JP2021192554A - Relay device, communication system, relay method, and relay program - Google Patents

Abstract

To provide a relay device capable of controlling communication according to the day of the week and time of operation.SOLUTION: A relay device includes storage means for storing the list of frames to be the object of first processing after received by the relay device, analytic means for collating the received frame with the list, and control means performing first processing to the received frame if it conforms to the listed frame when collated by the analytic means, otherwise performing second processing to the received frame. Multiple lists exist according to the day of the week and time, and the analytic means collates the received frame and a list corresponding to the day of the week and time of operation.SELECTED DRAWING: Figure 7

Description

The present invention relates to a relay device, a communication system, a relay method, and a relay program for relaying data in data communication.

In recent years, as collectively referred to as the IoT (Internet of Things), everything has come to be connected to the Internet. For example, a unique protocol is used to newly connect the control network of a factory or plant that was communicating to the Internet.

By connecting to the Internet in this way, various benefits such as new added value and device management can be obtained, while malicious persons using means such as unauthorized access and DoS attack (Denial of Service attack) can be used. You will also be exposed to threats.

However, for example, it is not easy to take countermeasures against threats from malicious persons to each of the equipment such as machine tools, sensors and cameras installed in factories and plants. This is because equipment such as machine tools, sensors, and cameras may not be equipped with a function for taking such measures in the first place.

Therefore, it is important that the relay device that relays the communication of these devices, not the devices themselves, has a security function for responding to a threat from a malicious person.

Under such circumstances, for example, Patent Document 1 discloses a network switch that stores a list of packets that meet the permitted communication regulations in advance and allows communication of packets that match the list.

Japanese Unexamined Patent Publication No. 2015-050767 Japanese Unexamined Patent Publication No. 2014-1201381

However, the device according to Patent Document 1 has a problem that it cannot cope with a case where a specific terminal does not want to communicate in normal times but wants to communicate only at a certain time on a certain day of the week. Furthermore, in the regular communication flow, if the communication volume for a specific port increases or decreases compared to the normal time, the regular communication flow cannot be blocked, or communication control including detour, bandwidth control, etc. cannot be performed. There was a problem.

In this regard, for example, in Patent Document 2, a list is generated in which the correspondence relationship between the user's operation and the abnormality that occurred when the operation is performed is described together with the date and time when the abnormality occurred, and the abnormality is found based on the list. An invention that warns of a user's operation with high accuracy is disclosed. However, in the invention according to Patent Document 2, the date and time described in the list are only past times, and the data in the list is merely an accumulation of past achievements. Therefore, the operation is controlled according to the schedule after the present time. It's not something to do. Furthermore, it does not switch the list to be referenced depending on the current date and time.

Therefore, an object of the present invention is to provide a relay device capable of controlling communication according to the day of the week and the time of day during operation. Further, it provides a relay device capable of performing control such as cutoff, detour, bandwidth control, and monitoring for the regular communication flow when the communication volume increases or decreases compared to the normal time in the regular communication flow. The purpose is.

According to the first aspect of the present invention, the relay device is a storage means for storing a list of frames to be processed by the first process after reception by the relay device, and one PLC (Programmable Logic Controller). A first connection port that connects only to one, a second connection port that connects only to one IoT device, an analysis means that collates frames received from the first or second connection port with the list, and the above. At the time of collation by the analysis means, if the received frame matches the frame described in the list, the first process is performed on the received frame, and if the received frame does not match, the received frame is second. The list includes information identifying the first or second connection port, and the analysis means further comprises the first or second connection at the time of the collation. A relay device is provided, subject to the information that identifies the port.

According to the second aspect of the present invention, the relay device includes the relay device and the setting terminal connected to the relay device, and the relay device is subject to the first processing after being received by the relay device. Received from a storage means for storing a list of frames, a first connection port connected to only one PLC, a second connection port connected to only one IoT device, and the first or second connection port. If the received frame matches the frame described in the list at the time of collation by the analysis means and the analysis means for collating the received frame with the list, the first process is performed on the received frame, and the combination is performed. If not, the received frame is provided with a control means for performing a second process, the list includes information identifying the first or second connection port, and the analysis means is said. At the time of collation, further, subject to the information for identifying the first or second connection port, the setting terminal has the contents of each of the above processes and the contents of each process according to the operation from the user accepted by the setting terminal. A communication system is provided that modifies part or all of the contents of the list.

According to the third aspect of the present invention, it is a relay method used in the relay device, and only a step of storing a list of frames to be processed by the first process after reception by the relay device and one PLC. The received frame at the time of the step of collating the frame received from the first connection port connected to the list or the second connection port connected to only one IoT device with the list and the collation by the collating step. If the frame is matched with the frame described in the list, the received frame is subjected to the first processing, and if the frame is not matched, the received frame is subjected to the second processing. The list includes information that identifies the first or second connection port, and the matching step is conditioned on information that further identifies the first or second connection port at the time of the matching. A relay method is provided.

According to the fourth aspect of the present invention, it is a relay program that causes a computer to function as a relay device, and stores the list of frames to be processed by the first process after receiving the computer by the relay device. Matching by the analysis means with the storage means and the analysis means for collating the frame received from the first connection port connected to only one PLC or the second connection port connecting only with one IoT device with the list. Occasionally, if the received frame matches the frame described in the list, the received frame is subjected to the first processing, and if it does not match, the received frame is subjected to the second processing. The control means and the list includes information for identifying the first or second connection port, and the analysis means further identifies the first or second connection port at the time of the collation. Is provided, a relay program that functions as a relay device is provided.

According to the present invention, it is possible to perform appropriate processing at the time of relay.

It is a figure which shows the basic structure of each embodiment of this invention. It is a figure which shows the communication example for every day of the week, every time in 1st Embodiment of this invention. It is a figure which shows the list of permission list for every day of the week, time in 1st Embodiment of this invention. It is a figure which shows the example of the permission list in 1st Embodiment of this invention. It is a figure which shows the example of the permission list in 1st Embodiment of this invention. It is a figure which shows the operation setting example in 1st Embodiment of this invention. It is a figure which shows the structural example of the relay device in 1st Embodiment of this invention. It is a flowchart which shows the operation flow of the relay device in 1st Embodiment of this invention. It is a flowchart which shows the operation flow of the relay device in 1st Embodiment of this invention. It is a figure which shows the communication example for every communication amount in the 2nd Embodiment of this invention. It is a figure which shows the list of permission list for every communication amount in 2nd Embodiment of this invention. It is a figure which shows the example of the permission list in the 2nd Embodiment of this invention. It is a figure which shows the example of the permission list in the 2nd Embodiment of this invention. It is a figure which shows the structural example of the relay device in 2nd Embodiment of this invention. It is a flowchart which shows the operation flow of the relay device in 2nd Embodiment of this invention. It is a flowchart which shows the operation flow of the relay device in 2nd Embodiment of this invention. It is a figure which shows the communication example for each day of the week, time, and the communication amount in the 3rd Embodiment of this invention. It is a figure which shows the list of permission list for every day of the week, time, and communication amount in the 3rd Embodiment of this invention. It is a figure which shows the example of the permission list in the 3rd Embodiment of this invention. It is a figure which shows the example of the permission list in the 3rd Embodiment of this invention. It is a figure which shows the example of the permission list in the 3rd Embodiment of this invention. It is a figure which shows the structural example of the relay device in 3rd Embodiment of this invention. It is a flowchart which shows the operation flow of the relay device in 3rd Embodiment of this invention. It is a flowchart which shows the operation flow of the relay device in 3rd Embodiment of this invention.

