JP2005210645A - Data communication method, data communication system, data communication program, and data communication apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make compatible the security of data communication, an IPsec/IKE program and convenience of data communication depending upon seamless roaming. <P>SOLUTION: An IKE cipher communication path which is parallel with an IPsec cipher communication path, is utilized to request a communication party to update the IPsec cipher communication path, using an IKE phase-2 protocol from a changed IP address if the IP address changes. At the side of the opposite party, negotiation of information required for said updating is performed by an IKE protocol, according to the request, as long as the identity of the request source can be confirmed from the identity with a conventional cookie, regardless of the IP address difference. Afterwards, an IPsec cipher communication path, according to the new address is created between both the communicators and the former communication path, is deleted. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a data communication method, a data communication system, a data communication program, and a data communication apparatus that transmit and receive data between a first data communication apparatus and a second data communication apparatus via an IPsec encryption communication path.

  As an encryption communication method that is widely used in network communication requiring safety and is also applied to P2P encryption communication, encrypted VPN (Virtual Private Network), secure gateway of firewall, etc., “IPsec / IKE (Internet) Protocol security / Internet Key Exchange) ”(see, for example, Non-Patent Document 1).

  As described in Non-Patent Document 1, IPsec is an encryption communication (and authentication communication) protocol, and IKE is a protocol for exchanging keys used in IPsec. By periodically replacing the key used in the IPsec encrypted communication path via the IKE encrypted communication path, the safety of communication can be further improved.

  FIG. 14 is an explanatory diagram showing an outline of the IKE protocol. In the figure, phase 1 is a protocol executed at the start of communication. Between the communication person A as an initiator and the communication person B as a responder, IKE SA parameters and key information, ID, authentication information, etc. are passed (refer to FIGS. 14 (1-1) to (1-6)). Phase 2 is a protocol that is periodically executed at the start of communication and during communication. Among the combinations of the SA parameters for IPsec proposed by the communication person A to the communication person B, the communication person B is one. When the communication person A is selected and notified to the communication person A, the communication person A notifies the communication person B of the confirmation (refer to FIGS. 14 (2-1) to (2-3)).

  On the other hand, with the development of mobile devices such as mobile phones, notebook computers, and in-vehicle terminals, there are increasing occasions where communication services are provided to these devices even while moving. In order to continuously provide a service to a moving device, it is necessary to perform a roaming service between a plurality of base stations / access points. In particular, providing seamless communication services during roaming is called “seamless roaming” and is said to be an essential service / technology in the future ubiquitous network society. In general, a roaming service for IP communication is realized by a technique called “mobile IP”. As a conventional technique related to roaming, for example, there is Patent Document 1 below.

JP 2003-319010 A Tatsuya Baba, “Mastering IPsec”, Ohmsha, 2001

  However, in order to perform communication using the mobile IP safely, it is essential to encrypt the communication by some method. As described above, a typical protocol for encrypted communication is IPsec / IKE. However, in IPsec in which a communication partner is exclusively identified by an IP address, communication cannot be continued if roaming occurs and the IP address changes. Therefore, if the mobile IP technology that can use the same IP address before and after roaming is applied outside IPsec, the header of mobile IP is not subject to encryption.

  That is, when IPsec is used to ensure the safety of mobile IP, roaming becomes impossible, and in order to continue IPsec even after roaming, it is necessary to use unencrypted mobile IP. Therefore, it has been difficult to simultaneously realize secure network communication by encryption communication and seamless roaming.

  Therefore, in the past, it has been abandoned to protect the mobile IP communication protocol itself, and the security has been temporarily secured and seamless roaming has been realized by continuing the IPsec encryption communication. As a conventional example, for example, a “MobileIP FA (Foreign Agent)” is installed in a device on the side where roaming occurs (IP address changes), and a “MobileIP HA (Home Agent)” is installed on the communication partner side of the device. Some of these functions automatically change the communication path when the occurrence of roaming is detected. However, it cannot be said that it is completely secure communication, and “MobileIP HA” is a kind of server and has restrictions on movement. Therefore, it is difficult to achieve both safety and convenience in P2P communication anyway. There was also a problem.

  In order to solve the above-described problems caused by the prior art, the present invention provides a data communication method and data communication capable of satisfying both the safety of data communication based on the IPsec / IKE protocol and the convenience of data communication based on seamless roaming. It is an object to provide a system, a data communication program, and a data communication apparatus.

