JP2007235715A - Network equipment - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide network equipment capable of identify causes related to the inadequate setting easily when the communication of IPsec fails by notifying a user of which steps have been completed normally until now for each step of communication procedures. <P>SOLUTION: The network equipment corresponds to the IPsec communication, and comprises a means for retaining a setting parameter required for IPsec connection set by the user, a means for maintaining an error information output level set by the user, and a means for notifying the user of error information occurring in the process of the IPsec communication. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a network device compatible with IPsec (Security Architecture for Internet Protocol) communication.

  The IPsec communication procedure has a plurality of stages and has a feature that a plurality of settings are required for each stage. In order to perform IPsec communication, it is necessary to align all settings at each stage with the communication partner. Therefore, if there is a problem in one of many IPsec settings, communication itself cannot be performed. Since no communication can be obtained from the communication partner due to the inability to perform communication, the user cannot obtain any information regarding the incomplete setting.

On the other hand, Patent Document 1 discloses a technique that enables an external terminal to monitor an error occurrence state in a communication apparatus such as a facsimile apparatus.
JP 2005-223947 A

  As described above, the user cannot obtain any response from the communication partner when communication cannot be performed due to a mistake in the setting of the IPsec setting, so it is difficult to identify the cause of which setting has a problem. There was a problem of being.

  When the automatic key exchange method is used, re-establishment of SA (Security Association) called re-key is performed. If this re-key fails, a new SA cannot be established and sudden communication becomes impossible. It was difficult to determine whether there was a problem with the settings.

  Furthermore, in addition to various general communication errors, IPsec has errors that are specific to IPsec, such as errors when decryption fails due to different parameters, and errors when proposals do not fit. Normally, when these errors occur, communication becomes impossible, and the user cannot obtain information for solving the problem.

  The present invention has been proposed in view of the above-described conventional problems, and the purpose of the present invention is to notify the user of which stage has been normally completed for each stage of the communication procedure. It is an object of the present invention to provide a network device that can easily identify the cause of a setting defect when IPsec communication fails.

In order to solve the above problems, in the present invention,
According to a first aspect of the present invention, there is provided a network device that is compatible with IPsec communication and that stores a setting parameter necessary for IPsec connection set by a user, and an error information output level set by the user. The gist of the present invention is a network device including means for holding and means for notifying a user of error information generated in the course of IPsec communication.

  Further, as described in claim 2, in the network device according to claim 1, a protocol corresponding to IPv6 communication can be used as a protocol to be changed to IPsec.

  Further, as described in claim 3, in the network device according to claim 1, a protocol corresponding to IPv4 communication can be used as a protocol to be changed to IPsec.

  Further, as described in claim 4, the network device according to claim 1 can be provided with a display panel for notifying a user of error information generated in the process of IPsec communication.

  Further, as described in claim 5, the network device according to claim 1 can be provided with storage means for accumulating error information generated in the past IPsec communication process.

  Further, as described in claim 6, in the network device according to claim 1, the user can set the type of error information to be output.

  In addition, as described in claim 7, in the network device according to claim 1, it is possible to provide a telnet system capable of referring to error information generated in the course of IPsec communication from an external telnet terminal.

  Further, as described in claim 8, the network device according to claim 1 can be provided with a Web system capable of referring to error information generated in the course of IPsec communication from an external Web browser.

  Further, as described in claims 9 to 16, it can be configured as an error notification method for a network device.

  In the network device of the present invention, for each stage of the communication procedure, the user is notified of which stage has been successfully completed, thereby facilitating the identification of the cause of the setting failure at the time of IPsec communication failure. be able to.

  Hereinafter, preferred embodiments of the present invention will be described.

  FIG. 1 is an overall configuration diagram showing an embodiment of a network system using a network device of the present invention. In FIG. 1, network devices 1 A and 1 B are arranged on a network 3, network devices 1 C and 1 D are arranged on a network 4, and both networks 3 and 4 are connected by a router 2. The network devices 1A to 1D are assumed to be client PCs (Personal Computers), servers, printers, MFPs (Multi Function Printers), and the like. The network devices 1A to 1D may operate as telnet terminals or Web browsers.

  The network devices 1A to 1D are compatible with IPsec. In IPsec, in addition to a transport mode in which all communications are converted to IPsec and direct communication is performed, there is a method called a tunnel mode in which only gateway devices are converted to IPsec. The network device on the other side of communication may be a network device in the same segment connected to the same network 3 or 4, or a network device existing in another segment via the router 2. In the figure, a network device compatible with IPv6 (Internet Protocol version 6) is described. In this case, a unique address is automatically assigned to the device so that it can be accessed beyond the segment. Internet Protocol version 4) The same applies to network devices that support addresses.

