A communication security apparatus (102;104), comprising: a communicator that receives a packet from a first device and that transmits the received packet to a second device; a memory that retains address authentication information containing pairs of a physical address and a logical address of one or more devices; and a controller (202;204) that determines whether a pair of a physical address and a logical address of the first device and a pair of a physical address and a logical address of the second device each match any one of the pairs of the physical address and the logical address of the one or more devices when the address authentication information includes a physical address or a logical address of each of the first device and the second device contained in the packet, and that discards the packet if it is determined that the pair of the physical address and the logical address of the first device and the pair of the physical address and the logical address of the second device do not match any one of the pairs of the physical address and the logical address of the one or more devices and transmits the packet to the second device if it is determined that the pair of the physical address and the logical address of the first device and the pair of the physical address and the logical address of the second device match one of the pairs of the physical address and the logical address of the one or more devices; wherein the memory further retains a group key and an algorithm shared within a group of multiple communication security apparatuses (102, 104), wherein the communication security apparatus and a second communication security apparatus belong to the group; and the controller (202;204) receives, via the communicator, an update notification message containing addresses of a third device and message authentication information of the update notification message from the second communication security apparatus, wherein the message authentication information is authentication information generated by the second communication security apparatus using the algorithm and the group key as a secret key of said algorithm, obtains the group key and determines that the received update notification message is reported by another communication security apparatus in the same group if authentication information generated by the communication security apparatus with said algorithm using the group key matches the received message authentication information, and updates the address authentication information by adding the addresses of the third device contained in the update notification message to the address authentication information in response to the match. a communicator that receives a packet from a first device and that transmits the received packet to a second device; a memory that retains address authentication information containing pairs of a physical address and a logical address of one or more devices; and a controller (202;204) that determines whether a pair of a physical address and a logical address of the first device and a pair of a physical address and a logical address of the second device each match any one of the pairs of the physical address and the logical address of the one or more devices when the address authentication information includes a physical address or a logical address of each of the first device and the second device contained in the packet, and that discards the packet if it is determined that the pair of the physical address and the logical address of the first device and the pair of the physical address and the logical address of the second device do not match any one of the pairs of the physical address and the logical address of the one or more devices and transmits the packet to the second device if it is determined that the pair of the physical address and the logical address of the first device and the pair of the physical address and the logical address of the second device match one of the pairs of the physical address and the logical address of the one or more devices; wherein the memory further retains a group key and an algorithm shared within a group of multiple communication security apparatuses (102, 104), wherein the communication security apparatus and a second communication security apparatus belong to the group; and the controller (202;204) receives, via the communicator, an update notification message containing addresses of a third device and message authentication information of the update notification message from the second communication security apparatus, wherein the message authentication information is authentication information generated by the second communication security apparatus using the algorithm and the group key as a secret key of said algorithm, obtains the group key and determines that the received update notification message is reported by another communication security apparatus in the same group if authentication information generated by the communication security apparatus with said algorithm using the group key matches the received message authentication information, and updates the address authentication information by adding the addresses of the third device contained in the update notification message to the address authentication information in response to the match.