  In order to solve the above-described problems and achieve the object, the data communication method, data communication system, data communication program, and data communication apparatus according to the present invention establish an IPsec encryption communication path between the communicators A and B. When A's IP address changes, A requests B to update the IPsec encrypted communication path, and B confirms the identity of the communication partner using identification information other than the IP address and is necessary for the above update. New information is negotiated with A and the IPsec encrypted communication path is updated.

  According to the present invention, even if the other party's IP address changes during communication due to roaming or the like, as long as the other party's identity can be confirmed by the other identification information, the IPsec encrypted communication path under the new IP address Can be connected to maintain the connection.

  In addition, the data communication method and the data communication system according to the present invention perform an update request for the IPsec encryption communication path and determination of information necessary for the update according to the IKE phase 2 protocol.

  According to the present invention, it is possible to maintain the connection by changing the IPsec encrypted communication path at high speed even if the IP address changes by simply using / extending the existing IKE phase 2 protocol.

  Further, the data communication method and the data communication system according to the present invention use the other party's cookie received before the IP address changes, as identification information for confirming the identity of the other party.

  According to the present invention, the identity of the communication partner can be confirmed even after the change of the IP address by using the cookie in the packet exchanged by the existing IKE phase 2 protocol.

  According to the data communication method, the data communication system, the data communication program, and the data communication apparatus according to the present invention, even if the IP address changes during the communication, a new update is performed using the IPsec key update process according to the IKE phase 2 protocol. Since the IPsec encryption communication path is replaced under a unique IP address, there is an effect that it is possible to achieve both the safety of data communication by the IPsec / IKE protocol and the convenience of data communication by seamless roaming.

  Exemplary embodiments of a data communication method, a data communication system, a data communication program, and a data communication apparatus according to the present invention will be explained below in detail with reference to the accompanying drawings.

  FIG. 1 is an explanatory diagram showing the overall configuration of the data communication system according to the embodiment of the present invention. In the figure, the data communication device A 100a is specifically a mobile device on the side where roaming occurs (IP address changes) such as a notebook computer. The data communication device B 100b is a gateway or the like that is a communication partner of the data communication device B 100b, and performs communication with a device outside the LAN in place of the other data communication device C 100c in the LAN. Note that an encryption communication path in the IPsec tunnel mode is maintained between the data communication apparatuses A 100a and B 100b, and an application using this IPsec communication uses a private IP address set in the tunnel mode. ing.

  Next, FIG. 2 is an explanatory diagram showing the hardware configuration of the data communication apparatuses A100a, B100b, and C100c that constitute the data communication system according to the embodiment of the present invention. For convenience of explanation, it is assumed that each device has the same hardware configuration.

  As shown in FIG. 2, the data communication apparatuses A 100 a, B 100 b, and C 100 c include a CPU 201, ROM 202, RAM 203, HDD (hard disk drive) 204, HD (hard disk) 205, FDD (flexible disk drive) 206, and FD (flexible disk) 207. , A display 208, a network I / F (interface) 209, a keyboard 210, and a mouse 211. Each of the above parts is connected by a bus 200.

  In the figure, a CPU 201 controls the entire apparatus. The ROM 202 stores a boot program and the like. The RAM 203 is used as a work area for the CPU 201.

  The HDD 204 controls data read / write with respect to the HD 205 according to the control of the CPU 201. The HD 205 stores data written according to the control of the HDD 204. The FDD 206 controls reading / writing of data with respect to the FD 207 according to the control of the CPU 201. The FD 207 stores data written according to the control of the FDD 206. The FD 207 is an example of a detachable recording medium, and may be a CD-ROM (CD-R, CD-RW), MO, DVD (Digital Versatile Disk), memory card, or the like instead of the FD 207.

  A display 208 displays various data such as a document and an image, as well as a cursor, a window, an icon, and the like. A network I / F 209 is connected to a network such as a LAN / WAN and manages data transmission / reception between the network and the inside of the apparatus. The keyboard 210 includes a plurality of keys for inputting characters, numbers, various instructions, and the like, and inputs data corresponding to the pressed key into the apparatus. The mouse 211 inputs the amount and direction of rotation of the ball at the bottom of the main body and ON / OFF of each button at the top of the main body into the device as needed.