  FIG. 2 is a software module configuration diagram illustrating an internal configuration example of the network device 1. In FIG. 2, the network device 1 includes a host application 11 that uses IPsec communication, a network control unit 12 that manages IPsec communication, and an OS (Operating System) 13.

  The network control unit 12 includes an IPsec setting table 121 that holds IPsec settings set by a user, an IPsec communication unit 122 that executes IPsec communication based on the IPsec settings held in the IPsec setting table 121, and a user Log output setting table 123 holding information indicating which log to be output (error information output level), and the state of IPsec communication are determined, and based on the information held in log output setting table 123 In this case, it is determined whether to output a log each time, an IPsec status determination unit 124 that outputs a log of each communication error, a decryption failure error that is unique to IPsec, a proposal nonconformity, and the output log. And a log table 125 to be held. The IPsec setting table 121, the log output setting table 123, and the log table 125 are stored in an NVRAM (Non Volatile RAM (Random Access Memory)), a magnetic disk device, or the like.

  The OS 13 includes a network protocol 131 and a network communication driver 132.

  FIG. 3 is a diagram showing an example of the IPsec setting table 121, which holds items such as mode, IKE (Internet Key Exchange) Phase 1 authentication method, IP address / mask, and setting values corresponding thereto.

  FIG. 4 is a diagram showing an example of the log output setting table 123. Log acquisition, IKE Phase 1 communication error, IKE Phase 2 communication error, IKE Phase 2 decryption error, IPsec proposal nonconformity, IPsec communication error, IPsec decryption error, rekey failure Items such as errors and corresponding setting values (ON or OFF) are held.

  FIG. 5 is a diagram showing an example of the log table 125, which includes the date and time when the event occurred, the source IP address src, the destination IP address dst, and the event content.

  6 to 8 are diagrams showing examples of setting screens for IPsec communication. The user performs various settings for IKE Phase 1, IKE Phase 2, and IPsec from the setting panel of the network device 1 that supports IPsec communication. The setting items include a selection type and a type for inputting password information called a key phrase.

  A plurality of stages and respective settings in the communication procedure of IPsec are as follows.

  A connection in IPsec is called SA. In IPsec, an SA is established and communication is performed using the SA. IPsec SA is guaranteed to be complete by various parameters and is encrypted. IPsec has an automatic key exchange method and a manual key exchange method as methods for establishing an SA. In order to use IPsec, the user needs to set which method to use, an automatic key exchange method or a manual key exchange method.

  When establishing an SA for IPsec using an automatic key exchange method, communication called an automatic key exchange protocol IKE is performed in order to exchange IPsec parameters such as a communication protocol and an encryption key. In IKE, first, plaintext communication is performed to exchange a communication protocol and encryption key for IKE, and a connection for key exchange called ISAKMP (Internet Security Association Key Management Protocol) SA is established (IKE Phase 1). Next, the communication protocol and encryption key for IPsec are exchanged with a connection called ISAKMP SA encrypted with the communication protocol and encryption key for IKE (IKE Phase 2). IPsec can establish IPsec SA through these procedures, and can perform security communication.

  In addition, when the automatic key exchange method is used, the SA is reestablished in a certain period. The SA established by the automatic key exchange method has a lifetime set at the time of establishment, and the SA after a certain period of time becomes unusable. Here, in the automatic key exchange method, a new SA is automatically established by IKE.

  Further, the IKE Phase 1 procedure has two operation modes: a Main mode and an Aggressive mode. The user needs to set which mode to use.

  In IKE, the other party is authenticated by the other party authentication method. Four types of partner authentication methods in IKE are defined. Therefore, it is necessary to set which of four types of pre-shared secret key authentication method (Pre-Shared Key), digital signature authentication method, public key authentication encryption method, and improved public key encryption authentication method is used. . Furthermore, there are two types of pre-shared secret key authentication methods: a method for designating a character string as a key for each IP address of a communicating party and a method for designating a character string as a key for each range of IP addresses by mask specification. It is necessary to set which one to use.

  The parameters and values necessary for establishing ISAKMP SA, which is communication for performing IKE Phase 2, are as follows. Cryptographic algorithm (DES-CBC / 3DES-CBC, etc.), hash algorithm (MD5 / SHA1, etc.), partner authentication method (pre-shared secret key authentication method / digital signature authentication method / public key authentication encryption method / improved public key encryption authentication) Scheme), Oakley group (768-bit MODP group / 1024-bit MODP group, etc.).

