JP2010268087A - Network device, network, and automatic encryption communication method used for them - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network device that automatically generates an encrypted communication path in-between an opposite router. <P>SOLUTION: The network device (1) includes: a storage means (11) that stores a security policy, required in encrypted communication between a plurality of network equipment, by corresponding it to each of the plurality of network equipment; a generating means (12) that generates a group policy, showing the network equipment allowed to communicate with each other, on the basis of the security policy corresponding to each of the plurality of network equipment; a distribution means (13) that distributes the group policy, generated by the generating means, to each of the plurality of network equipment; and a security policy distributing means (14) that distributes the security policy, requested from the plurality of network equipment, to the network equipment on the basis of the group policy distributed by the distribution means. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a network device, a network, and an automatic encryption communication method used for them, and more particularly to automatic encryption communication in a network.

  In a network related to the present invention, when security is secured and set using a network VPN (Virtual Private Network), all are managed by a system engineer or the like. However, users who want to ensure security have recently been on an expanding trend, and it is desired to develop a network framework that can easily ensure security without management by a system engineer or the like.

  In the network related to the present invention, various methods of automatic VPN configuration by a remote management server have been studied. However, the remote management server itself needs to control a large number of base routers in real time, There is a need for a way to reduce it.

  Patent Document 1 below describes a zero configuration function for performing automatic setting / remote management via the Internet in order to automate network settings, and discloses a method for centralized management of network connections. In this case, the router acquires configuration data from the initial server when connected to the network.

  FIG. 7 shows a configuration example in the case where an encrypted communication such as IPsec (Internet Protocol security protocol) is attempted between the base routers in the network related to the present invention.

  FIG. 7A shows a configuration example of a center router type VPN that is set in advance for performing IPsec connection to all the base routers 6-1 to 6-4 and the center router 5, and each base router 6 -1 to 6-4 and the center router 5 are connected by an IPsec tunnel.

  FIG. 7B shows a configuration example of a full mesh VPN that is set for performing IPsec connection between all the base routers 7-1 to 7-4. -4 are connected by an IPsec tunnel.

Japanese Patent No. 3774433

  In the network related to the present invention described above, in the case of the center router type VPN method, since all IPsec connections are concentrated on the center router, the load is concentrated on the center router and a large amount of settings need to be made. There is a problem that the configuration cannot be easily changed once set.

  In addition, in the network related to the present invention, when connecting with a full mesh VPN, when one base router is added, it is necessary to review the settings of all the base routers. There is also a problem that it becomes enormous.

  In the method described in Patent Document 1 described above, only a centralized management method of network connection is disclosed, and thus the problems in the center router type VPN and the full mesh type VPN cannot be solved.

  SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to provide a network device, a network, and an automatic encrypted communication method used therefor, which can solve the above-mentioned problems and can automatically generate an encrypted communication path with the opposite router. is there.

The network device according to the present invention comprises a storage means for storing a security policy necessary for encrypted communication between a plurality of network devices corresponding to each of the plurality of network devices;
Generating means for generating a group policy indicating network devices that are allowed to communicate with each other based on a security policy corresponding to each of the plurality of network devices;
Distribution means for distributing the group policy generated by the generation means to each of the plurality of network devices;
Security policy distribution means for distributing a security policy requested from the plurality of network devices to the network device based on the group policy distributed by the distribution means.

  A network according to the present invention includes the above-described network device.

An automatic encryption communication method according to the present invention includes:
Network device
A first process of storing a security policy required for encrypted communication between a plurality of network devices in a storage unit corresponding to each of the plurality of network devices;
A second process of generating a group policy indicating network devices that are allowed to communicate with each other based on a security policy corresponding to each of the plurality of network devices;
A third process for distributing the group policy generated in the second process to each of the plurality of network devices;
Performing a fourth process of distributing to the network device a security policy requested from the plurality of network devices based on the group policy distributed in the third process;
Encrypted communication is executed between the network devices facing each other using the security policy distributed in the fourth process.

A program according to the present invention is a program to be executed by a central processing unit in a network device,
A first process of storing a security policy required for encrypted communication between a plurality of network devices in a storage unit corresponding to each of the plurality of network devices;
A second process of generating a group policy indicating network devices that are allowed to communicate with each other based on a security policy corresponding to each of the plurality of network devices;
A third process for distributing the group policy generated in the second process to each of the plurality of network devices;
A fourth process of distributing security policies requested from the plurality of network devices to the network device based on the group policy distributed in the third processing;
The encrypted communication is executed between the network devices facing each other using the security policy distributed in the fourth process.

