JP2003110603A - Packet processing apparatus and its packet processing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a packet processing apparatus capable of reserving a required minimum memory area and efficiently transferring packet processing information to respective units in the apparatus. SOLUTION: This invention is based on the premise of a packet processing apparatus where a packet processing section transceives a packet, that is subjected to at least one of encryption/decoding/authentication processing by an encryption authentication processing section on the basis of packet processing information managed by a packet processing information management section, from/to an opposed apparatus connected to the packet processing apparatus via a network. The packet processing information management section manages the packet processing information comprising communication protocol independent information independently of the communication protocol and communication protocol dependent information depending on only the communication protocol used at present.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a packet processing device that processes a packet.

[0002]

2. Description of the Related Art In recent years, it has become possible to provide information and collect information easily and at low cost by using a home page published on the Internet. Also, exchange of electronic mails via the Internet and electronic commerce using the Internet are becoming popular.

Here, when communicating important information such as electronic commerce, security must be ensured. Therefore, recently, IPSec (Internet Protocol Se
curityProtocol) is attracting attention. This IPSec is an OSI reference model (Open System Interconnection r
This is a security protocol that performs authentication / encryption at the network layer, which is the third layer of the eference model).

A VPN (Virtual Private Network) can be constructed by connecting to the Internet via a computer or a router equipped with the above-mentioned IPSec function (hereinafter, these are collectively referred to simply as "packet processing device"). . That is, the user of the packet processing device can safely use the Internet without being aware of the type of network (whether it is a public network or a dedicated network).

[0005]

By the way, the above IPS
In ec, it is necessary to manage information such as what kind of authentication algorithm or encryption algorithm is used and what kind of encryption key is used. These parameters are SA (Security Associatio).
n) has become part of the logical connection. This SA is information required for each logical connection that needs security, and its configuration is shown in FIG.
It will be described according to 0.

That is, the information stored in the packet processing information database 30 as the SA (hereinafter referred to as "packet processing information") 31 is the communication protocol independent information 31-1 which does not depend on the communication protocol and the communication which depends on the communication protocol. It is roughly divided into protocol-dependent information 31-2 to 4-4. Furthermore, this communication protocol dependent information 31-
2 to 4 are referred to as communication protocol A dependence information 31-2 depending on communication protocol A, communication protocol B dependence information 31-3 depending on communication protocol B, and communication protocol C dependence information 31-4 depending on communication protocol C. As such, it depends on the type of communication protocol. Details of these pieces of information will be described later.

However, conventionally, all the communication protocol dependence information 31-2 to 4 are always provided regardless of the presence or type of the communication protocol actually used, and the necessary communication protocol dependence information is included from among them. The method of using selectively was adopted.

If such a method is adopted, for example, even when the communication protocol currently used is only the communication protocol A, it is used only by the communication protocol B dependent information 31-3 and the communication protocol C used only by the communication protocol B. The communication protocol C dependent information 31-4 to be stored is also stored in the packet processing information database 30. That is, according to the above-mentioned conventional method, there is a problem that an unnecessary memory area is secured in order to store the communication protocol dependence information which is not actually used.

Further, when processing a packet, the packet processing information is transferred between each means in the device. Therefore, in the above-mentioned conventional method, even communication protocol-dependent information that is not actually used is transferred, and there is a problem that efficiency is poor.

The present invention has been proposed based on the above conventional circumstances, and it is possible to secure a minimum required memory area, and packet processing information is provided between each means in the device. It is an object of the present invention to provide a packet processing device capable of efficiently transferring packets.

[0011]

The present invention employs the following means in order to achieve the above object. That is, according to the present invention, a packet in which at least one of encryption processing, decryption processing, and authentication processing is performed by the encryption authentication processing unit based on the packet processing information managed by the packet processing information management unit is transmitted via a network. It is premised on a packet processing device in which a packet processing unit transmits / receives to / from a connected opposite device.

Here, the packet processing information management unit is
Packet management information consisting of communication protocol-independent information that does not depend on the communication protocol and communication protocol-dependent information that depends only on the communication protocol that is currently used is managed.

With this configuration, there is no problem that an unnecessary memory area is reserved for storing the packet processing information that is not actually used. Further, since the packet processing information which is not actually used is not transferred between the respective means in the device, the processing speed can be increased.