<Outline of each embodiment of the present invention>
First, the outline of each embodiment of the present invention will be described.

In the embodiment of the present invention, information that identifies a communication destination that is considered to have no problem is used as a list (such a list is hereinafter referred to as a "permission list"), and frames that match this permission list are forwarded. The method of allowing and discarding frames that do not match this permission list is adopted.

Here, in the present invention, a plurality of permission lists are prepared. For example, a permission list for 8:30 to 17:29 on each day of the week and a permission list for 17:30 to 8:29 on each day of the week are prepared according to the day of the week and the time of day. This makes it possible to provide a security switch that switches the communication control method according to the day of the week and the time.

Alternatively, depending on the amount of communication, a permission list when the communication amount is normal and a permission list when the communication amount is abnormal are prepared. This makes it possible to provide a security switch capable of controlling such as blocking the regular communication flow when an abnormality is found in the communication volume.

Further, embodiments of the present invention also provide the ability to automatically generate at least a portion of such a permission list.

Specifically, the relay device is provided with a registration period and an operation period. Then, the permission list is automatically generated by adding the frame input to the relay device to the permission list during the registration period. At this time, it may be possible to manually add or delete the automatically generated permission list by the user's operation.

After that, the registration period is switched to the operation period, the frame input to the relay device is compared with the permission list automatically generated in the registration period, and if they match, the frame is passed, and if they do not match, the frame is discarded.

As a result, the permission list can be automatically generated and security management can be performed by the permission list.

The above is the outline of the embodiment of the present invention.

Next, an embodiment of the present invention will be described in detail with reference to the drawings. Here, three embodiments of the present invention will be described below.
First, the first embodiment is a form in which a permission list is generated for each day of the week and time, and the permission list to be referred to is switched according to the day and time during operation.
Next, the second embodiment is a mode in which a permission list is generated for each communication amount and the permission list to be referred to is switched according to the communication amount at the time of operation.
Further, the third embodiment is a form in which a permission list is generated for each day of the week, time, and communication amount, and the permission list to be referred to is switched according to the day of the week, time, and communication amount at the time of operation.
Hereinafter, these three embodiments will be described in order.

<First Embodiment>
Hereinafter, the first embodiment of the present invention will be described in detail with reference to FIGS. 1 to 8-2.

Referring to FIG. 1, the present embodiment includes a security switch 100, a plurality of communication terminals 10-1 to 10-n (these are also collectively referred to as “communication terminal 10” here), a setting terminal 50, a firewall 500, and the Internet. Includes 700. (Note that the security switch is also referred to as a "relay device" in the present specification.)

Here, the security switch 100 is a security switch for relaying communication between communication terminals 10 and communication by the communication terminals 10 via the firewall 500 and the Internet 700.

In this regard, in this embodiment, a firewall 500 is provided between the security switch 100 and the Internet 700 as shown in the figure. Then, by setting the firewall 500 according to the user's policy, it is possible to prevent the inflow of malicious data such as a virus from the Internet 700 and the outflow of unintended data to the Internet 700. can.

However, although the firewall 500 functions in communication with devices existing in the Internet 700, it does not function in communication between each communication terminal 10. Therefore, in the present embodiment, in order to prevent inappropriate communication between the communication terminals 10, a security switch 100 equipped with a security function is connected instead of a simple relay device.

Then, the security switch 100 prevents the malicious frame from being transferred by performing the process using the above-mentioned permission list. A plurality of connection ports are provided in the security switch 100, and each communication terminal 10 and a firewall 500 are connected to such ports.

The plurality of communication terminals 10 are terminals each having a communication function. The communication terminal 10 communicates with another communication terminal 10 via the security switch 100. Such communication is executed in accordance with general protocols such as IP (Internet Protocol), TCP (Transmission Control Protocol), and FTP (File Transfer Protocol).
It should be noted that there is no particular limitation on the content of the data actually exchanged, that is, what kind of content is included in the payload portion.

Further, for example, some communication terminals 10 may have a function of communicating with a terminal existing in the Internet 700. Further, the communication terminal 10 may be realized by a terminal that is directly operated by the user, but may be realized by a device such as a machine tool, a sensor, and a camera installed in a factory or a plant. Further, it may be a device such as a PLC (Programmable Logic Controller) that controls a machine tool.

The setting terminal 50 is a terminal for setting the security switch 100. The setting terminal 50 is used by an administrator or the like who manages the present embodiment. The setting terminal 50 may be realized by a dedicated terminal for setting the security switch 100, but it may be realized by a general-purpose terminal such as a personal computer to which software for setting the security switch 100 is added. Is also good.

The Internet 700 is connected to a security switch 100 via a firewall 500 in order for a communication terminal 10 or the like to communicate with the outside.

The firewall 500 has a function of monitoring data transmitted to and received from the Internet 700 and discarding data considered to be malicious.

Here, as shown in FIG. 2A, for example, during the time zone from 8:30 to 17:29 on weekdays (Monday to Friday), between PC10-1 and the server PC10-3, and PC10-2. Only communication between the server PC 10-3 and the server PC 10-3 shall be permitted. On the other hand, during the time zone from 17:30 to 8:29 on weekdays (Monday to Friday), as shown in FIG. 2 (B), only communication is performed between the server PC 10-3 and the backup server PC 10-4. Shall be permitted.

Therefore, as shown in FIG. 3, a plurality of permission lists are prepared. That is, it is assumed that a permission list is generated for each time zone of 8:30 to 17:29 and 17:30 to 8:29 on each day of the week and referred to during operation. For example, for the operation of the security switch 100 in the time zone from 8:30 to 17:29 on Sunday, a permission list of "day-day" is generated, and in the time zone, a permission list of "day-day" is generated. Control communication by referring to. Similarly, for the operation of the security switch 100 during the time zone from 17:30 to 8:29 on Sunday, a permission list of "day-night" is generated, and in that time zone, the permission of "day-night" is generated. Refer to the list to control communication. Similarly, a permit list is generated for each time zone from 8:30 to 17:29 and 17:30 to 8:29, respectively, from Monday to Saturday, and the permit list is generated in the time zone corresponding to each permit list. By referring to it, the security switch 100 is operated.

FIG. 4 shows an example of a permission list corresponding to the time zone from 8:30 to 17:29 on weekdays (Monday to Friday). That is, it is an example of the permission list named "Monday-daytime", "Tuesday-daytime", "Wednesday-daytime", "Thursday-daytime", and "Friday-daytime" in the table of FIG.

