JP2006033358A - Communication method, router, processing method of router, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve problems that communication is carried out in an unencrypted state and packets cannot be transmitted because a high-order layer application does not notice the setting state of the IPsec in the case of temporarily setting the IPsec. <P>SOLUTION: SIP-Proxy servers A, B relay INVITE, Ringing, and OK. The SIP-Proxy servers A, B transmit an IPsec setting instruction to routers A, B (S9, S10). The routers A, B receiving the IPsec setting instruction carry out secure communication start processing (S16, S17). Upon the receipt of an ACK from a client A to a client B (S18), the router A transfers the ACK after end of the secure communication start processing. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a communication method, a router, a router processing method, and a program.

SIP (Session Initiation Protocol) is a protocol for starting, changing, and terminating a bidirectional session of a terminal device, which is used for bidirectional multimedia communication such as VoIP in an Internet telephone or the like (see, for example, Patent Document 1). . On the other hand, IPsec is a standardized technology having sufficient functions and safety for realizing security at an end-to-end IP layer between terminal devices (see, for example, Patent Document 2).
JP 2004-147195 A JP 2001-007849 A

  Conventionally, in communication using the SIP protocol, the SIP message for controlling the session itself and the media session for actually exchanging multimedia data are separate sessions including the communication path and the used port, and are linked from the SIP side. Although it is possible, in particular, when a lower layer security mechanism such as IPsec is adopted, the lower layer state such as whether IPsec is established cannot be recognized from the upper media session or the SIP protocol.

  In addition, IPsec is usually suitable for securing an encrypted communication path between fixed bases such as between main branches of a company, but for example, terminal devices located in different segments are temporarily connected only on the spot. It is not suitable for applications such as setting and performing secure communication by IPsec.

In order to securely set multimedia communication between unspecified communication partner terminal devices, when temporarily setting IPsec, the upper layer application is not conscious of the setting status of IPsec, and thus has the following problems.
1. If communication is started in a state where there is no entry of the other party who wants to perform IPsec communication in SPD (Security Policy Database), communication is performed in an unencrypted state.
2. If there is a communication partner entry in the SPD and the SA is not extended,
-In the case of use setting, communication is performed without encryption.
・ If request is set, packets cannot be sent.
Problems arise.

  In the present invention, the relay device that relays the call message from the first communication device to the second communication device and the response message from the second communication device to the first communication device is the first communication device. The first router provided on the side and the second router provided on the second communication device side transmit a security setting instruction, and the first router and the second router that received the security setting instruction When the secure communication start process is performed and the first router receives an acknowledgment message from the first communication apparatus to the second communication apparatus, the first router transfers the acknowledge message after the secure communication start process is completed.

  Further, in the present invention, the router provided on the first communication device side calls the call message from the first communication device to the second communication device, and the second communication device to the first communication device. In response to the security setting instruction from the relay device that relays the response message, the encrypted communication path is set with the second router provided on the second communication device side, and the first communication device When an acknowledgment message to the second communication device is received, the acknowledgment message is transferred to the second router after the setting of the encrypted communication path is completed.

  According to the present invention, it is possible to perform secure communication by performing security setting at the start of communication without complicated and difficult operations by the user.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In this embodiment, a router and an SIP server that perform IPsec setting using a SIP signal will be described.

  FIG. 1 shows an example of a network configuration according to an embodiment of the present invention. In FIG. 1, a client A 101 is a terminal having an incoming / outgoing call function based on a session initiation protocol (hereinafter SIP). In this embodiment, it is positioned as a calling terminal. The client B102 is a terminal having an SIP incoming / outgoing call function as in the case of 101, but in the present embodiment, it is positioned as an incoming call terminal called from the 101 calling terminal. Client A and client B are connected to a router A103 having an IPsec function and a router B104 having an IPsec function, respectively. Router A and router B are connected to the Internet.