The communication protocol dependent information includes cryptographic communication protocol dependent information that depends on the cryptographic communication protocol, authentication communication protocol dependent information that depends on the authentication communication protocol, and communication mode dependent information that depends on the communication mode. .

[0015]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in detail below with reference to the drawings.

The "packet processing device" referred to below
Terms such as “packet processing information” and “packet processing information database” are as described in the above-mentioned section of the prior art, and therefore detailed description thereof is omitted here. Further, in the following description, when focusing on one of the packet processing devices on the transmission side and the reception side, the other packet processing device is referred to as an “opposite device”. (Embodiment 1) FIG. 1 is a block diagram of a packet processing device to which the present invention is applied, and its configuration will be described below together with its operation.

First, when a packet arrives from the communication path 11, the packet processing unit 1 issues an acquisition request for packet processing information corresponding to this packet to the packet processing information management unit 3.

As a result, the packet processing information management unit 3
Is a packet processing information database 3 provided therein.
The packet processing information corresponding to the packet is searched from 0 (details will be described later), and the packet processing information thus searched is returned to the packet processing unit 1.

Next, the packet processing unit 1 processes the packet based on the packet processing information. At this time, if it is necessary to perform encryption or decryption processing, authentication processing, or both of them (hereinafter, may be simply referred to as “encryption authentication processing”), this packet and packet processing information are subjected to encryption authentication processing. Deliver to Part 2.

On the other hand, if it is not necessary to perform the cryptographic authentication process, the packet processing unit 1 transmits this packet to the opposite device through the communication path 11. Needless to say, whether or not the cryptographic authentication process is required depends on whether or not the information related to the cryptographic authentication process is included in the packet processing information.

As a result, the cryptographic authentication processing section 2 performs cryptographic authentication processing on the packet based on the packet processing information, and then returns the processed packet to the packet processing section 1. The packet thus returned to the packet processing unit 1 is transmitted to the opposite device by the packet processing unit 1 through the communication path 11.

By the way, as described with reference to FIG. 10, conventionally, all the communication protocol dependent information 3 is always irrespective of the presence or absence of the communication protocol currently used and its type.
1-2 to 4 are provided, and a method of selectively using necessary communication protocol dependent information from among them is adopted.

If such a method is adopted, even if the communication protocol currently used is only the communication protocol A, the communication protocol B used only by the communication protocol B is used.
The dependency information 31-3 and the communication protocol C dependency information 31-4 used only in the communication protocol C are also stored in the packet processing information database 30. That is,
According to the above-mentioned conventional method, there is a problem that an unnecessary memory area is secured in order to store the communication protocol dependence information which is not actually used.

In order to explain this point in more detail, the communication protocol independent information 31-1 is 64 units, the communication protocol A dependent information 31-2 is 16 units, and the communication protocol B dependent information 31-3 is 32 units. A case where the unit and the communication protocol C dependence information 31-4 are 48 units will be exemplified.
It should be noted that the unit referred to here is a unit for indicating the size of information, such as bytes.

First, according to the above-mentioned conventional method, 32 units of communication protocol B dependence information 3 which are not actually used are used.
Communication protocol C dependency information 31-4 in units of 1-3 and 48
An unnecessary memory area of 32 + 48 = 80 units is reserved for storing and.

When processing a packet, the packet processing information is transferred from the packet processing information management section 3 to the packet processing section 1, and further from the packet processing section 1 to the cryptographic authentication processing section 2. Therefore, in the above-mentioned conventional method, even 80 units of the communication protocol dependent information 31-3 and 31-4 which are not actually used are transferred, and there is a problem that the efficiency is low.

Therefore, in the present invention, the following method is adopted to solve the above problem.

That is, similar to the above, if the currently used communication protocol is only the communication protocol A, the communication protocol B dependence information 31-3 and the communication protocol C dependence information 31-4 are unnecessary. Therefore, in such a case, the packet processing information management unit 3 according to the present invention has 64
The packet processing information (32 in FIG. 5) of 80 units is constituted by the communication protocol independent information 31-1 of unit and the communication protocol A dependent information 31-4 of 16 unit.

