JP3911697B2 - Network connection device, network connection method, network connection program, and storage medium storing the program - Google Patents

Description

The present invention relates to a network connection device that establishes a security association with a network connection device of a communication partner by exchanging a public key certificate and an IP address by an automatic key exchange protocol.

Conventionally, as technology related to communication security on the Internet, technologies discussed in the IPsec (Internet Protocol Security) working group of the IETF (The Internet Engineering Task Force), such as Security Architecture for the Internet Protocol (for the Internet protocol). IKE (automatic key exchange protocol, Internet Key Exchange) using a security architecture and public key infrastructure is known (see Non-Patent Document 1 and Non-Patent Document 2).
Here, IPsec is a protocol for encrypting packets on the Internet and performing communication safely, and IKE exchanges and shares information such as an encryption algorithm and an encryption key before starting communication. This is a protocol that automatically negotiates for this purpose.

In IPsec, before starting communication, a secure communication path is established by negotiating a security association (hereinafter abbreviated as SA) for exchanging and sharing an encryption method, encryption key information, own ID, and the like. When establishing this SA (IPsec SA), there is a method of authenticating the communication partner using IKE. In this method, the communication subject side node transmits the public key certificate transmitted from the communication partner in phase 1 of IKE. Since the verification of the certificate is performed, it is possible to prevent so-called “spoofing” of the communication partner and to prevent denial of access by the communication partner.
In the IKE phase 1 described above, SA negotiation is performed for safely performing security protocol SA negotiation or the like in IPsec. That is, negotiation of ISAKMP SA (Internet Security Association Key Management Protocol Security Association) is performed. Incidentally, in IKE phase 2, negotiation is performed in phase 1 and security protocol SA negotiation and shared secret key generation are performed based on the established ISAKMP SA.
IETF, RFC2401, [online], [Search February 17, 2004], Internet, <URL: http: //www.ietf.org/rfc/rfc2401.txt> IETF, RFC2409, [online], [Search February 17, 2004], Internet, <URL: http: //www.ietf.org/rfc/rfc2409.txt>

However, the IKE phase 1, in exchange for ID between the communication partners node and communication partner nodes (IP addresses), communication partner node, the communication partner node has transmitted ID (IP address) It is not possible to determine whether the right to use is in the communication partner node. That is, even if the communication partner node accesses (spoofes) using another person's IP address , it cannot check that it is impersonation. That is, there is a possibility that the communication subject side node establishes an IPsec SA with the node that applied for the spoofed IP address .

The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a network connection device or the like that prevents establishment of an IPsec SA with a node that has applied for a spoofed IP address .

In order to solve the above-described problem, the present invention provides a network connection device that exchanges a public key certificate and an IP address by IKE, which is an automatic key exchange protocol, and establishes a security association with a network connection device of a communication partner. An interface unit that transmits / receives various types of information via an IP address table, an IP address table storage unit that stores an IP address table indicating correspondence between an IP address of a network connection device of a communication partner and identification information of a public key certificate, and an interface unit An IKE processing unit which receives an IP address and a public key certificate transmitted from another network connection device via IKE and negotiates a security association with the other network connection device by IKE, and an IP address table storage IP address And a verification unit that searches the table and determines whether the combination of the IP address and the public key certificate transmitted from the other network connection device is stored in the IP address table, and the other network connection device When the verification unit determines that the combination of the IP address and the public key certificate transmitted from is stored in the IP address table, the IKE processing unit can establish a security association with another network connection device. It was set as the structure to do.

  The “network connection device” in the claims corresponds to a “node” in an embodiment described later. In addition, the “network connection device of the communication partner” in the claims refers to a network connection device intended by the communication subject (network connection device) as the communication partner, and the “other network connection device” refers to via a network. It refers to all network connection devices that access (send data) to the communication entity.

According to the present invention, since the network connection device of the communication subject stores the IP address table indicating the correspondence between the IP address of the network connection device of the communication partner and the public key certificate, it is transmitted from the other network connection device. When the registered IP address and public key certificate are not described in the IP address table, the ISAKMP SA in the IKE phase 1 can be prevented from being established with the network connection device. Therefore, it is possible for the network-connected device that is the communication subject to not establish an IPsec SA with the network-connected device that has been accessed by impersonation.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

First, a basic configuration and a basic processing procedure of a system including a node according to an embodiment of the present invention will be described with reference to FIGS. 1 to 3, and then a characteristic configuration of the present invention will be described.
Here, an application example in the case of using a digital signature authentication method (aggressive mode) using a digital signature in IPsec SA negotiation (more specifically, Phase 1 of IKE of IPsec SA) will be described.
The aggressive mode is a method of exchanging SA parameters, key information, and ID (IP address) in IKE phase 1 with three messages.
FIG. 1 is a block diagram showing a basic configuration of a network connection system including nodes (network connection devices) according to an embodiment of the present invention.
2 and 3 are sequence diagrams showing basic processing procedures of a network connection system including a node (network connection device) according to an embodiment of the present invention.