  FIG. 3 is an explanatory diagram functionally showing the configuration of the data communication system according to the embodiment of the present invention. However, only the part (specifically, data communication apparatuses A100a and B100b) necessary for the description of the present invention is shown in the above system.

  As shown in FIG. 3, each of the data communication devices A 100a and B 100b includes a plurality of NICs (Network Interface Cards) each having a separate IP address. Note that the IP address of the NIC A 300a of the data communication apparatus A 100a is “IP address A A”, the IP address of the NIC B 301a is “IP address A B”, the IP address of the NIC A 300b of the data communication apparatus B 100b is “IP address B A”, NIC B It is assumed that the IP address of 301b is “IPaddressB B”.

  In addition to the above, the data communication devices A 100a and B 100b include the roaming detection units 302a and 302b, the IKE processing units 303a and 303b, the IKE DBs (databases) 304a and 304b, the IPsec processing units 305a and 305b, and the IPsec DBs (databases). 306a and 306b are provided. The function of each part with the same name is common among ABs. Each unit other than the NIC is realized by the CPU 201 executing a program read from the HD 205 or the like to the RAM 203.

  First, the roaming detection units 302a and 302b are functional units that detect the occurrence of roaming in the own apparatus (change of the IP address to be used). The method of detection is not particularly limited in the present invention, and may be detected by some existing technique.

  Next, the IKE processing units 303a and 303b are functional units that hold IKE encryption communication paths with other data communication apparatuses. The IKE DBs 304a and 304b are databases that hold various information necessary for processing by the IKE processing units 303a and 303b. FIG. 4 is an explanatory diagram schematically showing the contents of the IKE DBs 304a and 304b. As schematically shown in FIG. 4, the IKE DBs 304a and 304b hold the IP addresses of the data communication apparatuses A 100a and B 100b, cookies, SA parameters to be used, keys exchanged between ABs, and the like.

  Returning to FIG. 3, the IPsec processing units 305a and 305b are functional units that hold an IPsec encrypted communication path with other data communication apparatuses. The IPsec DBs 306a and 306b are databases that hold various information necessary for processing in the IPsec processing units 305a and 305b. FIG. 5 is an explanatory diagram schematically showing the contents of the IPsec DBs 306a and 306b. As schematically shown in FIG. 5, the IPsec DBs 306 a and 306 b include the IP addresses of the data communication apparatuses A 100 a and B 100 b, the SA parameters to be used, the keys used for encrypted communication from A to B, and conversely from B to A Keys used for encrypted communication to are stored. As shown in the figure, IPsec data is composed of two types of communication information from A to B and communication information from B to A.

  Here, FIG. 6 is an explanatory view schematically showing a state before the occurrence of roaming of the data communication system according to the embodiment of the present invention, and FIG. 7 is a data communication system according to the embodiment of the present invention. It is explanatory drawing which shows typically the state immediately after the occurrence of roaming.

  As shown in FIG. 6, in the state where the IPsec / IKE encryption communication path is established between the NIC A 300a of the data communication apparatus A 100a and the NIC A 300b of the data communication apparatus B 100b, data communication is performed as shown in FIG. Assume that roaming from NIC A 300a to NIC B 301a occurs on the device A 100a side. At this time, as described above, since IPsec cannot maintain communication when the IP address changes, both the IPsec encrypted communication path and the IKE encrypted communication path are disconnected. In FIG. 7, a dotted line means a state in which the communication path is disconnected.

  Therefore, in this embodiment, even if the IP address changes, other information, for example, IKE that can confirm the identity of the communication partner by the identity of the cookie is used, and the IPsec / IKE encryption channel Re-seat.

  FIG. 8 is an explanatory view schematically showing a state proposed by the initiator in the IPsec encrypted communication channel update process of the data communication system according to the embodiment of the present invention. FIG. 9 is a diagram illustrating the implementation of the present invention. It is explanatory drawing which shows typically the mode of the selection by a responder, and the confirmation by a starter among the IPsec encryption channel update processes of the data communication system concerning a form. FIG. 10 is an explanatory diagram schematically showing a state after the creation of a new IPsec encrypted communication path in the data communication system according to the embodiment of the present invention, and FIG. 11 according to the embodiment of the present invention. It is explanatory drawing which shows typically the state after an old IPsec encryption communication path deletion of a data communication system.

