JP5522201B2 - COMMUNICATION PATH RETURN METHOD, COMMUNICATION DEVICE, AND COMMUNICATION SYSTEM - Google Patents

Description

The present invention, communication path restoration method relates to communication apparatus及beauty communications system, in particular established communications path restoration method Ru was ascribed restore the communication path when the communication path is disconnected, Shin passing It relates to an apparatus及beauty communications system.

  For example, in encrypted communication using a secure protocol such as IPsec, an IPsec tunnel, which is a virtual encrypted communication path, exchanges and shares security association (SA) information such as an encryption method and an encryption key before starting encrypted communication. Establish. IPsec is a secure protocol that performs encryption and authentication at the IP level (network layer). SA information in IPsec is negotiated by IKE (Internet Key Exchange) which is a key exchange protocol. In IPsec, when negotiation is completed, encrypted communication through an IPsec tunnel is possible. Patent Document 1 describes an example of encrypted communication using IPsec.

  By the way, a terminal that has established an IPsec tunnel with another terminal sometimes loses SA information due to a power cut or the like. In this case, other terminals that have not lost the SA information recognize that the IPsec tunnel remains established. Accordingly, other terminals that have not lost the SA information try to perform encrypted communication using the IPsec tunnel even after the terminal of the encryption communication partner has lost the SA information.

  On the other hand, even if a terminal that has lost SA information receives encrypted data via an IPsec tunnel, there is a problem that the encrypted data cannot be decrypted because SA information has been lost. Conventionally, in cryptographic communication using an IPsec tunnel, if any of the terminals that have established the IPsec tunnel loses SA information, it is necessary to negotiate again with the IKE key exchange protocol. There was a problem of hanging.

The present invention has been made in view of the above, when the communication path is disconnected, communication path restoration method capable of rapidly ascribed recover the communication path, communication devices及beauty communications system The purpose is to provide.

To solve the above problems, the present invention provides a communication path restoration method Ru was ascribed restore the previous SL communications path when the communication path established in the communication system is disconnected, the first terminal information storage step the information necessary to use the pre-Symbol communications path is stored in said first terminal and a second terminal when establishing the previous SL communications path between the second terminal And an information registration step in which at least one of the first terminal or the second terminal registers the information in a management device other than the first terminal and the second terminal; the first terminal; when at least one of the information of the the terminal are stored is unavailable, when the recovery to recover availability information included in the information registered Previous Symbol management device is specified, using the information and having a front Symbol communication communication path restoration step of Ru a signal path was attributed condensate

  In addition, what applied the component, expression, or arbitrary combination of the component of this invention to a method, an apparatus, a system, a computer program, a recording medium, a data structure, etc. is also effective as an aspect of this invention.

According to the present invention, when the communication path is disconnected, communication path restoration method capable of rapidly ascribed recover the communication path, it is possible to provide a communication device及beauty communications system.

It is a block diagram of an example of the encryption communication system by this invention. It is a functional diagram of an example of the encryption communication system by this invention. It is a hardware block diagram of an example of a terminal. It is a sequence diagram of an example showing the processing procedure when SA information is lost in the cryptographic communication system according to the present invention. 3 is a schematic diagram illustrating an example of SA information of a terminal 1. FIG. 4 is a schematic diagram illustrating an example of SA information of a terminal 2. FIG. It is a flowchart of an example showing the process sequence when SA information lose | disappears in the encryption communication system by this invention. It is a sequence diagram of the other example showing the process sequence when SA information lose | disappears in the encryption communication system by this invention.

  Next, the best mode for carrying out the present invention will be described based on the following embodiments with reference to the drawings. In this embodiment, IPsec, which is a secure protocol, is described as an example, but L2TP (Layer2 Tunneling Protocol), which is a protocol for establishing a virtual communication path (tunnel), and protocol for performing cryptographic communication. Application to SSL (Secure Socket Layer) is also possible. For example, in SSL, the secret key and the encryption key correspond to the SA information of IPsec.

