JPH11205309A - Network security system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide the network security system where encryption/decoding function is controlled, based on a type of a frame to be sent/received. SOLUTION: An IP address, a protocol type, a port number and a command of a communication equipment not encrypted/decoded are respectively set to plain text communication tables 12, 22. When any of the information such as the IP address set to a frame to be sent corresponds to any of contents set in the plain communication table 12, a data communication processing section 11 sends data as a plain text without encrypting data, and when not corresponding, the section 11 sends data after encrypting the data. A data communication processing section 21 receives as a plain text without decoding data when any of the information such as the IP address set to the received frame corresponds to any of the contents set in the plain text communication table 22, and otherwise, it decodes the data when receiving.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network security system and, more particularly, to a data encryption / decryption switching mechanism in a network in which terminals having encryption functions and terminals not having encryption functions coexist.

[0002]

2. Description of the Related Art FIG. 6 is a schematic diagram of a conventional network system. Conventionally, when data communication is performed between the terminals 2 and 3 via the network 1, data exchanged between the terminals is encrypted on the data transmission side by encryption devices 4 and 5 built in or attached to the terminal. To the destination terminal. For example, when the terminal 2 encrypts data and transmits the data to the terminal 3, the terminal 3 on the data receiving side decrypts the received data with an encryption device 5 also equipped with a decryption function, thereby obtaining the encrypted data. The content can be decrypted. In this way, by providing the terminals 2 and 3 for performing network communication with the encryption / decryption function, data flowing on the network can be prevented from eavesdropping and the like.

[0003]

However, in the conventional system configuration, a terminal having an encryption function transmits data to one of the terminals after uniformly encrypting the data. In the case where a terminal having an encryption function and a terminal having no encryption function coexist on a network, a terminal having an encryption function is a terminal having no encryption function. Data communication could not be performed.

[0004] Also, depending on the type of data to be transmitted, the communication protocol, the application, and the like, even if there is a case where data communication is desired to be performed without encryption even between terminals having an encryption function, the reason described above may be obtained. Can not be realized.

The present invention has been made to solve the above problems, and an object of the present invention is to provide a network security system capable of controlling execution of an encryption / decryption function depending on the type of a frame to be transmitted and received. Is to do.

[0006]

In order to achieve the above object, a network security system according to a first aspect of the present invention encrypts data to a communication device as a communication partner via a network, and then encrypts the data. In a network security system having a communication device equipped with an encryption function for transmitting a frame including data, the communication device equipped with the encryption function performs encryption processing in which a condition for not encrypting data is set. It has encryption processing invalidation information storage means for holding invalidation information, and data transmission means for transmitting without encryption when the type of frame to be transmitted corresponds to the encryption processing invalidation information.

[0007] In a second aspect of the present invention, in the network security system according to the first aspect, the encryption processing invalid information storage means has an area for setting identification information of a protocol used for data communication. The data transmitting means transmits the data contained in the transmission frame without encryption when the identification information of the protocol set in the transmission frame is set in the encryption processing invalid information storage means. Things.

[0008] In a third aspect of the present invention, in the network security system according to the first aspect, the encryption processing invalid information storage means has an area for setting address information of a communication device, and the data transmission The means transmits the data contained in the transmission frame without encryption when the address information of the destination set in the transmission frame is set in the encryption processing invalid information storage means.

According to a fourth aspect of the present invention, in the network security system according to the first aspect, the encryption process invalid information storage means has an area for setting identification information of an application used for data communication. The data transmission means transmits the transmission data without encryption when the identification information of the destination application set in the transmission frame is set in the encryption processing invalid information storage means.

[0010] In a fifth aspect of the present invention, in the network security system according to the first aspect, the encryption process invalid information storage means has an area for setting command identification information, and the data transmission means. When the identification information of the command included in the transmission data is not set in the encryption processing invalid information storage means, the transmission data excluding the command is encrypted before transmission, and the identification information of the command is the encryption information. When it is set in the encryption process invalid information storage means, the transmission data is transmitted without encryption.

[0011] A network security system according to a sixth aspect of the present invention is the network security system according to the first aspect, further comprising information updating means for updating the encryption processing invalidation information held by the encryption processing invalidation information storage means.