  The present invention has an effect that an encrypted communication path with the opposite router can be automatically generated by adopting the configuration and operation as described above.

It is a block diagram which shows the structural example of the remote management server apparatus by embodiment of this invention. It is a block diagram which shows the structural example of the router apparatus by embodiment of this invention. It is a block diagram which shows the structural example of the network by embodiment of this invention. It is a figure which shows an example of the setting content of the policy in embodiment of this invention. It is a flowchart which shows the processing operation of the router shown in FIG. It is a flowchart which shows the processing operation of the remote management server apparatus shown in FIG. (A) is a figure which shows the example of a structure of center router type | mold VPN at the time of trying to perform encryption communication between each base router in the network relevant to this invention, (b) is each base in the network relevant to this invention It is a figure which shows the structural example of a full mesh type VPN at the time of trying to perform encryption communication between routers.

  Next, embodiments of the present invention will be described with reference to the drawings. First, an outline of an automatic encryption communication method in a network according to the present invention will be described. In the network according to the present invention, communication between connected routers is automatically managed in a hierarchy using a zero configuration system that realizes automatic acquisition of configuration information and remote management, and the total number of applicable security policies is limited. It has been realized that communication is performed by encryption using the Internet Protocol security protocol.

  FIG. 1 is a block diagram showing a configuration example of a remote management server device according to an embodiment of the present invention. In FIG. 1, the remote management server device 1 includes a security policy storage unit 11, a group policy list generation unit 12, a group policy list distribution unit 13, and a security policy distribution unit 14.

  FIG. 2 is a block diagram showing a configuration example of the router device according to the embodiment of the present invention. In FIG. 2, the router device 2 includes an encrypted communication path setting unit 21, a group policy list storage unit 22, a group policy list search unit 23, a security policy setting request unit 24, and a group policy list confirmation unit 25. I have.

  FIG. 3 is a block diagram showing a configuration example of a network according to the embodiment of the present invention. In FIG. 3, the network according to the embodiment of the present invention includes a base router device (AD) 2-1 to 2-4, a center router device (E) 3 corresponding to a zero configuration framework, and a remote control. The remote management server device 1 is a server device that can control these router devices, and terminals (AD) 4-1 to 4-4.

  The remote management server device 1 has the configuration shown in FIG. 1, and the base router devices (A to D) 2-1 to 2-4 and the center router device (E) 3 are the same as those shown in FIG. The configuration is the same as that of the router device 2 shown in FIG.

  Hereinafter, automatic encryption communication of a network according to an embodiment of the present invention will be described with reference to FIGS. First, means for solving automatic encrypted communication according to an embodiment of the present invention will be described.

  In the present embodiment, in the configuration shown in FIG. 3, the remote management server device 1, the base router device (A) 2-1, and the base router device (B) 2-2 are connected to the base router devices (A, B). ) IPsec communication is realized without directly setting IPsec in 2-1 and 2-2. Thereby, in the present embodiment, encryption of communication between the network NetA of the base router device (A) 2-1 and the network Net-B of the base router device (B) 2-2 is realized.

  In this case, the security policy storage unit 11 of the remote management server device 1 stores the security policy required for encrypted communication between the base router devices (A, B) 2-1 and 2-2. Policy and base router device B policy are set. Here, the security policies described in the security policy storage unit 11 include the settings of the network NetA managed by the base router device (A) 2-1 and the network NetB managed by the base router device (B) 2-2, respectively. It is included.

  In the remote management server device 1, the group policy list generation unit 12 automatically starts the base router device (A, B) 2-1, 2-2 from the base router device policy set in the security policy storage unit 11 above. The IP (Internet Protocol) address and the network address to be managed are extracted to generate a group policy list α (see 121 in FIG. 3).

  The group policy list α uses the encrypted communication from the group policy list distribution unit 13 of the remote management server device 1 as in the zero configuration network to manage the operation of the base router devices (A, B) 2-1, 2-2. Using the mechanism that can perform the above, the information is distributed to the base router devices (A, B) 2-1 and 2-2 of the same security group α100. Here, the base router devices (A, B) 2-1 and 2-2, which are allowed to communicate with each other, are called security groups.