  FIG. 1 is a block diagram of an example of a cryptographic communication system according to the present invention. In the cryptographic communication system of FIG. 1, a plurality of terminals 1 and 2 and an SA (security association) management server 3 are communicably connected to a public network 4 such as a LAN or the Internet. Note that the terminal 1 and the terminal 2 are a PC, a multifunction machine, or the like capable of encrypted communication using IPsec.

  When starting encryption communication using IPsec, the terminals 1 and 2 negotiate to exchange and share SA information such as an encryption method and an encryption key (IKE phase), and establish an IPsec tunnel 5. When the IPsec tunnel 5 is established, the terminals 1 and 2 start encrypted communication using the IPsec tunnel 5 (IPsec phase).

  The SA management server 3 manages SA information registered as described later from one or both of the terminals 1 and 2. The SA management server 3 provides SA information to either one or both of the inquiry source terminals 1 and 2 when there is an inquiry about SA information from either one or both of the terminals 1 and 2 as described later.

  FIG. 2 is a functional diagram of an example of a cryptographic communication system according to the present invention. The terminals 1 and 2 are configured to include an IP function unit 11 having an IPsec function unit 12, a TCP / UDP function unit 13, an IKE daemon 14, an HTTP function unit 15, and an FTP function unit 16. The IP function unit 11 having the IPsec function unit 12 is included in the network layer. The TCP / UDP function unit 13 is included in the transport layer. The IKE daemon 14, the HTTP function unit 15, and the FTP function unit 16 are included in the application layer. The HTTP function unit 15 is an example of a protocol belonging to the application layer, and may be another protocol.

  The IKE daemon 14 can record the start of encrypted communication using IPsec in addition to the confirmation and acquisition of the IPsec policy managed by the security policy database (SPD) 17 in the SPD. Although FIG. 2 shows an example in which the SPD is realized by the external storage devices of the terminals 1 and 2, the SPD may be realized by an internal storage device (for example, an auxiliary storage device) of the terminals 1 and 2.

  The IKE daemon 14 of the terminals 1 and 2 performs negotiation for exchanging and sharing SA information such as an encryption method and an encryption key in accordance with an IKE standard procedure. Terminals 1 and 2 store SA information in a RAM as a main storage device. As described above, since the SA information exists on the RAMs of the terminals 1 and 2, the SA information is lost when the terminals 1 and 2 are powered off.

  The SA management server 3 is configured to include an SA information registration daemon 21 and an SA information search daemon 22. The SA information registration daemon 21 registers SA information requested to be stored from either one or both of the terminals 1 and 2 in the SA information management database 23. Although FIG. 2 shows an example in which the SA information management database 23 is realized by an external storage device of the SA management server 3, it may be realized by an internal storage device (for example, an auxiliary storage device) of the SA management server 3. The SA information search daemon 22 searches the SA information management database 23 for SA information requested to be searched from either one or both of the terminals 1 and 2.

  Next, a hardware configuration when the terminals 1 and 2 are PCs will be briefly described. FIG. 3 is a hardware configuration diagram of an example of a terminal.

  The terminals 1 and 2 are configured to include an input device 31, an output device 32, a drive device 33, an auxiliary storage device 34, a main storage device 35, an arithmetic processing device 36, and an interface device 37 connected to each other via a bus B. Is done.

  The input device 31 includes a keyboard and a mouse, and is used for inputting various information. The output device 32 includes a display device and is used to display various windows, data, and the like. The interface device 37 includes a modem, a LAN card, and the like, and is used for connecting to the public network 4.

  Various programs for controlling the terminals 1 and 2 are provided by, for example, distribution of the recording medium 38 or downloading from the public network 4. The recording medium 38 on which various programs are recorded is a recording medium such as a CD-ROM, a flexible disk, a magneto-optical disk, etc. for recording information optically, electrically or magnetically, a ROM, a flash memory, etc. Various types of recording media such as a semiconductor memory for electrical recording can be used.

  When the recording medium 38 on which various programs are recorded is set in the drive device 33, the various programs are installed from the recording medium 38 to the auxiliary storage device 34 via the drive device 33. Various programs downloaded from the public network 4 are installed in the auxiliary storage device 34 via the interface device 37.