<Basic configuration>
As shown in FIG. 1, the network connection system that is the basic configuration of the present embodiment includes a node 100 (100A to C) and authentication for issuing a public key certificate and a private key of the node 100 (100A to C). Station 200 (200A, 200B) and the network 4 which connects these are comprised.
The nodes 100 (100A to 100C) are network connection devices that transmit and receive communication data via the network 4, and are, for example, PCs (Personal Computers), routers, and the like. The network 4 is, for example, a regional IP network or the Internet network.
Note that the node 100 performs data transmission / reception (communication) among the plurality of nodes 100, but here, for the sake of explanation, the node that transmits the first message of the IKE phase 1 is designated as the node 100B ( Other network connection devices in the claims), the node that receives the first message of the IKE phase 1 and becomes the communication subject is the node 100A. Further, a node of a communication partner of the node 100A (a node intended as a communication partner) is a node 100C.

The node 100A acquires the public key certificate of the certificate authority 200B from the certificate authority 200B that is the certificate authority of the node 100C before the start of IKE. Then, after the start of the IKE, an IKE message including the ID (IP address) of the node 100B , the public key certificate, and the digital signature is received from the node 100B. Next, it is verified whether or not the public key certificate included in the IKE message is a valid public key certificate with the public key certificate of the certificate authority 200B. When it is verified that the public key certificate received from the node 100B is a valid public key certificate, the digital signature of the node 100B is verified with the public key certificate.
In this way, the node 100A confirms (authenticates) that the node 100B is a valid communication partner (node 100C), and then performs the processes after the IKE phase 2 with the node 100B (node 100C). Do.

Next, the basic configuration of the node 100 (100A to 100C) will be described with reference to FIG.
Since the node 100A has the same configuration as the nodes 100B and 100C, the configuration of the node 100 (100A to C) will be described using the configuration of the communication subject node 100A in FIG.

  The node 100 (100A to C) includes an interface unit 101 that transmits and receives various types of information via the network 4, a processing unit 120 that performs IKE negotiation processing with the nodes 100B and 100 of communication partners using IKE, And a storage unit 110 that stores various types of information regarding the SA.

(Processing means)
The processing unit 120 includes an IKE processing unit 121, a public key certificate acquisition unit 122, and a verification unit 123.
The IKE processing unit 121 executes IKE phase 1 (ISAKMP SA negotiation) with the node 100B. Specifically, 1) ISAKMP SA data (message) including the IP address , public key certificate, and digital signature of the node 100B is received from the node 100B, and 2) the ISAKMP SA data (message) of the node 100A is received accordingly (message). 3) Send this message to the node 100B to negotiate an ISAKMP SA with the node 100B.

  The public key certificate acquisition unit 122 acquires the public key certificate of the certificate authority 200B from the certificate authority 200B, which is the certificate authority of the communication partner node 100C, via the network 4 before the start of the IKE phase 1 ISAKMP SA negotiation. To do. Then, the public key certificate of the certificate authority 200B is stored in the public key certificate storage unit 111, and the public key certificate of the node 100A (own node) is stored in the IKE data storage unit 112.

The verification unit 123 verifies the public key certificate included in the ISAKMP SA data transmitted from the node 100B with the public key certificate of the certificate authority 200B stored in the public key certificate storage unit 111 to be described later. It is determined whether or not the public key certificate transmitted from 100B is a valid public key certificate. When it is determined that the public key certificate transmitted from the node 100B is a valid public key certificate, the digital signature of the node 100B is verified with the public key of the public key certificate. That is, whether or not the node 100B is a communication partner (node 100C) is confirmed by two steps of verification of the public key certificate acquired from the certificate authority 200B and verification of the digital signature.
The operation of each component of the processing means 120 will be described in detail in the section of the communication processing procedure described later.

(Memory means)
Next, the storage unit 110 will be described. The storage unit 110 includes a public key certificate storage unit 111 and an IKE data storage unit 112.