  The client A 101 uses the SIP-Proxy server A 105 existing on the Internet to search for a partner terminal using a URI. The client A can register its own address and URI in the SIP-Proxy server A. Similarly, the client B registers its own URI and IP address with the SIP-Proxy server B 106 existing on the Internet. Note that the client B can search for a partner terminal by URI using the SIP-Proxy server B106 existing on the Internet.

  When the SIP-Proxy server A is called from the client A, it finds the SIP-Proxy server (SIP-ProxyB in this embodiment) that manages the URI of the other party by referring to the SRV record of the DNS 107 To do.

  In this embodiment, when a session is established by SIP, the encrypted communication path 108 using IPsec between the routers AB is used for the subsequent communication.

  In this embodiment, the IPsec function is held on the routers A and B connected to the ends of the networks on the client (terminal) A and B sides, and the routers A and B send SPDs from the SIP-Proxy servers A and B. Holds the function of interpreting the decision message, and further holds the function of holding the SIP message depending on the setting state of the IPsec, and for each partner communicating with the SIP when each of the clients A and B makes a call. SPD (Security Policy Database) has a function of dynamically generating before starting actual communication, and has a function of not starting a SIP media session when the IPsec setting is not complete.

  SIP-Proxy servers A and B (relay devices) are an INVITE (call message) from client A (first communication device) to client B (second communication device), and client B (second communication device). ) To the client A (first communication device), relaying the OK (response message). SIP-Proxy servers A and B (relay devices) are provided on the router A (first router) and client B (second communication device) side provided on the client A (first communication device) side. An IPsec (security) setting instruction is transmitted to the router B (second router). The routers A and B (first router and second router) that have received the IPsec (security) setting instruction perform secure communication start processing. When the router A (first router) receives an ACK (acknowledgment message) from the client A (first communication device) to the client B (second communication device), the secure communication start process is performed on the ACK (acknowledgment message). Transfer after completion.

  FIG. 2 shows an example of the hardware configuration of the clients A and B, the routers A and B, and the SIP-Proxy servers A and B. A computer 1200 includes a CPU 1201, a ROM 1202, a RAM 1203, a hard disk (HD) 1207, a disk controller (DC) 1205 of a floppy (registered trademark) disk (FD) 1208, and a network interface card (NIC) 1206. 1204 is configured to be communicable with each other via 1204. A system bus 1204 is connected to the Internet via a network interface card 1206. The CPU 1201 performs overall control of each component connected to the stem bus 1204 by executing software stored in the ROM 1202 or the HD 1207 or software supplied from the FD 1208. The routers A and B may separately have a network interface card (NIC) for connecting the corresponding clients A and B and a network interface card (NIC) for connecting the Internet.

  That is, the CPU 1201 reads out the processing program from the ROM 1202, the HD 1207, or the FD 1208 and executes it, thereby performing control for realizing the operation in the present embodiment. A RAM 1203 functions as a main memory or work area of the CPU 1201. The DC 1205 controls access to the HD 1207 storing the boot program, various applications, editing files, user files, network management programs, the above-described processing programs in the present embodiment, and the FD 1208. The NIC 1206 communicates with each other through the Internet.

  The router A is a router provided on the client A (first communication device) side. The SIP-Proxy server A (relay device) includes an INVITE command (call message) from the client A (first communication device) to the client B (second communication device), and the client B (second communication device). From the client to the client A (first communication device), relaying OK (response message). In the router A, the CPU 1201 is a setting unit that sets the encrypted communication path 108 with the router B (second router) provided on the client B (second communication device) side. In the router A, when the NIC 1206 operating under the control of the CPU 1201 receives an ACK (acknowledgment message) from the client A (first communication device) to the client B (second communication device), the SIP Proxy server A transfer means for transferring to A (relay device).