Specifically, for example, in item 1, the MAC-DA (Destination address) of the frame received from the receiving port 1 is "M-PC3", and the MAC-SA (Source address). )) Is "M-PC1", Type is "0x0800" (IPv4), VID is "0", IP-SA (source IP address) is "IP-PC1", IP-DA (destination IP address) is " Indicates a frame in which the IP-PC3 ”, the protocol is“ 6 ”(TCP), the L4SP (source port number in the TCP header) is“ 3000 ”, and the L4DP (destination port number in the TCP header) is“ 23 ”.

Further, FIG. 5 shows an example of a permission list corresponding to the time zone from 17:30 to 8:29 on weekdays (Monday to Friday). That is, it is an example of the permission list of "Monday-night", "Tue-night", "Wed-night", "Thursday-night", and "Friday-night" in the table of FIG.

Specifically, for example, in No. 5, the MAC-DA (destination Mac address) of the frame received from the receiving port 3 is "M-PC4", and the MAC-SA (source Mac address) is "M-PC3". , Type is "0x0800" (IPv4), VID is "0", IP-SA (source IP address) is "IP-PC3", IP-DA (destination IP address) is "IP-PC4", protocol is "" 6 ”(TCP), L4SP (source port number in the TCP header) indicates a frame of“ any ”, and L4DP (destination port number in the TCP header) indicates a frame of“ any ”.

For example, frame information of a frame to be passed through the security switch 100 is set in the permission list. Specifically, a frame for specifying a frame of a protocol used in each communication terminal 10 and a frame including an address representing a destination or a source used in each communication terminal 10. The information is included in the allow list.

This time, the elements constituting the permission list are the device, layer 2, layer 3, and layer 4, but as described above, it is not always necessary to include all of them as elements, and some of them may be combined or others. You may add the element of.

FIG. 6 is a table showing an example of operation settings when the frames match and do not match the permission list illustrated in FIGS. 4 and 5. Specifically, in the table of FIG. 6, the frame whose frame matches the permission list is passed through the security switch 100 and is not notified to the setting terminal 50. On the other hand, a frame that does not match the permission list is discarded and indicates that the setting terminal 50 is notified that the frame has been discarded.

Next, with reference to FIG. 7, the functional block included in the security switch 100 according to the first embodiment will be described. Referring to FIG. 7, the security switch 100 includes a frame analysis unit 110, a permission list generation unit 120, a permission list storage unit 130, a day / time management unit 140, and a communication control unit 150. Here, the frame analysis unit 110 is also referred to as an "analysis means", the permission list storage unit 130 is also referred to as a "storage means", and the communication control unit 150 is also referred to as a "control means".

The frame analysis unit 110 analyzes the received input frame each time the security switch 100 receives the input frame from the outside. Here, the analysis is to extract predetermined information (hereinafter referred to as "frame information") from the received input frame.

The frame information is, for example, predetermined information specified to be described by each protocol used for communication. As a specific example, it is necessary information of a higher layer than the layer 3 (IP header) information depending on the receiving port number, the layer 2 (MAC header) information, and the frame type. In the present embodiment, by using the frame information conforming to such a general-purpose protocol, it is possible to eliminate the need for processing such as embedding special information or the like in the payload portion.

Further, in the present embodiment, all of these information may be used in the frame information and each list, but some combinations of information may be used. For example, only layer 2 (MAC header) information may be used, or a combination of layer 2 (MAC header) information and layer 3 (IP header) information may be used.

Further, for example, if layer 2 (MAC header) information is to be used, all layer 2 (MAC header) information may be used, but the destination address (MAC-DA), which is a part thereof, or The source address (MAC-SA) may be used, or a combination thereof may be used.

The frame analysis unit 110 is set with two settings, "registration period setting" and "operation setting", by the setting terminal 50.

Here, in the present embodiment, as described above, there are two periods, a registration period and an operation period, and the registration period and the operation period are switched by the registration period setting. Specifically, for example, when generating a "Monday-noon" list, the registration period is set to Monday from 8:30 to 17:29.

Further, in the operation setting, what kind of operation is performed depending on whether the frame information of the received input frame matches each list or does not match each list is set. For example, if it matches the allow list, it can be set to pass the corresponding frame. Also, if the permission list does not match, the corresponding frame can be set to be discarded. Further, “passing” means that the received input frame is passed through the frame analysis unit 110 and output, so that the frame is transferred to the destination corresponding to the destination address in the frame.

In addition to this, it is also possible to set whether or not to notify to that effect when the list matches or does not match. The content of the notification may be only the fact that it matches or does not match each list, but the frame corresponding to the frame information may be duplicated and the duplicated frame may be included in the notification. Then, for example, a virtual communication system may be created by the setting terminal 50, and the duplication of the frame may be communicated in the virtual communication system so that the influence of the malicious frame can be known.

The notification destination may be, for example, the setting terminal 50, or may be another server device or the like. Further, instead of or together with the notification, the frame corresponding to the frame information may be recorded inside the security switch 100. The administrator or the like who manages the present embodiment can grasp the communication status in the present embodiment by referring to the content of the notification and the content recorded in the security switch 100 as a log.

Further, the frame analysis unit 110 extracts the frame information from the received input frame when the input frame is received and is in the registration period, and receives the frame information from the day / time management unit 140 described later, which is the current day / time. After adding the data, it is passed to the permission list generation unit 120 described later.

Further, the frame analysis unit 110 extracts the frame information from the received input frame when the input frame is received and the operation period is reached. Then, the extracted frame information is compared with the permission list corresponding to the current day of the week / time among the permission lists stored in the permission list storage unit 130.

As a result of comparison, if the frame information matches the permission list, it operates according to the setting of the corresponding operation setting. For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame. However, no notification will be given.

On the other hand, if the frame information does not match the permission list as a result of comparison, the operation is performed according to the setting of the corresponding operation setting. For example, if the setting is "discard, notify", the frame is discarded and the setting terminal 50 is notified that the frame has been discarded.

The permission list generation unit 120 starts operation when it receives frame information from the frame analysis unit 110 during the registration period. The permission list information is generated from the received frame information, and the permission list information is stored in the permission list storage unit 130.

The permission list storage unit 130 is a storage unit for storing the permission list. The permission list stored in the permission list storage unit 130 is generated by the permission list generation unit 120 during the registration period. Then, the permission list stored in the permission list storage unit 130 is referred to and used by the frame analysis unit 110 during the operation period.

For example, frame information of a frame to be passed through the frame analysis unit 110 is set in the permission list. Specifically, a frame for specifying a frame of a protocol used in each communication terminal 10 and a frame including an address representing a destination or a source used in each communication terminal 10. The information is included in the allow list.

As described above, the permission list is generated by the permission list generation unit 120 during the registration period. In addition to this, the permission list may be modified by "list setting" from the setting terminal 50. For example, the administrator who uses the setting terminal 50 may be able to delete a part of the permission list or add new frame information to the permission list. By doing so, for example, when a communication terminal 10 is newly added, it is possible to pass a frame related to the newly added communication terminal 10 without obtaining a registration period again. In addition, for example, when a part of the existing communication terminal 10 is removed, the frame information related to the removed communication terminal 10 can be deleted from the permission list without obtaining the registration period again.

