Communication management apparatus, communication system, communication management method, and computer readable medium

A communication system comprising:

• a plurality of devices;
• a plurality of relay apparatuses;
• and
• a communication management apparatus, wherein
• the relay apparatus transfers, by a packet, data supplied from the device provided in the communication system, and
• the communication management apparatus comprises:
• at least one memory storing program instructions;
• and
• at least one processor configured to execute the program instructions stored in the memory to:
• generate a template including identification information of a packet for transferring data supplied from a predetermined device based on design information of the communication system;
• receive, from the relay apparatus, log information about the transfer of the data by the packet;
• generate an allowed list based on the log information when the log information conforms to the template, a condition of a packet under which the transfer of the data by the relay apparatus is permitted being described in the allowed list;
• determine, when the log information does not conform to the template, whether or not to register the identification information of the packet related to the log information in the allowed list based on information about whether or not the log information can be registered;
• and
• transmit the generated allowed list to the relay apparatus.

A communication management method comprising:

• generating a template including identification information of a packet for transferring data supplied from a predetermined device based on design information of a communication system;
• receiving, from a relay apparatus configured to transfer data by a packet, log information about the transfer of the data by the packet, the data being supplied from a device provided in the communication system;
• generating an allowed list based on the log information when the log information conforms to the template, a condition of a packet under which the transfer of the data by the relay apparatus is permitted being described in the allowed list;
• determining, when the log information does not conform to the template, whether or not to register the identification information of the packet related to the log information in the allowed list based on information about whether or not the log information can be registered;
• and
• transmitting the generated allowed list to the relay apparatus.

A non-transitory computer readable medium storing a communication management program for causing a computer to execute:

• a template generation process of generating a template including identification information of a packet for transferring data supplied from a predetermined device based on design information of a communication system;
• a log reception process of receiving, from a relay apparatus configured to transfer data by a packet, log information about the transfer of the data by the packet, the data being supplied from the device;
• an allowed list generation process of generating an allowed list based on the log information when the log information conforms to the template, a condition of a packet under which the transfer of the data by the relay apparatus is permitted being described in the allowed list;
• a determination support process of determining, when the log information does not conform to the template, whether or not to register the identification information of the packet related to the log information in the allowed list based on information about whether or not the log information can be registered;
• and
• a transmission process of transmitting the generated allowed list to the relay apparatus.