In this way, 32 units of communication protocol B dependence information 31-3 and 48 which are not actually used are used.
There is no problem that an unnecessary memory area is reserved for storing the unit communication protocol C dependence information 31-4. Also, these communication protocol dependent information 3
There is no need to transfer 1-3 and 31-4 from the packet processing information management unit 3 to the packet processing unit 1 and further from the packet processing unit 1 to the cryptographic authentication processing unit 2, so that the processing speed can be increased. is there.

As described above, according to the present invention, the packet processing information is composed of the communication protocol independent information that does not depend on the communication protocol and the communication protocol dependent information that depends only on the communication protocol that is actually used. The required minimum memory area can be secured, and the packet processing information can be efficiently transferred between the respective means in the device.

In the above description, simply "the packet processing unit 1 passes the packet processing information to the cryptographic authentication processing unit 2".
However, the packet processing information passed from the packet processing unit 1 to the cryptographic authentication processing unit 2 need not be the entire packet processing information. That is, even if only the portion of the packet processing information related to the cryptographic authentication processing is passed, the same effect as above can be obtained.

Although not particularly mentioned in the above description, the communication protocol dependent information is, as shown in FIG. 6, encrypted communication protocol dependent information dependent on the encrypted communication protocol and authentication dependent on the authentication communication protocol. It can be classified into communication protocol dependent information and communication mode dependent information depending on the communication mode.

The cryptographic communication protocol dependent information is information representing the cryptographic key, the cryptographic key size, the cryptographic processing block size, etc. The authentication processing protocol dependent information is the authentication key, the authentication key size, and the authentication. Information indicating a processing block size or the like, and the communication mode-dependent information is, for example, information indicating a transport mode or a tunnel mode, or information accompanying it (for example, an address of a partner terminal that establishes a tunnel). Etc. Further, the communication protocol-independent information is information indicating a source address and a destination address of a packet, and an expiration date of the packet processing information. (Embodiment 2) By the way, when processing packets related to the same connection, it is usual to use the same packet processing information many times. Therefore, the procedure of searching the packet processing information database 30 for the corresponding packet processing information every time a packet is processed as in the first embodiment is inefficient. Therefore, in the present embodiment (see FIG. 2), the following method is adopted in order to avoid such a problem.

First, when a packet arrives from the communication path 11, the packet processing unit 1 issues a request for acquiring packet processing information corresponding to this packet to the search priority information management unit 4.

As a result, the search priority information management unit 4
Is a search priority information database 41 provided therein.
A packet processing information acquisition request is issued to the packet processing information management unit 3 based on the search priority information stored in.

That is, the retrieval priority information database 4
1, the packet processing information management unit 3
Stores the search priority information of the packet processing information managed by. Therefore, the search priority information management unit 4 in this case issues a request to acquire the packet processing information 33 having the highest search priority to the packet processing information management unit 3.

The search priority information management unit 4 uses the LRU
(Least Recently Used) algorithm, etc.
Higher search priority information is dynamically set in order from the packet processing information used recently. Of course, the method of determining the search priority information is not limited to this. For example, if an algorithm for identifying frequently used packet processing information is used, it is possible to dynamically set high search priority information in order from the most frequently used packet processing information.

After that, the packet processing information management unit 3 retrieves the packet processing information from the packet processing information database 30 in the same procedure as in the first embodiment, and manages the retrieved packet processing information in the retrieval priority information. Return to Part 4. The packet processing information returned in this way is sent to the packet processing unit 1 by the search priority information management unit 4.
The packet is processed according to the same procedure as in the first embodiment.

As described above, in the present embodiment, since the search priority information of the packet processing information is managed, the trouble of repeatedly searching the packet processing information database 30 for the same packet processing information is avoided. it can. This way, you don't have to do unnecessary searches,
It goes without saying that packet processing will be speeded up.

The above-mentioned search priority information database 4
1 and the packet processing information managed by the database 41 may be held in a CPU cache memory (not shown). In this way, the packet processing information to be searched from the packet processing information database 30 can be specified by the search priority information management unit 4 in the CPU cache memory, so that the packet processing can be speeded up. be able to. (Embodiment 3) By the way, when processing packets relating to the same connection, it is usual to use the same packet processing information many times. Therefore, the procedure in which the packet processing unit 1 passes the corresponding packet processing information to the cryptographic authentication processing unit 2 every time a packet is processed as in the first embodiment is inefficient. Therefore, in the present embodiment (see FIG. 3), the following method is adopted in order to avoid such a problem.