This time, the elements constituting the permission list are the device, layer 2, layer 3, and layer 4, but as described above, it is not always necessary to include all of them as elements, and some of them may be combined or others. You may add the element of.

The day / time management unit 140 plays the role of a so-called calendar and outputs the current day / time data.

The communication control unit 150 actually processes the frame according to the operation setting set in the frame analysis unit 110 while referring to the permission list stored in the permission list storage unit 130 as necessary.

Next, the operation of the present embodiment during the registration period will be described with reference to the flowchart of FIG. 8-1.

First, in step S101, the day of the week and the time of the permission list to be generated are registered. For example, if "Monday: 8:30 to 17:29" is set, the learning period will be from 8:30 to 17:29 on Monday, and it will be referred to during operation from 8:30 to 17:29 on Monday. An allow list is generated.

Next, in step S102, the security switch 100 determines whether or not the frame analysis unit 110 is set in the registration period. Here, if the registration period is set (S102: Yes), the process proceeds to step S103. On the other hand, if it is not set in the registration period (S102: No), that is, if it is set in the operation period, the process proceeds to step S108 in FIG. 8-2.

Next, in step S103, the frame analysis unit 110 performs frame analysis and transmits the frame information to the permission list generation unit 120. At this time, the actual frame is output as an output frame via the communication control unit 150.

Next, in step S104, the day / time management unit 140 adds the current day / time data to the frame information transmitted by the frame analysis unit 110.

Next, in step S105, the permission list generation unit 120 receives the frame information to which the data of the current day of the week and the time is added, and generates the permission list information.

Next, in step S106, the permission list generation unit 120 transfers the generated permission list information to the permission list storage unit 130.

Next, in step S107, the permission list storage unit 130 stores the transferred permission list information.

Next, in step S108, the security switch 100 determines whether or not the registration period has expired. When the registration period has expired (S108: Yes), the process proceeds to step S109 in FIG. 8-2. If the registration period has not ended (S108: No), the process returns to step S103.

Next, the operation when the permission list generated and updated in this way is used during the operation period will be described with reference to FIG. 8-2.

First, in step S109, when the security switch 100 receives an input frame during the operation period, the frame analysis unit 110 analyzes the received input frame to extract frame information.

Next, in step S110, the day / time management unit 140 instructs the frame analysis unit 110 to select the day / time range corresponding to the current day / time. For example, if the current time is 12:30 on Monday, the selection of "Monday-noon" is instructed.

Next, in step S111, the frame analysis unit 110 refers to the permission list corresponding to the day / time range selected and instructed by the day / time management unit 140. For example, in the above example, the permission list of "Monday-noon" is referred to.

Next, in step S112, the frame analysis unit 110 compares the extracted frame information with the referenced permission list, and determines whether or not they match.

When both match (S112: Yes), the frame analysis unit 110 processes the frame corresponding to the frame information matching the permission list according to the instruction of the operation setting when the frame information matches the permission list (step). S113). For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame.
However, no notification will be given.

When the process of step S113 is completed, the process returns to step S109, and each of the above operations is repeated for the newly received frame.

When the two do not match (S112: No), the frame analysis unit 110 processes the frame corresponding to the frame information that does not match the permission list according to the instruction of the operation setting when the frame information does not match the permission list. (Step S114). For example, if the setting is "discard, notify", the frame is discarded and the setting terminal 50 is notified that the frame has been discarded.

When the process of step S114 is completed, the process returns to step S109, and each of the above operations is repeated for the newly received frame.

According to the first embodiment described above, it becomes possible to communicate only at a certain time on a certain day of the week on a specific terminal, and it becomes possible to further improve security. The reason is that the permission list to be referenced from the permission list storage unit is switched for each day of the week and time, and the frame analysis unit compares and determines the data of the received frame.

In the first embodiment described above, when the permission list for a specific day / time is generated, the learning period is set to be learned during the specific day / time at the stage of setting the first learning period. Instead, for example, assuming that the learning period is one week, a weekly permission list is once generated, and the weekly permission list is divided by day of the week and time by a direct operation on the permission list storage unit. You may.

<Second embodiment>
Hereinafter, the second embodiment of the present invention will be described in detail with reference to FIGS. 9 to 14-2.

The second embodiment has the same basic configuration as that of FIG. 1 according to the first embodiment. However, although not shown, a security switch 200 is provided instead of the security switch 100 of FIG.

In the first embodiment, the permission list is generated for each day of the week / time, and the permission list to be referred to is switched according to the day / time at the time of operation. On the other hand, in the second embodiment, the permission list according to the communication amount is generated, and the permission list to be referred to is switched according to the communication amount at the time of operation.

As shown in FIG. 9, when the communication volume is normal, as shown in (A), only communication between PC10-1 and server PC10-3 and between PC10-2 and server PC10-3 is permitted. Then. On the other hand, as shown in (B), when the communication volume is abnormal, no communication is permitted.

Therefore, as shown in FIG. 10, the permission list to be referred to is switched according to the amount of communication. For example, when the communication amount is 0 Mbps to 5 Mbps, the communication is controlled by referring to the permission list named "normal" used when the communication amount is normal. On the other hand, when the communication amount exceeds 5 Mbps, the communication is controlled by referring to the permission list named "abnormality" used when the communication amount is abnormal. The amount of communication described here may be the amount of communication for each security switch or the amount of communication for each port.

FIG. 11 shows an example of a permission list to be referred to when the traffic is normal. That is, it is an example of the permission list of the name "normal" in the table of FIG.

Similar to the table of FIG. 4 according to the first embodiment, specifically, for example, in item 1, the MAC-DA (destination Mac address) of the frame received from the receiving port 1 is “M-PC3”. MAC-SA (source Mac address) is "M-PC1", Type is "0x0800" (IPv4), VID is "0", IP-SA (source IP address) is "IP-PC1", IP-DA (Destination IP address) is "IP-PC3", protocol is "6" (TCP), L4SP (source port number in TCP header) is "3000", L4DP (destination port number in TCP header) is "23". Indicates the frame of ".

Further, FIG. 12 shows an example of a permission list to be referred to when the communication volume is abnormal. That is, it is an example of the permission list of the name "abnormal" in the table of FIG.

In the table of FIG. 12, no data is registered. That is, when the permission list occupied in the table of FIG. 12 is referred to, there is no frame that matches the permission list.

The operation setting example when the frames match and do not match the permission list illustrated in FIGS. 11 and 12 is the same as in FIG. Specifically, the frame matching the permission list shown in FIG. 11 is passed through the security switch 200 and is not notified to the setting terminal 50. On the other hand, the frame that does not match the permission list is discarded, and the setting terminal 50 is notified that the frame has been discarded. Further, when referring to the permission list shown in FIG. 12, since there is no frame matching the permission list, all the frames are discarded and the setting terminal 50 is notified that the frames have been discarded.

Next, with reference to FIG. 13, the functional block included in the security switch 200 according to the second embodiment will be described. In FIG. 13, the same components as the security switch 100 according to the first embodiment are shown by using the same reference numerals.