  The public key certificate storage unit 111 stores the public key certificate of the certificate authority 200B acquired by the public key certificate acquisition unit 122.

The IKE data storage unit 112 stores various types of data for IKE negotiations (ISAKMP SA negotiations) with the node 100B. ISAKMP SA negotiation data includes the secret key, public key certificate, ISAKMP SA parameter candidate, node 100A key information, ID (IP address) of the node 100A, etc. acquired by the node 100A from the certificate authority 200A. It is.
The IKE processing unit 121 reads the data in the IKE data storage unit 112 and creates an ISAKMP SA negotiation message.

<Communication processing procedure>
Next, a basic communication processing procedure of the node 100 (100A, B) will be described using FIG. 2 and FIG.

First, before starting the IKE SA (ISAKMP SA) with the node 100B, the public key certificate acquisition unit 122 of the node 100A makes a private key of the node 100A and the public of the private key pair from the certification authority 200A. A public key certificate including the key is acquired (step S101). These pieces of information are stored in the IKE data storage unit 112. At the same time, a public key certificate of the certificate authority 200B, which is the certificate authority of the node 100C, is acquired (step S102), and the public key certificate is stored in the public key certificate storage unit 111.

At this time, the node 100B also obtains the private key of the node 100B and the public key certificate including the public key that is a pair of the private key from the certificate authority 200B (step S101 and step S102 of the node 100A) (step S101). In step S103, a public key certificate is acquired from the certificate authority 200A that is the certificate authority of the node 100A (step S104).

Next, the node 100A receives the first message of the IKE phase 1 (ISAKMP SA negotiation) transmitted from the node 100B and starts IKE. That is, upon receiving ISAKMP SA parameter candidates, node 100B key information, node 100B ID (IP address) , node 100A public key certificate request, etc. (step S201), node 100A starts IKE processing. To do.

Specifically, when the node 100A receives the first message of the IKE phase 1, the IKE processing unit 121 1) selects the ISAKMP SA parameter from the ISAKMP SA parameter candidates transmitted from the node 100B, and 2) the node 100A Create key information, 3) create a signature (digital signature) of the node 100A with the private key of the node 100A read from the IKE data storage unit 112, and 4) add the public key certificate of the node 100A to these pieces of information, A second message of IKE phase 1 including the IP address of node 100A and the public key certificate request of node 100B is created. Then, this message is transmitted to the node 100B (step S202).

  Next, when the node 100A receives the third message of the IKE phase 1 (the public key certificate and signature of the node 100B) transmitted from the node 100B (step S203), the process proceeds to step S301 in FIG. The signature of the received node 100B is verified. That is, it is determined whether or not the node 100B is a communication partner (node 100C) of the node 100A.

The processing procedure of the node 100A at this time will be specifically described with reference to FIG.
First, the verification unit 123 reads the public key certificate of the certificate authority 200B, which is the certificate authority of the node 100B, from the public key certificate storage unit 113, and whether or not the public key certificate acquired in step S203 is valid. Is verified (step S301). Next, when it is verified that the public key certificate received in step S203 is valid (Yes in step S302), the process proceeds to step S303.

  On the other hand, when the verification unit 123 determines that the public key certificate received in step S203 is not valid (No in step S302), it notifies the node 100B that the IKE phase 1 (ISAKMP SA) negotiation has failed. Then, the process ends (step S306). In other words, the node 100A confirms whether or not the public key certificate of the accessing node 100B is valid, and if it is not valid, there is a possibility of access by impersonation or the like. Avoid processing.

In step S303 in which the public key certificate can be confirmed to be valid, the verification unit 123 verifies the signature of the node 100B using the public key certificate received in step S203.
Specifically, the verification unit 123 determines whether or not the ciphertext included in the signature of the node 100B can be decrypted with the public key of the public key certificate received in step S203. Here, when the verification unit 123 can decrypt the ciphertext included in the signature with the public key of the public key certificate received in step S203 (Yes in step S304), the process proceeds to step S305.
Then, the IKE processing unit 121 establishes an ISAKMP SA with the node 100B, and performs processing after the IKE phase 2 (step S305). That is, when the node 100A can confirm that the node 100B is the communication partner (node 100C), the node 100A performs subsequent IPsec SA processing.

  In step S304, when the ciphertext included in the signature of the node 100B cannot be decrypted with the public key of the public key certificate transmitted from the node 100B by the verification unit 123 (No in step S304), the IKE processing unit The node 120 notifies the node 100B that the IKE phase 1 (ISAKMP SA) negotiation has failed and ends the process (step S306). That is, the node 100B determines that it is not the IPsec communication partner (node 100C) of the node 100A, and does not perform the IPsec SA processing.