First, the procedure until the packet processing unit 1 that has acquired the packet processing information processes a packet based on this packet processing information is the same as in the first embodiment.

In other words, the packet processing unit 1 uses the communication path 1
When the packet arrives from 1, the packet processing information management unit 3 issues an acquisition request for the packet processing information corresponding to this packet. Therefore, the packet processing information management unit 3 searches the packet processing information database 30 provided therein for packet processing information corresponding to the packet, and returns the packet processing information thus searched to the packet processing unit 1. Thereby, the packet processing unit 1 processes the packet based on the packet processing information acquired in this way.

Here, the packet processing unit 1 gives the packet processing information identifier to the packet processing information acquired as described above. The packet processing information identifier is information for uniquely identifying the packet processing information, and its specific mode is not particularly limited.

Next, the packet processing unit 1 passes this packet and its packet processing information identifier to the encryption authentication processing unit 2 if it is necessary to perform the encryption authentication process. As a result, the cryptographic authentication processing unit 2 passes the packet processing information identifier to the packet processing information cache unit 5.

Then, the packet processing information cache unit 5
Retrieves the packet processing information corresponding to the packet processing information identifier from the packet processing information cache database (see FIG. 8) provided therein and returns it to the cryptographic authentication processing unit 2. As a result, the cryptographic authentication processing unit 2 performs cryptographic authentication processing on the packet based on the packet processing information, and then returns the processed packet to the packet processing unit 1.

As described above, since the packet processing information cache unit 5 is provided in this embodiment,
It is possible to avoid the problem that the same packet processing information is repeatedly passed by the packet processing unit 1 to the cryptographic authentication processing unit 2. That is, since the packet processing information does not have to be passed from the packet processing unit 1 to the cryptographic authentication processing unit 2 (only the packet processing information identifier needs to be passed), the transfer time can be reduced accordingly, resulting in high-speed packet processing. The packet processing information stored in the packet processing information database 31 may be deleted by the user. Some of the packet processing information stored in the packet processing information database 31 may be deleted because one of the number of packets that can be processed, the amount of data that can be processed, and the expiration date is exceeded.

Therefore, when such an event occurs,
Upon detecting this, the packet processing information management unit 3 gives an instruction to the packet processing unit 1 to delete the packet processing information. Then, the packet processing information cache unit 5 that has received this instruction via the packet processing unit 1 and the cryptographic authentication processing unit 2 deletes the packet processing information from the packet processing information cache database 51 according to the instruction. .

In this way, the packet processing information database 31 and the packet processing information cache database 51 can be kept consistent. However, when the content of the packet processing information stored in the packet processing information database 31 is changed, the content of the packet processing information stored in the packet processing information cache database 51 is also changed or deleted accordingly. In addition, when new packet processing information is stored in the packet processing information database 31, this new packet processing information is stored in the packet processing information cache database 51.

However, the point that new packet processing information is stored in the packet processing information cache database 51 is not an essential requirement. That is, even if new packet processing information is stored in the packet processing information database 31, nothing is done (that is, the new packet processing information is stored in the packet processing information cache database 51).
Do not store it in). (Fourth Embodiment) Incidentally, although not particularly mentioned in the above description, in order to search the packet processing information database 30, SPD (Security Policy
y Database) to obtain the security policy information in advance. That is, the packet processing unit determines the packet processing method based on the security policy information.

The SPD (an internal structure is not shown because it is publicly known) means a database which constitutes a security policy. Further, the security policy is a regulation of access to a system in which security is ensured.

The conventional general processing procedure will be described below.

First, the packet processing means 1 uses the communication path 11
When the packet arrives from, the connection condition is generated based on this packet and is passed to the connection information management unit. Since the technique of generating the connection condition is not directly related to the present invention, detailed description will be omitted here.

Then, the connection information management unit uses the SPD (hereinafter referred to as "connection information database") provided therein to provide security policy information satisfying the connection conditions (hereinafter, the security policy information will be referred to as "connection information").
It was a general procedure to search for and return it to the packet processing unit 1. The number of pieces of connection information retrieved from the connection information database in this way is not limited to one, because the connection information simply satisfies the connection conditions.