  First, when detecting the occurrence of roaming, the roaming detection unit 302a of the data communication apparatus A 100a notifies the IKE processing unit 303a of the roaming event and the new IP address after roaming (FIG. 7). Receiving this, the IKE processing unit 303a updates its own IP address used in the current IKE encryption communication path with a new IP address (FIG. 8). Specifically, “IPaddress A” (IP address of NIC A 300a) in the IKE DB 304a shown in FIG. 4 is rewritten to “IPaddress A II” (IP address of NIC B 301a).

  The IKE processing unit 303a simultaneously updates the IKE DB 304a, and at the same time, requests the data communication apparatus B 100b to update the IPsec encrypted communication path (update the key for the IPsec encrypted communication path from the new IP address using the IKE phase 2 protocol). Request) is transmitted (FIG. 8). At this time, the key, cookie, ID, etc. used in the conventional IKE encryption communication path are used. This IPsec encryption communication channel update request (FIG. 14 (2-1)) is also a request to replace the IKE encryption communication channel from the old IP address to the new IP address using the conventional key or the like.

  Then, as shown in FIG. 9, the IKE processing unit 303b of the data communication device B 100b that has received the request indicates that the communication partner is A by predetermined identification information, specifically a cookie regardless of the change of the IP address. Is confirmed, the other party's IP address (held in the IKE DB 304b) used in the current IKE encryption communication path is updated with a new IP address on the condition that the encrypted communication can be decrypted. At the same time, the key update process shown in FIGS. 14 (2-2) and (2-3) is performed with the data communication apparatus A 100a.

  When the above processing is completed, as shown in FIG. 10, each of the IKE processing units 303a and 303b of the data communication apparatuses A 100a and B 100b sets a new IPsec encrypted communication path with the new IP address of A, and the IPsec DB 306a Register in 306b. As a result, the two “IPaddress A” (IP address of NIC A 300a) in the IPsec DBs 306a and 306b shown in FIG. 5 are both replaced with “IP address A B” (IP address of NIC B 301a) ”. It will be. Next, the IPsec processing units 305a and 305b that have received this start communication using the new IPsec encrypted communication path.

  Thereafter, as shown in FIG. 11, the IKE processing units 303a and 303b delete the information on the previous IPsec encrypted communication path from the IPsec DBs 306a and 306b. As a result, the old IPsec encryption communication path between A's NIC A 300a and B's NIC A 300b is deleted, and the IPsec / IKE encryption communication path is replaced between A's NIC B 301a and B's NIC A 300b. It is done.

  Next, FIG. 12 is a flowchart showing a procedure for updating the IPsec / IKE encryption communication path in the data communication apparatus A 100a. When the roaming detection unit 302a of the data communication apparatus A 100a detects the occurrence of roaming (step S1201), the fact and the new IP address are notified to the IKE processing unit 303a, and the IKE processing unit 303a that has received the notification notifies the IKE processing unit 303a. The own IP address in the DB 304a is updated (step S1202).

  Next, the IKE processing unit 303a transmits an IPsec encrypted communication path update request (IPsec key update request) from the new IP address after roaming to the data communication apparatus B 100b, and receives the IKE of the data communication apparatus B 100b. Key update processing is performed between the processing unit 303b and the IKE phase 2 protocol (FIGS. 14 (2-1) to (2-3)) (step S1203). Thereafter, a new IPsec SA with a new key and IP address is created and registered in the IPsec DB 306a (step S1204), and the previous IPsec SA is deleted from the DB (step S1205).

  On the other hand, FIG. 13 is a flowchart showing a procedure for updating the IPsec / IKE encryption channel in the data communication apparatus B 100b. When an IPsec encrypted communication path update request (IPsec key update request) is received from the IKE processing unit 303a of the data communication apparatus A 100a (step S1301), the IKE processing unit 303b of the data communication apparatus B 100b first includes an IP address included in the request. And the identification information (specifically, the cookie) are checked whether they are the same as those of A registered in the IKE DB 304b (step S1302). The IP address of A is described in the IP header, and the cookie of A is described in the ISAKMP header.