  In this way, the node 100A can establish IPsec SA after confirming that the node 100B is the communication partner (node 100C).

<Characteristic configuration>
Next, the characteristic configuration and processing procedure of the network connection system including the nodes 300 (300A to 300C) according to the embodiment of the present invention will be described with reference to FIGS. explain. Note that a node that transmits the first message of IKE phase 1 is a node 300B (another network connection device in the claims), and a node that receives the first message of IKE phase 1 is a node 300A. In addition, a node of a communication partner of the node 300A (a node intended as a communication partner) is a node 300C.
FIG. 4 is a block diagram showing a configuration of a network connection system including nodes according to the embodiment of the present invention.
5 and 6 are sequence diagrams showing the processing procedure of the network connection system including the node according to the embodiment of the present invention.
In addition, the same components as the basic configuration described above are denoted by the same reference numerals, and description thereof is omitted.

  The feature of this embodiment is that the node 300A stores 1) an IP address table indicating the correspondence between the identification information of the public key certificate of the communication partner (node 300C) and the IP address, and 2) from the node 300B When the combination of the IP address received by IKE and the public key certificate is stored in the IP address table (existing), the node 300B is determined as the communication partner (node 300C), and the IPsec SA can be established. It is configured.

  That is, the node 300A has a configuration in which an IP address table creating unit 124 that creates an IP address table and an IP address table storage unit 113 that stores the IP address table are added to the basic configuration of the node 100A. ing. Further, the verification unit 123 determines whether or not the combination of the IP address and the public key certificate received by the IKE from the node 300B is in the IP address table. When the verification unit 123 determines that the combination of the IP address received from the node 300B and the public key certificate is in the IP address table, the IKE processing unit 121 establishes an ISAKMP SA with the node 300B. , IKE phase 2 and subsequent processes are performed.

Below, the component of this Embodiment is demonstrated.
The IP address table creation unit 124 creates an IP address table indicating the correspondence between the IP address of the communication partner (node 300C) and the public key certificate of the communication partner (node 300C) acquired from the certificate authority 200B.

  Table 1 illustrates an IP address table created by the IP address table creation unit 124.

As illustrated in Table 1, the IP address table includes an IP address of the node 300C and identification information of the public key certificate of the node 300C.
For example, in the IP address table of Table 1, No. The information 1 indicates that the identification information of the public key certificate of the node 300C with the IP address “aaa.aaa.aaa.aaa” is “xxx”.

  Here, it is assumed that the IP address and public key certificate of the communication partner (node 300C) are obtained in advance from the communication partner (node 300C) in writing or by mail. That is, the user of the node 300A receives the notification of the IP address and the public key certificate from the node 300C and inputs the notification to the node 300A via an input unit (keyboard, mouse, etc.) not shown, and the storage unit 110 of the node 300A. Etc. shall be memorized.

  The identification information of the public key certificate includes 1) Subject field (a field in which information of the owner of the public key certificate is written) of the public key certificate acquired by the public key certificate acquisition unit 122 from the certificate authority 200. 2) The character string described in the Issuer field (the field in which the identification information of the certificate authority 200B that issued the public key certificate is written) and the Serial Number field You may make it produce from the combination with the character string of (The field where the serial number of the public key certificate produced by the certification authority 200 is written).

  Here, in addition to the character string in the Subject field, a combination of the character string in the Issuer field and the character string in the Serial Number field can be used as the identification information of the public key certificate. This is because 300A can identify (identify) which public key certificate is created (issued) by which certificate authority 200. That is, the public key certificate acquired by the node 300A can be identified.

As described above, the identification information of the public key certificate used in the IP address table is not limited to the above-described information as long as the information can identify the public key certificate. The IP address format may be IPv4 (Internet Protocol version 4) or IPv6 (Internet Protocol version 6). Furthermore, in this embodiment, the IP address is used as the ID (identification information) of the node 300. However, the information is not limited to the IP address as long as the information can identify the node 300 on the network 4 .

  The IP address table created by the IP address table creation unit 124 is stored in the IP address table storage unit 113.

  When the IKE processing unit 121 receives the IP address and public key certificate of the node 300B in the IKE phase 1, in addition to the public key certificate verification function described in the basic configuration section above, the verification unit 123 It is determined whether or not the combination is stored in the IP address table, and the node 300B has a function of verifying that it is a communication partner (node 300C).