However, when processing packets related to the same connection, the same connection information is usually used many times. Therefore, as described above, the procedure of retrieving connection information from the connection information database every time a packet is processed is inefficient. Therefore, in the present embodiment (see FIG. 4), the following method is adopted to avoid such a problem.

First, when a packet arrives from the communication path 11, the packet processing section 1 generates a connection condition based on this packet and passes it to the connection condition connection information management section 6.

As a result, the connection condition connection information management unit 6 manages the connection information acquisition request based on the search priority information stored in the connection condition connection information database 61 provided therein. Issue to Part 7.

That is, in the connection information connection information database 61, as shown in FIG. 9, search priority information (61 → 62 → ...) Of connection information managed by the connection information management unit 7.
→ Higher in order of 6N) is stored. Therefore, in this case, the connection condition connection information management unit 6 determines that the connection information 61-1 and 6 satisfy the connection condition 61 with the highest search priority.
The acquisition request 1-2 is issued to the connection information management unit 7.

Further, as described above, the number of pieces of connection information retrieved from the connection information database is not limited to one, because the connection information simply satisfies the connection conditions. Therefore, as shown in FIG. 9, the connection condition connection information database 61 does not manage connection conditions and connection information on a one-to-one basis, but on a one-to-many basis (that is, a connection condition that satisfies connection conditions). It is preferable to manage all the information (for each connection condition).

The connection condition connection information management unit 6 is L
By using a RU (Least Recently Used) algorithm or the like, high search priority information is dynamically set in order from the recently used connection information. Of course, the method of determining the search priority information is not limited to this. For example, if an algorithm for identifying frequently used connection information is used, it is possible to dynamically set high search priority information in order from the most frequently used connection information.

After that, the connection information management section 7 uses the connection information database 70 provided therein to read the connection information 61.
-1 and 61-2 are retrieved and returned to the connection condition connection information management unit 6. Then, the connection information 61- returned in this way
1 and 61-2 are passed to the packet processing unit 1 by the connection condition connection information management unit 6, and the packet processing information database 30 is searched by the same procedure as in the first embodiment.

As described above, in this embodiment, since the search priority information of the connection information is managed, it is possible to avoid the problem that the same connection information is repeatedly searched from the connection information database. Needless to say, this makes it possible to speed up packet processing because unnecessary searches are not required.

Here, when the connection information stored in the connection information database 70 is deleted by the user,
Upon detecting this, the connection information management unit 7 gives an instruction to the connection condition connection information management unit 6 to delete the connection information.
Then, the connection condition connection information management unit 6 that has received this instruction deletes the connection information from the connection condition connection information database 61 in accordance with the instruction. It is preferable that the connection information to be deleted in this way is not only the connection information deleted by the user but all connection information having the same connection condition as this connection information.

By doing so, it is possible to maintain consistency between the connection condition connection information database 61 and the connection information database 70. However, when the content of the connection information stored in the connection information database 70 is changed, the connection condition connection information database 61 is accordingly changed.
If the connection information database 70 stores new connection information, the new connection information will be changed to the connection information connection information database. It will be stored in 61.

The connection condition connection information database 61 and the connection information managed by the database 61 may be held in the CPU cache memory. By doing so, the connection information to be searched from the connection information database 70 can be specified by the connection condition connection information management unit 6 on the CPU cache memory, so that the packet processing can be further speeded up. You can

[0065]

As described above, according to the present invention, the packet processing information is constructed from the communication protocol independent information that does not depend on the communication protocol and the communication protocol dependent information that depends only on the communication protocol that is actually used. Therefore, the minimum necessary memory area can be secured, and the packet processing information can be efficiently transferred between the respective means in the device.

Further, since the search priority information of the packet processing information is managed, it is possible to avoid the trouble that the same packet processing information is repeatedly searched from the packet processing information database. Needless to say, this makes it possible to speed up packet processing because unnecessary searches are not required.

Furthermore, since the packet processing information cache unit is provided, it is possible to avoid the problem that the same packet processing information is repeatedly passed to the encryption authentication processing unit by the packet processing unit. That is, since the packet processing information does not have to be passed from the packet processing unit to the cryptographic authentication processing unit (only the packet processing information identifier needs to be passed), the transfer time can be reduced accordingly, resulting in faster packet processing. be able to.

In addition, since the search priority information of the connection information is managed, it is possible to avoid the problem that the same connection information is repeatedly searched from the connection information database. This way, you don't have to do unnecessary searches,
It goes without saying that packet processing will be speeded up.

