicate, the administrator investigates the cause of the communication failure and sets the communication terminal to enable communication again. By operating, the information in the attribute storage unit 122 is updated by the availability setting change process of FIG.

  As described above, according to the present embodiment, when the port 140 through which plaintext data flows is linked down, the port 140 is made unavailable. As a result, it is possible to prevent eavesdropping of plaintext data by a malicious person by physically changing the connection destination of the cable connected to the port 140.

  Further, according to the present embodiment, the communication device 200 connected to each port is automatically specified, and the communication mode (unencrypted communication or encrypted communication) preset in the specified communication device 200 is selected. Set to that port. Therefore, even if the connection relationship between the cable and the port is changed, the communication mode of each port is automatically changed to a mode corresponding to the communication device of the connection destination. Therefore, the communication mode setting process is easy, and the combination of the cable and the port is easy.

  As mentioned above, although embodiment of this invention was described, this invention is not limited to said embodiment, A various deformation | transformation and application are possible.

  For example, the communication device 200 to which the relay device 100 is connected has been described as a server device, a client device, or the like, but is not limited thereto, and may be a security device or another relay device.

  In the present embodiment, a method using the ARP protocol has been described as a method for acquiring the device identification information of the communication device 200 connected to the port 140. However, the method is not limited to this method. The method for acquiring the device identification information may be a method using a MAC address resolution means different from the ARP protocol. Further, as a method for acquiring the device identification information, it may be designed such that when it detects that the communication device 200 is connected to the port 140, the communication device 200 notifies the relay device 100 of its own device identification information. .

  In addition, when the port 140 is linked down due to a cable being disconnected or the like, the relay device 100 tries to check the communication a predetermined number of times by transmitting an ARP request from the port 140. Also good. When the port 140 receives the ARP response, if the device identification information of the communication device 200 included in the received ARP response is different from the device identification information before the link down, the port control unit 113 Makes the port 140 unusable and ends the communication.

  Further, in this embodiment, in the port control process, when the port 140 in which the communication attribute indicating non-encrypted communication is set changes from link-down to link-up, the attribute setting unit 112 displays the attribute storage unit. 122, it has been described that it is determined whether or not the device identification information of the communication device 200 connected to the port 140 is set in the port 140. This determination is different from the attribute setting unit 112. May be provided by the determination unit.

  The determination unit changes the port 140 in which the attribute indicating that the port control unit 113 performs non-encrypted communication from the available state to the unusable state, and then the detection unit 114 performs the link up from the link down state. When a change to the state is detected, the communication device 200 connected to the port 140 is connected to the port 140 before the port control unit 113 changes the port 140 from an available state to an unavailable state. It functions as a determination unit that determines whether or not the communication apparatus 200 is different from the communication apparatus 200 that has been used. In the present embodiment, the attribute setting unit 112 functions as a determination unit.

  In the above embodiment, when a link down occurs in a port 140 for which unencrypted communication is set as a communication attribute, communication excluding an ARP request, an ARP response, and the like via the port 140 is prohibited. The present invention is not limited to this. For example, since the object of the present invention is focused on information leakage, other pieces of information (for example, information on the relay device 100) may be used within a range in which plaintext information acquired from the communication device 200 of the communication partner is not leaked. Communication may be possible. Further, encrypted communication may be performed while blocking unencrypted communication. These cases are also included in “making the port 140 unusable” of the present invention.

  In the present embodiment, it has been described that the detection unit 114 detects the change when the link state of each port 140 changes from link-up to link-down or from link-down to link-up. Unit 114 may be designed to detect only changes from link up to link down.

  The processes shown in FIGS. 7 to 9 are examples, and any process may be adopted as long as the same function can be realized. For example, the communication attribute automatic setting process of FIG. 7 may be periodically started and executed. In addition to collecting device identification information for a specific port i, for example, scanning all ports 140 to obtain device identification information of communication devices connected to the port 140 and setting communication attributes You may make it do. Further, in the availability setting change process illustrated in FIG. 8, for example, it may be automatically started when it is detected that the availability setting column of the attribute storage unit 122 has been updated. Further, the port 140 for which encrypted communication is set may be a scan target.