  The terminal (B) 4 under the network NetB managed by the base router device (B) 2-2 from the terminal (A) 4-1 under the network NetA managed by the base router device (A) 2-1. -2 to communicate with each other, it is necessary to set an encrypted communication path (IPsec tunnel) between the base router device (A) 2-1 and the base router device (B) 2-2. .

  First, the base router device (A) 2-1 is already distributed from the remote management server device 1 by the group policy list search unit 23 using the destination address of the packet of the terminal (A) 4-1 as a keyword. It is searched whether there is a network including the destination address in the group policy list α stored in the list storage unit 22. Here, the network NetB managed by the base router device (B) 2-2 matches.

  Based on the search result of the group policy list search unit 23, the base router device (A) 2-1 makes the base router device (B) 2-2 to the remote management server device 1 at the security policy setting request unit 24. Request security policy settings for

  In response to a request from the base router device (A) 2-1, the remote management server device 1 sends the security policy of the base router device (B) 2-2 from the security policy distribution unit 14 to the base router device (A) 2- Return to 1. As for the communication between the base router device (A) 2-1 and the remote management server device 1, the remote management server device 1 and the base router device (A ) It is assumed that the communication is encrypted with 2-1 and further authenticated.

  The base router device (A) 2-1 uses the security policy from the remote management server device 1, and performs encrypted communication between the base router device (A) 2-1 and the base router device (B) 2-2. An attempt is made to set the IPsec tunnel 101 that is a route.

  The base router device (B) 2-2 refers to the group policy list distributed from the remote management server device 1 in the group policy list confirmation unit 25, and the base router device (A) 2-1 that has attempted connection Is included in the group policy list α. The base router device (B) 2-2 uses its own security policy in response to the request for establishing the IPsec tunnel 101 from the base router device (A) 2-1.

  Thus, in this embodiment, the base router device (A, B) 2-1 is further set without setting anything in the base router device (A) 2-1 and the base router device (B) 2-2. , 2-2, the encrypted communication path can be established without being aware of the policy of the base router devices (A, B) 2-1 and 2-2 that are paired with each other.

  Next, the means for solving the automatic encrypted communication considering the load distribution in the hierarchy in the embodiment of the present invention will be described.

  As described above, if communication is performed while acquiring the security policy of the base router device, even if the security policy between base router devices that do not communicate for a certain period of time is deleted from the base router device, the base router device In a network having hundreds to thousands, there is a possibility that not all security policies can be maintained in the base router device.

  This situation is a detrimental effect due to the existing network configuration, which is caused by the fact that the network configured according to the above description constitutes a full mesh VPN (Virtual Private Network).

  However, in the present embodiment, the group policy list used in the automatic encryption communication solution means is generated in a hierarchy, so that the network of the center router apparatus type VPN configuration that solves this problem is also automatically generated. can do. Thus, in the present embodiment, it is possible to automatically set an encrypted communication path without setting a large amount of configuration even in the center router device while reducing the load on the base router device.

  The policy of the center router device (E) 3 is performed on the remote management server device 1 in the same manner as the policy setting of the base router devices (A, B) 2-1 and 2-2. Here, the network using the center router device (E) 3 is set as the security group β200, and the policies of the base router devices (BD) 2-2 to 2-4 are stored in the security policy storage unit 11 of the remote management server device 1. The policy of the center router device (E) 3 is set.

  Further, the policy of the center router device (E) 3 includes the addresses of the base router device (B) 2-2, the base router device (C) 2-3, and the base router device (D) 2-4 subordinate thereto. Is set in place of the management network set in the policy setting in the base router device.

  In the remote management server device 1, the group policy list generation unit 12 automatically converts this policy setting into the group policy list β (see 122 in FIG. 3). At this time, the group policy list β includes the network router B (2-2), the network router B (2-2), the network router C (2), the network router C (base router device), as in the group policy list described above. (D) 2-4 is described as managing the network NetD, but each of the base router device (B) 2-2, the base router device (C) 2-3, and the base router device (D) 2-4 Information that the center router device (E) 3 manages the networks NetB, NetC, and NetD is added.

  This group policy list is sent from the group policy list distribution unit 13 of the remote management server device 1 to the base router devices (BD) 2-2 to 2-4 and the center router device (E) 3 in the same manner as described above. Distributed.