  The parameters and their values necessary for establishing IPsec SA, which is communication by IPsec, are as follows. AH (Authentication Header) authentication algorithm (such as HMAC-MD5 / HMAC-SHA1), ESP (Encapsulating Security Payload) encryption algorithm (such as NULL / DES-CBC / AES-CBC), ESP authentication algorithm (HMAC-MD5 / HMAC-SHA1) PFS (Perfect Forward Secrecy) group (not used / 768-bit MODP group / 1024-bit MODP group).

  When establishing the SA for IPsec using the manual key exchange method, the IKE Phase 1 and IKE Phase 2 communication is not performed, and the user manually sets all parameters necessary for the IPsec SA. In this case, unlike the automatic key exchange method, no lifetime is set in the SA, so rekeying is not performed and the key is not automatically updated.

  The IPsec communication device transmits, to the communication counterpart device, as a proposal, a number of IKE parameters and a method that can be used among the IKE parameters and the IPsec parameters. The communication partner device performs two-way communication by selecting parameters that can be used from among the proposals.

  FIG. 9 is a diagram showing an example of a log output setting screen. Log acquisition (whether all logs are acquired), IKE Phase 1 communication error, IKE Phase 2 communication error, IKE Phase 2 decryption error, IPsec proposal nonconformity, IPsec For items such as a communication error, an IPsec decryption error, and a rekey failure error, buttons for selecting ON or OFF according to whether or not to output the log are provided. When the log output is set to ON, a log is output not only for an error but also for success (indicating that there was no error).

  FIG. 10 is a sequence diagram showing a processing example of IPsec communication, and shows an example in which communication is performed between the network device 1A and the network device 1B. In FIG. 10, when the automatic key exchange method is used in IPsec, the IKE encryption algorithm / IKE key is exchanged between the network device 1A and the network device 1B in IKE Phase 1 (steps S101 and S102). If the settings are incorrect, an error may occur at this stage.

  When the IKE Phase 1 is successful, the IPsec encryption algorithm / IPsec security protocol / IPsec key are exchanged between the network device 1A and the network device 1B in the IKE Phase 2 (steps S103 and S104). If the settings are incorrect, an error may occur at this stage.

  When IKE Phase 2 is successful, IPsec communication can be performed (steps S105 and S106).

  In this way, IPsec communication can be performed through IKE Phase 1 and IKE Phase 2 communication. Since communication using IKE Phase 2 (ISAKMP SA) is encrypted based on information exchanged using IKE Phase 1, it cannot be performed without information exchanged using IKE Phase 1, and communication using IPSec (IPSec). Similarly, SA) cannot be performed without the information exchanged in IKE Phase2.

  FIG. 11 is a flowchart illustrating an example of a process for outputting a log during IPsec communication. When the user has already set the IPsec setting and the log output setting has been set, when the IPsec communication is started, the process according to the flowchart of FIG.

  When the process is started (step S201), first, IKE Phase 1 communication is performed (step S202), and communication error information is output (steps S203 to S205).

  Next, IKE Phase 2 communication is performed according to the information of IKE Phase 1 (step S206). Here, in addition to the communication error, an error when the encrypted communication cannot be normally performed due to inappropriate information of IKE Phase 1 and an error when the proposal with the communication partner is incompatible are notified ( Steps S207 to S215).

  Next, IPsec communication is performed according to the information of IKE Phase 2 (step S216). Here, in addition to the communication error, an error when the encrypted communication cannot be normally performed due to inappropriate information of IKE Phase 2 is notified (steps S217 to S223).

  FIG. 12 is a flowchart showing an example of processing for outputting a log of a rekey failure error after the start of IPsec communication. In FIG. 12, when the process is started (step S301), a rekey process is performed (step S302), and it is determined whether a rekey failure error has occurred (step S303). If an error occurs, a failure log is output (step S305), and the process ends (step S306).

  FIG. 13 is a diagram showing an example of a log to be output, which outputs which type of error has occurred in communication with which partner at each time. As a result, the user can determine the reason for failure when IPsec communication fails. Further, even when successful, it is possible to grasp the communication status by displaying whether or not the connection with any setting parameter is successful. The IPsec log output can be displayed on a display panel installed in the network device 1 such as an MFP in addition to a PC monitor. The display panel outputs an IPsec log output as character information using a liquid crystal panel, CRT, or the like.

  Further, the IPsec log output result shown in FIG. 13 can be referred from an external telnet terminal. In this case, a telnet server is included in the network device 1 so that a telnet connection from the outside can be performed.

  Similarly, the IPsec log output result shown in FIG. 13 can be referred from an external Web browser. In this case, the network device 1 includes a Web server so that external Web connection can be performed.

  As described above, according to the present invention, by notifying the user of the cause of specifying an error in the IPsec procedure, it becomes easy to specify the cause of the setting failure of the user when IPsec communication fails.

