JP2009038512A - Encrypted information communication device, encrypted information communication system, and encrypted information communication method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an encrypted information communication device capable of securely protecting prior shared parameter information by preventing an invite message from being secretly looked at without going through a server with a simple configuration, an encrypted information communication system, and an encrypted information method and program. <P>SOLUTION: A communication path is established by using IPv6 address privacy extension between encrypted information communication devices for performing IPsec communication, security association prior shared parameter information is exchanged to thereby register the IPv6 global addresses of the both determined dynamically by a DHCP, or the like, and a temporary IPv6 privacy extension is used to exchange the security association prior shared parameter information. In addition, encryption is performed on the IPv6 address privacy extension to exchange the security association prior shared parameter information. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an encrypted information communication apparatus, an encrypted information communication system, an encrypted information communication method, and a program for performing encrypted communication using an IPsec protocol via an IPv6 network.

  In IPv6, IPsec for performing encrypted communication is standardized by RFC (Request For Comment) as a standard function. In performing encrypted communication by IPsec, it is necessary to negotiate in advance which communication device and which communication device perform encrypted communication with which encryption key and with which encryption algorithm. By establishing and sharing such negotiation parameters for encryption as a security association by a protocol based on IKE (Internet Key Exchange), encrypted communication by IPsec can be performed. However, in the Internet world, there is no guarantee that the IP address of the information communication device will always take a constant value. For example, if the IP address is assigned by DHCP (Dynamic Host Configuration Protocol), Is assigned a different IP address. Since it is necessary to register a parameter with a pair of an IP address and an IP address in a security association, when such an IP address changes dynamically, it is not possible to specify a partner to perform a specific encrypted communication. Security association cannot be established. Therefore, the pre-shared parameter information such as the IP address, encryption algorithm, encryption key, etc. is registered in the SIP (Session Initiation Protocol) server, and the pre-shared parameter information of the other party is set prior to starting the encrypted communication. A method is used in which the security association is obtained through the SIP server and the security association according to the IKE protocol is established.

  An example of such an encrypted information communication system is a security policy setting method described in Patent Document 1.

  In the encrypted information communication system described in Patent Document 1, an encrypted information communication apparatus that wishes to perform encrypted communication registers the pre-shared parameter information of its security association with the SIP server using the SDP protocol. In addition, the pre-shared parameter information of the security association of the encrypted information communication device of the communication partner is acquired using the SIP Invite message. As a result, even between encrypted information communication apparatuses whose IP addresses are dynamically determined by DHCP or the like, it becomes possible to obtain the pre-shared parameter information of each other's IP address and the security association and establish the security association by IKE. Communication by IPsec can be performed.

  A conventional encrypted information communication system will be specifically described.

  FIG. 6 is a flowchart showing a process for exchanging pre-shared parameter information for security association in a conventional encrypted information communication system. The encrypted information communication apparatus 11 on the transmission side executes Steps S1 to S7, and the encrypted information communication apparatus 12 on the reception side executes Steps S11 to S16. Messages are transmitted and received through the SIP server 10.

  In FIG. 6, the encrypted information communication device 11 on the transmission side sets pre-shared parameters related to its own security association using the Session Description Protocol (SDP) defined in RFC2327 at the start of IPsec communication ( Step S1). Next, the set pre-shared parameter is attached to the Invite message of the Session Initiation Protocol (SIP) defined in RFC3261 (step S2) and transmitted to the SIP server 10 (step S3).

  The SIP server 10 searches for a destination encrypted information communication device and transfers a SIP Invite message.

  When the encrypted information communication apparatus 12 on the receiving side receives the SIP Invite message (step S11), it extracts the SDP information of the transmission source from the transmitted message (step S12). Next, the encrypted information communication apparatus 12 on the receiving side uses the SDP to set a pre-shared parameter related to its own security association (step S13). Further, the SDP information is attached to the SIP OK message (step S14), and the SIP OK message is transmitted to the SIP server 10 (step S15). When the transmission is completed, the encrypted information communication device on the reception side sets the security association pre-shared parameter information on the transmission side and its own security association pre-shared parameter information in the SA parameter table and ends the flow on the reception side. (Step S16).

