JP2009060245A - Communication control method, program and communication device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To eliminate inexpedience due to a wait of an IPsec process occurring until an SA with a device of a transmission destination is established when the SA is not established, in IPsec communication. <P>SOLUTION: A communication device 20 executing IPsec communication includes a retention buffer 310 for storing an IP packet therein; an AH/ESP module part 230 subjects an IP packet with an SA with the communication device 20 of a transmission destination established to an IPsec process according to SA data to be transmitted; an AH/ESP task part 240 stores, in the retention buffer 310, an IP packet without having the SA with the communication device 20 of the transmission destination established, and causes an IKE task part 250 to execute an IKE process for establishing the SA; and the AH/ESP task part 240 extracts an IP packet corresponding to the SA established by the IKE process of the IKE task part 250 from the retention buffer 310, subject it to the IPsec process according to the SA data to be transmitted. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a communication control method, a program, and a communication device when a communication device performs IPsec communication with another communication device.

  IPsec is a standard for an encrypted communication system realized at the IP (network layer) level of the TCP / IP protocol, and authentication and encryption are performed in units of IP packets. In IPsec, a logical connection called “SA (Security Association)” is obtained by exchanging and sharing authentication / encryption algorithms and encryption keys used in advance between apparatuses performing IPsec communication (IPsec apparatus). Need to be established. This SA is a unidirectional connection. The establishment of SA is realized by “IKE (Internet Key Exchange)” which is a key exchange protocol.

Further, in IPsec, for example, the following method is known as a recovery method when a failure occurs in one apparatus that performs IPsec communication. That is, the IPsec apparatus in which the failure has occurred notifies the failure information to the IPsec apparatus that has been communicating with reference to the cache. Then, the IPsec apparatus of the communication partner that has received this notification immediately deletes the old SA, starts the IKE process, and re-establishes the SA (for example, see Patent Document 1).
JP 2005-20215 A

  As described above, in IPsec, before performing IPsec communication between devices, it is necessary to perform an IKE process to establish an SA with a communication device of a transmission destination (destination). If the SA is not established, the IP packet is subjected to IPsec processing after establishing the SA with this apparatus. In other words, a “waiting” process occurs between the reception of an IP packet to be transmitted and the IPsec processing of this IP packet. That is, during the “waiting” of this process, the IPsec process cannot be performed on the newly received IP packet. Furthermore, when IPsec communication is performed in parallel with each of a plurality of devices, processing with devices that have not established SA may affect communication with devices that have already established SA. There is sex.

  The present invention has been made in view of the above circumstances, and in the IPsec communication, when the SA with the transmission destination apparatus is not established, the “waiting” for the IPsec process that occurs until the SA is established. The purpose is to eliminate the inconvenience caused by "."

  A first invention for solving the above-described problem is a communication control method when a communication device performs IPsec communication with another communication device, which receives an IP packet and is designated as a destination of the IP packet. It is determined whether the SA data of the communication device is currently registered in the SA database in which SA data related to the established SA is registered. If the SA data is not registered, the IP packet is stored in the hold buffer and registered. In this case, the IP packet is generated according to the registered SA data according to the registered SA data to generate an IPsec packet, which is transmitted to the other communication device of the transmission destination, and the IP packet stored in the hold buffer IKE processing is executed to establish an SA with another communication device designated as the destination of the transmission, and the SA data of the established SA is updated to the SA database. A second process registered in the SA database, and an IP packet destined for another communication apparatus newly registered in the SA database and for which a new SA has been established is searched from the holding buffer, and IPsec is determined according to the SA data. This is a communication control method that performs processing independently to generate an IPsec packet, transmit it to the other communication device of the transmission destination, and independently execute a third process of deleting the IP packet from the hold buffer.

  According to a fourth aspect of the present invention, there is provided a hold buffer for temporarily storing an IP packet, an IKE processing unit that executes IKE processing according to an SA establishment request signal designated by another communication device and generates SA data of the established SA, The SAD management unit that registers and manages the SA data generated by the IKE processing unit in the SA database, and the SA data of another communication device that receives a new IP packet and is designated as the transmission destination of the IP packet A determination unit that determines whether or not the information is registered in the SA database; and when the determination unit determines that the packet has been registered, the determined IP packet is subjected to IPsec processing according to the registered SA data to generate an IPsec packet; A first IP packet processing unit that transmits to another communication device of the transmission destination, and when the determination unit determines that it is unregistered, Causing the IKE processing unit to establish an SA between the hold control unit for storing the specified IP packet in the hold buffer and the other communication device specified as the transmission destination of the IP packet stored in the hold buffer. IP packet whose destination is the other communication device of the established SA is searched from the holding buffer, IPsec processing is performed according to the SA data to generate an IPsec packet, and the packet is transmitted to the other communication device of the destination And a second IP packet processing unit that deletes the IP packet from the hold buffer.

