Communication device, system, and method

1. A communication device comprising:

a first reception unit, within a packet relay device, that has a port connected to a redundant network or a ring port or a port capable of being subjected to route switching at the time of failure and is set in advance to be excluded as a target of generation and control of a whitelist which is a list of communication data permitted to be transferred;

a second reception unit, within the packet relay device, that has a port connected to another device or an edge port or a port having no probability of occurrence of route switching at the time of failure and is set in advance as a target of generation and control of the whitelist;

a transfer unit, within the packet relay device, that transfers communication data to a transfer destination defined in advance when determining that the communication data has been received via the first reception unit, in a case where the communication device is set in advance to a whitelist generation state;

a control unit, within the packet relay device, that generates and stores the whitelist based on communication data that has been received and causes the transfer unit to transfer the communication data to a transfer destination defined in advance when the transfer unit determines that the communication data has been received via the second reception unit, in a case where the communication device is set in advance to the whitelist generation state; and

a transfer setting memory in which one or a plurality of the first reception units is set in advance to be excluded from a target of generation and control of the whitelist and one or a plurality of the second reception units is set in advance as a target of generation and control of the whitelist,

wherein in a case where the communication device is set in advance to the whitelist generation state:

the transfer unit refers to the transfer setting memory and determines whether a reception unit that has received communication data is the second reception unit that is the target of generation and control of the whitelist or the first reception unit excluded from the target;

the transfer unit transmits header information on the communication data received by the second reception unit to the control unit when determining that the second reception unit has received the communication data;

the control unit generates a whitelist according to the header information and stores the whitelist to a whitelist retention memory; and

the transfer unit transfers the communication data received via the second reception unit to a transfer destination defined in advance.

2. The communication device according to claim 1 , wherein

in a case where the communication device is set in advance to a practical state:

the transfer unit refers to the transfer setting memory and determines whether a reception unit that has received communication data is the second reception unit that is a whitelist target or the first reception unit excluded from the target;

the transfer unit judges whether the header information on the communication data received via the second reception unit is retained in the whitelist retention memory when determining that the second reception unit has received the communication data;

the transfer unit transfers the communication data received via the second reception unit to a transfer destination defined in advance in accordance with the header information when the header information is retained in the whitelist retention memory;

the transfer unit discards the communication data or transfers the communication data to a transfer destination defined in advance in accordance with discard information or pass information defined in advance, respectively, when the header information is not retained in the whitelist retention memory; and

the transfer unit transfers the communication data received via the first reception unit to a transfer destination defined in advance when determining that the first reception unit has received the communication data.

3. The communication device according to claim 1 ,

wherein, when finding a link down in a link connected to the first reception unit, the control unit changes the state of the first reception unit to a closed state so as not to change the state of the first reception unit even when finding a link up in the link connected to the first reception unit and, when accepting an opening instruction from the outside, changes the state of the first reception unit to an open state.

4. The communication device according to claim 3 , wherein

when finding a link down in a link connected to the second reception unit, the control unit changes the state of the second reception unit to the closed state and, when finding a link up in the link connected to the second reception unit, changes the state of the second reception unit to the open state.

5. A communication device comprising:

a first reception unit, within a packet relay device, that has a port connected to a redundant network or a ring port or a port capable of being subjected to route switching at the time of failure and is set in advance to be excluded as a target of generation and control of a whitelist which is a list of communication data permitted to be transferred;

a second reception unit, within the packet relay device, that has a port connected to another device or an edge port or a port having no probability of occurrence of route switching at the time of failure and is set in advance as a target of generation and control of the whitelist;

a transfer unit, within the packet relay device, that transfers communication data to a transfer destination defined in advance when determining that the communication data has been received via the first reception unit, in a case where the communication device is set in advance to a whitelist generation state;

a control unit, within the packet relay device, that generates and stores the whitelist based on communication data that has been received and causes the transfer unit to transfer the communication data to a transfer destination defined in advance when the transfer unit determines that the communication data has been received via the second reception unit, in a case where the communication device is set in advance to the whitelist generation state; and

a transfer setting memory in which one or a plurality of the first reception units is set in advance to perform regeneration and one or a plurality of the second reception units is set in advance not to perform regeneration,

wherein the transfer setting memory further sets in advance the one or plurality of the first reception units as a target of generation and control of the whitelist and the control unit generates and stores a whitelist based on communication data received by the transfer unit via the one or plurality of the first reception units, and

wherein when finding a failure on a redundant network, the control unit refers to the transfer setting memory, deletes a whitelist for the one or plurality of the first reception units, sets the communication device to a whitelist regeneration state, and regenerates the whitelist.

6. The communication device according to claim 5 ,

wherein the transfer unit receives communication data and, in a case where the communication device is set to the regeneration state and it is determined with reference to the transfer setting memory that a reception unit that has received the communication data is the first reception unit, transmits header information on the communication data to the control unit, while the control unit regenerates the whitelist from the header information to store, and

wherein, in a case where the communication device is not set to the regeneration state or in a case where it is determined with reference to the transfer setting memory that a reception unit that has received the communication data is the second reception unit, the transfer unit performs communication control on the communication data according to the whitelist.

7. The communication device according to claim 2 , wherein

the transfer unit includes:

a transfer destination resolution unit that controls transfer;

a transfer table memory in which transfer destination information is saved;

the whitelist retention memory; and

the transfer setting memory,

wherein the transfer setting memory further sets in advance a mode as to whether to use a whitelist function and sets in advance non-registration discard/pass, and

wherein the transfer destination resolution unit:

refers to the transfer setting memory and controls whether communication control using the whitelist is to be carried out based on a setting of the mode; and

refers to the transfer setting memory and controls whether data communication not registered in the whitelist is to be discarded or transferred based on a setting of the non-registration discard/pass.

8. The communication device according to claim 5 ,

wherein, when finding a link down in a link connected to the first reception unit, the control unit changes the state of the first reception unit to a closed state so as not to change the state of the first reception unit even when finding a link up in the link connected to the first reception unit and, when accepting an opening instruction from the outside, changes the state of the first reception unit to an open state.

9. A communication method comprising:

setting in advance a first reception unit having a port connected to a redundant network or a ring port or a port capable of being subjected to route switching at the time of failure to be excluded from a target of generation and control of a whitelist which is a list of communication data permitted to be transferred;

setting in advance a second reception unit having a port connected to another device or an edge port or a port having no probability of occurrence of route switching at the time of failure as a target of generation and control of the whitelist;

transferring communication data to a transfer destination defined in advance when it is determined that the communication data has been received via the first reception unit, in a case where a communication device is set in advance to a whitelist generation state; and

generating and storing the whitelist based on communication data that has been received and transferring the communication data to a transfer destination defined in advance when it is determined that the communication data has been received via the second reception unit, in a case where the communication device is set in advance to the whitelist generation state,

wherein in a case where the communication device is set in advance to the whitelist generation state, the method further comprises:

determining whether a reception unit that has received communication data is the second reception unit that is the target of generation and control of the whitelist or the first reception unit excluded from the target;

transmitting header information on the communication data received by the second reception unit when determining that the second reception unit has received the communication data;

generating a whitelist according to the header information and store the whitelist to a whitelist retention memory; and

transferring the communication data received via the second reception unit to a transfer destination defined in advance.