  A terminal in the network NetB managed by the base router device (B) 2-2, using the communication means similar to the “automatic encryption communication solution means” described above with reference to the above group policy list (B) When communication is performed from 4-2 to the terminal (C) 4-3 in the network NetC managed by the base router device (C) 2-3, the group policy list is obtained from the destination address of the packet. The encrypted communication path IPsec tunnels 102 and 103 can be automatically established by referring to and requesting the necessary security policy from the remote management server apparatus 1.

  Further, there is communication from the terminal (B) 4-2 in the network NetB of the base router device (B) 2-2 to the terminal (D) 4-4 in the network NetD of the base router device (D) 2-4. However, the IPsec tunnel 102 is shared with the IPsec tunnel automatically generated by the terminal (B) 4-2 and the terminal (C) 4-3.

  As a result, the security policy required for two base router devices becomes one base for the center router device (E) 3, and even if the number of base router devices is increased, the center router device (E) 3 As long as it is routed, the total number of security policies required in the base router device (B) 2-2 does not increase.

  The base router devices (A to D) 2-1 to 2-4, the center router device (E) 3 and the remote management server device 1 are connected to a network such as the Internet via Ethernet (registered trademark) or the like. Has been.

  In control communication between the remote management server device 1 and each base router device (A to D) 2-1 to 2-4 and control communication between the remote management server device 1 and the center router device (E) 3, Assume that encrypted communication authenticated by SSL (Secure Sockets Layer) or the like has been established. These preconditions already exist as a network that supports zero configuration.

  In the present embodiment, in addition to the above, the remote management server device 1 includes the security policy, management network, and management base router device of the base router devices (A to D) 2-21 to 2-4 and the center router device (E) 3. A storage area for setting a policy consisting of a policy, a program for automatically converting the setting to a group policy list, and distributing the group policy list to each base router device and center router device using zero-configuration encrypted communication control Includes functionality.

  In the present embodiment, there are a security group α and a security group β managed by different security policies, and the base router devices (A, B) 2-1 and 2-2 managed by the security group α, security There are base router devices (BD) 2-2 to 2-4 and a center router device (E) 3 managed by the group β.

  The remote management server device 1 can manage a plurality of group policy lists in order to manage a plurality of security groups, and can also apply a plurality of security groups like the base router device (B) 2-2. It shall be possible.

  4 is a diagram showing an example of policy setting contents in the embodiment of the present invention, FIG. 5 is a flowchart showing processing operations of the router 2 shown in FIG. 2, and FIG. 6 is a remote management server shown in FIG. 4 is a flowchart showing a processing operation of the device 1. The network processing operation according to the embodiment of the present invention will be described with reference to FIGS.

  The processing operation shown in FIG. 5 can be realized by a CPU (central processing unit) (not shown) in the router 2 executing a program stored in the memory. The processing operation shown in FIG. This can be realized by a CPU (not shown) in the server device 1 executing a program stored in the memory.

  First, policy setting of the base router devices (A to D) 2-1 to 2-4 will be described. In the present embodiment, in order to establish encrypted communication between the base router devices (A to D) 2-1 to 2-4, the remote management server device 1 includes the base router devices (A to D) 2-1 to It is necessary to set a policy every 2-4.

  As shown in FIG. 4, the contents to be set in the remote management server device 1 are separately described in the base router device (A to D) policy sample and the center router device (E) policy sample in the security groups α and β. As described above, the IP addresses of the base router devices (A to D) 2-1 to 2-4, the network managed by the base router devices (A to D) 2-1 to 2-4, and the security policy necessary for encrypted communication Etc.

  As a typical example of a security policy, in order to establish an IPsec tunnel, a fixed key, a pre-shared key used for IKE (Internet Key Exchange), AES (Advanced Encryption Standard) / 3DES (triple Data Encrypt), etc. Although it is assumed that an encryption method is included, the present embodiment is not directly related to the present invention, and a detailed description thereof will be omitted. In the present embodiment, the above contents are all items set by the operator.

  Next, automatic generation and distribution of group policy lists α and β by the remote management server device 1 will be described.

  In the remote management server device 1, when the policy of the base router devices (A, B) 2-1 and 2-2 belonging to the security group α is newly set or changed, the group policy list generation unit 12 performs grouping. A policy list α is automatically generated. Similarly, in the remote management server device 1, the policies of the base router devices (B to D) 2-2 to 2-4 and the center router device (E) 3 belonging to the security group β are newly set or changed. In this case, the group policy list generator 12 automatically generates the group policy list β.