  Upon receiving the SIP OK message transmitted in step S15, the SIP server 10 transfers the SIP OK message to the transmission source that first transmitted the SIP Invite message. When receiving the SIP OK message (step S4), the encrypted information communication apparatus 11 of the transmission source extracts the SDP information of the communication partner from the received message (step S5). Further, the other party's security association pre-shared parameter information is extracted from the SDP (step S6), and the receiving-side security association pre-shared parameter information and the user's own security association pre-shared parameter information are paired and transmitted in the SA parameter table. The side flow is terminated (step S7).

As described above, the conventional encrypted information communication system communicates with the information communication apparatus having an unspecified IP address by performing communication by placing the pre-shared parameter information of the communication partner on the Invite message of the SIP server 10. The pre-shared parameter information for establishing the security association can be exchanged between them, the security association can be established by IKE, and encrypted communication by IPsec can be performed.
JP 2006-50407 A

  However, in such a conventional encrypted information communication system, it is premised that the communication is made via a SIP server. When the SIP server goes down, the pre-shared parameter information for establishing the security association is exchanged. Can not. If the pre-shared parameter information cannot be exchanged, the SA cannot be established between devices, and IPsec communication cannot be performed.

  Further, since communication with a specific SIP server is not encrypted, when exchanging pre-shared parameter information for originally performing encrypted communication, the exchanged communication is peeped, and IPsec security is not guaranteed. . For example, since the communication with the SIP server is not concealed, it is possible to look through the SIP Invite message, obtain pre-configuration information for establishing the SA, and misrepresent it.

  The present invention has been made in view of the above, and an encrypted information communication that can protect a pre-shared parameter information safely by preventing a peep of an Invite message without using a server with a simple configuration. An object is to provide an apparatus, an encrypted information communication system, an encrypted information communication method, and a program.

  The encrypted information communication apparatus according to the present invention is an encrypted information communication apparatus that performs encrypted communication using the IPsec protocol via an IPv6 network, and is necessary for establishing IPsec security association (SA) information using the IKE protocol. Security association pre-shared parameter information exchanging means for exchanging pre-shared parameter information, and IPv6 Address Privacy Extension for generating / deleting an IPv6 Address Privacy Extension to be assigned to each other on the transmitting side and the receiving side connected via the IPv6 network Prior to the security association between the generation / deletion means and the IPv6 Address Privacy Extension assigned to each other Security that establishes a security association for IPsec by performing IKE communication using communication means for transmitting and receiving protocol procedures for exchanging shared parameter information and security association pre-shared parameter information exchanged by the security association pre-shared parameter information exchanging means It adopts a configuration comprising association establishing means.

  An encrypted information communication system according to the present invention is an encrypted information communication system including a plurality of encrypted information communication devices that perform encrypted communication using an IPsec protocol via an IPv6 network. Use the configuration to be used.

  The encrypted information communication method according to the present invention is an encrypted information communication method comprising a plurality of encrypted information communication devices that perform encrypted communication using the IPsec protocol via an IPv6 network, and includes an IPsec security association (SA). A security association pre-shared parameter information exchange step for exchanging pre-shared parameter information necessary for establishing information by the IKE protocol, and an IPv6 Address for assigning each other between the transmitting side and the receiving side connected via the IPv6 network An IPv6 Address Privacy Extension generation / deletion step for generating / deleting a privacy extension, and the IPv6 address privacy extensions assigned to each other. a communication step for transmitting and receiving a protocol procedure for exchanging security association pre-shared parameter information between ntions, and IKE communication is performed using the security association pre-shared parameter information exchanged by the security association pre-shared parameter information exchanging means. A security association establishing step for establishing a security association.

  From another viewpoint, the present invention is a program for causing a computer to execute each step of the encrypted information communication method.

  According to the present invention, since the security association pre-shared parameter information is exchanged between two encrypted information communication apparatuses that perform encrypted communication, a server becomes unnecessary, and encrypted communication cannot be performed if the server goes down. Can be prevented.

  Further, since security association pre-shared parameter information is exchanged between IPv6 Address Privacy Extensions of the IPv6 protocol, the addresses used for communication are different each time, and peeping can be prevented. In addition, since the security association pre-shared parameter information is exchanged after being encrypted, the security association pre-shared parameter information can be safely protected even if it is looked into.

  Further, since communication is performed between IPv6 Address Privacy Extensions that are temporarily generated, it is possible to prevent data from being captured in advance.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

(Embodiment)
FIG. 1 is a block diagram showing a schematic configuration inside an encrypted information communication apparatus of an encrypted information communication system according to an embodiment of the present invention.