  If both the IP address and the cookie are A (step S1302: Yes), the request is a normal IPsec key update request that is periodically transmitted during communication. On the other hand, if the IP address is different but only the cookie is A (step S1302: No, step S1307: Yes), the request is transmitted when roaming occurs, and the IPsec key update accompanied by the change of the IP address is performed. It is a request. Therefore, in any of the above cases, the process proceeds to the IPsec key update process on condition that the requested encrypted packet can be normally decrypted (step S1303: Yes or step S1309: Yes).

  That is, first, in the case of normal key update (step S1302: Yes, step S1303: Yes), the IKE phase 2 protocol (FIGS. 14 (2-1) to (2-1) is exchanged with the IKE processing unit 303a of the data communication apparatus A 100a. The key update process according to 2-3)) is performed (step S1304). Thereafter, a new IPsec SA with a new key and IP address is created and registered in the IPsec DB 306b (step S1305), and the previous IPsec SA is deleted from the DB (step S1306).

  On the other hand, in the case of key update when roaming occurs (step S1302: No, step S1307: Yes, step S1309: Yes), first, the IP address of A in the IKE DB 304b is updated from “IPaddressA A” to “IPaddressA second”. (Step S1310). Then, the process proceeds to step S1304, and the same key update as in a normal case, registration of the new IPsec SA in the IPsec DB 306b, and deletion of the old IPsec SA from the IPsec DB 306b are performed (steps S1304 to S1306).

  If neither the IP address nor the cookie is A (Step S1302: No, Step S1307: No), or if the encrypted packet cannot be correctly decrypted (Step S1303: No or Step S1309: No), It is determined that an abnormal packet has arrived, and the process proceeds to illegal packet processing (step S1308). As this abnormal processing, for example, there are many implementations such as canceling communication with A on the spot or ignoring received packets, but the details are not limited in the present invention.

  As described above, in the conventional IPsec / IKE, when roaming occurs, both the IPsec encrypted communication channel and the IKE encrypted communication channel are disconnected. Therefore, when continuing the encrypted communication, IKE Phase 1 and Phase 2 are performed again. There must be. On the other hand, in the present invention, even if roaming occurs, it is only necessary to perform IKE phase 2. Therefore, communication can be continued by changing the IPsec encrypted communication path at high speed, and seamless roaming is realized. Note that in some remote access software investigated by the present applicant, the communication from phase 1 to phase 2 required 4 seconds, whereas in the case of phase 2 alone, the time was 0.1 seconds or less. Therefore, when this embodiment is introduced in this environment, roaming that is 40 times faster than the prior art becomes possible.

  In addition, according to the present invention, since it is not necessary for communicators to be special servers, seamless roaming with P2P, which has been impossible in the past, becomes possible.

  In addition, in order to realize the above, the present invention only adds some processing functions to the IKE processing units 303a and 303b except that the roaming detection units 302a and 302b are newly provided. That is, a function for forcibly executing the IKE phase 2 protocol when roaming occurs and a function other than that enclosed by a dotted line “normal IPsec key update” in FIG.

  In the above-described embodiment, a cookie is used as identification information of the communicator A after roaming. This is because the protocol specifications of the current IPsec / IKE communication are not changed, and therefore seamless roaming is possible while maintaining the original security of IPsec / IKE. In addition to cookies, ID, FQDN mail address, private address used in tunnel mode, etc. can be used as identification information as well as cookies, as long as it is possible to determine the difference between communication partners. It is possible to use a protocol other than IKE to switch to the IP address.

  In the above-described embodiment, roaming is exclusively assumed as the cause of the change in the IP address of the communication partner. However, not only roaming, but the IP address changes for some reason, so IPsec / IKE communication is disconnected. Even in such a case, the disconnection of communication can be avoided by applying the present invention.

  The data communication method described in this embodiment can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. This program is recorded on a computer-readable recording medium such as the hard disk 205, the flexible disk 207, the CD-ROM, the MO, and the DVD, and is executed by being read from the recording medium by the computer. The program may be a transmission medium that can be distributed via a network such as the Internet.