  The auxiliary storage device 34 stores various installed programs and files, data, and the like necessary for executing the various programs. The main storage device 35 reads and stores various programs from the auxiliary storage device 34 when the computer is activated. The arithmetic processing unit 36 implements various processes as described later in accordance with various programs stored in the main storage device 35.

  FIG. 4 is a sequence diagram illustrating an example of a processing procedure when SA information is lost in the cryptographic communication system according to the present invention. In step S1, the terminal 2 acquires the IPsec policy addressed to the terminal 1 managed by the SPD 17 of the terminal 2 itself. The terminal 2 proceeds to step S2 and transmits an IPsec start request corresponding to the IPsec policy addressed to the terminal 1 to the terminal 1.

  When receiving the IPsec start request from the terminal 2, the terminal 1 proceeds to step S3, and searches for an IP policy addressed to the terminal 2 managed by the SPD 17 of its own terminal. If the IP policy addressed to the terminal 2 is retrieved from the SPD, the terminal 1 proceeds to step S4, and transmits an IPsec start acceptance corresponding to the IPsec policy addressed to the terminal 2 to the terminal 2.

  By the processing up to step S4, the SA information shown in FIGS. 5 and 6 is stored in the RAM as the main storage device 35 in the terminals 1 and 2. FIG. 5 is a schematic diagram showing an example of SA information of the terminal 1. FIG. 6 is a schematic diagram showing an example of SA information of the terminal 2.

  The SA information in FIGS. 5 and 6 includes items (Field) and values (Value). The items include ID, src, dst, mode, protocol, direction, SPI, auth key, encrypt key, and recovery.

  The item “ID” is a unique identifier for management by the SA management server 3. The item “src” is a source IP address. The item “dst” is a destination IP address. The item “mode” specifies either “transport mode” or “tunnel mode”. The item “protocol” designates a protocol that provides an encryption function. The item “direction” is used to specify the input / output direction viewed from the own terminal.

  The item “SPI” is an identifier for managing SA information called a security parameter index. The item “auth key” represents an authentication key. The item “encrypt key” represents an encryption key. The item “recovery” is a recovery enable / disable flag specifying whether or not SA information can be recovered.

  In step S5, the terminal 2 transmits to the SA management server 3 an SA information registration request for storing SA information as shown in FIG. When receiving the SA information registration request, the SA management server 3 proceeds to step S6 and registers the SA information in the SA information management database 23.

  4 represents an example in which the terminal 2 registers the SA information in the SA information management database 23. However, the terminal 1 may register the SA information in the SA information management database 23. 1 and 2 may register SA information in the SA information management database 23. As is clear from the SA information in FIGS. 5 and 6, if at least one SA information of the terminal 1 and the terminal 2 is known, the other SA information can be created.

  The terminals 1 and 2 record the start of encrypted communication using IPsec in the SPD 17 of their own terminals. In step S 7, the terminal 2 transmits the encrypted IPsec packet to the terminal 1 via the established IPsec tunnel 5. In step S8, the terminal 1 decodes the received IPsec packet based on the SA information in FIG. The terminal 1 then responds to the IPsec packet received from the terminal 2 in step S7.

  After step S8, the terminal 1 is assumed to have been powered off. In step S 9, the terminal 2 transmits the encrypted IPsec packet to the terminal 1 via the established IPsec tunnel 5. At this time, since the terminal 1 is in a power-off state, the terminal 1 cannot receive the IPsec packet and respond to the IPsec packet.

  If a predetermined time elapses from step S9 without receiving a response to the IPsec packet, the terminal 2 proceeds to step S10, and retransmits the IPsec packet transmitted to the terminal 1 in step S9. However, since the terminal 1 is in a power-off state, the terminal 1 cannot receive an IPsec packet and make a response to the IPsec packet.

  After step S10, the terminal 1 is assumed to be turned on. When a predetermined time has elapsed from step S10 without receiving a response to the IPsec packet, the terminal 2 proceeds to step S11, and retransmits the IPsec packet transmitted to the terminal 1 in steps S9 and S10.