Note that the relay device 100 of the present invention can also be realized by a computer such as a normal PC.
Specifically, in the present embodiment, the program of the relay device 100 has been described as being stored in the storage unit 120 in advance. However, a computer capable of executing the functions of the above-described units by installing the program of the storage unit 120 in the computer may be configured. The program is not limited to the storage unit 120, and may be stored in other computer-readable recording media (for example, a flexible disk, CD-ROM, DVD, MO, etc.) and distributed to computers. is there.

  Further, the program may be stored in a disk device or the like of a server device on a communication network such as the Internet, and may be downloaded to a computer, for example. Furthermore, the above-described processing of the relay device 100 can also be achieved by starting and executing a program while transferring it via a communication network.

100: Relay device 110: Control unit 111: Acquisition unit 112: Attribute setting unit 113: Port control unit 114: Detection unit 120: Storage unit 121: Identification information storage unit 122: Attribute storage unit 130: Memory 140: Port 150: Management Interface 160: Buses 200a to 200x: Communication device

Claims (7)

Detecting means for detecting a change from a link-up state in which communication is established to a link-down state in which communication is not established between at least one port and a communication device connected to the port;
Attribute setting means for setting an attribute indicating performing unencrypted communication to a port through which unencrypted data flows among the at least one port;
If the detection means detects a change from the link-up state to the link-down state with respect to the port in which the attribute setting means sets an attribute indicating that the unencrypted communication is performed, the port is A port control means for disabling,
A relay apparatus comprising: Storage means for storing, in the identification information of the communication device, information indicating whether or not the communication device performs the unencrypted communication;
Obtaining means for obtaining identification information from the communication device for the port connected to the communication device among the at least one port;
The attribute setting means refers to the storage means for the identification information acquired by the acquisition means, and stores information indicating that non-encrypted communication is performed, the communication apparatus having the identification information is connected. Set an attribute indicating that the non-encrypted communication is to be performed on the selected port,
The relay apparatus according to claim 1. The port control means changes the link-up state from the link-down state after the port having the attribute indicating that the unencrypted communication is performed is changed from an available state to an unusable state. When a change to the state is detected, the port set with the attribute indicating that the unencrypted communication is performed is left in an unusable state.
The relay apparatus according to claim 1 or 2, characterized in that The port control means uses the port from an unusable state based on a user operation after changing the port set with an attribute indicating performing unencrypted communication from an available state to an unusable state. Make it possible,
The relay device according to claim 1, wherein the relay device is a relay device. After the port control unit changes the port set with the attribute indicating that the unencrypted communication is performed from the available state to the unusable state, the detection unit changes from the link down state to the link up state. A communication device connected to the port before the port control means changes the port from an available state to an unusable state. Comprises determination means for determining whether or not the communication device has become different,
The port control means, when it is determined that the determination means is not the different communication device, the port that has been disabled is made available.
The relay apparatus according to claim 1 or 2, wherein Detecting a change from a link-up state to a link-down state between a port and a communication device connected to the port;
Set an attribute indicating that unencrypted communication is performed on the port through which unencrypted data flows,
When a change from a link-up state to a link-down state is detected for a port for which an attribute indicating performing unencrypted communication is set, the port is controlled to an unusable state.
Relay method. To a computer with a communication port,
A process for detecting a change from a link-up state to a link-down state between a port and a communication device connected to the port;
A process for setting an attribute indicating that unencrypted communication is performed on a port through which unencrypted data flows,
When a change from a link-up state to a link-down state is detected for a port for which an attribute indicating performing unencrypted communication is set, a process of controlling the port to an unusable state;
A relay program that executes