  According to the first or fourth invention, when the communication device performs IPsec communication with another communication device, (1) SA data of the other communication device designated as the transmission destination of the newly received IP packet. Is registered in the SA database, and if registered, IPsec processing is performed according to the registered SA data to generate and transmit an IPsec packet. If not registered, this IP packet is suspended. (2) IKE processing for establishing SA with another communication device designated as the destination of the IP packet stored in the hold buffer is executed, and the SA data of the established SA is converted into SA. Processing for registering in the database, and (3) taking out the IP packet destined for the communication device whose SA is established by the IKE processing from the hold buffer, and performing IPsec processing And generating and transmitting an IPsec packet, the processing is performed independently Te.

  In the conventional method of waiting for processing until the SA is established when the SA with the destination communication device is not established, the IPsec processing for the IP packet newly accepted during the “waiting” of this processing is performed. In addition, when IPsec communication is performed in parallel with a plurality of communication devices, there is a problem in that communication to other communication devices for which SA has already been established is also temporarily stopped. Arise. Therefore, as in the present invention, a process is provided for storing an IP packet having a hold buffer for storing an IP packet, the destination being a communication apparatus for which SA is not established, in the hold buffer, and when a new SA is established. In addition, the IP packet destined for the communication apparatus with the SA established is taken out of the hold buffer, and the IPsec processing is performed independently of the processing for generating and transmitting the IPsec packet. Inconvenience caused by “waiting” can be solved. In other words, for each of the IP packets received one after another, either the IPsec process or the process of storing in the hold buffer can be performed promptly. There is no “waiting” for processing due to the SA being not established with the communication device. In addition, when a plurality of IP packets whose destination is a communication device for which SA is not established are accepted, at the time when the SA is established, these IP packets stored in the hold buffer are collectively processed. Therefore, IPsec processing can be performed efficiently.

  The second invention is the communication control method according to the first invention, and in the second process, when the establishment of SA by the IKE process fails, the other party of the IKE process In the communication control method, an IP packet destined for a communication device is deleted from the hold buffer.

  According to the second aspect of the present invention, when the SA establishment by the IKE process fails, the IP packet destined for the destination communication device of the IKE process is deleted from the hold buffer. As a result, IP packets that cannot be transmitted due to SA establishment failure are deleted, thereby enabling efficient use of the reserved buffer.

  A third invention is a program for causing a computer incorporated in a communication device to execute the communication control method of the first or second invention.

  According to the third aspect of the invention, the same effect as that of the first or second aspect of the invention can be achieved by causing the computer to execute arithmetic processing according to the program.

  Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.

[System configuration]
FIG. 1 is a configuration diagram of a communication system according to the present embodiment. As shown in the figure, in the communication system of the present embodiment, each of a plurality of PCs (Personal Computers) 10 is connected to a communication network N that is the Internet via a communication device 20.

  The communication device 20 is an IPsec device in which IPsec is implemented, and performs encrypted communication (IPsec communication) in which security is ensured by IPsec with other communication devices 20. That is, the communication device 20 performs IPsec processing on the IP packet requested to be transmitted from the PC 10 to generate an IPsec packet, and transmits it to the other communication device 20 via the communication network N. Also, the IPsec packet transmitted from the other communication device 20 is decoded and transferred to the PC 10. In the present embodiment, the communication device 20 is illustrated and described as a separate device of the PC 10, but may be built in the PC 10.

  IPsec is a standard for encrypted communication defined by the IP layer of TCP / IP, which is a standard protocol for the Internet, and performs authentication and encryption in units of IP packets. In IPsec, first, “IPsec-SA (hereinafter simply referred to as“ SA ”)” is established (agreement) by “IKE”, and then IPsec communication according to this SA is performed. “IKE” is a key exchange protocol for generating and exchanging authentication / encryption algorithms and encryption keys to be used by negotiating with a partner apparatus, such as “ISAKMP (Internet Security Association and Key Management Protocol)” and “ Based on "Oakley". The agreement regarding the authentication / encryption algorithm and encryption key agreed upon by the IKE process is “SA”, which is a logical unidirectional connection established with the destination communication device. Corresponds to (tunnel). The SA has a valid period set by the elapsed time from establishment or the amount of transmitted / received packets. When this valid period expires, the SA disappears and a new SA is established (ReKey). Further, along with the establishment of the SA, the “SPI (Security Parameters Index)” associated with the SA is determined. “SPI” is added to the header of the IPsec packet and used to identify the SA to which the SPI is applied. Moreover, in IPsec, as a protocol for authentication / encryption, AH (Authentication Header: authentication header) that provides encryption and authentication functions and ESP (Encapsulating Security Payload: encryption payload) that provides only authentication functions are used. Two types are defined, both or one is used.

  As a feature of the present embodiment, the communication device 20 includes a hold buffer that temporarily stores (holds) IP packets. In this hold buffer 310, when an IP packet is transmitted, if the SA with the destination communication device 20 is not established, the IP packet is stored. When the SA with the destination communication device 20 is established, the IP packet stored in the hold buffer is extracted from the hold buffer 310, converted into IPsec according to the SA, and transmitted to the destination communication device 20.

