Communication system and communication device

A communication system, comprising:

• a first device and a second device which are mutually coupled via a network so as to transmit and receive packets over the network,
• wherein the first device and the second device respectively include a first packet counter and a second packet counter which are respectively updated in association with transmission and reception of packets,
• wherein, when a message is to be transmitted to the second device, the first device generates one message authentication code on the basis of the message, draws out part of the message authentication code on the basis of a counted value of the first packet counter, sets the part as a divided message authentication code, generates a packet which includes the message and the divided message authentication code and transmits the packet to the second device over the network,
• wherein, when the packet has been received from the first device, the second device generates another message authentication code on the basis of the message included in the received packet, draws out part of the message authentication code on the basis of a counted value of the second packet counter and sets the part as a central bit array,
• wherein the second device further draws a plurality of bit arrays of the message authentication code concerned out of positions based on the counted values concerned in a plurality of MAC values which are generated on the basis of a plurality of the counted values respectively corresponding to received packets ranging from a received packet which has been received earlier than the received packet concerned by “i” packets (“i” is an optional integer) to a received packet to be received later than the received packet concerned by “j” packets (“j” is an optional integer), and
• wherein the second device compares each of the central bit array and the plurality of bit arrays with the divided message authentication code included in the received packet concerned and authenticates the received packet concerned as a valid packet when at least one bit array matches the divided message authentication code.

A communication device which is coupled with another communication device which includes a first packet counter via a network so as to transmit and receive packets to and from the another communication device via the network and authenticates a message in a packet received from another communication device, comprising:

• a second packet counter which corresponds to the first packet and is updated in association with transmission and reception of packets between the communication device concerned and another communication device;
• and
• a hardware security module,
• wherein a random number which has been generated by the hardware security module is set as an initial value of the second packet counter, and the random number is subjected to encryption and is transmitted to another communication device in order to make another communication device set the encrypted random number as an initial value of the first packet counter,
• wherein the packet which is received from another communication device is a packet which has been generated by the another communication device by generating one message authentication code on the basis of a message to be transmitted, drawing out part of the message authentication code so generated on the basis of the counted value of the first packet counter, setting the part as a divided message authentication code and including the message and the divided message authentication code in the packet, and
• wherein, when the packet has been received from the another communication device, the communication device concerned generates another message authentication code on the basis of the message included in the received packet, draws out part of the generated message authentication code on the basis of a counted value of the second packet counter, compares the drawn-out part with the divided message authentication code included in the received packet and thereby performs message authentication.