  In the router A, the CPU 1201 is a SIP proxy server A (relay device) that relays a control signal for establishing a session between the client A (first communication device) and the client B (second communication device). Is a setting means for setting the encrypted communication path 108 with the router B (second router) provided on the client B (second communication device) side in response to a security setting instruction from the client B (second communication device). In the router A, the NIC 1206 operating under the control of the CPU 1201 transmits an ACK (last message) transmitted from the client A (first communication device) to establish a session between the client B (second communication device). When the control signal is received, after the setting of the encrypted communication path 108 is completed, it is a transfer means for transferring to the SIP Proxy server A (relay device).

  FIG. 3 shows the SIP proxy server A105, the SIP proxy server B106, the router A101 and the router B103, and the clients A and B of the SIP protocol and SIP commands related to this embodiment. The command exchange sequence is described. These routers A101 and the like perform operations as described below when the CPU 1201 executes programs stored in the ROM 1202, the HD 1207, or the FD 1208.

  Note that the SIP proxy server A 105 and the SIP proxy server B 106 have a role of recognizing the SIP command and issuing an IPsec security policy database (SPD) to the router A 101 and the router B 103. The router A 101 and the router B 103 Upon receiving an SPD instruction from each of the SIP Proxy servers A and B, IPsec setting can be dynamically performed.

  In S1, the client A issues a SIP REGISTER command to the SIP-Proxy server A. At this time, an authentication ID and password are set in advance in the client A, and the SIP proxy server A requests authentication in response to the registration request of the REGISTER command, and performs registration only when authenticated. The authentication used here is generally digest authentication. Therefore, the registration operation by REGISTER is also composed of a plurality of steps, but is omitted here. When the client A is authenticated, the URI in the parameters included in the REGISTER command and the IP address of the client A are registered in the SIP proxy server A105.

  Similarly, in S2, a SIP REGISTER command is issued from the client B to the SIP proxy server B, and the URI and the IP address of the client B are registered in the SIP proxy server B.

  In S3, the SIP INVITE command is issued from the calling client A to the URI belonging to the client B. The SIP proxy server A recognizes that the designated URI belongs to the SIP proxy server B, and transfers the INVITE command issued from the client A to the SIP proxy server B in S4. Note that the SIP-Proxy server A finds the SIP-Proxy server (SIP-ProxyB in this embodiment) that manages the URI of the other party with reference to the SRV record of the DNS 107.

  When the SIP Proxy server B receives the INVITE command of S4, the IP address of the client B registered by the REGISTER command, which is designated in the INVITE command parameters, is used as a key. In step S5, an INVITE command is transferred to the determined IP address.

  In S6, the client B receives INVITE and returns a response Ringing indicating that it is calling to the SIP Proxy server B. The SIP Proxy server B holds the IP addresses of the clients A and B included in S4 and S6 for use in S10.

  In S7, the SIP Proxy server B returns a Ringing response to the SIP Proxy server A. Here, the SIP Proxy server A holds the IP addresses of the client A and the client B included in the parameter of the INVITE command of S3 and the Ringing response of S7 for use in S9.

  In S8, the client A receives the Ringing response from the client B sent to the client A from the SIP proxy server A.

  In S9, the SIP Proxy server A uses the IP address of the client A, the IP address of the client B, and all the port numbers used by the client A and the client B from the command and response parameters of the S1 and S7. The router A is notified of information indicating that all port numbers are used as port numbers.

  Similarly, in S10, the SIP Proxy server B uses the command and response parameters of S4 and S6 to send the router B with all of the IP addresses of the client A, the IP address of the client B, and the port numbers used by the client A. The router B is notified of the number and information indicating that all port numbers are used as the port numbers used by the client B.

  In S11, the router A is instructed by the SIP proxy server A in S9, and the source address and port number, and the destination address and port number (IP address of client A, port number, IP address of client B, port number) Is set in the SPD used in IPsec.

  Similarly, in S12, the router B sets the source address and port number, and the destination address and port number specified by the SIP proxy server B in 10 to the SPD used in IPsec.