A network security system according to a seventh aspect of the present invention is a network security system having a communication device equipped with a decryption function for decrypting data transmitted via a network, wherein the communication device equipped with the decryption function comprises: A device having a decoding process invalidation information storage unit that holds decoding process invalidation information that sets conditions for not decoding received data, and a data receiving unit that does not decode when the type of the received frame corresponds to the decoding process invalidation information It is.

[0013] In a network security system according to an eighth aspect based on the seventh aspect, the decryption processing invalid information storage means has an area for setting identification information of a protocol used for data communication. The data receiving means does not decode the data contained in the received frame when the identification information of the protocol set in the received frame is set in the decoding invalidation information storage means.

According to a ninth aspect of the present invention, in the network security system according to the seventh aspect, the decryption processing invalid information storage means has an area for setting address information of a communication device, and the data reception means Does not decode the data contained in the received frame when the address information of the transmission source set in the received frame is set in the decoding invalidation information storage means.

According to a tenth aspect of the present invention, in the network security system according to the seventh aspect, the decryption processing invalid information storage means has an area for setting identification information of an application used for data communication. The data receiving means does not decode the received data when the identification information of the transmission source application set in the received frame is set in the decoding invalidation information storage means.

In a network security system according to an eleventh aspect based on the seventh aspect, the decryption processing invalid information storage means has an area for setting command identification information, and the data reception means has When the identification information of the command included in the received data is not set in the decoding invalidation information storage means, the reception data other than the command is decoded, and the identification information of the command is stored in the decoding invalidation information storage. When set in the means, the received data is not decoded.

A network security system according to a twelfth aspect is the network security system according to the seventh aspect, further comprising information updating means for updating the decryption processing invalidation information stored in the decryption processing invalidation information storage means.

[0018]

Preferred embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a diagram showing functional blocks of a network configuration and each device configuration showing an embodiment of a network security system according to the present invention. FIG. 1 shows a server 10 that transmits data after being encrypted as necessary, a terminal 20 provided with a decryption function, and a terminal 30 not provided with an encryption / decryption function. Connected through. Each of the communication devices 10, 20, and 30 can be realized by a general personal computer or the like equipped with a CPU, a memory, a communication unit, and the like, and has basically the same functions except for the components described below. It is assumed that

The server 10 has a data communication processing unit 11, a plaintext communication table 12, and a table management unit 13. The data communication processing unit 11 is a communication processing unit for performing data communication with the other terminals 20 and 30 via the network 1 and has an encryption function. In the present embodiment, in particular, when the type of the frame to be transmitted corresponds to the encryption invalidation information held in the plaintext communication table 12, the data transmission unit is provided as a data transmission unit that transmits the data without encryption. Plaintext communication table 12
Is encryption processing invalidation information storage means for storing encryption processing invalidation information in which a condition for not encrypting data is set. The table management unit 13 is an information updating unit that updates the encryption process invalidation information stored in the plaintext communication table 12.

The terminal 20 has a data communication processing unit 21, a plaintext communication table 22, and a table management unit 23. The data communication processing unit 21 is a communication processing unit for performing data communication with the other terminals 10 and 30 via the network 1, and has a decoding function. In the present embodiment, a data receiving unit that does not decode data when the type of the received frame corresponds to the decoding process invalidation information is provided. Plaintext communication table 22
Is a decoding process invalidation information storage unit that holds decoding process invalidation information in which a condition for not decoding received data is set. The table management unit 23 is an information updating unit that updates the decryption process invalidation information stored in the plaintext communication table 22.

The terminal 30 includes a data communication processing unit 3 for performing data communication with other terminals 10 and 20 via the network 1.
One. The data communication processing unit 31 does not have an encryption / decryption function.

FIG. 2 is a configuration diagram of the plaintext communication table in the present embodiment shown in FIG. The plaintext communication table 12 has a protocol table, an address table, a port table, and a data table. The protocol table is an area for setting identification information of a protocol used for data communication, the address table is an area for setting address information of a communication device, and the port table is for setting identification information of an application used for data communication. And the data table are areas for setting the identification information of the command. The plaintext communication table will be described in more detail by taking network communication based on TCP / IP as an example.