(Additional remark 1) In the data communication method which transmits / receives data via an IPsec encryption communication path between the 1st data communication apparatus and the 2nd data communication apparatus,
A detection step of detecting that the IP address used by the first data communication device has been changed to another IP address;
A transmission step of transmitting an update request for the IPsec encryption channel from the other IP address to the second data communication device when the change is detected in the detection step;
A receiving step for receiving the update request transmitted in the transmitting step;
Determining whether or not the update request is transmitted from the first data communication device based on identification information other than the source IP address included in the update request received in the reception step Process,
In the determination step, when it is determined that the update request received in the reception step is transmitted from the first data communication device, information necessary for updating the IPsec encryption communication path is determined. A decision process;
An update step of updating the IPsec encrypted communication path based on the information determined in the determination step;
A data communication method comprising:

(Supplementary note 2) The data communication method according to supplementary note 1, wherein, in the transmission step and the determination step, the update request is transmitted or the information is determined according to an IKE phase 2 protocol.

(Supplementary Note 3) The identification information is stored in the first data communication device received by the second data communication device via the IKE encryption communication channel before the update request is received in the reception step. The data communication method according to appendix 2, wherein the data communication method is a cookie.

(Additional remark 4) In the data communication system which transmits / receives data via an IPsec encryption communication path between the 1st data communication apparatus and the 2nd data communication apparatus,
Detecting means for detecting that the IP address used by the first data communication device has been changed to another IP address;
Transmitting means for transmitting an update request for the IPsec encrypted communication path from the other IP address to the second data communication device when the change is detected by the detecting means;
Receiving means for receiving the update request transmitted by the transmitting means;
Determination of whether or not the update request is transmitted from the first data communication device based on identification information other than the source IP address included in the update request received by the receiving unit Means,
When the determination unit determines that the update request received by the reception unit is transmitted from the first data communication apparatus, information necessary for updating the IPsec encryption communication path is determined. A determination means;
Updating means for updating the IPsec encrypted communication path based on the information determined by the determining means;
A data communication system comprising:

(Supplementary note 5) The data communication system according to supplementary note 4, wherein the transmission unit and the determination unit transmit the update request or determine the information according to an IKE phase 2 protocol.

(Supplementary Note 6) The identification information is stored in the first data communication apparatus received by the second data communication apparatus via the IKE encryption communication path before the update request is received by the reception unit. The data communication system according to appendix 5, wherein the data communication system is a cookie.

(Supplementary note 7) In a data communication program that operates on a data communication apparatus that transmits and receives data to and from other data communication apparatuses via an IPsec encrypted communication path,
A detection step of detecting that the IP address used by the data communication device is changed to another IP address;
A transmission step of transmitting an update request for the IPsec encrypted communication path from the other IP address to the other data communication device when the change is detected in the detection step;
The other data communication apparatus that has determined that the update request has been transmitted from the data communication apparatus based on identification information other than the source IP address included in the update request transmitted in the transmission step A determination step for determining information necessary for updating the IPsec encrypted communication path;
An update step of updating the IPsec encrypted communication path based on the information determined in the determination step;
A data communication program for causing a computer to execute.

(Supplementary note 8) The data communication program according to supplementary note 7, wherein in the transmission step and the determination step, the update request is transmitted or the information is determined according to an IKE phase 2 protocol.

(Supplementary Note 9) The identification information is a cookie of the data communication device that is transmitted to the other data communication device via the IKE encryption communication channel before the update request is transmitted in the transmission step. The data communication program according to appendix 8, wherein

(Additional remark 10) In the data communication apparatus which transmits / receives data via an IPsec encryption communication path between other data communication apparatuses,
Detecting means for detecting that the IP address used by the own device has been changed to another IP address;
Transmitting means for transmitting an update request for the IPsec encrypted communication path from the other IP address to the other data communication device when the change is detected by the detecting means;
The other data communication apparatus that has determined that the update request has been transmitted from the data communication apparatus based on identification information other than the source IP address included in the update request transmitted by the transmission means Determining means for determining information necessary for updating the IPsec encrypted communication path;
Updating means for updating the IPsec encrypted communication path based on the information determined by the determining means;
A data communication apparatus comprising:

(Supplementary note 11) The data communication apparatus according to supplementary note 10, wherein the transmission unit and the determination unit transmit the update request or determine the information according to an IKE phase 2 protocol.

(Additional remark 12) The identification information is a cookie of the own apparatus transmitted to the other data communication apparatus via the IKE encryption communication path before the update request is transmitted by the transmission means. The data communication device as set forth in Appendix 11.

