Abstract: A relay apparatus for relaying data in a network comprises: a storage configured to store therein a whitelist in which normal information is registered, the normal information indicating that said data is normal based on a destination and source thereof; a receiver configured to receive first data; a determining part configured to determine whether normal information for the first data received is registered in the whitelist or not; a rewriting part configured to rewrite, when the determining part determines that the whitelist does not have normal information of the first data, a remaining lifespan required to reach the destination of the first data to a prescribed lifespan required to reach a specific communication apparatus that exists between the nearest communication apparatus and the furthest communication apparatus from the relay apparatus in the network; and a transmitter configured to transmit the first data that has gone through a rewriting process.

Abstract: A whitelist generation possibility/impossibility determination unit transmits a signal for permitting generation of a whitelist to a whitelist generating unit, in a case where an IP address corresponding to a source MAC address stored in a protocol information table matches the extracted source IP address, and in a case where an IP address corresponding to a destination MAC address stored in the protocol information table matches the extracted destination IP address.

Abstract: A transfer apparatus comprises: a first storage unit configured to store a whitelist for storing reliable information indicating that communication between a source address and a destination address is authorized; a second storage unit configured to store an addition list including a specific address not included in the reliable information and a valid period of the specific address; a receiving unit configured to receive data; a check unit configured to check whether either a destination address or a source address included in data within the valid period is the specific address; and a generation unit configured to generate specific reliable information indicating that communication between the destination address and the source address included in the data is authorized and register the generated specific reliable information to the whitelist in a case where the check unit confirms within the valid period that either address is the specific address.

Abstract: A communication apparatus that transfers received data stores a whitelist to manage an allowed object that is allowed to perform communications via the communication apparatus, comprises: a transfer unit that performs transfer control on the received data based on the whitelist; and a control unit that analyzes behavior related to communications performed by the allowed object. The control unit being configured to calculate a monitoring parameter that indicates the behavior related to the communications performed by the allowed object, and detect the allowed object where an abnormality occurred based on the monitoring parameter.

Abstract: A transfer apparatus comprises: a first storage unit configured to store a whitelist for storing reliable information indicating that communication between a source address and a destination address is authorized; a second storage unit configured to store an addition list including a specific address not included in the reliable information and a valid period of the specific address; a receiving unit configured to receive data; a check unit configured to check whether either a destination address or a source address included in data within the valid period is the specific address; and a generation unit configured to generate specific reliable information indicating that communication between the destination address and the source address included in the data is authorized and register the generated specific reliable information to the whitelist in a case where the check unit confirms within the valid period that either address is the specific address.

Abstract: It is an object of the present invention to achieve improvement of security by a whitelist function and improvement of network reliability by a network redundancy function at the same time. A packet relay device 100 includes packet reception units 200, a packet transfer unit 300, a S/W control unit 400, packet transmission units 500, and an input/output interface 600 and automatically generates a whitelist including an allowed communication rule. It is possible to select whether to perform communication control using the whitelist or to carry out data communication without using the whitelist for each data reception unit 200 that receives data.

Abstract: A whitelist generation possibility/impossibility determination unit transmits a signal for permitting generation of a whitelist to a whitelist generating unit, in a case where an IP address corresponding to a source MAC address stored in a protocol information table matches the extracted source IP address, and in a case where an IP address corresponding to a destination MAC address stored in the protocol information table matches the extracted destination IP address.

Abstract: A packet relay device automatically generates a whitelist including an authorized communication rule. The packet relay device snoops on communications between a DHCP server and a DHCP client in accordance with DHCP. When the IP address of a DHCP client is changed, the packet relay device also automatically changes IP address information included in a whitelist related to the DHCP client to IP address information newly allocated to the DHCP client.

Abstract: A communication apparatus that transfers received data stores a whitelist to manage an allowed object that is allowed to perform communications via the communication apparatus, comprises: a transfer unit that performs transfer control on the received data based on the whitelist; and a control unit that analyzes behavior related to communications performed by the allowed object. The control unit being configured to calculate a monitoring parameter that indicates the behavior related to the communications performed by the allowed object, and detect the allowed object where an abnormality occurred based on the monitoring parameter.

Abstract: It is an object of the present invention to achieve improvement of security by a whitelist function and improvement of network reliability by a network redundancy function at the same time. A packet relay device 100 includes packet reception units 200, a packet transfer unit 300, a S/W control unit 400, packet transmission units 500, and an input/output interface 600 and automatically generates a whitelist including an allowed communication rule. It is possible to select whether to perform communication control using the whitelist or to carry out data communication without using the whitelist for each data reception unit 200 that receives data.

Abstract: A communication apparatus receives control information of first data and a plurality of types of header information of first data, the first data being received by a first data receiver; selects a parameter from the plurality of types of header information of the first data based on a priority of a first data receiver group to which the first data receiver belongs and a storage condition, the priority being indicated by priority information, the storage condition indicating the number of entries of a whitelist that can be stored in a whitelist storage first memory; and add, to the whitelist, an entry that includes control information of the first data and at least one parameter selected above.

Abstract: A relay apparatus for relaying data in a network comprises: a storage configured to store therein a whitelist in which normal information is registered, the normal information indicating that said data is normal based on a destination and source thereof; a receiver configured to receive first data; a determining part configured to determine whether normal information for the first data received is registered in the whitelist or not; a rewriting part configured to rewrite, when the determining part determines that the whitelist does not have normal information of the first data, a remaining lifespan required to reach the destination of the first data to a prescribed lifespan required to reach a specific communication apparatus that exists between the nearest communication apparatus and the furthest communication apparatus from the relay apparatus in the network; and a transmitter configured to transmit the first data that has gone through a rewriting process.

Abstract: A packet relay device automatically generates a whitelist including an authorized communication rule. The packet relay device snoops on communications between a DHCP server and a DHCP client in accordance with DHCP. When the IP address of a DHCP client is changed, the packet relay device also automatically changes IP address information included in a whitelist related to the DHCP client to IP address information newly allocated to the DHCP client.

Abstract: A communication apparatus receives control information of first data and a plurality of types of header information of first data, the first data being received by a first data receiver; selects a parameter from the plurality of types of header information of the first data based on a priority of a first data receiver group to which the first data receiver belongs and a storage condition, the priority being indicated by priority information, the storage condition indicating the number of entries of a whitelist that can be stored in a whitelist storage first memory; and add, to the whitelist, an entry that includes control information of the first data and at least one parameter selected above.

Abstract: A packet relay device is equipped with a buffer memory including a plurality of queues for temporarily storing packets, and a storage unit for storing the first queue lengths indicating the respective queue length of each of the queues and a second queue length indicating a value according to a total of the plurality of first queue lengths. When the packet relay device receives packets, it discerns the queue to which the received packet belongs from among the plurality of queues, and temporarily stores the packet in relation to the discerned queue within the buffer memory. Then, the first queue length and the second queue length are updated, and a determination is made of whether or not to send a congestion notification to the packet sending source according to the first queue length corresponding to the discerned queue, and to the second queue length.

Abstract: A packet relay device is equipped with a buffer memory including a plurality of queues for temporarily storing packets, and a storage unit for storing the first queue lengths indicating the respective queue length of each of the queues and a second queue length indicating a value according to a total of the plurality of first queue lengths. When the packet relay device receives packets, it discerns the queue to which the received packet belongs from among the plurality of queues, and temporarily stores the packet in relation to the discerned queue within the buffer memory. Then, the first queue length and the second queue length are updated, and a determination is made of whether or not to send a congestion notification to the packet sending source according to the first queue length corresponding to the discerned queue, and to the second queue length.