FIG. 3 is a schematic diagram showing the format of a frame transmitted and received by TCP / IP. This frame is an IP (Internet Protocol)
l) Header and TCP (Transmission Co.)
(Control Protocol) header and a data portion. IP is OSI (Open System)
ms Inconnection) is a protocol located at the network layer of the reference model. The IP header set by this protocol includes, as address information of the communication device, the I / O of the communication device serving as the transmission source and destination of the frame.
An area for setting a P address and a protocol type as identification information of a protocol used for data communication is provided. In the protocol type, a protocol identification code (number) for identifying a protocol higher than IP is set. In the protocol table of the plaintext communication table 12, an IP address of a destination to which the server 10 transmits data as plaintext is set. In the address table of the plaintext communication table 12, a protocol identification code of a destination to which the server 10 transmits data in plaintext is set. In this example, TCP corresponds to this protocol, but other than UDP (User D)
atagram Protocol).

TCP is a protocol located at the transport layer of the OSI reference model, and a TCP header set by this protocol includes identification information of an application used for data communication in each communication device as a transmission source and a destination. Is provided with a port number area for setting the identification information of the application set in. For example, as an application, FTP (File T
transfer Protocol) or SMTP (Si
Mple Mail Transfer Protocol
ol). In the port table of the plaintext communication table 12, the port number of the application to which the server 10 transmits data in plaintext is set.

Actual data to be transmitted to the destination is set in the data area of the frame, and a command line to be passed to the destination may be set in this data. Since the format of this command line is predetermined between the communication apparatuses, it is clear where in the data area the command identification information, for example, the command name is specified. FIG. 3 shows an example in which a command name designation area is provided in the first n bytes of the data area. As a command,
There is a PORT command or the like in FTP. In the data table of the plaintext communication table 12, identification information of a command for transmitting data in plaintext in the server 10 is set.

On the other hand, the plaintext communication table 2 of the terminal 20
2, the same identification information as in the plaintext communication table 12 is set. However, in the present embodiment, each of the tables 12, 2
2, information about the communication partner is set, so that each identification information set in the plaintext communication table 22 on the data receiving side is:
The information is not the destination but the source of the data.

A feature of this embodiment is that before transmitting a frame in the server 10 equipped with an encryption function, various information set in the frame, that is, the type of the frame and the setting of the plaintext communication table 12 are set. Compared with the content, when the type of the frame corresponds to the set content, the data is transmitted as plain text without encryption. On the other hand, a terminal 2 equipped with a decryption function
0, the type of the received frame is compared with the setting contents of the plaintext communication table 22. When the type of the frame corresponds to the setting contents, the data is received as plaintext without decoding. is there. As a result, not only can the execution of encryption / decryption be controlled depending on the presence / absence of the encryption / decryption function, but also the protocol and application can be used for frame communication between communication devices equipped with encryption / decryption. In addition, it is possible to make detailed settings of whether to perform encryption / decryption depending on the type of data.

Next, the processing in the server 10 equipped with the encryption / decryption function and the terminal 20 according to the present embodiment will be described with reference to the flowchart shown in FIG. The description starts with frame processing. It is assumed that each piece of identification information as shown in FIG. 5 is set in the plaintext communication table 12.

When receiving the frame to be transmitted, the data communication processing unit 11 compares the type (identification information) set in the frame with the setting information in the plaintext communication table 12 (step 101). Specifically, the protocol type in the frame and the setting contents of the protocol table, the destination IP address in the frame and the setting contents of the address table, the destination port number in the frame and the setting contents of the port table, and the setting in the data area in the frame The command name and the contents set in the data table are compared. As a result of the comparison, if none of the identification information in the frame corresponds to each set content of the corresponding plaintext communication table 12, the data in the frame is encrypted and then transmitted to the destination communication device (step 102). ). As a result of the comparison, if at least one of the pieces of identification information in the frame corresponds to the setting contents of the corresponding plaintext communication table 12, the data in the frame is transmitted to the destination communication device without encryption. For example, as shown in FIG. 5, if the IP address of the terminal 30 having no decryption function is set in the address table, all data transmitted to the terminal 30 is not encrypted. Can be. In addition, HTTP (HyperTe) is stored in the port table.
If the port number 80 of the xt Transfer Protocol (Xt Transfer Protocol) is set, WWW (World
When accessing Wide Web), data can be transmitted as plain text. in this way,
IP of terminal 20 equipped with decryption function in address table
If an HTTP port number is set in the port table without setting an address, data to be transmitted to the terminal 20 is encrypted in principle, but WWW-related data is transmitted as plain text without being encrypted. You can make detailed settings such as

Next, frame processing in the terminal 20 on the data receiving side will be described.