  In addition, by supporting automatic key exchange, it is possible to output logs for operations that are not performed directly by the user, such as logs during rekeying, and it is easy to identify the cause of unexpected errors related to inadequate user settings. become.

  In addition, since the devices support IPv6 communication, they can access each other across segments by an address uniquely given to the devices. By applying the present invention to an IPv6 communication-compatible device, a log output function can be provided to more devices.

  Further, by displaying the log on a display panel installed in the device, the IPsec error log can be referred to by the device alone.

  Further, by accumulating IPsec communication logs in the device, it becomes possible to track problems related to past connections.

  Further, the amount of error information that is output increases as the number of IPsec communications increases. However, by narrowing down the error information to be output, it is easier to identify the cause of the setting error.

  Further, by having a telnet system in the network device, it is easy to refer to an error log from an external terminal.

  In addition, by having a Web system in the network device, it is easy to refer to an error log from an external terminal.

  The present invention has been described above by the preferred embodiments of the present invention. While the invention has been described with reference to specific embodiments, various modifications and changes may be made to the embodiments without departing from the broad spirit and scope of the invention as defined in the claims. Obviously you can. In other words, the present invention should not be construed as being limited by the details of the specific examples and the accompanying drawings.

1 is an overall configuration diagram showing an embodiment of a network system using a network device of the present invention. It is a software module block diagram which shows the internal structural example of a network apparatus. It is a figure which shows the example of an IPsec setting table. It is a figure which shows the example of a log output setting table. It is a figure which shows the example of a log table. FIG. 6 is a diagram (part 1) illustrating an example of a setting screen for IPsec communication; FIG. 10 is a second diagram illustrating an example of a setting screen for IPsec communication; FIG. 10 illustrates an example of a setting screen for IPsec communication (part 3); It is a figure which shows the example of the setting screen of log output. It is a sequence diagram which shows the example of a process of IPsec communication. It is a flowchart which shows the example of a process which outputs a log in the case of IPsec communication. It is a flowchart which shows the process example which outputs the log of the rekey failure error after IPsec communication start. It is a figure which shows the example of the log output.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1, 1A-1D Network apparatus 11 Application 12 Network control part 121 IPsec setting table 122 IPsec communication part 123 Log output setting table 124 IPsec status determination part 125 Log table 13 OS
131 Network Protocol 132 Network Communication Driver 2 Router 3, 4 Network

Claims (16)

A network device compatible with IPsec communication,
Means for holding setting parameters necessary for IPsec connection set by a user;
Means for holding the error information output level set by the user;
A network device comprising means for notifying a user of error information generated in the course of IPsec communication. The network device according to claim 1,
A network device characterized in that a protocol corresponding to IPv6 communication is used as a protocol for making an IPsec. The network device according to claim 1,
A network device characterized in that a protocol corresponding to IPv4 communication is used as a protocol for making an IPsec. The network device according to claim 1,
A network device comprising a display panel for notifying a user of error information generated in the course of IPsec communication. The network device according to claim 1,
A network device comprising storage means for storing error information generated in the past IPsec communication process. The network device according to claim 1,
A network device in which a user sets the type of error information to be output. The network device according to claim 1,
A network device comprising a telnet system capable of referring to error information generated in the course of IPsec communication from an external telnet terminal. The network device according to claim 1,
A network device comprising a Web system capable of referencing error information generated in the course of IPsec communication from an external Web browser. An error notification method for an IPsec communication compatible network device,
Holding a setting parameter required for the IPsec connection set by the user;
A step of maintaining an error information output level set by a user;
An error notification method for a network device, comprising: a step of notifying a user of error information generated in the course of IPsec communication. The error notification method for a network device according to claim 9,
An error notification method for a network device, characterized in that a protocol corresponding to IPv6 communication is used as a protocol for realizing IPsec. The error notification method for a network device according to claim 9,
An error notification method for a network device, characterized in that a protocol corresponding to IPv4 communication is used as a protocol for realizing IPsec. The error notification method for a network device according to claim 9,
An error notification method for a network device comprising a step of notifying a user of error information generated in the course of IPsec communication by a display panel. The error notification method for a network device according to claim 9,
An error notification method for a network device comprising a step of accumulating error information generated in the past IPsec communication process in a storage means. The error notification method for a network device according to claim 9,
An error notification method for a network device, wherein a user sets the type of error information to be output. The error notification method for a network device according to claim 9,
An error notification method for a network device, comprising: a step of allowing error information generated during IPsec communication to be referred to from an external telnet terminal by a telnet system. The error notification method for a network device according to claim 9,
An error notification method for a network device comprising a step of allowing error information generated in the course of IPsec communication to be referred to from an external Web browser by a Web system.

Images