A communication security apparatus, comprising: a communicator that receives a packet from a first device and that transmits the received packet to a second device, the communicator including a plurality of ports configured to connect a plurality of devices including the first device and the second device; a memory that retains address authentication information containing pairs of a trusted physical address and a trusted logical address of one or more devices; and a controller (202;204) that determines whether a pair of a physical address and a logical address of the first device and a pair of a physical address and a logical address of the second device each match any one of the pairs of the physical address and the logical address of the one or more devices when the address authentication information includes a physical address or a logical address of each of the first device and the second device contained in the packet, and that discards the packet if it is determined that the pair of the physical address and the logical address of the first device and the pair of the physical address and the logical address of the second device do not match any one of the pairs of the physical address and the logical address of the one or more devices included in the address authentication information and that transmits the packet to the second device if it is determined that the pair of the physical address and the logical address of the first device and the pair of the physical address and the logical address of the second device match one of the pairs of the physical address and the logical address of the one or more devices included in the address authentication information, wherein after a learning period of receiving and transmitting packets, the controller (202; 204) extracts, from pairs of a physical address and a logical address associated with a port ID of one port, one or more pairs of a physical address and a logical address whose physical address is the only physical address associated with the one port and registers in the address authentication information the extracted one or more pairs in association with the port ID as pairs of a trusted physical address and a trusted logic address. a communicator that receives a packet from a first device and that transmits the received packet to a second device, the communicator including a plurality of ports configured to connect a plurality of devices including the first device and the second device; a memory that retains address authentication information containing pairs of a trusted physical address and a trusted logical address of one or more devices; and a controller (202;204) that determines whether a pair of a physical address and a logical address of the first device and a pair of a physical address and a logical address of the second device each match any one of the pairs of the physical address and the logical address of the one or more devices when the address authentication information includes a physical address or a logical address of each of the first device and the second device contained in the packet, and that discards the packet if it is determined that the pair of the physical address and the logical address of the first device and the pair of the physical address and the logical address of the second device do not match any one of the pairs of the physical address and the logical address of the one or more devices included in the address authentication information and that transmits the packet to the second device if it is determined that the pair of the physical address and the logical address of the first device and the pair of the physical address and the logical address of the second device match one of the pairs of the physical address and the logical address of the one or more devices included in the address authentication information, wherein after a learning period of receiving and transmitting packets, the controller (202; 204) extracts, from pairs of a physical address and a logical address associated with a port ID of one port, one or more pairs of a physical address and a logical address whose physical address is the only physical address associated with the one port and registers in the address authentication information the extracted one or more pairs in association with the port ID as pairs of a trusted physical address and a trusted logic address.