The data communication processing unit 21 is connected to the network 1
When a frame is received via the PC, the type (each identification information) set in the frame is compared with the setting information in the plaintext communication table 22 (step 101). Specifically, the protocol type in the frame and the settings in the protocol table, the source IP address in the frame and the settings in the address table, the source port number in the frame and the settings in the port table, the data area in the frame Is compared with the command name set in the data table. As a result of the comparison, each of the identification information in the frame corresponds to the corresponding plaintext communication table 22.
If the data does not correspond to each of the above settings, the data in the frame is decoded by decoding (step 102). As a result of the comparison, if at least one of the pieces of identification information in the frame corresponds to the setting content of the corresponding plaintext communication table 22, the data in the frame is received without decoding. For example, as shown in FIG. 5, if the IP address of the terminal 30 not equipped with the decryption function is set in the address table, all data sent from the terminal 30 will not be decrypted. it can. Also,
When the port number 80 of HTTP is set in the port table, data relating to WWW is received without decoding. As described above, if the port number of the HTTP is set in the port table without setting the IP address of the server 10 having the encryption function in the address table, the data transmitted from the server 10 can be decrypted in principle. However, it is possible to make detailed settings such that WWW-related data is received without decoding.

By the way, the data communication processing unit 21 on the data receiving side encrypts the command name in order to compare the command name set in the data area in the frame with the setting contents of the data table. Can not. Therefore, as described above, the data communication processing unit 11 transmits the identification information of the command in the data to be transmitted as plain text without encryption.

The processes related to data communication other than those described above may be performed according to a conventional processing procedure, and are not characteristic processes of the present embodiment.

According to the present embodiment, each of the plaintext communication tables 12 and 22 for setting conditions for not encrypting / decrypting is provided, and the setting contents and the frame type are compared at the time of transmitting / receiving the frame. Even in a communication device equipped with each function of encryption / decryption, data communication can be performed while switching execution of encryption / decryption processing. Accordingly, not only can the execution of encryption / decryption be controlled depending on the presence / absence of the encryption / decryption function of the communication partner, but also in frame communication between communication devices equipped with encryption / decryption. Fine communication control of not performing encryption / decryption depending on the type of protocol, application, and data can be performed. That is, the server 10 that transmits data can set both the terminal 20 equipped with the decryption function and the terminal 30 not equipped with the decryption function on the network by setting the plaintext communication table 12 in accordance with the above-described conditions. It is possible to transmit data to the terminals 20 and 30 without any trouble while switching the execution of the encryption process. In addition, since it is possible to control whether or not to execute the encryption process depending on the type of the frame, the data can be transmitted to one terminal 20 in plain text or encrypted. The same applies to the terminal 20 that receives data.

In the present embodiment, the data management units 13 and 23 for updating the setting contents of the plaintext communication tables 12 and 22 in the communication devices on the data transmission / reception side are provided. Thereby, it is possible to flexibly cope with a configuration change such as a network configuration or a function addition / deletion. If the plaintext communication tables 12 and 22 are held in a text format, they can be easily changed by an editor or the like.

In this embodiment, for convenience, the server 10 having the data transmission function and the terminal 20 having the data reception function have been clearly described. Of course, the reverse may be the case, or each may be configured to have both functions. That is, the data communication processing unit 11 may be further provided as data receiving means, and the data communication processing unit 21 may be further provided as data transmitting means. The number of communication devices is not limited to three as shown in FIG. Also,
In this embodiment, a computer has been described as an example of the communication device. However, the above-described units may be provided in a router, a bridge, an Ethernet hub, or the like on a network.

Also, in the present embodiment, a network conforming to TCP / IP has been described as an example, but the present invention is not limited to this. Also, in the present embodiment, TCP
Although information such as the protocol and application set in the / IP frame is used as a condition for switching the encryption / decryption processing, if it is another protocol, other information set in the frame of that protocol is used as the condition. Can be used as a condition.

The data management unit 1 serves as information updating means.
Although the communication devices 3 and 23 are provided in each communication device, it is also possible to provide a common information updating means on any of the management terminals on the network to manage the plaintext communication table of the entire network. .