  In FIG. 1, an encrypted information communication system 100 includes an encrypted information communication device 110, an encrypted information communication device 120 having the same configuration as the encrypted information communication device 110, an encrypted information communication device 110, and encrypted information. An IPv6 network 130 that connects the communication device 120 is included.

  The encrypted information communication device 110 will be described as a transmission-side encrypted information communication device, and the encrypted information communication device 120 will be described as a reception-side encrypted information communication device. The encrypted information communication device 120 has the same configuration as that of the encrypted information communication device 110, and thus description thereof is omitted.

  The encrypted information communication apparatus 110 includes a security association pre-shared parameter storage unit 111, a security association pre-shared parameter information exchange unit 112, an IPv6 Address Privacy Extension exchange unit 113, an encryption key generation unit 114, an encryption key storage unit 115, and an encryption path generation unit. Unit 116, IPv6 Address Privacy Extension generation / deletion unit 117, parameter transmission unit 118, and parameter reception unit 119.

  Also, the encrypted information communication apparatus 110 is given an IPv6 Global Address 121 that is dynamically determined by the DHCP protocol or IPv6 RA at startup, and temporarily exchanges IPv6 Address Privacy parameters when exchanging security association pre-shared parameter information. Extension 122 is given. The IPv6 Address Privacy Extension 122 will be described later with reference to FIG.

  The security association pre-shared parameter information exchanging unit 112 exchanges pre-shared parameter information necessary for establishing IPsec security association (SA) information using the IKE protocol. Further, the security association pre-shared parameter information exchanging unit 112 encrypts the security association pre-shared parameter information with the generated encryption key. The security association pre-shared parameter information includes the IPv6 Global Address on the transmission side or the reception side and the pre-shared key used in the IKE protocol. Specifically, the security association pre-shared parameter information exchange unit 112 receives the security association pre-shared parameter information including its own IPv6 Global Address, which is necessary when exchanging keys by IKE for IPsec communication, as a parameter transmission unit 118 and a parameter reception unit. It is exchanged by 119 and registered in the security association pre-shared parameter storage unit 111.

  The IPv6 Address Privacy Extension exchange unit 113 sets a communication path using a temporary IPv6 Address Privacy Extension.

  The encryption key generation unit 114 generates an encryption key using the interface ID of the IPv6 Address Privacy Extension on the transmission side and the reception side when exchanging parameters.

  The encryption key storage unit 115 stores the encryption key generated by the encryption key generation unit 114.

  The encryption path generation unit 116 generates an encryption path for exchanging advance information necessary for SA establishment. The key information for securing the encryption path is generated from both IPv6 Privacy Extension Addresses.

  The IPv6 Address Privacy Extension generation / deletion unit 117 performs allocation between the encrypted information communication device 110 on the transmission side and the encrypted information communication device 120 on the reception side that are connected via the IPv6 network 130.

  The parameter transmission unit 118 and the parameter reception unit 119 constitute a communication unit that transmits and receives a protocol procedure for exchanging security association pre-shared parameter information between the IPv6 Address Privacy Extension creation / deletion function and the IPv6 Address Privacy Extension.

  FIG. 2 is a block diagram when generating an encryption key for exchanging security association pre-shared parameter information.

  In FIG. 2, IPv6 Address Privacy Extension 122 includes a prefix part 122a and an interface ID part 122b.

  When the interface ID unit 122b of the IPv6 Address Privacy Extension 122 on the transmitting side and the interface ID unit 122b of the IPv6 Address Privacy Extension 122 on the receiving side are input, the encryption key generating unit 114 generates an encryption key, and the encryption key storage unit 115 Save to. The algorithm by which the encryption key generation unit 114 generates the encryption key from the interface ID is, for example, a method of setting the interface ID on the transmission side to the upper 64 bits and the interface ID on the reception side to the lower 64 bits, A method of alternately arranging one bit at a time is conceivable.

  FIG. 3 is a diagram illustrating an example of security association pre-shared parameter information stored in the security association pre-shared parameter storage unit 111.

  In FIG. 3, the security association pre-shared parameter information 200 stores an identification ID 201, a communication partner IPv6 Global Address 202, an IKE pre-shared key 203, a protocol 204 for performing IPsec communication, a port number 205, and an encryption type 206. . For example, the protocol 204 is set to TCP / UDP / ICMP or ANY including everything. The port number 205 is set to ANY indicating a port to be designated or all port numbers. As the encryption type 206, AH or ESP, which is the encryption type 206 of IPsec, AH + ESP that performs both AH and ESP, and the like are set.