<Processing procedure>
Next, the communication processing procedure of the node 300 (300A, B) will be described using FIGS. 5 and 6 with reference to FIGS. Again, the basic processing steps as well as IKE Phase 1, the illustrating the communication procedure as an example the case of using a digital signature authentication method (A Aggressive mode).

First, before starting the IKE, the node 300A receives the input of the character string of the Subject field of the public key certificate of the node 300C and the ID (IP address) of the node 300C at the IP address table creation unit 124, An IP address table showing the relationship is created (step S400 in FIG. 5).
The IP address table may be created by reading out the IP address and public key certificate stored in advance in the storage unit 110 or the like.

  The processing in steps S401 to S503 in FIG. 5 is the same as the processing in steps S101 to S203 in FIG. 2, and thus description thereof will be omitted. The processing after step S601 in FIG.

  In step S601, the verification unit 123 1) the ID (IP address) received in step S501 (IKE phase 1 first message) and 2) the public key received in step S503 (IKE phase 1 third message). A combination of character strings in the Subject field of the certificate is searched from the IP address table in the IP address table storage unit 113. That is, the verification unit 123 determines whether or not the combination of the public key certificate and the IP address transmitted from the node 300B exists in the IP address table.

  Here, when the verification unit 123 determines that the combination of the public key certificate and the IP address transmitted from the node 300B exists (stored) in the IP address table (Yes in step S602), the process from step S701 is performed. Perform the process. Since the processing from step S701 to step S706 is the same as the processing from step S301 to step S306 in FIG.

  On the other hand, when the verification unit 123 determines that there is no combination of the public key certificate and the IP address transmitted from the node 300B (No in step S602), that is, 1) of these pieces of information both in the IP address table. When judged not to be listed 2) When judged that only one of them is listed in the IP address table 3) Determined that the combination of these information is different from the combination listed in the IP address table Then, the IKE processing unit 120 notifies the node 300B that the IKE phase 1 (ISAKMP SA) negotiation has failed (step S706), and ends the process.

  As described above, the node 300 (300A) executes three steps of 1) verification of the validity of the public key certificate, 2) verification of the digital signature, and 3) confirmation of the combination of the IP address and the public key certificate. Thus, it is possible to establish IPsec SA after confirming that node 300B is indeed the communication partner (node 300C). In other words, since it is possible to prevent the node 300A, which is the communication subject, from establishing an IPsec SA with the node 300 that has accessed with the spoofed IP address, a network connection with a higher security level can be performed.

The present invention can be applied without departing from the spirit of the invention. For example, in the embodiment described above, the node 300A has has been described as an example the case of using a digital authentication method for authenticating a communication partner in the IKE phase 1 (A Aggressive Mode), IP address of the public key certificate and the node 300C as long as the method of replacing the (ID), and when using a digital authentication method (main mode), modified public key encryption scheme (a Aggressive mode, main mode) ∎ you can in be applied when used.

  In the embodiment described above, the IP address table stored in the node 300 (300A to C) is created by the IP address table creating unit 124 in the node 300 (300A to C). Or the like (not shown). That is, an IP address table created by an external server or the like may be acquired via the network 4 by the processing means 120 or the like.

  The network connection device according to the present embodiment can be realized by a network connection program for executing the processing as described above, and can be provided by storing the program in a computer-readable storage medium. is there. It is also possible to provide the program through a network.

It is the block diagram which showed the basic composition of the network connection system containing the node which is embodiment of this invention. It is the sequence diagram which showed the basic processing procedure of the network connection system containing the node which is embodiment of this invention It is the sequence diagram which showed the basic processing procedure of the network connection system containing the node which is embodiment of this invention It is the block diagram which showed the structure of the network connection system containing the node which is embodiment of this invention. It is the sequence diagram which showed the process sequence of the network connection system containing the node which is embodiment of this invention. It is the sequence diagram which showed the process sequence of the network connection system containing the node which is embodiment of this invention.