  The client B performs an off-hook or similar operation to return an OK response in S13 to the SIP Proxy server B, and similarly, the SIP Proxy server B transfers the OK response to the SIP Proxy server B in S14. Similarly, in S15, the SIP proxy server A transfers an OK response to the client A. Note that the steps from S13 to S15 are performed at arbitrary timings after S6 (generally, timings operated by the user). The timing of this embodiment is an example.

  In S11 and S12, when the client A and the client B existing under the mutual network communicate with each other, the router A and the router B have SPDs for setting the IPsec. Thereafter, IKE (key exchange) Phase 1 of the IPsec key exchange protocol is performed in S16, and IKE Phase 2 is performed in S17. That is, the SIP-Proxy server A (relay device) establishes a control signal (client A (first communication device) for establishing a session between the client A (first communication device) and the client B (second communication device). Device) to client B (second communication device) INVITE command (call message), and Ringing from client B (second communication device) to client A (first communication device), OK (response message) )). The router A provided on the client A (first communication apparatus) side sends a message to the client B (second communication apparatus) side in response to an IPsec (security) setting instruction from the SIP-Proxy server A (relay apparatus). The encrypted communication path 108 is set with the provided router B (second router).

  During this time, that is, between the time when the OK response is received at S15 and S17 when SA (Security Association) is established by IPsec, the router A may receive the S18 ACK from the client A at any timing. However, until the router A recognizes that the IPsec SA is completed, the ACK signal from the client A is temporarily stored without being transferred, and the transfer process is performed when the IKE SA is completed. In this embodiment, the ACK signal is received from the client A at the time of S18. However, the ACK signal is not sent immediately, but after the IPsec SA is completed, the ACK is transferred to the SIP Proxy server A at S19. . That is, the router A provided on the client A (first communication device) side receives an ACK (acknowledgment message, client A (first communication device) from the client A (first communication device) to the client B (second communication device). When the first communication apparatus) receives the last control signal transmitted to establish a session between the client B (second communication apparatus), the ACK is transferred to the relay apparatus after the setting of the encrypted communication path 108 is completed. To do.

  In S20, an ACK is transferred from the SIP Proxy server A to the SIP Proxy server B, and in S21, an ACK signal is transferred from the SIP Proxy server B to the client B.

  At this point, in the exchange of IP between the client A and the client B, an IPsec SA has already been performed, and the SIP media session S22 is actually executed after being encrypted with the IPsec SA. Note that ACK is not encrypted.

  To end the media session, the BYE command is sent from the client A to the SIP proxy server A in S23, the BYE command is transferred from the SIP Proxy server A to the SIP Proxy server B in S24, and further the SIP Proxy is sent in S25. The BYE command is transferred from the server B to the client B, and the media session is terminated. BYE is not encrypted.

  The router A is a router provided on the client A (first communication device) side. In the router A, the CPU 1201 transmits a control signal (client A (first communication device) to client B (first communication device) to client B (second communication device) to establish a session between the client A (first communication device) and the client B (second communication device). Relay of INVITE command (call message) to the second communication device), Ringing from client B (second communication device) to client A (first communication device), OK (response message)) Encrypted communication with a router B (second router) provided on the client B (second communication device) side in response to an IPsec (security) setting instruction from the SIP-Proxy server A (relay device) Setting means for setting the path 108. In the router A, the NIC 1206 operating under the CPU 1201 receives an ACK (acknowledgment message, client A (first communication device)) from the client A (first communication device) to the client B (second communication device). Receives the ACK to the SIP Proxy server A (relay device) after completion of the setting of the encrypted communication path 108, upon reception of the last control signal transmitted to establish a session between the client B (second communication device). Transfer means for transferring.

  In the above embodiment, a mode has been described in which the router A transfers a control signal (ACK) for establishing a session to the SIP proxy server A after completion of IPsec SA (after completion of setting of the encrypted communication path 108). However, when the client A transmits a communication signal to be transmitted after the session is established following the ACK before the completion of the IPsec SA (before the setting of the encrypted communication path 108 is completed), the router A transmits the IPsec SA. After completion of the above (after completion of setting of the encrypted communication path 108), the communication signal is transferred to the SIP Proxy server A via the encrypted communication path 108.