[0040]

According to the present invention, encryption / decryption processing invalid information storage means for setting conditions for not encrypting / decrypting is provided, and the setting contents and the frame type are compared when transmitting / receiving a frame. Therefore, even in a communication device equipped with each function of encryption / decryption, data communication can be performed while switching execution of encryption / decryption processing. Accordingly, not only can the execution of encryption / decryption be controlled depending on the presence / absence of the encryption / decryption function of the communication partner, but also in frame communication between communication devices equipped with encryption / decryption. Fine communication control of not performing encryption / decryption depending on the type of protocol, application, and data can be performed.

[Brief description of the drawings]

FIG. 1 is a diagram showing a network configuration and a functional block of each device configuration showing an embodiment of a network security system according to the present invention.

FIG. 2 is a configuration diagram of a plaintext communication table in the present embodiment.

FIG. 3 is a schematic diagram showing a format of a frame transmitted and received by TCP / IP.

FIG. 4 is a flowchart illustrating frame processing according to the present embodiment.

FIG. 5 is a diagram showing an example of setting contents of a plaintext communication table in the present embodiment.

FIG. 6 is a schematic diagram of a conventional network security system.

[Explanation of symbols]

1 network, 10 servers (communication devices), 11,
21 data communication processing unit, 12, 22 plaintext communication table, 13, 23 table management unit, 20, 30 terminal (communication device).

────────────────────────────────────────────────── ───

[Procedure amendment]

[Submission date] January 18, 1999

[Procedure amendment 1]

[Document name to be amended] Statement

[Correction target item name] Claims

[Correction method] Change

[Correction contents]

[Claims]

2. A set to the encryption processing disable information storage means
2. The network security system according to claim 1, further comprising information updating means for updating the fixed contents .

3. A network security system having a communication device equipped with a decryption function for decrypting data transmitted via a network, wherein the communication device equipped with the decryption function includes the following conditions : For data communication
The identification information of the protocol to be used and the address information of the communication device
Information of applications used for information and data communications
And an area for setting command identification information. The decoding processing invalidation information storage means comprises:
If it corresponds to any of the identification information set in the column,
A data receiving unit that does not decode the frame .

4. A setting to the decoding invalid information storage means
4. The network security system according to claim 3, further comprising information updating means for updating contents .

[Procedure amendment 2]

[Document name to be amended] Statement

[Correction target item name] 0006

[Correction method] Change

[Correction contents]

[0006]

In order to achieve the above object, a network security system according to the present invention encrypts data to a communication device as a communication partner via a network, and then encrypts the data. In a network security system having a communication device equipped with an encryption function for transmitting a frame including a frame, a communication device equipped with the encryption function may use a protocol used for data communication as a condition for not encrypting data when transmitting the data.
File identification information, communication device address information, and data communication.
Identification information of the application to be used and identification of the command
An encryption process invalid information storage unit having an area for setting different information ;
And data transmission means for transmitting the frame without encryption when the identification information corresponds to any of the identification information set in the invalidation information storage means .

[Procedure amendment 3]

[Document name to be amended] Statement

[Correction target item name] 0007

[Correction method] Deleted

[Procedure amendment 4]

[Document name to be amended] Statement

[Correction target item name] 0008

[Correction method] Deleted

[Procedure amendment 5]

[Document name to be amended] Statement

[Correction target item name] 0009

[Correction method] Deleted

[Procedure amendment 6]

[Document name to be amended] Statement

[Correction target item name] 0010

[Correction method] Deleted

[Procedure amendment 7]

[Document name to be amended] Statement

[Correction target item name] 0011

[Correction method] Change

[Correction contents]

[0011] In addition, to the encryption processing invalid information storage means
Has information updating means for updating the contents of the setting .

[Procedure amendment 8]

[Document name to be amended] Statement

[Correction target item name] 0012

[Correction method] Change

[Correction contents]

A network security system according to another aspect of the present invention is a network security system having a communication device equipped with a decryption function for decrypting data transmitted via a network. , As a condition not to decrypt the received data, the identification of the protocol used for data communication
Used for information, communication device address information, data communication
Application identification information and command identification information
A decoding process invalidation information storage means having an area for setting , and a type of the received frame indicating whether the type of the received frame is invalid.
A data receiving unit that does not decode the frame when any of the identification information set in the storage unit is applicable.