[Brief description of drawings]

FIG. 1 is a block diagram of a packet processing device according to a first embodiment.

FIG. 2 is a block diagram of a packet processing device according to a second embodiment.

FIG. 3 is a block diagram of a packet processing device according to a third embodiment.

FIG. 4 is a block diagram of a packet processing device according to a fourth embodiment.

FIG. 5 is a diagram showing an internal configuration example of a packet processing information database according to the present invention.

FIG. 6 is a diagram showing an internal configuration example of a packet processing information database according to the present invention.

FIG. 7 is a diagram showing an internal configuration example of a search priority information database according to the present invention.

FIG. 8 is a diagram showing an internal configuration example of a packet processing information cache database according to the present invention.

FIG. 9 is a diagram showing an internal configuration example of a connection information connection information database according to the present invention.

FIG. 10 is a diagram showing an example of the internal configuration of a conventional packet processing information database.

[Explanation of symbols]

1 Packet processing unit 2 Cryptographic authentication processing unit 3 Packet processing information management unit 4 Search Priority Information Management Department 5 Packet processing information cache unit 6 Pair connection condition Connection information management unit 7 Connection Information Management Department 11 communication channels 30 Packet processing information database 40 Search Priority Information Database 50 Packet processing information cache database 60 pair connection condition connection information database 70 Connection information database

   ─────────────────────────────────────────────────── ─── Continued front page    F-term (reference) 5K030 GA01 GA06 HA08 HC01 JT03                       KA02 LD19                 5K034 AA05 EE11 FF01 FF02 HH63                       JJ24 MM21

Claims (8)

[Claims] 1. A packet, to which a cryptographic authentication processing unit has performed at least one of encryption processing, decryption processing, and authentication processing based on packet processing information managed by a packet processing information management unit, is connected via a network. In the packet processing device that the packet processing unit transmits / receives to / from the opposite device, the packet processing information management unit is a communication protocol independent information that does not depend on the communication protocol and a communication protocol that depends only on the communication protocol that is actually used. A packet processing device characterized by managing packet processing information including dependency information. 2. The communication protocol dependent information comprises cryptographic communication protocol dependent information dependent on the cryptographic communication protocol, authentication communication protocol dependent information dependent on the authentication communication protocol, and communication mode dependent information dependent on the communication mode. The packet processing device according to claim 1. 3. A search priority information management unit for managing search priority information of packet processing information managed by the packet processing information management unit, wherein the packet processing unit is the search priority information management unit. 3. The packet processing information is acquired from the packet processing information management unit based on the search priority information to be managed.
The packet processing device according to 1. 4. A packet processing information cache unit that holds packet processing information managed by the packet processing information management unit, wherein the cryptographic authentication processing unit stores the packet processing information in the packet processing information cache unit. Cryptographic processing based on
The packet processing device according to claim 1, wherein at least one of the decryption process and the authentication process is performed on the packet. 5. A packet processing information managed by the packet processing information management unit can be deleted, changed, or added, or a packet corresponding to the packet processing information managed by the packet processing information management unit can be processed. The packet processing device according to claim 4, wherein when any of the number, the amount of processable data, and the expiration date is exceeded, the packet processing information held by the packet processing information cache unit is deleted, changed, or added according to the excess. . 6. A connection information management unit that manages connection information satisfying the connection conditions for each connection condition, and search priority information of the connection information managed by the connection information management unit, as well as all connection information satisfying the connection conditions. And a connection condition connection information management unit that manages the connection condition for each connection condition, wherein the packet processing unit determines a packet processing method based on connection information managed by the connection condition connection information management unit. Alternatively, the packet processing device according to item 2. 7. When the connection information managed by the connection information management section is deleted, changed, or added, the connection information managed by the connection condition connection information management section is deleted, changed, or The packet processing device according to claim 6, which is added. 8. Cryptographic processing based on packet processing information
In a packet processing method of a packet processing device for transmitting / receiving a packet, which has been subjected to at least one of decryption / authentication processing, to / from an opposite device connected via a network, a communication protocol non-dependent on a communication protocol A packet processing method comprising: managing packet processing information including dependency information and communication protocol dependency information that depends only on a communication protocol that is currently used.