  Hereinafter, the operation of the encrypted information communication system 100 configured as described above will be described.

  FIG. 4 is a flowchart showing a procedure for exchanging address information between IPv6 Address Privacy Extensions. The encrypted information communication apparatus 110 on the transmission side executes steps S21 to S25, and the encrypted information communication apparatus 120 on the reception side executes steps S31 to S33.

  In FIG. 4, the encrypted information communication apparatus 110 on the transmission side has started the IPv6 Address Privacy Extension request processing (step S20). In the encrypted information communication apparatus 120 on the receiving side, the address privacy extension response process is activated (step S30).

  The encrypted information communication apparatus 110 on the transmission side determines whether or not the security association (SA) pre-shared parameter information regarding the encrypted information communication apparatus 120 on the receiving side that is the connection destination exists in the security association pre-shared parameter storage unit 111. Check (step S21).

  If the parameter information does not exist, the encrypted information communication apparatus 110 on the transmission side refers to the DNS (Domain Name System) of the connection destination and resolves the IP address (step S22). Next, the IPv6 Address Privacy Extension generation / deletion unit 117 of the encrypted information communication apparatus 110 on the transmission side generates a new IPv6 Address Privacy Extension as its transmission address (step S23). Next, the IPv6 Privacy Address exchange unit 113 of the encrypted information communication apparatus 110 on the transmission side requests the IPv6 Address Privacy Extension from the parameter transmission unit 118 to the connection destination (Step S24).

  On the other hand, the encrypted information communication apparatus 120 on the receiving side is in a state of waiting for receiving a packet (step S31). When receiving the packet, the encrypted information communication apparatus 120 on the receiving side generates a new IPv6 Address Privacy Extension as its own response address from the IPv6 Address Privacy Extension generation / deletion unit 117 (step S32). Next, the encrypted information communication apparatus 120 on the receiving side generates a packet for response by the IPv6 Privacy Address exchanging unit 113, and responds its own IPv6 Address Privacy Extension to the request source from the parameter transmitting unit 118 (Step S1). S33).

  When receiving the response message from the connection destination (step S25), the encrypted information communication apparatus 10 on the transmission side ends the IPv6 Address Privacy Extension request processing.

  Next, processing for exchanging security association (SA) pre-shared parameter information will be described.

  FIG. 5 is a flowchart showing a process for exchanging security association (SA) pre-shared parameter information. The encrypted information communication device 110 on the transmission side executes steps S41 to S46, and the encrypted information communication device 120 on the reception side executes steps S51 to S56.

  As shown in FIG. 2, the encryption key generation unit 114 of the encrypted information communication device 110 on the transmission side uses the security association from the IPv6 Address Privacy Extension on both the transmission side and the reception side acquired in step S25 of FIG. An encryption key for exchanging the pre-shared parameter information 200 (see FIG. 3) is generated (step S41 in FIG. 5). The generated encryption key is stored in the encryption key storage unit 115.

  Next, the encryption information communication apparatus 110 on the transmission side generates security association pre-shared parameter information 200 including its own IPv6 Global Address and IKE pre-shared key, and uses the encryption key stored in the encryption key storage unit 115. Using this, encryption is performed (step S42). Thereafter, the security association pre-shared parameter information 200 encrypted in step S42 is transmitted to the connection destination (step S43).

  On the other hand, the encrypted information communication apparatus 120 on the reception side performs the same operation as the encryption key generation unit 114 of the encrypted information communication apparatus 110 on the transmission side. That is, the encryption key generation unit 114 of the encrypted information communication device 120 on the reception side uses the security association pre-shared parameter from the IPv6 Address Privacy Extension on both the transmission side and the reception side acquired in Step S31 and Step S32 of FIG. An encryption key for exchanging information is generated (step S51). The generated encryption key is stored in the encryption key storage unit 115.