The security switch 200 does not include the day / time management unit 140 and the communication control unit 150, but includes the communication amount monitoring unit 210, the communication amount management unit 220, and the communication control unit 230, according to the first embodiment. It is different from the security switch 100 according to the above.

The communication amount monitoring unit 210 monitors the communication amount of the passing data, and periodically notifies the communication amount management unit 220 of the communication amount. The particle size to be monitored may be a physical port unit or a device unit. The range of the communication amount to be monitored follows the instruction of the communication amount management unit 220.

The communication amount management unit 220 sets the expected communication amount in the learning period by the communication amount setting means. The settings are set with a certain range. For example, it may be set to "0 Mbps or more and 5 Mbps or less" or "5 Mbps ± 20%". If the actual amount of communication is within this range, it is determined that the amount of communication is normal, and if it exceeds this range, it is determined that the amount of communication is abnormal. This expected communication amount is given to the frame information when the frame information is passed from the frame analysis unit 110 to the permission list generation unit 120. After that, when the permission list is stored in the permission list storage unit 130, the expected communication amount is stored at the same time as an attribute of the permission list.

Further, the communication amount management unit 220 periodically obtains the communication amount from the communication amount monitoring unit 210, and also obtains the communication amount expected value data corresponding to the permission list from the permission list storage unit 130. Further, when the communication amount obtained from the communication amount monitoring unit 210 is periodically compared with the communication amount expected value data obtained from the permission list storage unit 130, and the actual communication amount is outside the range of the communication amount expected value. Instructs the selection of the permission list referred to by the frame analysis unit 110. In addition, the communication control unit 230 may be instructed to control the band or the like. When the actual communication amount returns to the range of the expected communication amount, the frame analysis unit 110 selects the permission list to be referred to and gives an instruction to the communication control unit 230 again.

The communication control unit 230 actually processes the frame according to the operation settings set in the frame analysis unit 110. Further, communication control such as bandwidth control may be performed according to the instruction from the communication amount management unit 220.

Next, the operation of the present embodiment during the registration period will be described with reference to the flowchart of FIG. 14-1.

First, in step S201, the security switch 200 determines whether or not the frame analysis unit 110 is set during the registration period. Here, if the registration period is set (S201: Yes), the process proceeds to step S202. On the other hand, if it is not set in the registration period (S201: No), that is, if it is set in the operation period, the process proceeds to step S209 in FIG. 14-2.

Next, in step S202, the frame analysis unit 110 performs frame analysis and transmits the frame information to the permission list generation unit 120. At this time, the actual frame is output as an output frame via the communication amount monitoring unit 210 and the communication control unit 230.

Next, in step S203, the communication amount management unit 220 adds data of the expected communication amount to the frame information transmitted by the frame analysis unit 110. For example, when the communication amount of 0 Mbps to 5 Mbps is within the normal range of the communication amount, the data of "0 Mbps to 5 Mbps" is added.

Next, in step S204, the permission list generation unit 120 receives the frame information to which the expected communication amount is added, and generates the permission list information when the actual communication amount is within the range of the expected communication amount. ..

Next, in step S205, the permission list generation unit 120 transfers the generated permission list information to the permission list storage unit 130.

Next, in step S206, the permission list storage unit 130 stores the transferred permission list information.

Next, in step S207, the security switch 100 determines whether or not the registration period has expired. If the registration period has expired (S207: Yes), the process proceeds to step S208. If the registration period has not ended (S207: No), the process returns to step S202.

Next, in step S208, the user directly operates on the permission list storage unit 130 to generate a permission list when the communication amount is out of the range of the expected communication amount, for example, the permission list of FIG. .. In addition, for example, when it is decided in advance that the permission list when the communication amount is out of the range of the expected communication amount is an empty list as shown in FIG. 12, the user's operation is used. Instead, the permission list generation unit 120 may automatically generate a permission list when the communication amount is out of the range of the communication amount expected value.

The operation when the permission list generated and updated in this way is used during the operation period will be described with reference to FIG. 14-2.

First, in step S209, when the security switch 100 receives an input frame during the operation period, the frame analysis unit 110 analyzes the received input frame to extract frame information.

Next, in step S210, the communication volume monitoring unit 210 transmits the current communication volume to the communication volume management unit 220.

Next, in step S211 the communication amount management unit 220 compares the current communication amount with the range of the expected communication amount value which is an attribute of the permission list stored in the permission list storage unit 130, and performs frame analysis. Instructs unit 110 to select an expected communication amount range corresponding to the current communication amount. For example, when the current communication volume is 2 Mbps, the item number 1 in the table of FIG. 10 is instructed to select "normal communication volume", and when the current communication volume is 10 Mbps, the item number in the table of FIG. 10 is instructed. Instructs the selection of "traffic volume abnormality" which is 2.

Next, in step S212, the frame analysis unit 110 refers to the permission list corresponding to the communication amount range instructed to be selected by the communication amount management unit 220 in step S211.

Next, in step S213, the frame analysis unit 110 compares the extracted frame information with the referenced permission list, and determines whether or not they match.

When both match (S213: Yes), the frame analysis unit 110 processes the frame corresponding to the frame information matching the permission list according to the instruction of the operation setting when the frame information matches the permission list (step). S214). For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame.
However, no notification will be given.

When the process of step S214 is completed, the process returns to step S209, and each of the above operations is repeated for the newly received frame.

When the two do not match (S213: No), the frame analysis unit 110 processes the frame corresponding to the frame information that does not match the permission list according to the instruction of the operation setting when the frame information does not match the permission list. (Step S215). For example, if the setting is "discard, notify", the frame is discarded and the setting terminal 50 is notified that the frame has been discarded.

When the process of step S215 is completed, the process returns to step S209, and each of the above operations is repeated for the newly received frame.

According to the second embodiment described above, communication control (blocking, detour, band control, etc.) can be performed when the communication volume of the regular communication flow exceeds a certain range as compared with the normal time. Become. The reason is that the communication amount monitored by the communication amount monitoring unit 210 and the expected communication amount value at the normal time are compared by the communication amount management unit 220, and if it is out of the range, the communication control unit 230 controls the communication. be.

In the above description, only two types of permission lists, one is normal and the other is abnormal, are illustrated. However, the present embodiment is not limited to this, and there are three or more types depending on the amount of communication. You may generate and refer to the permission list.

<Third embodiment>
Hereinafter, the third embodiment of the present invention will be described in detail with reference to FIGS. 15 to 21-2.

The third embodiment has the same basic configuration as that of FIG. 1 according to the first embodiment. However, although not shown, a security switch 300 is provided in place of the security switch 100 of FIG.

In the first embodiment, the permission list is generated for each day of the week / time, and the permission list to be referred to is switched according to the day / time at the time of operation. Further, in the second embodiment, the permission list according to the communication amount is generated, and the permission list to be referred to is switched according to the communication amount at the time of operation. The third embodiment generates a combination of these, that is, a permission list according to the day of the week, time, and communication volume, and creates a permission list to be referred to according to the day of the week, time, and communication volume at the time of operation. Switch.