Explanation of symbols

100 (100A to C) node (network connection device)
DESCRIPTION OF SYMBOLS 101 Interface part 110 Storage means 111 Public key certificate storage part 112 IKE data storage part 113 IP address table storage part 120 Processing means 121 IKE processing part 122 Public key certificate acquisition part 123 Verification part 124 IP address table creation part 200 ( 200A, B) Certificate authority 300 (300A-C) Node (network connection equipment)

Claims (9)

A network connection device that establishes a security association with a network connection device of a communication partner by exchanging a public key certificate and an IP address by IKE which is an automatic key exchange protocol,
An interface unit for transmitting and receiving various information via a network;
And IP address table storage unit for storing an IP address table showing the correspondence between the identification information of the IP address and the public key certificate of the network connection apparatus of the communication partner,
An IKE processing unit that receives an IP address and a public key certificate transmitted from another network connection device via the interface unit, and performs a negotiation process of security association by IKE with the other network connection device;
The search for the IP address table of the IP address table storage unit, determines whether the combination of the public key certificate transmitted IP address from the other network connection apparatus is stored in the IP address table A verification unit to
Including
When the verification unit determines that the combination of the IP address and the public key certificate transmitted from the other network connection device is stored in the IP address table, the IKE processing unit A network connection device configured to be able to establish a security association with a connection device. Upon receipt of the IP address and public key certificate of the network connection device of the communication partner, an IP address table indicating the correspondence between the IP address of the network connection device of the communication partner and the identification information of the public key certificate is created. The network connection device according to claim 1, further comprising an IP address table creation unit that performs the operation. The IP address table creation unit, before starting the security association by the IKE, and receives the IP address and public key certificate of the network connection apparatus of the communication partner, the public IP address of the network connection apparatus of the communication partner Configure to create an IP address table showing the correspondence with the identification information of the key certificate,
When the verification unit determines that the combination of the IP address and the public key certificate transmitted from the other network connection device is stored in the IP address table, the IKE processing unit 3. The network connection device according to claim 2, wherein the network connection device is configured to establish an IKE phase 1 security association with the network connection device. The identification information of the public key certificate in the IP address table is described in the character string described in the Subject field indicating the owner of the public key certificate, or in the Issuer field indicating the certificate authority that issued the public key certificate. 4. The network according to claim 2, wherein the network is composed of a combination of a character string that is generated and a character string in a Serial Number field that indicates a serial number of the public key certificate issued by the certificate authority. Connected equipment. A network connection method in which a network connection device establishes a security association with a network connection device of a communication partner by exchanging a public key certificate and an IP address by IKE which is an automatic key exchange protocol,
A network connection device that stores an IP address table indicating correspondence between the IP address of the network connection device of the communication partner and the identification information of the public key certificate in the storage unit,
Receiving an IP address and a public key certificate transmitted from the other network connection device in an IKE processing unit that performs an IKE process with the other network connection device;
The verification unit that performs verification of the public key certificate and verification of the digital signature searches the IP address table stored in the storage unit , and transmits the IP address and the public key certificate transmitted from the other network connection device. Determining whether the combination is stored in the IP address table;
When the verification unit determines that the combination of the IP address and the public key certificate transmitted from the other network connection device is stored in the IP address table, the IKE processing unit determines that the other network Making it possible to establish a security association with a connected device;
The network connection method characterized by performing. A network connection method in which a network connection device establishes a security association with a network connection device of a communication partner by exchanging a public key certificate and an IP address by IKE which is an automatic key exchange protocol,
The network connection device is
Receiving an input of an IP address and a public key certificate of the network connection device of the communication partner;
In IP address table creation unit to create an IP address table showing the correspondence between the identification information of the public key certificate and IP address of the network connection device of the inputted the communication partner, creating the IP address table, the Storing an IP address table in a storage means;
Receiving an IP address and a public key certificate transmitted from the other network connection device by the IKE in an IKE processing unit that performs IKE processing with the other network connection device;
The verification unit that verifies the public key certificate of the other network connection device and the digital signature verifies the IP address table of the storage unit, and discloses the IP address transmitted from the other network connection device. Determining whether a combination with a key certificate is stored in the IP address table;
When the verification unit determines that the combination of the IP address received from the other network connection device and the public key certificate is stored in the IP address table, the IKE processing unit determines the other network connection device. Enabling the establishment of a security association with
The network connection method characterized by performing. In the IP address table creation unit, the character string described in the Subject field indicating the owner of the public key certificate, or the character string described in the Issuer field indicating the certificate authority that issued the public key certificate, and the 7. The identification information of the public key certificate of the IP address table is created based on a combination with a character string in a Serial Number field indicating a serial number of the public key certificate issued by a certificate authority. The network connection method described in 1.   A network connection program that causes a computer that operates a network connection device to execute the network connection method according to any one of claims 5 to 7.   A computer-readable storage medium that stores the network connection program according to claim 8 and that operates the network connection device.

Images