  As shown in FIG. 4, the group policy list is obtained from the policy of the base router devices (A to D) 2-1 to 2-4 and the center router device (E) 3, and the base router devices (A to D) 2-1. 2-4 IP address (router-addr), IP address (router-addr) of management network (network) or center router device (E) 3, and base router device managed by center router device (E) 3 (BD) The addresses (sub-routers) 2-2 to 2-4 are extracted and listed.

  The group policy list does not include a security policy (security-policy). Further, an ID (IDentifier) is attached to the group policy list in order to recognize a policy change for each of the base router devices (A to D) 2-1 to 2-4 and the center router device (E) 3. . This ID is different from that before the change, for example, when the policy is changed (including contents not included in the group policy list such as a security policy).

  The remote management server device 1 has the IP addresses (router-addr) of the base router devices (AD) 2-1 to 2-4 and the center router device (E) 3 in the group policy list shown in FIG. This list is distributed from the group policy list distribution unit 13.

  The distribution of the group policy list uses the authentication and encrypted remote control framework described above. That is, the group policy list α is assigned to the base router devices (A, B) 2-1 and 2-2, and the group policy list β is assigned to the base router devices (BD) 2-2 to 2-4 and the center router device (E). ) 3.

  Next, holding of the group policy list in the base router devices (A to D) 2-1 to 2-4 and the center router device (E) 3 will be described.

  The group policy list distributed from the remote management server device 1 is the group policy list storage unit 22 (memory or the like) in each of the base router devices (A to D) 2-1 to 2-4 and the center router device (E) 3. Retained.

  In addition, when a group policy list has been distributed in the past, the IDs in the group policy list shown in FIG. 4 are compared with the past list. Discard any automatic settings that were made. This automatic setting will be described later. Here, two group policy lists α and β are distributed to the base router device (B) 2-2 in particular, but both are stored as different group policy lists.

  Next, a flow of processing operations (establishment of the IPsec tunnel 101) until establishment of an encrypted communication path within the security group α according to the present embodiment will be described.

  First, it is necessary for communication from the terminal (A) 4-1 in the network NetA of the base router device (A) 2-1 to the terminal (B) 4-2 in the network NetB of the base router device (B) 2-2. The flow of processing operations until the IPsec tunnel 101 that is the encrypted communication path to be established will be described.

  Here, the address of the terminal (A) 4-1 is “192.168.1.10” in the network NetA of the base router apparatus (A) policy sample shown in FIG. 4, and the terminal (B) 4-2 The address of “192.168.2.20” in the network NetB is assumed to be the same as described above.

  The base router device (A) 2-1 transmits a packet (source address: “192.168.1.10”, destination address: “192.168.2.20”) transmitted from the terminal (A) 4-1. ) (Step S1 in FIG. 5), it is confirmed whether a communication path for encrypting this packet has already been established (step S2 in FIG. 5). Here, if the communication path has already been established, the base router apparatus (A) 2-1 uses the encrypted communication path and transmits it as it is (step S7 in FIG. 5).

  If the encrypted communication path is not yet established, the base router device (A) 2-1 uses the destination address of the packet as a keyword next from the group policy list α already acquired from the remote management server device 1. Check whether the encrypted communication path can be established with the packet.

  That is, the base router device (A) 2-1 searches the network to which the destination address “192.168.2.20” shown in FIG. 4 is applied from “network =” of the group policy list α (step in FIG. 5). S3), router = 10.2.1.1, network = 192.168.2.0 / 24, id = 10 can be selected.

  That is, if the base router device (A) 2-1 can acquire the security policy of the base router device address “10.2.1.1”, it can be understood that the encrypted communication path can be established. From this information, the base router device (A) 2-1 requests the remote management server device 1 for a security policy of the base router device address “10.2.1.1” (step S4 in FIG. 5).

  When the remote management server device 1 receives the security policy request from the base router device (A) 2-1, the address of the request source base router device (A) 2-1 is first requested. It is confirmed whether the address of the base router device of the security policy that exists is in the same group policy (step S12 in FIG. 6).

  Here, the address of the requesting base router device (A) 2-1 is “10.1.1.1”, and the address of the base router device of the requested security policy is “10.2.1.1”. Therefore, it can be confirmed from the group policy list α managed by the remote management server device 1 that both exist in the same management network.

