Abstract: A communication management system includes: a normal signature list which stores a list of signatures of normal communication; a search circuit which acquires communication data and searches the normal signature list to check if the signature of the communication data appears in the list; and a warning unit which issues a warning when communication data does not match any signature in the normal signature list. An operator terminal includes: a determination result acquisition unit which indicates whether or not communication data against which a warning has been issued is normal; and a normal signature list update unit which, when communication data against which a warning has been issued is found to be normal, adds the signature of the communication data to the normal signature list.

Abstract: A communication management system comprises a first rule database storing a rule for extracting specific communication data among communication data; a search unit searching the first rule database to check if the communication data complies with a rule stored therein; an output unit which, when the communication data complies with the rule stored in the first rule database, outputs the communication data; an update unit accepting a change in a rule and updating it; a second rule database storing the updated rule changed by the update unit; and a database server transmitting the updated rule from the second rule database to the first rule database, and reflects in real time, the change in a rule.

Abstract: A communication management system includes a terminal which has a peer to peer connection to communicate with a node conducting peer to peer communication, a content detector which, when the terminal receives from the node a content of which distribution should be controlled, detects identification information of the content, and a communication control apparatus which refers to the detected identification information to control transmission of the content of which distribution should be controlled.

Abstract: The present invention provides a technique for improving the security of access to contents. A virus/phishing site list contains a list of URLs of phishing sites, which masquerade as valid websites and are provided with an attempt to acquire private information including card numbers, PIN numbers and passwords, from users illegally. When a communication control unit receives, via a network, a packet that contains communication data for requesting access to a content, a search circuit compares the URL of the content to be accessed included in the communication data, with URLs of phishing sites included in the virus/phishing site list. If the address of the content to be accessed matches a URL of a phishing site, a process execution circuit will prohibit the access to the content.

Abstract: A communication control apparatus includes a database which stores identification information of a party on the other end of communication with whom communication should be controlled, a search circuit which acquires communication data for requesting a connection to a party on the other end of communication and searches the database for the identification information of the party on the other end of communication, and a control unit which, if the identification information of the party on the other end of communication is found in the database, transmits a connection termination request to a terminal of the transmission source, and further transmits a connection request thereto so as to establish, in place of the party on the other end of communication, a connection with the terminal of the transmission source of the communication data and controls communication between the transmission source and the party on the other end of communication.

Abstract: The present invention provides a technique for managing P2P communication appropriately. Each P2P node constituting a P2P network in a communication management system conducts P2P communication with another P2P node. A P2P node has a P2P connection to communicate with a P2P node. A node detector refers to communication data transmitted from or to a P2P node to detect identification information of a P2P node, and registers the information in a P2P node database. A communication control system possessed by an ISP refers to identification information stored in the P2P node database, so as to detect and perform filtering on P2P communication between P2P nodes.

Abstract: The present invention provides a technique for enabling a high-speed communication control apparatus. A packet processing circuit of a communication control apparatus includes a user database, a virus list, a whitelist, a blacklist and a common category list. Upon acquisition of a request for access to a content, matching between information on a user who has sent the access request and the user database is performed by a search circuit, so as to authenticate the user. When the user is authenticated, the search circuit performs matching between the URL of the content to be accessed and the virus list, whitelist, blacklist and common category list. A process execution circuit controls the permission for the access based on the search result of the search circuit and determination conditions stored in a second database. The packet processing circuit is configured with a wired logic circuit.

Abstract: The present invention provides a technique for enabling high-speed binary search. A binary search circuit 36 searches a database 50, which stores pieces of data aligned in ascending or descending order, for comparison target data by binary search. Comparison circuits 36A, 36B and 36C compare pieces of data read out from databases 50A, 50B and 50C with the comparison target data. A control circuit 36Z inputs each piece of data at the 1/2n, 2/2n, . . . , and (2n?1)/2n positions in the search range of the database 50 into 2n?1 comparison circuits respectively and allows the comparison circuits to compare the pieces of data thus input with the comparison target data, so as to perform n searchs simultaneously in parallel.

Abstract: The present invention provides a technique for determining processing to be performed at high speed. When processing to be performed is determined through multiple condition judgments and branches, a comparison target extraction circuit extracts from acquired data multiple pieces of determination data used for the condition judgments and branches and connects the pieces to generate comparison target data. A first database and a second database store reference data generated by connecting a possible value of each of multiple pieces of determination data and also store a processing content to be performed, in which the reference data and the processing content are related to each other. A binary search circuit collectively conducts multiple condition judgments and branches by searching the first database for comparison target data and outputs a processing content to be performed.

Abstract: Network device testing equipment capable of testing network devices using small size packets and for a transferring ability and a filtering ability at a media speed is described. A configuration is adopted in which a Field Programmable Gate Array (FPGA) included in a transmitter or receiver on one or both of transmitting and receiving sides is connected directly to a physical layer chip of a network and computers on both the transmitting and receiving sides are connected thereto. Each of the FPGAs of the transmitter and receiver has a circuit which has an integrated function of transmitting a packet pattern generation function and a packet-receiving function, thereby enabling a test and an inspection in real time. When inspecting the filtering function, a hash table storing therein a hash value and a list of occurrence frequencies for hash values is utilized.