As shown in FIG. 15A, for example, when the traffic is normal during the time zone from 8:30 to 17:29 on weekdays (Monday to Friday), between PC10-1 and server PC10-3. , And only communication between PC10-2 and server PC10-3 shall be permitted. If the traffic is normal during the time period from 17:30 to 8:29 on weekdays (Monday to Friday), the server PC10-3 and the backup server PC10-4 are shown in FIG. 15B. Only communication with and shall be permitted. Further, if the communication volume is abnormal on weekdays (Monday to Friday), no communication is permitted as shown in FIG. 15 (C).

Therefore, as shown in FIG. 16, a plurality of permission lists are prepared. That is, for each time zone from 8:30 to 17:29 and 17:30 to 8:29 on each day of the week, a permission list for normal and abnormal traffic is generated and referred to during operation. Then. For example, for the operation of the security switch 300 when the traffic is normal during the time zone from 8:30 to 17:29 on Sunday, a permission list of "day-day-normal" is generated, and in that time zone. At the time of operation, communication is controlled by referring to the permission list of "day-day-normal". In addition, for the operation of the security switch 300 when the communication volume is abnormal during the time zone from 8:30 to 17:29 on Sunday, a permission list of "day-day-abnormal" is generated, and in that time zone. Controls communication by referring to the permission list "Sun-day-abnormal".
Similarly, for the operation of the security switch 100 when the traffic is normal during the time zone from 17:30 to 8:29 on Sunday, a permission list of "day-night-normal" is generated and the time zone is concerned. At the time of operation in, communication is controlled by referring to the permission list of "day-night-normal". In addition, for the operation of the security switch 100 when the traffic is abnormal during the time zone from 17:30 to 8:29 on Sunday, a permission list of "day-night-abnormal" is generated, and in that time zone. During operation, communication is controlled by referring to the permission list "day-night-abnormal". Similarly, for each time zone from 8:30 to 17:29 and 17:30 to 8:29, respectively, from Monday to Saturday, a permission list is generated when the traffic is normal and abnormal. The security switch 100 is operated by referring to the permission list in the time zone corresponding to each permission list.

FIG. 17 shows an example of a permission list corresponding to the case where the traffic is normal during the time zone from 8:30 to 17:29 on weekdays (Monday to Friday). That is, in the table of FIG. 16, the names "Monday-daytime-normal", "Tue-daytime-normal", "Wednesday-daytime-normal", "Thursday-daytime-normal", and "Friday-daytime-normal" An example of an allow list.

Specifically, for example, in item 1, the MAC-DA (destination Mac address) of the frame received from the receiving port 1 is "M-PC3", and the MAC-SA (source Mac address) is "M-PC1". , Type is "0x0800" (IPv4), VID is "0", IP-SA (source IP address) is "IP-PC1", IP-DA (destination IP address) is "IP-PC3", protocol is "" 6 ”(TCP), L4SP (source port number in the TCP header) is“ 3000 ”, and L4DP (destination port number in the TCP header) is“ 23 ”.

Further, FIG. 18 shows an example of a permission list corresponding to a case where the traffic is normal during the time zone from 17:30 to 8:29 on weekdays (Monday to Friday). That is, the permission list of "Monday-Night-Normal", "Tue-Night-Normal", "Wed-Night-Normal", "Thu-Night-Normal", and "Fri-Night-Normal" in the table of FIG. Is an example of.

Specifically, for example, in No. 5, the MAC-DA (destination Mac address) of the frame received from the receiving port 3 is "M-PC4", and the MAC-SA (source Mac address) is "M-PC3". , Type is "0x0800" (IPv4), VID is "0", IP-SA (source IP address) is "IP-PC3", IP-DA (destination IP address) is "IP-PC4", protocol is "" 6 ”(TCP), L4SP (source port number in the TCP header) indicates a frame of“ any ”, and L4DP (destination port number in the TCP header) indicates a frame of“ any ”.

Further, FIG. 19 shows an example of a permission list to be referred to when the communication volume is abnormal. That is, "Mon-day-abnormal", "Mon-night-abnormal", "Tue-day-abnormal", "Tue-night-abnormal", "Wed-day-abnormal", "Wed-Wed-" in the table of FIG. This is an example of a permission list named "Night-Abnormal", "Thu-Day-Abnormal", "Thu-Night-Abnormal", "Fri-Day-Abnormal", and "Fri-Night-Abnormal".

In the table of FIG. 19, no data is registered. That is, when the permission list shown in the table of FIG. 19 is referred to, there is no frame that matches the permission list.

The operation setting example when the frames match the permission list illustrated in FIGS. 17 to 19 and when the frames do not match is the same as in FIG. Specifically, the frame matching the permission list shown in FIGS. 17 and 18 is passed through the security switch 300 and is not notified to the setting terminal 50. On the other hand, the frame that does not match the permission list is discarded, and the setting terminal 50 is notified that the frame has been discarded. Further, when referring to the permission list shown in FIG. 19, since there is no frame matching the permission list, all the frames are discarded and the setting terminal 50 is notified that the frames have been discarded.

Next, with reference to FIG. 20, the functional block included in the security switch 300 according to the third embodiment will be described. In FIG. 20, the same components as the security switch 100 according to the first embodiment and the security switch 200 according to the second embodiment are shown by using the same reference numerals.

The security switch 300 includes a frame analysis unit 110, a permission list generation unit 120, and a permission list storage unit 130, which both the security switch 100 according to the first embodiment and the security switch 200 according to the second embodiment have. .. Further, the security switch 300 includes a day / time management unit 140 included in the security switch 100 according to the first embodiment. Further, the security switch 300 includes a communication amount monitoring unit 210, a communication amount management unit 220, and a communication control unit 230 included in the security switch 200 according to the second embodiment.

Among the operations of each block of the security switch 300, the differences from the operations of the corresponding blocks included in the security switch 100 and the security switch 200 are as follows.

The frame analysis unit 110 extracts frame information from the received input frame when the input frame is received and is in the registration period, and the communication amount expected value received from the communication amount management unit 220, and the day / time management unit 140. After adding the data of the current day of the week and time received from, it is passed to the permission list generation unit 120 described later.

Further, the frame analysis unit 110 extracts frame information from the received input frame when the input frame is received and during the operation period. Then, the extracted frame information is compared with the permission list corresponding to the current day of the week, time, and communication amount among the permission lists stored in the permission list storage unit 130.

Further, the particle size of the communication amount monitored by the communication amount monitoring unit 210 may be a physical port unit, a device unit, or a day / time range unit corresponding to each permission list.

Next, the operation of the present embodiment during the registration period will be described with reference to the flowchart of FIG. 21-1.

First, in step S301, the day / time of the permission list to be generated is registered. For example, if "Monday: 8:30 to 17:29" is set, the learning period will be from 8:30 to 17:29 on Monday, and it will be referred to during operation from 8:30 to 17:29 on Monday. An allow list is generated.

Next, in step S302, the security switch 300 determines whether or not the frame analysis unit 110 is set in the registration period. Here, if the registration period is set (S302: Yes), the process proceeds to step S303. On the other hand, if it is not set in the registration period (S302: No), that is, if it is set in the operation period, the process proceeds to step S311 in FIG. 21-2.