  However, since the terminal 1 establishes the IPsec tunnel 5 with the terminal 2 and then the power is turned off, the SA information stored in the RAM is lost. Therefore, the terminal 1 cannot decode the received IPsec packet.

  Therefore, the terminal 1 proceeds to step S12, confirms the SPD 17 of its own terminal, and determines whether the start of encrypted communication with the terminal 2 using IPsec is recorded. If the start of encrypted communication with the terminal 2 using IPsec is recorded in the SPD 17, the terminal 1 proceeds to step S 13 and determines that the encrypted communication was performed with the terminal 2 before the power was turned off. The SA management server 3 is inquired about the SA information of its own terminal.

  If the start of encrypted communication with the terminal 2 using IPsec is not recorded in the SPD 17, the terminal 1 determines that it has not performed encrypted communication with the terminal 2 before the power is turned off. The IPsec packet received from 2 is discarded.

  In step S 14, the SA management server 3 searches the SA information management database 23 for SA information inquired from the terminal 1. In step S 15, the SA management server 3 reads the SA information of the searched terminal 1 from the SA information management database 23 and transmits it to the terminal 1.

  The terminal 1 refers to the item “recovery” of the received SA information, and if recovery is specified for whether or not the SA information can be recovered, the terminal 1 stores the SA information in the RAM and performs SA recovery processing to make it usable. Thereafter, the terminal 1 decodes the IPsec packet received in step S11 based on the restored SA information of FIG. Terminal 1 then responds to the IPsec packet received from terminal 2 in step S11.

  When terminals 1 and 2 end encryption communication using IPsec, they are recorded in the SPD 17 of their own terminals so that the end of encryption communication using IPsec can be recognized.

  FIG. 7 is a flowchart illustrating an example of a processing procedure when SA information is lost in the cryptographic communication system according to the present invention.

  In step S22, the terminal 2 receives a packet transmission request addressed to the terminal 1. In step S22, the terminal 2 searches for and acquires an IPsec policy addressed to the terminal 1 managed by the SPD 17 of the terminal 2 itself. In step S23, the terminal 2 transmits an IPsec start request corresponding to the IPsec policy addressed to the terminal 1 to the terminal 1.

  In step S24, the terminal 1 is waiting for an IPsec start request. When receiving the IPsec start request from the terminal 2, the terminal 1 proceeds from step S24 to step S25, and searches for the IP policy addressed to the terminal 2 managed by the SPD 17 of the own terminal.

  If the IP policy addressed to terminal 2 is retrieved from the SPD (YES in S26), terminal 1 proceeds to step S27, and transmits an IPsec start acceptance corresponding to the IPsec policy addressed to terminal 2 to terminal 2. If the IP policy addressed to terminal 2 is not retrieved from the SPD (NO in S26), terminal 1 returns to step S24 and waits for the next IPsec start request.

  By the processing up to step S27, the SA information shown in FIGS. 5 and 6 is stored in the RAM as the main storage device 35 in the terminals 1 and 2. In step S28, the terminal 2 is waiting for IPsec start acceptance. When receiving the IPsec start acceptance from the terminal 1, the terminal 2 proceeds from step S28 to step S29, and transmits to the SA management server 3 an SA information registration request for storing SA information as shown in FIG. To do.

  In step S30, the SA management server 3 waits for a request from the terminal 1 or 2. When the SA information registration request is received from the terminal 2, the SA management server 3 proceeds from step S30 to step S31, and registers the SA information in the SA information management database 23. In step S32, the SA management server 3 again waits for a request from the terminal 1 or 2.

  In step S33, the terminal 1 records the start of encrypted communication with the terminal 2 using IPsec in the SPD 17 of its own terminal. On the other hand, in step S34, the terminal 2 records the start of encrypted communication with the terminal 1 using IPsec in the SPD 17 of its own terminal.

  In step S 35, the terminal 2 transmits the encrypted IPsec packet to the terminal 1 through the established IPsec tunnel 5. In step S36, the terminal 1 decodes the received IPsec packet based on the SA information in FIG. Terminal 1 then responds to the IPsec packet received from terminal 2.