  Next, the encrypted security association pre-shared parameter information is received from the encrypted information communication apparatus 110 on the transmission side (step S52). When the parameter is received, the received security association pre-shared parameter information is decrypted using the encryption key stored in the encryption key storage unit 115 (step S53). If the security association pre-shared parameter information can be decrypted normally, a response message is transmitted (step S54). When the transmission of the response message is completed, the encrypted information communication apparatus 120 on the reception side stores the security association pre-shared parameter information in the security association pre-shared parameter storage unit 111 (step S55). Next, the IPv6 Address Privacy Extension used as the communication path is deleted (step S56), and the pre-shared parameter information exchange process of the encrypted information communication apparatus 120 on the receiving side is terminated.

  On the other hand, the encrypted information communication apparatus 110 on the transmission side receives a response message from the encrypted information communication apparatus 120 on the reception side (step S44). When receiving the response message, the encrypted information communication device 110 on the transmission side stores the security association pre-shared parameter information in the security association pre-shared parameter storage unit 111 (step S45). Next, the IPv6 Address Privacy Extension used as the communication path is deleted (step S46), and the pre-shared parameter information exchange process of the encrypted information communication apparatus 110 on the transmission side is terminated.

  As described above in detail, according to the present embodiment, a communication path is set using IPv6 Address Privacy Extension between encrypted information communication apparatuses for performing IPsec communication, and exchange of security association pre-shared parameter information is performed. In addition to registering both IPv6 Global Addresses dynamically determined by DHCP, etc., and exchanging security association pre-shared parameter information using temporary IPv6 Privacy Extension, peep by packet capture Can be prevented. Further, since the security association pre-shared parameter information is exchanged by performing encryption on the IPv6 Address Privacy Extension, the parameter information can be safely protected even if a peep is performed.

  The above description is an illustration of a preferred embodiment of the present invention, and the scope of the present invention is not limited to this. For example, this is an example applied to an encrypted information communication system that performs encrypted communication using the IPsec protocol via an IPv6 network. However, the IPv6 network may be used, and if a higher version including the IPv6 network function is formulated, Is also included.

  In the present embodiment, the names of the encrypted information communication apparatus, the encrypted information communication system, and the encrypted information communication method are used. However, this is for convenience of explanation, such as the encrypted communication system, the security association method, and the like. Of course, it may be.

  Further, any part of the encrypted information communication apparatus and the encrypted information communication system, for example, the type, number and connection method of the encryption key generation part may be used.

  The encrypted information communication method described above is also realized by a program for causing the encrypted information communication method to function. This program is stored in a computer-readable recording medium.

  As described above, the encrypted information communication device, the encrypted information communication system, the encrypted information communication method, and the program according to the present invention encrypt the security association pre-shared parameter information for establishing the security association required for IPsec communication. In addition, since the exchange is performed on the communication path on the IPv6 Address Privacy Extension, it is possible to exchange parameters safely and to prevent malicious users from peeping at the encryption key information. In addition, it is useful as an encrypted information communication system capable of establishing a security association even in a network environment such as DHCP in which an IP address is dynamically determined.

The block diagram which shows schematic structure inside the encryption information communication apparatus of the encryption information communication system which concerns on embodiment of this invention. The block diagram at the time of producing | generating the encryption key for exchanging the security association pre-shared parameter information of the encryption information communication apparatus concerning this Embodiment The figure which shows an example of the security association pre-shared parameter information stored in the security association pre-shared parameter storage part of the encryption information communication apparatus which concerns on this Embodiment The flowchart which shows the procedure which performs the address information exchange between the IPv6 Address Privacy Extension of the encryption information communication apparatus which concerns on this Embodiment The flowchart which shows the process which exchanges the security association (SA) pre-shared parameter information of the encryption information communication apparatus concerning this Embodiment Flow diagram showing processing for exchanging pre-shared parameter information of security association in a conventional encrypted information communication system

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Encryption information communication system 110,120 Encryption information communication apparatus 130 IPv6 network 111 Security association pre-shared parameter storage part 112 Security association pre-shared parameter information exchange part 113 IPv6 Address Privacy Extention exchange part 114 Encryption key generation part 115 Encryption key storage Unit 116 encryption path generation unit 117 IPv6 Address Privacy Extension generation / deletion unit 118 parameter transmission unit 119 parameter reception unit

Claims (12)