Next, in step S303, the frame analysis unit 110 performs frame analysis and transmits frame information to the permission list generation unit 120. At this time, the actual frame is output as an output frame via the communication amount monitoring unit 210 and the communication control unit 230.

Next, in step S304, the communication amount management unit 220 adds data of the expected communication amount to the frame information transmitted by the frame analysis unit 110. For example, when the communication amount of 0 Mbps to 5 Mbps is within the normal range of the communication amount, the data of "0 Mbps to 5 Mbps" is added.

Next, in step S305, the day / time management unit 140 further adds data on the current day of the week and time to the frame information to which the expected communication amount is assigned.

Next, in step S306, the permission list generation unit 120 receives the frame information to which the data of the current day of the week and the time and the data of the expected communication amount are added, and generates the permission list information.

Next, in step S307, the permission list generation unit 120 transfers the generated permission list to the permission list storage unit 130.

Next, in step S308, the permission list storage unit 130 stores the transferred permission list.

Next, in step S309, the security switch 100 determines whether or not the registration period has expired. If the registration period has expired (S309: Yes), the process proceeds to step S310. If the registration period has not ended (S309: No), the process returns to step S303.

Next, in step S310, the user directly operates the permission list storage unit 130 to generate a permission list when the communication amount is out of the range of the expected communication amount, for example, the permission list of FIG. .. In addition, for example, when it is decided in advance that the permission list when the communication amount is out of the range of the expected communication amount is an empty list as shown in FIG. 19, the operation of the user is used. Instead, the permission list generation unit 120 may automatically generate a permission list when the communication amount is out of the range of the communication amount expected value.

The operation when the permission list generated and updated in this way is used during the operation period will be described with reference to FIG. 21-2.

First, in step S311, when the security switch 300 receives an input frame during the operation period, the frame analysis unit 110 analyzes the received input frame to extract frame information.

Next, in step S312, the communication amount monitoring unit 210 transmits the current communication amount to the communication amount management unit 220.

Next, in step S313, the communication volume management unit 220 compares the current communication volume with the range of the communication volume expected value which is an attribute of the permission list stored in the permission list storage unit 130, and performs frame analysis. Instruct unit 110 to select a communication amount expected value range corresponding to the current communication amount. For example, when the current communication amount is 2 Mbps, the selection of "normal communication amount" is instructed, and when the current communication amount is 10 Mbps, the selection of "abnormal communication amount" is instructed.

Next, in step S314, the day / time management unit 140 instructs the frame analysis unit 110 to select the day / time range corresponding to the current day / time. For example, if the current time is 12:30 on Monday, the selection of "Monday-noon" is instructed.

Next, in step S315, the frame analysis unit 110 selected and instructed the communication amount range by the communication amount management unit 220 in step S313, and the day / time / time specified by the day / time management unit 140 in step S314. Refer to the permission list corresponding to the range. For example, when "normal traffic" is selected in step S313 and "month-noon" is selected in step S314, the permission list of "month-noon-normal" is referred to.

Next, in step S316, the frame analysis unit 110 compares the extracted frame information with the referenced permission list, and determines whether or not they match.

When both match (S316: Yes), the frame analysis unit 110 processes the frame corresponding to the frame information matching the permission list according to the instruction of the operation setting when the frame information matches the permission list (step). S317). For example, if the setting is "pass, do not notify", the frame is output by passing the frame analysis unit 110 through the frame.
However, no notification will be given.

When the process of step S317 is completed, the process returns to step S311 and repeats each of the above operations for the newly received frame.

When the two do not match (S316: No), the frame analysis unit 110 processes the frame corresponding to the frame information that does not match the permission list according to the instruction of the operation setting when the frame information does not match the permission list. (Step S318). For example, if the setting is "discard, notify", the frame is discarded and the setting terminal 50 is notified that the frame has been discarded.

When the process of step S318 is completed, the process returns to step S311, and each of the above operations is repeated for the newly received frame.

According to the third embodiment described above, it becomes possible to communicate only at a certain time on a certain day of the week on a specific terminal, and it becomes possible to further improve security. The reason is that the permission list to be referenced from the permission list storage unit is switched for each day of the week and time, and the frame analysis unit compares and determines the data of the received frame. Further, when the communication amount of the regular communication flow exceeds a certain range as compared with the normal time, communication control (blocking, detour, band control, etc.) can be performed. The reason is that the communication amount monitored by the communication amount monitoring unit 210 and the communication amount in the normal time are compared by the communication amount management unit 220, and if it is out of the range, the communication control unit 230 controls the communication.

In the third embodiment described above, when the permission list for a specific day / time is generated, the learning period is set to be learned during the specific day / time at the stage of setting the first learning period. Instead, for example, assuming that the learning period is one week, a weekly permission list is once generated, and the weekly permission list is divided by day of the week and time by a direct operation on the permission list storage unit. You may.

Each of the above security switch, communication terminal and setting terminal can be realized by hardware, software or a combination thereof. Further, the relay method performed by the above-mentioned security switch, communication terminal and setting terminal can also be realized by hardware, software or a combination thereof. Here, what is realized by software means that it is realized by a computer reading and executing a program.

Programs can be stored and supplied to a computer using various types of non-transitory computer readable medium. Non-transient computer-readable media include various types of tangible storage media. Examples of non-temporary computer-readable media include magnetic recording media (eg, flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (eg, magneto-optical disks), CD-ROMs (Read Only Memory), CD-. Includes R, CD-R / W, semiconductor memory (eg, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (random access memory)).

Further, although the above-described embodiment is a preferred embodiment of the present invention, the scope of the present invention is not limited to the above-mentioned embodiment, and various modifications have been made without departing from the gist of the present invention. It can be implemented in the form.

For example, each embodiment can be modified as follows.

In each of the above embodiments, the security switch is connected to the Internet, but it is not always necessary to connect to the Internet. Even when not connected to the Internet, it is possible to detect a malicious frame that occurs when, for example, a malicious user connects an unauthorized terminal to the corporate network.

In each of the above-described embodiments, the operation period is reached after a predetermined time has elapsed from the registration period, and the operation is continued. In this case, the operation period may be changed to the registration period again, and if a predetermined time has elapsed after the transition, the operation period may be changed again. That is, the permission list may be updated by re-registering.

For example, when a new communication terminal is added after the transition of the operation period, the frame related to the added communication terminal may be added to the permission list by re-registering. In this case, the permission list may be left blank and the permission list may be recreated from scratch, or new frame information may be added to the existing permission list.

Some or all of the above embodiments may also be described, but not limited to:

(Appendix 1)
It ’s a relay device,
A storage means for storing a list of frames to be processed in the first process after reception by the relay device.
An analysis means that collates the received frame with the list,
At the time of collation by the analysis means, if the received frame matches the frame described in the list, the received frame is subjected to the first processing, and if the received frame does not match, the received frame is subjected to the first processing. It is equipped with a control means that performs the processing of 2.
A plurality of the lists exist according to the day of the week and the time, and the analysis means collates the received frame with the list corresponding to the day of the week and the time during operation.