  After receiving the ACK in S21, the communication signal transmitted by the client B is transmitted via the encrypted communication path 108.

  Therefore, in the form in which the upper application starts the media session, the upper application can start the media session and perform secure communication without being aware of the security setting status.

  When the network side service is provided between router A and router B and the SIP media session is to be charged, the timing at which charging is started when the SIP proxy server A receives the ACK response of S19. In addition, the charging is terminated when the BYE command in S23 is received. Therefore, when providing a function required for communication combining IPsec and SIP as a pay service on the Internet side, a communication carrier is charged even though IPsec is not set end-to-end. The problem of being started can be avoided, and the timing of charging can be optimized.

It is a network block diagram concerning embodiment. It is a figure showing hardware constitutions concerning an embodiment. It is a command sequence diagram concerning an embodiment.

Explanation of symbols

103 Router A
104 Router B
105 SIP-Proxy server A
106 SIP-Proxy server B

Claims (7)

A relay device that relays a call message from the first communication device to the second communication device and a response message from the second communication device to the first communication device is provided on the first communication device side. Send the security setting instruction to the first router and the second router provided on the second communication device side,
The first router and the second router that have received the security setting instruction perform secure communication start processing,
When the first router receives an acknowledgment message from the first communication device to the second communication device, the first router transfers the acknowledgment message after completion of the secure communication start process. A router provided on the first communication device side,
In response to a security setting instruction from a relay device that relays a call message from the first communication device to the second communication device and a response message from the second communication device to the first communication device. Setting means for setting an encrypted communication path with a second router provided on the communication device side of
A router comprising transfer means for transferring an acknowledgment message to a relay device upon completion of setting of an encrypted communication path when receiving an acknowledgment message from the first communication device to the second communication device. A processing method of a router provided on the first communication device side,
In response to a security setting instruction from a relay device that relays a call message from the first communication device to the second communication device and a response message from the second communication device to the first communication device. Set the encrypted communication path with the second router provided on the communication device side of
A router processing method, comprising: receiving an acknowledgment message from the first communication device to the second communication device, and transferring the acknowledgment message to the relay device after completing the setting of the encrypted communication path. A processing program for a router provided on the first communication device side,
In response to a security setting instruction from a relay device that relays a call message from the first communication device to the second communication device and a response message from the second communication device to the first communication device. Set the encrypted communication path with the second router provided on the communication device side of
A processing program for a router, wherein upon receipt of an acknowledgment message from the first communication device to the second communication device, the acknowledgment message is transferred to the relay device after completion of setting of the encrypted communication path. A router provided on the first communication device side,
A second router provided on the second communication device side in response to a security setting instruction from a relay device that relays a control signal for establishing a session between the first communication device and the second communication device Setting means for setting an encrypted communication path with
When the first communication device receives the last control signal transmitted to establish a session between the second communication devices, the first communication device has a transfer means for transferring to the relay device after completing the setting of the encrypted communication path. And router. A processing method of a router provided on the first communication device side,
A second router provided on the second communication device side in response to a security setting instruction from a relay device that relays a control signal for establishing a session between the first communication device and the second communication device Set up an encrypted communication path with
When the last control signal transmitted from the first communication device to establish a session between the second communication devices is received, the router is transferred to the relay device after the setting of the encrypted communication path is completed. Processing method. A program for a router provided on the first communication device side,
A second router provided on the second communication device side in response to a security setting instruction from a relay device that relays a control signal for establishing a session between the first communication device and the second communication device Set up an encrypted communication path with
When the last control signal transmitted from the first communication device to establish a session between the second communication devices is received, the router is transferred to the relay device after the setting of the encrypted communication path is completed. Program for.

Images