  Next, the remote management server device 1 searches for the security policy “10.2.1.1” requested by the base router device (A) 2-1 (step S13 in FIG. 6).

  As shown in FIG. 4, since the remote management server device 1 manages all the security policies in the group policy list α, the security policy “10.2.1.1” is assigned to the base router device (B ) It is understood that “security-policy = IPsec, key = hoge02” set in the policy.

  The remote management server device 1 attaches this security policy and returns it to the requesting base router device (A) 2-1 (step S14 in FIG. 6). As described above, the base router device (A) 2-1 and the base router device (B) 2-2 can share the same security policy.

  Thereby, the base router device (A) 2-1 can establish an IPsec tunnel with respect to the base router device (B) 2-2 (steps S5 and S6 in FIG. 5). Here, a detailed description for establishing IPsec with the same security policy is omitted.

  Thus, in this embodiment, since the packet can be encrypted and an encrypted path for transmitting from the base router device (A) 2-1 to the base router device (B) 2-2 can be established, The base router device (A) 2-1 encrypts and encapsulates the packet (transmission address: 10.1.1.1, destination address: 10.2.1.1), and the base router device (B) 2- 2 (step S7 in FIG. 5).

  Subsequently, a flow of processing operations (establishment of the IPsec tunnel 102 and the IPsec tunnel 103) until establishment of the encrypted communication path in the security group β according to the present embodiment will be described.

  That is, the flow of processing operations until the IPsec tunnel 102 and the IPsec tunnel 103 that are encrypted communication paths are established through the center router device (E) 3 will be described. The communication necessary for this establishment will be described using a packet from the terminal (B) 4-2 to the terminal (C) 4-3. Here, similarly to the above, the address of the terminal (B) 4-2 is “192.168.2.20”, and the address of the terminal (C) 4-3 is also an address included in the network NetC. 192.168.3.30 ".

  Similarly to the above description, the base router device (B) 2-2 receives the packet (source address: 192.168.2.20, destination address: 192.168.3.30) (step in FIG. 5). S1) A process similar to the above is executed to perform a group policy list search (step S3 in FIG. 5).

  Here, the group policy lists α and β are searched using the destination address: 192.168.3.30 as a keyword, and “router-addr = 10.3.1.1, network” is retrieved from the group policy list β shown in FIG. = 192.168.3.0/24, id = 24 ".

  Here, when the line of the center router device (E) 3 is further retrieved, the router-addr = 10.3.1.1 that has been retrieved earlier is the router-addr = 10.11.1 of the center router device (E) 3. .1, sub-router = 10.3.1.1, 10.4.1.1.

  As a result, the base router device (B) 2-2 requests the remote management server device 1 for a security policy of the address “10.11.1.1.1” of the center router device (E) 3.

  From here, until the IPsec tunnel 102 is established, it is established by the same processing operation flow as described above.

  The packet transmitted from the terminal (B) 2-2 reaches the center router device (E) 3 through the IPsec tunnel 102 described above. The center router device (E) 3 also searches for the group policy list β by the same processing as before. However, “router-addr = 10.11.1.1.1, sub-router = 10.3. Since “1.1, 10.4.1.1” is itself, the necessary security policies are “router-addr = 10.3.1.1, network = 192.168.3.0”. / 24, id = 24 ".

  That is, the center router device (E) 3 requests the remote management server device 1 for a security policy of “10.3.1.1” that is the base router device (C) 2-3.

  Thereafter, the IPsec tunnel 103 is established by performing the same processing as before, and the base router device (C) 2 from the base router device (B) 2-2 via the center router device (E) 3. -3 is established.

  As described above, in this embodiment, the remote management server device 1 does not directly set the base router devices (A to D) 2-1 to 2-4 and the center router device (E) 3. Centralized management.

  Further, in the present embodiment, it is automatically set as the opposite router device only by setting the security policy for the base router devices (AD) 2-1 to 2-4 and the center router device (E) 3 alone. It is possible to generate an encrypted communication path.

  Furthermore, in this embodiment, even when the security policy is changed or the network configuration is changed, the policies of the target base router devices (AD) 2-1 to 2-4 and the center router device (E) 3 are changed. It is possible to automatically update the associated encrypted communication path only by changing.

  Furthermore, in the present embodiment, the remote management server device 1 can be configured as long as it has a function of only returning a response to the requests of the base router devices (A to D) 2-1 to 2-4. . That is, in the present embodiment, the remote management server device 1 causes the plurality of base router devices (A to D) 2-1 to 2- by some trigger of the base router devices (A to D) 2-1 to 2-4. There is no need to actively issue instructions to 4.