(Appendix 2)
The relay device described in Appendix 1
In addition to the day of the week and the time, there are a plurality of the lists according to the amount of communication during operation, and the analysis means includes the received frame and a list corresponding to the day of the week, time, and amount of communication during operation. A relay device characterized by collation.

(Appendix 3)
It ’s a relay device,
A storage means for storing a list of frames to be processed in the first process after reception by the relay device.
An analysis means that collates the received frame with the list,
At the time of collation by the analysis means, if the received frame matches the frame described in the list, the received frame is subjected to the first processing, and if the received frame does not match, the received frame is subjected to the first processing. It is equipped with a control means that performs the processing of 2.
A plurality of the lists exist according to the amount of communication during operation, and the analysis means is a relay device for collating the received frame with a list corresponding to the amount of communication during operation.

(Appendix 4)
The relay device according to any one of Supplementary note 1 to 3, wherein the relay device is
The relay device, wherein the first process includes transferring the frame to the destination of the frame, and the second process does not include transferring the frame to the destination of the frame.

(Appendix 5)
The relay device according to any one of Supplementary Provisions 2 to 4.
A relay device characterized in that the communication volume of the relay device unit is monitored as the communication volume during the operation.

(Appendix 6)
The relay device according to any one of Supplementary Provisions 2 to 4.
A relay device characterized in that the communication volume for each physical port of the relay device is monitored as the communication volume during the operation.

(Appendix 7)
The relay device according to any one of Supplementary Provisions 2 to 4.
A relay device characterized in that the communication amount of the day of the week and the time unit is monitored as the communication amount during the operation.

(Appendix 8)
A communication system including the relay device according to any one of Supplementary note 1 to 7 and a setting terminal connected to the relay device.
A communication system characterized in that a part or all of the contents of each of the processes and the contents of the list is changed according to an operation from a user accepted by the setting terminal.

(Appendix 9)
It is a relay method used in a relay device.
A step of storing a list of frames to be processed in the first process after reception by the relay device, and a step of storing the list.
The step of collating the received frame with the list,
At the time of collation by the analysis means, if the received frame matches the frame described in the list, the received frame is subjected to the first processing, and if the received frame does not match, the received frame is subjected to the first processing. It has a step of processing 2 and
A plurality of the lists exist according to the day of the week and the time, and the analysis means collates the received frame with the list corresponding to the day of the week and the time during operation.

(Appendix 10)
A relay program that allows a computer to function as a relay device.
The computer
A storage means for storing a list of frames to be processed in the first process after reception by the relay device.
An analysis means that collates the received frame with the list,
At the time of collation by the analysis means, if the received frame matches the frame described in the list, the received frame is subjected to the first processing, and if the received frame does not match, the received frame is subjected to the first processing. It is equipped with a control means that performs the processing of 2.
There are a plurality of the lists according to the day of the week and the time, and the analysis means is a relay program that functions as a relay device for collating the received frame with the list corresponding to the day and time during operation.

The present invention is suitable for security measures in a relay device.

10 10-1 10-2 10-3 10-4 10-n Communication terminal 50 Setting terminal 100 200 300 Security switch 110 Frame analysis unit 120 Permission list generation unit 130 Permission list storage unit 140 Day / time management unit 150 Communication control Unit 210 Traffic monitoring unit 220 Communication volume management unit 230 Communication control unit 500 Firewall 700 Internet

Claims (14)

It ’s a relay device,
A storage means for storing a list of frames to be processed in the first process after reception by the relay device.
A first connection port that connects only to 1 PLC (Programmable Logical Controller), and
A second connection port that connects only to one IoT (Internet Of Things) device,
An analysis means for collating a frame received from the first or second connection port with the list, and
At the time of collation by the analysis means, if the received frame matches the frame described in the list, the received frame is subjected to the first processing, and if the received frame does not match, the received frame is subjected to the first processing. The control means that performs the processing of 2 and
Equipped with
The list contains information that identifies the first or second connection port.
The analysis means is further conditioned on the information that identifies the first or second connection port at the time of the collation.
Relay device. The storage means stores a plurality of the lists and stores the list.
The analysis means collates the received frame with a first list selected from the plurality of lists based on predetermined conditions.
The relay device according to claim 1. The plurality of lists exist according to the amount of communication during operation.
The relay device according to claim 2. As the communication volume during the operation, the communication volume of the relay device unit is monitored.
The relay device according to claim 3. As the communication volume during the operation, the communication volume for each physical port of the relay device is monitored.
The relay device according to claim 3. The first process includes transferring the frame to the destination of the frame.
The second process does not include transferring the frame to the destination of the frame.
The relay device according to any one of claims 1 to 5. With a relay device
The setting terminal connected to the relay device and
Equipped with
The relay device is
A storage means for storing a list of frames to be processed in the first process after reception by the relay device.
A first connection port that connects to only one PLC,
A second connection port that connects only to one IoT device,
An analysis means for collating a frame received from the first or second connection port with the list, and
At the time of collation by the analysis means, if the received frame matches the frame described in the list, the received frame is subjected to the first processing, and if the received frame does not match, the received frame is subjected to the first processing. The control means that performs the processing of 2 and
Equipped with
The list contains information that identifies the first or second connection port.
The analysis means is subject to the information for identifying the first or second connection port at the time of the collation.
The setting terminal changes a part or all of the contents of each of the processes and the contents of the list according to the operation from the user accepted by the setting terminal.
Communications system. It is a relay method used in a relay device.
A step of storing a list of frames to be processed in the first process after reception by the relay device, and a step of storing the list.
A step of collating a frame received from a first connection port connected to only one PLC or a second connection port connecting only one IoT device with the above list.
At the time of the collation by the collation step, if the received frame matches the frame described in the list, the first process is performed on the received frame, and if they do not match, the received frame is performed. And the step to do the second process,
Have,
The list contains information that identifies the first or second connection port.
The collation step is further conditioned on information identifying the first or second connection port at the time of the collation.
Relay method. The memorizing step stores a plurality of the lists and stores the list.
The collating step collates the received frame with a first list selected from the plurality of lists based on predetermined conditions.
The relay method according to claim 8. The plurality of lists exist according to the amount of communication during operation.
The relay method according to claim 9. As the communication volume during the operation, the communication volume of the relay device unit is monitored.
The relay method according to claim 10. As the communication volume during the operation, the communication volume for each physical port of the relay device is monitored.
The relay method according to claim 10. The first process includes transferring the frame to the destination of the frame.
The second process does not include transferring the frame to the destination of the frame.
The relay method according to any one of claims 8 to 12. A relay program that allows a computer to function as a relay device.
The computer
A storage means for storing a list of frames to be processed in the first process after reception by the relay device.
An analysis means for collating a frame received from a first connection port connected only to one PLC or a second connection port connected only to one IoT device with the above list.
At the time of collation by the analysis means, if the received frame matches the frame described in the list, the received frame is subjected to the first processing, and if the received frame does not match, the received frame is subjected to the first processing. The control means that performs the processing of 2 and
Equipped with
The list contains information that identifies the first or second connection port.
The analysis means is further conditioned on the information that identifies the first or second connection port at the time of the collation.
A relay program that functions as a relay device.

Images