Communication security apparatus, control method, and storage medium storing a program

A control method for a communication security apparatus including a memory that retains address authentication information containing addresses of one or more devices, comprising:

• performing communication, by a communicator, for receiving a packet from a first device and transmitting the received packet to a second device, the communicator including a plurality of ports configured to connect a plurality of devices, including the first device and the second device,
• wherein after a learning period of receiving and transmitting packets,
• in a case where one device is associated with one port, registering one or more pairs of a physical address and a logical address of the one device in address authentication information in a memory as a trusted pair together with a port ID of the one port, and
• in a case where at least two devices are associated with the one port, not registering a pair of a physical address and a logical address of each of at least two devices in the address authentication information in the memory;
• performing control for determining whether a pair of a physical address and a logical address of the first device and a pair of a physical address and a logical address of the second device each match any one of the pairs of the physical address and the logical address of the one or more devices when the address authentication information includes a physical address or a logical address of each of the first device and the second device contained in the packet;
• and
• performing control for discarding the packet in a case where it is determined that the pair of the physical address and the logical address of the first device and the pair of the physical address and the logical address of the second device do not match any one of the pairs of the physical address and the logical address of the one or more devices.

A non-transitory storage medium storing a program that causes a computer to execute a process, the process comprising:

• performing communication, by a communicator, for receiving a packet from a first device and for transmitting the received packet to a second device, the communicator including a plurality of ports configured to connect a plurality of devices, including the first device and the second device,
• wherein after a learning period of receiving and transmitting packets,
• in a case where one device is associated with one port, registering one or more pairs of a physical address and a logical address of the one device in address authentication information in a memory as a trusted pair together with a port ID of the one port, and
• in a case where at least two devices are associated with the one port, not registering a pair of a physical address and a logical address of each of at least two devices in the address authentication information in the memory;
• performing control for determining whether a pair of a physical address and a logical address of the first device and a pair of a physical address and a logical address of the second device each match any one of the pairs of the physical address and the logical address of the one or more devices when the address authentication information includes a physical address or a logical address of each of the first device and the second device contained in the packet;
• and
• performing control for discarding the packet in a case where it is determined that the pair of the physical address and the logical address of the first device and the pair of the physical address and the logical address of the second device do not match any one of the pairs of the physical address and the logical address of the one or more devices.