(Supplementary note 13) In a data communication program that operates on a data communication apparatus that transmits and receives data to and from other data communication apparatuses via an IPsec encrypted communication path,
A receiving step of receiving an update request for the IPsec encrypted communication path transmitted from the other data communication apparatus;
Determining whether or not the update request has been transmitted from the other data communication device based on identification information other than the source IP address included in the update request received in the reception step Process,
In the determination step, when it is determined that the update request received in the reception step is transmitted from the other data communication device, information necessary for updating the IPsec encryption communication path is determined. A decision process;
An update step of updating the IPsec encrypted communication path based on the information determined in the determination step;
A data communication program for causing a computer to execute.

(Supplementary note 14) The data communication program according to supplementary note 13, wherein in the determination step, the information is determined according to an IKE phase 2 protocol.

(Supplementary note 15) The identification information is a cookie of the other data communication device received via the IKE encryption communication channel before the update request is received in the reception step. The data communication program according to appendix 14.

(Supplementary Note 16) In a data communication apparatus that transmits / receives data to / from another data communication apparatus via an IPsec encrypted communication path,
Receiving means for receiving an update request for the IPsec encrypted communication path transmitted from the other data communication apparatus;
Determination of whether or not the update request is transmitted from the other data communication device based on identification information other than the source IP address included in the update request received by the receiving unit Means,
When the determination unit determines that the update request received by the reception unit is transmitted from the other data communication apparatus, information necessary for updating the IPsec encryption communication path is determined. A determination means;
Updating means for updating the IPsec encrypted communication path based on the information determined by the determining means;
A data communication apparatus comprising:

(Supplementary note 17) The data communication apparatus according to supplementary note 16, wherein the determining means determines the information according to an IKE phase 2 protocol.

(Supplementary note 18) The identification information is a cookie of the other data communication device received via the IKE encryption communication channel before the update request is received by the receiving means. The data communication apparatus according to appendix 17.

  As described above, the data communication method, the data communication system, the data communication program, and the data communication apparatus according to the present invention are useful for ensuring the safety of data communication in which the IP address changes during communication. In the ubiquitous society where it should be, it is suitable for the application to transmit and receive data safely anytime and anywhere.

It is explanatory drawing which shows the whole structure of the data communication system concerning embodiment of this invention. It is explanatory drawing which shows the hardware constitutions of data communication apparatus A100a * B100b * C100c. It is explanatory drawing which shows the structure of the data communication system concerning embodiment of this invention functionally. It is explanatory drawing which shows typically the content of DB304a * 304b for IKE. It is explanatory drawing which shows typically the content of DB DB306a * 306b for IPsec. It is explanatory drawing which shows typically the state before the occurrence of roaming of the data communication system concerning embodiment of this invention. It is explanatory drawing which shows typically the state immediately after the occurrence of roaming of the data communication system concerning embodiment of this invention. It is explanatory drawing which shows typically the mode of the proposal by a starter among the IPsec encryption channel update processes of the data communication system concerning embodiment of this invention. It is explanatory drawing which shows typically the mode of the selection by a responder, and the confirmation by a starter among the IPsec encryption communication path update processes of the data communication system concerning embodiment of this invention. It is explanatory drawing which shows typically the state after creation of the new IPsec encryption communication path of the data communication system concerning embodiment of this invention. It is explanatory drawing which shows typically the state after the old IPsec encryption communication path deletion of the data communication system concerning embodiment of this invention. It is a flowchart which shows the procedure of the update process of an IPsec / IKE encryption communication path in data communication apparatus A100a. It is a flowchart which shows the procedure of the update process of an IPsec / IKE encryption communication path in data communication apparatus B100b. It is explanatory drawing which shows the outline of an IKE protocol.

Explanation of symbols

100a Data communication device A
100b Data communication device B
100c Data communication device C
200 Bus 300a, 300b NIC A 301a, 301b NIC B 302a, 302b Roaming detection unit 303a, 303b IKE processing unit 304a, 304b IKE DB
305a, 305b IPsec processing unit 306a, 306b DB for IPsec

Claims (10)