  After step S36, the terminal 1 is powered off. In step S 37, the terminal 2 transmits the encrypted IPsec packet to the terminal 1 through the established IPsec tunnel 5. At this time, since the terminal 1 is in a power-off state, the terminal 1 cannot receive the IPsec packet and respond to the IPsec packet.

  After step S37, the terminal 1 is turned on. When a predetermined time elapses from step S37 without receiving a response to the IPsec packet, the terminal 2 proceeds to step S38, and retransmits the IPsec packet transmitted to the terminal 1 in step S37. In step S39, the terminal 1 waits for an IPsec start request.

  When an encrypted IPsec packet is received from the terminal 2 via the established IPsec tunnel 5, the terminal 1 tries to read SA information from the RAM. However, since the SA information is not stored in the RAM, the terminal 1 proceeds from step S39 to step S40, confirms the SPD 17 of its own terminal, and searches whether the start of encrypted communication with the terminal 2 using IPsec is recorded. To do.

  If the start of encrypted communication with terminal 2 using IPsec is recorded in SPD 17 (YES in S41), terminal 1 proceeds to step S42 and performs encrypted communication with terminal 2 before the power is turned off. It is determined that it has been performed, and the SA management server 3 is inquired about the SA information of its own terminal.

  If the start of encrypted communication with the terminal 2 using IPsec is not recorded in the SPD 17 (NO in S41), the terminal 1 has not performed encrypted communication with the terminal 2 before the power is turned off. After discarding the IPsec packet received from the terminal 2, the process returns to step S39 and waits for an IPsec start request.

  In step S 43, the SA management server 3 searches the SA information management database 23 for the SA information inquired from the terminal 1. Then, the SA management server 3 reads the searched SA information of the terminal 1 from the SA information management database 23 and transmits it to the terminal 1.

  In step S44, the terminal 1 refers to the item “recovery” of the SA information received from the SA management server 3. If recovery is specified in the recovery possibility of SA information, the terminal 1 determines that the recovery of SA information is necessary, and proceeds to step S45. In step S45, the terminal 1 performs SA restoration processing for storing the SA information in the RAM and making it usable.

  Thereafter, the terminal 1 decodes the IPsec packet received in step S38 based on the restored SA information of FIG. Then, the terminal 1 proceeds to step S46, and makes a response to the IPsec packet received from the terminal 2 in step S38. When terminals 1 and 2 end encryption communication using IPsec, they are recorded in the SPD 17 of their own terminals so that the end of encryption communication using IPsec can be recognized.

  FIG. 8 is a sequence diagram of another example showing a processing procedure when SA information is lost in the cryptographic communication system according to the present invention. In addition, since the process of step S51-S58 is the same as that of step S1-S8 of FIG. 4, description is abbreviate | omitted.

  After step S58, it is assumed that the terminal 2 is once turned off and then turned on again. Terminal 2 receives a packet transmission request addressed to terminal 1. However, since the terminal 2 establishes the IPsec tunnel 5 with the terminal 1 and then the power is turned off, the SA information stored in the RAM is lost.

  Therefore, the terminal 2 proceeds to step S59, confirms the SPD 17 of the own terminal, and determines whether the start of encrypted communication with the terminal 1 using IPsec is recorded. If the start of encrypted communication with the terminal 1 using IPsec is recorded in the SPD 17, the terminal 2 proceeds to step S60 and determines that the encrypted communication was performed with the terminal 1 before the power was turned off. The SA management server 3 is inquired about the SA information of its own terminal.

  Note that if the start of encrypted communication with the terminal 1 using IPsec is not recorded in the SPD 17, the terminal 2 determines that the encrypted communication with the terminal 1 was not performed before the power was turned off, and the terminal Discard packets addressed to 1.

  In step S 61, the SA management server 3 searches the SA information management database 23 for SA information inquired from the terminal 2. In step S62, the SA management server 3 reads the SA information of the searched terminal 2 from the SA information management database 23 and transmits it to the terminal 2.

  The terminal 2 refers to the item “recovery” of the received SA information, and if recovery is specified for whether or not the SA information can be recovered, performs SA recovery processing for storing the SA information in the RAM and making it usable.