  In the present embodiment, since only the policies of the necessary base router devices (A to D) 2-1 to 2-4 are acquired when necessary, the base router devices (A to D) 2-1 to 2-4 are required. The storage area can be used efficiently.

  In the present invention, authentication technology, encryption control, and each base router device (AD) 2-1 between the remote management server device 1 and the base router devices (AD) 2-1 to 2-4. ~ 2-4 settings and remote control are based on the existing zero config network framework, but the remote management server device 1 and the base router devices (AD) 2-1 to 2-4 Other frameworks can be used as long as there is a mechanism that can perform authentication and encryption control with.

  In the present invention, a router device is used as a device for establishing a path for encrypted communication. However, the present invention is not particularly limited to the router device. It can also be replaced.

1 Remote management server device
2 Router device 2-1 to 2-4 Base router device (A to D)
3 Center router device (E)
4-1 to 4-4 Terminals (A to D)
11 Security policy storage
12 Group policy list generator
13 Group Policy List Distribution Department
14 Security Policy Distribution Department
21 Encrypted communication path setting section
22 Group policy list storage
23 Group Policy List Search Department
24 Security policy setting request section
25 Group Policy List Confirmation Department
100 Security group α
101-103 IPsec tunnel
200 Security group β

Claims (12)

Storage means for storing a security policy required for encrypted communication between a plurality of network devices corresponding to each of the plurality of network devices;
Generating means for generating a group policy indicating network devices that are allowed to communicate with each other based on a security policy corresponding to each of the plurality of network devices;
Distribution means for distributing the group policy generated by the generation means to each of the plurality of network devices;
A network apparatus comprising: security policy distribution means for distributing a security policy requested from the plurality of network devices to the network device based on the group policy distributed by the distribution means.   2. The network apparatus according to claim 1, wherein the generation unit generates a list of the group policies by listing necessary information from security policies corresponding to the plurality of network devices.   3. The network according to claim 1, wherein the security policy requested from the plurality of network devices is a security policy of an opposing network device required by each of the network devices according to the group policy. apparatus.   The distribution unit and the security policy distribution unit perform distribution to each of the plurality of network devices using encrypted and authenticated communication with a distribution destination. 4. The network device according to any one of 3.   4. The network device according to claim 1, wherein the group policy is hierarchized to automatically reduce the number of connections between the plurality of network devices.   A network comprising the network device according to any one of claims 1 to 5. Network device
A first process of storing a security policy required for encrypted communication between a plurality of network devices in a storage unit corresponding to each of the plurality of network devices;
A second process of generating a group policy indicating network devices that are allowed to communicate with each other based on a security policy corresponding to each of the plurality of network devices;
A third process for distributing the group policy generated in the second process to each of the plurality of network devices;
Performing a fourth process of distributing to the network device a security policy requested from the plurality of network devices based on the group policy distributed in the third process;
An automatic encrypted communication method, wherein encrypted communication is executed between mutually opposing network devices using the security policy distributed in the fourth process.   8. The automatic encryption communication method according to claim 7, wherein, in the second process, the group policy list is generated by listing necessary information from security policies corresponding to the plurality of network devices.   9. The automatic policy according to claim 7, wherein the security policy requested from the plurality of network devices is a security policy of an opposing network device required by each of the network devices according to the group policy. Encrypted communication method.   8. In the third process and the fourth process, delivery to each of the plurality of network devices is performed using communication encrypted and authenticated with a delivery destination. The automatic encryption communication method according to claim 9.   The automatic encryption communication method according to claim 7, wherein the group policy is hierarchized to automatically reduce the number of connections between the plurality of network devices. A program to be executed by a central processing unit in a network device,
A first process of storing a security policy required for encrypted communication between a plurality of network devices in a storage unit corresponding to each of the plurality of network devices;
A second process of generating a group policy indicating network devices that are allowed to communicate with each other based on a security policy corresponding to each of the plurality of network devices;
A third process for distributing the group policy generated in the second process to each of the plurality of network devices;
A fourth process of distributing security policies requested from the plurality of network devices to the network device based on the group policy distributed in the third processing;
A program for executing encrypted communication between mutually opposing network devices using the security policy distributed in the fourth process.

Images