An encrypted information communication apparatus that performs encrypted communication using an IPsec protocol via an IPv6 network,
Security association pre-shared parameter information exchanging means for exchanging pre-shared parameter information necessary for establishing IPsec security association (SA) information by the IKE protocol;
An IPv6 Address Privacy Extension generation / deletion means for generating / deleting an IPv6 Address Privacy Extension that assigns to each other on the transmission side and the reception side connected via the IPv6 network;
Communication means for transmitting and receiving a protocol procedure for exchanging security association pre-shared parameter information between the mutually assigned IPv6 Address Privacy Extensions,
An encrypted information communication apparatus that establishes a security association for IPsec by performing IKE communication using the security association pre-shared parameter information exchanged by the security association pre-shared parameter information exchanging means. The IPv6 Address Privacy Extension generation / deletion unit generates an IPv6 Address Privacy Extension for exchanging the security association pre-shared parameter information between the transmission side and the reception side,
The communication unit sets a communication path between the generated IPv6 Address Privacy Extension on the transmission side and the IPv6 Address Privacy Extension on the reception side,
The security association pre-shared parameter information exchanging means performs the security association pre-shared parameter information exchange,
The encrypted information communication according to claim 1, wherein the IPv6 Address Privacy Extension generation / deletion unit deletes each IPv6 Address Privacy Extension when the security association pre-shared parameter information exchange by the security association pre-shared parameter information exchange unit is completed. apparatus. An encryption key generating means for generating an encryption key from the lower 64 bits of the interface ID of the IPv6 Address Privacy Extension on the sending side and the lower 64 bits of the interface ID of the IPv6 Address Privacy Extension on the receiving side;
The encrypted information communication apparatus according to claim 1, further comprising: an encryption key storage unit that stores the generated encryption key.   4. The encrypted information communication apparatus according to claim 3, wherein the security association pre-shared parameter information exchanging unit encrypts the security association pre-shared parameter information based on the encryption key generated by the encryption key generating unit.   The encrypted information communication apparatus according to claim 1, wherein the security association pre-shared parameter information includes a pre-shared key used in an IPv6 Global Address on a transmitting side or a receiving side and an IKE protocol. An encrypted information communication system comprising a plurality of encrypted information communication devices that perform encrypted communication using an IPsec protocol via an IPv6 network,
An encrypted information communication system using the encrypted information communication apparatus according to any one of claims 1 to 5. An encrypted information communication method comprising a plurality of encrypted information communication devices that perform encrypted communication using the IPsec protocol via an IPv6 network,
A security association pre-shared parameter information exchange step for exchanging pre-shared parameter information necessary for establishing IPsec security association (SA) information by the IKE protocol;
An IPv6 Address Privacy Extension generation / deletion step for generating / deleting an IPv6 Address Privacy Extension that assigns each other between the transmitting side and the receiving side connected via the IPv6 network;
A communication step of transmitting and receiving a protocol procedure for exchanging security association pre-shared parameter information between the mutually assigned IPv6 Address Privacy Extensions;
An encrypted information communication method comprising: a security association establishing step of performing IKE communication using the security association pre-shared parameter information exchanged by the security association pre-shared parameter information exchanging means and establishing a security association for IPsec. In the IPv6 Address Privacy Extension generation / deletion step, when exchanging the security association pre-shared parameter information between the transmission side and the reception side, each IPv6 Address Privacy Extension is generated,
In the communication step, a communication path is set between the generated IPv6 Address Privacy Extension on the transmission side and the IPv6 Address Privacy Extension on the reception side,
In the security association pre-shared parameter information exchange step, the security association pre-shared parameter information exchange is performed,
8. The encrypted information communication according to claim 7, wherein, in the IPv6 Address Privacy Extension generation / deletion step, when the security association pre-shared parameter information exchange by the security association pre-shared parameter information exchanging means ends, each IPv6 Address Privacy Extension is deleted. Method. An encryption key generation step for generating an encryption key from the lower 64 bits of the interface ID of the IPv6 Address Privacy Extension on the sending side and the lower 64 bits of the interface ID of the IPv6 Address Privacy Extension on the receiving side;
The encryption information communication method according to claim 7, further comprising an encryption key storage step of storing the generated encryption key.   8. The encrypted information communication method according to claim 7, wherein, in the security association pre-shared parameter information exchange step, the security association pre-shared parameter information is encrypted based on an encryption key generated by the encryption key generation unit.   8. The encrypted information communication method according to claim 7, wherein the security association pre-shared parameter information includes a pre-shared key used in the IPv6 Global Address on the transmission side or the reception side and the IKE protocol. The program for making a computer perform each step of the encryption information communication method in any one of Claims 7 thru | or 11.

Images