Abstract: A data processing system includes a data processing unit which processes data acquired and a plurality of data retaining units which store databases used to process the data. Each of the plurality of data retaining units stores a primary database in common and stores the respective shares of a secondary database. The primary database stores a list of IDs for identifying data to be processed by any one of the plurality of data processing units. Each of the data processing units is notified of a range of IDs that the data processing unit handles, among the list of IDs stored in the primary database, and, when acquiring a packet containing an ID that lies within the range of IDs, the data processing unit processes the packet.

Abstract: The present invention provides a technique for determining processing to be performed at high speed. When processing to be performed is determined through multiple condition judgments and branches, a comparison target extraction circuit extracts from acquired data multiple pieces of determination data used for the condition judgments and branches and connects the pieces to generate comparison target data. A first database and a second database store reference data generated by connecting a possible value of each of multiple pieces of determination data and also store a processing content to be performed, in which the reference data and the processing content are related to each other. A binary search circuit collectively conducts multiple condition judgments and branches by searching the first database for comparison target data and outputs a processing content to be performed.

Abstract: The present invention provides a technique for outputting an appropriate message to a terminal. A communication control apparatus 10 includes: a message retaining unit 132 which retains a message to be transmitted to a user's terminal; a communication control apparatus 10 including a search unit which acquires communication data transmitted from or to a user's terminal and searches the communication data for identification information of a user's terminal to which a message is transmitted; and a message output unit 131 which, when the communication data includes identification information of a user's terminal to which a message is transmitted, reads out a message from the message retaining unit 132 and transmits the message to the user's terminal.

Abstract: A testing apparatus tests a communication control apparatus, which performs given processing on input communication data and outputs the data. The testing apparatus includes an output unit which outputs data to the communication control apparatus, a generating unit which generates data to be output by the communication control apparatus after the apparatus normally processes data output to the apparatus, an input unit which inputs data output by the communication control apparatus, and an inspection unit which compares data generated by the generating unit with data input by the input unit to check if the communication control apparatus operates normally.

Abstract: A communication management system includes a terminal which has a peer to peer connection to communicate with a node conducting peer to peer communication, a content detector which, when the terminal receives from the node a content of which distribution should be controlled, detects identification information of the content, and a communication control apparatus which refers to the detected identification information to control transmission of the content of which distribution should be controlled.

Abstract: In a communication management system, a communication control apparatus includes: a normal signature list which stores a list of signatures of normal communication; a search circuit which acquires communication data and searches the normal signature list storing signatures of normal communication to check if the signature of the communication data appears in the list; and a process execution circuit functioning as a warning unit which issues a warning when there is detected communication data of which the signature does not match any signature of normal communication stored in the normal signature list.

Abstract: In a communication management system, a communication control apparatus includes: a first communication control unit which acquires communication data from an upstream network and provides the communication data to a search circuit; a rule database which stores a rule for extracting specific communication data among communication data; a search circuit which acquires communication data and searches the rule database to check if the communication data complies with a rule stored in the database; a process execution circuit functioning as an output unit which, when there is detected communication data complying with a rule stored in the rule database, replicates the communication data and outputs the replica; and a second communication control unit which transmits communication data to a downstream network.

Abstract: The present invention provides a technique for enabling high-speed binary search. A binary search circuit 36 searches a database 50, which stores pieces of data aligned in ascending or descending order, for comparison target data by binary search. Comparison circuits 36A, 36B and 36C compare pieces of data read out from databases 50A, 50B and 50C with the comparison target data. A control circuit 36Z inputs each piece of data at the 1/2n, 2/2n, . . . , and (2n?1)/2n positions in the search range of the database 50 into 2n?1 comparison circuits respectively and allows the comparison circuits to compare the pieces of data thus input with the comparison target data, so as to perform n searchs simultaneously in parallel.

Abstract: A communication control apparatus includes a database which stores identification information of a party on the other end of communication with whom communication should be controlled, a search circuit which acquires communication data for requesting a connection to a party on the other end of communication and searches the database for the identification information of the party on the other end of communication, and a control unit which, if the identification information of the party on the other end of communication is found in the database, transmits a connection termination request to a terminal of the transmission source, and further transmits a connection request thereto so as to establish, in place of the party on the other end of communication, a connection with the terminal of the transmission source of the communication data and controls communication between the transmission source and the party on the other end of communication.

Abstract: A communication control apparatus includes a database which stores the telephone number of an emergency call center, a search circuit which acquires communication data with which a phone terminal calls another phone terminal and which searches the database for the telephone number of a call destination, and a position information addition unit which, if the telephone number of the call destination is found in the database, adds information indicating the position of the phone terminal originating the call or the position of the communication control apparatus to the communication data. The information indicating the position includes a zip code, an address or an address code. The position information addition unit adds the position information of the communication control apparatus posterior to position information added by a preceding communication control apparatus.