In a data communication method for transmitting and receiving data via an IPsec encryption communication path between a first data communication device and a second data communication device,
A detection step of detecting that the IP address used by the first data communication device has been changed to another IP address;
A transmission step of transmitting an update request for the IPsec encryption channel from the other IP address to the second data communication device when the change is detected in the detection step;
A receiving step for receiving the update request transmitted in the transmitting step;
Determining whether or not the update request is transmitted from the first data communication device based on identification information other than the source IP address included in the update request received in the reception step Process,
In the determination step, when it is determined that the update request received in the reception step is transmitted from the first data communication device, information necessary for updating the IPsec encryption communication path is determined. A decision process;
An update step of updating the IPsec encrypted communication path based on the information determined in the determination step;
A data communication method comprising:   2. The data communication method according to claim 1, wherein, in the transmission step and the determination step, the update request is transmitted or the information is determined according to an IKE phase 2 protocol.   The identification information is a cookie of the first data communication device received by the second data communication device via the IKE encryption communication channel before the update request is received in the reception step. The data communication method according to claim 2, wherein: In a data communication system in which data is transmitted and received between the first data communication device and the second data communication device via the IPsec encryption communication path,
Detecting means for detecting that the IP address used by the first data communication device has been changed to another IP address;
Transmitting means for transmitting an update request for the IPsec encrypted communication path from the other IP address to the second data communication device when the change is detected by the detecting means;
Receiving means for receiving the update request transmitted by the transmitting means;
Determination of whether or not the update request is transmitted from the first data communication device based on identification information other than the source IP address included in the update request received by the receiving unit Means,
When the determination unit determines that the update request received by the reception unit is transmitted from the first data communication apparatus, information necessary for updating the IPsec encryption communication path is determined. A determination means;
Updating means for updating the IPsec encrypted communication path based on the information determined by the determining means;
A data communication system comprising:   5. The data communication system according to claim 4, wherein the transmission unit and the determination unit transmit the update request or determine the information according to an IKE phase 2 protocol.   The identification information is a cookie of the first data communication device that is received by the second data communication device via an IKE encryption communication channel before the update request is received by the receiving means. The data communication system according to claim 5, wherein: In a data communication program that operates on a data communication device that transmits and receives data to and from other data communication devices via an IPsec encrypted communication path,
A detection step of detecting that the IP address used by the data communication device is changed to another IP address;
A transmission step of transmitting an update request for the IPsec encryption communication path from the other IP address to the other data communication device when the change is detected in the detection step;
The other data communication apparatus that has determined that the update request has been transmitted from the data communication apparatus based on identification information other than the source IP address included in the update request transmitted in the transmission step A determination step for determining information necessary for updating the IPsec encrypted communication path;
An update step of updating the IPsec encrypted communication path based on the information determined in the determination step;
A data communication program for causing a computer to execute. In a data communication apparatus that transmits / receives data to / from other data communication apparatuses via an IPsec encryption communication path,
Detecting means for detecting that the IP address used by the own device has been changed to another IP address;
Transmitting means for transmitting an update request for the IPsec encrypted communication path from the other IP address to the other data communication device when the change is detected by the detecting means;
The other data communication apparatus that has determined that the update request has been transmitted from the data communication apparatus based on identification information other than the source IP address included in the update request transmitted by the transmission means Determining means for determining information necessary for updating the IPsec encrypted communication path;
Updating means for updating the IPsec encrypted communication path based on the information determined by the determining means;
A data communication apparatus comprising: In a data communication program that operates on a data communication device that transmits and receives data to and from other data communication devices via an IPsec encrypted communication path,
A receiving step of receiving an update request for the IPsec encrypted communication path transmitted from the other data communication apparatus;
Determining whether or not the update request has been transmitted from the other data communication device based on identification information other than the source IP address included in the update request received in the reception step Process,
In the determination step, when it is determined that the update request received in the reception step is transmitted from the other data communication device, information necessary for updating the IPsec encryption communication path is determined. A decision process;
An update step of updating the IPsec encrypted communication path based on the information determined in the determination step;
A data communication program for causing a computer to execute. In a data communication apparatus that transmits / receives data to / from other data communication apparatuses via an IPsec encryption communication path,
Receiving means for receiving an update request for the IPsec encrypted communication path transmitted from the other data communication apparatus;
Determination of whether or not the update request is transmitted from the other data communication device based on identification information other than the source IP address included in the update request received by the receiving unit Means,
When the determination unit determines that the update request received by the reception unit is transmitted from the other data communication apparatus, information necessary for updating the IPsec encryption communication path is determined. A determination means;
Updating means for updating the IPsec encrypted communication path based on the information determined by the determining means;
A data communication apparatus comprising:

Images