[Procedure amendment 9]

[Document name to be amended] Statement

[Correction target item name] 0013

[Correction method] Deleted

[Procedure amendment 10]

[Document name to be amended] Statement

[Correction target item name] 0014

[Correction method] Deleted

[Procedure amendment 11]

[Document name to be amended] Statement

[Correction target item name] 0015

[Correction method] Deleted

[Procedure amendment 12]

[Document name to be amended] Statement

[Correction target item name] 0016

[Correction method] Deleted

[Procedure amendment 13]

[Document name to be amended] Statement

[Correction target item name] 0017

[Correction method] Change

[Correction contents]

Further, to the decoding invalid information storage means
It has information updating means for updating the setting contents .

Claims (12)

[Claims] 1. A network security system having a communication device equipped with an encryption function for encrypting data to a communication device serving as a communication partner via a network and then transmitting a frame including the data, wherein the encryption function The communication device equipped with the encryption processing invalidation information storage unit that stores the encryption processing invalidation information that sets the condition that the data is not encrypted when transmitting data, and the type of the frame to be transmitted is set to the encryption processing invalidation information. And a data transmitting means for transmitting the data without encryption when applicable. 2. The encryption processing invalid information storage means has an area for setting identification information of a protocol used for data communication, and the data transmission means has a protocol set in a transmission frame. 2. The network security system according to claim 1, wherein when the identification information is set in the encryption processing invalid information storage unit, the data included in the transmission frame is transmitted without being encrypted. 3. The encryption processing invalid information storage means has an area for setting address information of a communication device, and the data transmission means stores address information of a destination set in a transmission frame. 2. The network security system according to claim 1, wherein when set in the encryption processing invalid information storage means, data included in the transmission frame is transmitted without being encrypted. 4. The encryption processing invalid information storage means has an area for setting identification information of an application used for data communication, and the data transmission means has a destination set in a transmission frame. 2. The network security system according to claim 1, wherein when the identification information of the application is set in the encryption processing invalid information storage unit, the transmission data is transmitted without being encrypted. 5. The encryption processing invalid information storage means has an area for setting command identification information, and the data transmission means stores the command identification information contained in transmission data as the command identification information. When it is not set in the encryption processing invalid information storage means, the transmission data excluding the command is encrypted and then transmitted. When the identification information of the command is set in the encryption processing invalid information storage means, the transmission data is transmitted. 2. The network security system according to claim 1, wherein the password is transmitted without encryption. 6. The network security system according to claim 1, further comprising information updating means for updating encryption processing invalidation information held by said encryption processing invalidation information storage means. 7. A network security system having a communication device equipped with a decryption function for decrypting data transmitted via a network, wherein the communication device equipped with the decryption function sets a condition not to decrypt received data. A network security system comprising: a decryption process invalidation information storage unit that holds the decryption process invalidation information; and a data reception unit that does not decrypt when the type of the received frame corresponds to the decryption process invalidation information. 8. The decoding process invalid information storage means has an area for setting identification information of a protocol used for data communication, and the data receiving means has a protocol information set in a received frame. 8. The network security system according to claim 7, wherein when identification information is set in the decryption processing invalid information storage means, data included in the received frame is not decrypted. 9. The decoding process invalidation information storage means has an area for setting address information of a communication device, and the data receiving means stores address information of a transmission source set in a reception frame. 8. The network security system according to claim 7, wherein the data contained in the received frame is not decrypted when the data is set in the decryption processing invalid information storage unit. 10. The decryption processing invalid information storage means has an area for setting identification information of an application used for data communication, and the data receiving means has a transmission source set in a received frame. 8. The network security system according to claim 7, wherein when the identification information of the application is set in the decryption processing invalid information storage means, the received data is not decrypted. 11. The decoding process invalidation information storage means has an area for setting command identification information, and the data receiving means stores the command identification information contained in received data in the decoding data. When the command is not set in the processing invalidation information storage means, the received data except for the command is decoded, and when the identification information of the command is set in the decoding invalidation information storage means, the received data is not decoded. The network security system according to claim 7, wherein: 12. The network security system according to claim 7, further comprising information updating means for updating decryption processing invalidation information held by said decryption processing invalidation information storage means.