The present invention relates to a communication device, a communication system, and a communication method.
Recently, measures are needed to prevent situations in which an attacker intrudes into the network of a critical infrastructure, such as a power plant, to take control of the systems of the infrastructure. The network of the critical infrastructure is protected by firewall devices and anti-virus software installed on terminals such as personal computers. In order to prevent the intrusion of attackers who intend to take over system control, stronger measures are needed. An example of a scheme that mitigates risks when an attacker intrudes into systems, there is a method that uses communication devices enabling whitelisting functions. The whitelisting function enabled by the communication device is a function that improves security level by registering information about authorized terminals included in authorized communications carried in networks on the communication device that can store whitelists and blocking unauthorized communications sent from terminals that are not authorized and not registered on the communication device that can store the whitelists.
Regarding the background art of the present technique, there are Japanese Unexamined Patent Application Publication No. 2015-050767, Japanese Unexamined Patent Application Publication No. 2017-46149, and International Publication WO 2017073089.
Japanese Unexamined Patent Application Publication No. 2015-050767 describes a whitelist-based network switch. The whitelist-based network switch includes a whitelist monitoring unit for storing a whitelist including authorized communication rules, monitoring one or more packets input through a plurality of switch interfaces based on the whitelist, and permitting communication of each packet conforming to the whitelist, and a whitelist management unit for updating the whitelist and transmitting an updated whitelist to the whitelist monitoring unit (See Abstract).
Japanese Unexamined Patent Application Publication No. 2017-46149 describes a communication apparatus. The communication apparatus receives control information of first data and a plurality of types of header information of first data, the first data being received by a first data receiver; the apparatus selects a parameter from the plurality of types of header information of the first data based on a priority of a first data receiver group to which the first data receiver belongs and a storage condition, the priority being indicated by priority information, the storage condition indicating the number of entries of a whitelist that can be stored in a whitelist storage first memory; and the apparatus adds, to the whitelist, an entry that includes control information of the first data and at least one parameter selected above (See Abstract).
International Publication WO 2017073089 describes a communication device, a system, and a method. A packet relay device is provided with packet reception units, a packet transfer unit, an S/W controller, packet transmission units, and an input-output interface, and a whitelist including authorized communication rules is automatically generated. For each data reception unit that receives data, it is possible to select controlling communication using the whitelist, or implementing data communication without using the white list (See Abstract).
On the other hand, Japanese Unexamined Patent Application Publication No. 2007-36374 introduces a security technique for networks using the Dynamic Host Configuration Protocol (hereinafter, DHCP). Japanese Unexamined Patent Application Publication No. 2007-36374 describes a packet transfer device, a communication network, and a packet transfer method. The packet transfer device has a plurality of ports, a protocol processing unit, and a controller. The packet transfer device transfers an Internet Protocol (IP) address allocation request sent from a client terminal in accordance with DHCP to a DHCP server, and receives an application for IP address allocation. In the transfer and reception, the packet transfer device stores information, which is an IP address and a Media Access Control (MAC) address, about the client terminal on the storage unit. The packet transfer device also stores information, which is an IP address and a MAC address extracted from an ARP packet, about the client terminal on the storage unit through an Address Resolution Protocol (ARP) resolution by the client terminal or through an ARP resolution by the packet transfer device. When the IP address of the stored DHCP packet is matched with the IP address of the stored ARP packet, the packet transfer device filters the port for the client terminal that has transmitted the ARP packet (See Abstract).