  The terminal 2 encrypts the IPsec packet based on the restored SA information of FIG. 6 and transmits it to the terminal 1 via the IPsec tunnel 5. Then, the terminal 1 makes a response to the IPsec packet received from the terminal 2 in step S63.

  When terminals 1 and 2 end encryption communication using IPsec, they are recorded in the SPD 17 of their own terminals so that the end of encryption communication using IPsec can be recognized.

  In the cryptographic communication system according to the present invention, even if SA information is lost due to a power failure or the like, the start of cryptographic communication using IPsec is recorded in the SPD of the terminal itself, and the SA information is stored in the SA management server 3. Thus, when the IPsec tunnel 5 is disconnected, the IPsec tunnel 5 can be automatically returned quickly and without being negotiated again by IKE.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

DESCRIPTION OF SYMBOLS 1, 2 Terminal 3 SA (security association) management server 4 Public network 5 IPsec tunnel 11 IP function part 12 IPsec function part 13 TCP / UDP function part 14 IKE daemon 15 HTTP function part 16 FTP function part 17 Security policy database (SPD)
21 SA Information Registration Daemon 22 SA Information Search Daemon 23 SA Information Management Database 31 Input Device 32 Output Device 33 Drive Device 34 Auxiliary Storage Device 35 Main Storage Device 36 Arithmetic Processing Device 37 Interface Device 38 Recording Medium B Bus

Japanese Patent Laid-Open No. 2003-115834

Claims (7)

A communication path return method for returning the communication path when the communication path established in the communication system is disconnected,
Information storage for storing information necessary for using the communication path when the communication path is established between the first terminal and the second terminal in the first terminal and the second terminal Steps,
An information registration step in which at least one of the first terminal and the second terminal registers the information in a management device other than the first terminal and the second terminal;
When at least one of the information stored in the first terminal and the second terminal is unusable, when recovery is specified in the recovery availability information included in the information registered in the management device, A communication path return method comprising: a communication path return step for returning the communication path using the information. When the communication path is established between the first terminal and the second terminal, further comprising a communication start recording step of recording the start of communication through the communication path in a nonvolatile storage means,
The communication path return step receives data using the communication path from the second terminal after the information of the first terminal becomes unusable, and the non-volatility of the first terminal 2. The information processing apparatus according to claim 1, wherein when the start of communication through the communication path is recorded in the storage unit, the first terminal in which the information becomes unusable reads the information from the management device. Communication path return method. When the communication path is established between the first terminal and the second terminal, further comprising a communication start recording step of recording the start of communication through the communication path in a nonvolatile storage means,
In the communication path return step, the second terminal transmits data using the communication path from the second terminal to the first terminal after the information of the second terminal becomes unusable. If the start of communication through the communication path is recorded in the non-volatile storage means of the terminal, the second terminal in which the information becomes unusable reads the information from the management device. The communication path return method according to claim 1.   2. The communication path restoration method according to claim 1, wherein the information necessary for using the communication path is information on authentication and encryption negotiated using a key exchange protocol.   2. The communication path restoration method according to claim 1, wherein the communication path is established using a secure protocol that performs authentication and encryption in a network layer. A communication device for returning the communication path when the communication path established in the communication system is disconnected,
Information storage means for storing information necessary to use the communication path when the communication path is established with a communication partner terminal;
Information registration means for registering the information in a management device other than the communication partner terminal;
When the information stored in the information storage means is unusable, when the restoration is specified in the restoration availability information included in the information registered in the management device, the communication path is restored using the information. A communication device having communication path return means. A communication system for returning the communication path when the established communication path is disconnected,
Information storage for storing information necessary for using the communication path when the communication path is established between the first terminal and the second terminal in the first terminal and the second terminal Means,
Information registration means for registering at least one of the first terminal and the second terminal with a management device other than the first terminal and the second terminal;
When at least one of the information stored in the first terminal and the second terminal is unusable, when recovery is specified in the recovery availability information included in the information registered in the management device, A communication system comprising: a communication path returning means for returning the communication path using the information.

Images