[Communication device]
FIG. 2 is a block diagram illustrating an internal configuration of the communication device 20. According to the figure, the communication device 20 includes the CPU 110, the flash memory 120, the RAM 130, the IP communication unit 150, and the PC communication unit 140. And is configured.

  CPU 110 is a program or data stored in flash memory 120 or RAM 130, data received from an external device (mainly PC 10 or other communication device 20) via PC communication unit 140 or IP communication unit 150, or the like. Based on the above, various processes such as overall control of the communication device 20 are performed.

  The flash memory 120 stores a system program for the CPU 110 to control the communication device 20 in an integrated manner and a communication control program 121 for realizing the IPsec communication of this embodiment. The RAM 130 is used as a work area of the CPU 110, forms a holding buffer 310, and stores databases such as an IPsec-SAD 320, an IPsec-SPD 330, an ISAKMP-SAD 340, and an ISAKMP-SPD 350.

  The PC communication unit 140 transmits / receives data to / from the connected PC 10. When the communication device 20 is built in the PC 10, the PC communication unit 140 is realized by a bus or the like. The IP communication unit 150 implements the TCP / IP protocol and performs IP communication with another communication device 20 via the communication network N.

[Communication device]
FIG. 3 is a functional configuration diagram relating to the transmission processing of the IPsec packet in the communication device 20. According to the figure, the communication apparatus 20 includes a NETWORK unit 210, an authentication / encryption processing unit 220, an AH / ESP module unit 230, an AH / ESP task unit 240, and an IKE task as functional units related to transmission processing. Unit 250. These processing function units are realized as software executed by the CPU 110. In addition, IPsec-SAD 320, IPsec-SPD 330, ISAKMP-SPD 350, and ISAKMP-SAD 340 are provided as databases.

  The NETWORK unit 210 is equipped with a TCP / IP protocol stack, performs data transmission / reception with the PC 10 and performs IPsec communication with other communication devices 20 for transmission / reception of IPsec packets. Specifically, when an IP packet transmission request is made from the PC 10, the AH / ESP module unit 230 is requested to edit (generate) an IPsec packet. Then, when transmission of the IPsec packet generated in response to this request is requested, this IPsec packet is transmitted to the corresponding other communication device 20 via the communication network N. The NETWORK unit 210 corresponds to the IP communication unit 150 and the PC communication unit 140 in FIG.

  The authentication / encryption processing unit 220 performs data authentication and encryption in response to an authentication / encryption request from the AH / ESP module unit 230 or the AH / ESP task unit 240. As the encryption process, a process according to an algorithm such as DES (Data Encryption Standard), 3DES, or AES (Advanced Encryption Standard) is executed. As the authentication process, a process according to an algorithm such as HMAC-MD5 or HMAC-SHA is executed.

  When a request to edit an IPsec packet is made from the NETWORK unit 210, the AH / ESP module unit 230 refers to the IPsec-SPD 330 and searches the IPsec-SAD 320 for IPsec-SA data corresponding to the requested IP packet. . If the corresponding IPsec-SA data is “present”, the requested IP packet is converted to IPsec according to the IPsec-SA data to generate an IPsec packet, and the NETWORK unit 210 is requested to transmit the generated IPsec packet. At this time, the authentication / encryption processing unit 220 is requested to authenticate / encrypt the IP packet, and in response to this request, the authenticated / encrypted data is converted to IPsec to generate an IPsec packet. On the other hand, if there is no IPsec-SA data corresponding to IPsec-SAD 320, the AH / ESP task unit 240 is requested to establish SA with the communication device 20 that is the destination of the IP packet.

  FIG. 4 is a flowchart for explaining the flow of processing executed by the AH / ESP module unit 230. According to the figure, when a request for editing an IP packet is made from the NETWORK unit 210 (step A1: YES), the AH / ESP module unit 230 establishes an IPsec- with the communication device 20 that is the destination of the requested IP packet. SA data is retrieved from IPsec-SAD 320 (step A3).

  If there is corresponding IPsec-SA data (step A5: YES), the requested IP packet is subjected to IPsec processing according to this IPsec-SA data to generate an IPsec packet (step A7), and the NETWORK unit 210 The transmission of the generated IPsec packet is requested (step A9). On the other hand, if there is no corresponding IPsec-SA data (step A5: NO), the AH / ESP task unit 240 is requested to establish SA with the communication device 20 that is the destination of the requested IP packet (step A11). . Then, it returns to step A1 and repeats the above process.

  Returning to FIG. 3, when the SA establishment request is made from the AH / ESP module unit 230, the AH / ESP task unit 240 requests the IKE task unit 250 to establish the SA, and sends the requested IP packet to the hold buffer 310. Store. When the IKE task unit 250 is notified of the establishment of SA in response to this request, the IP packet destined for the communication device 20 with the established SA is extracted from the hold buffer 310, and the IPsec packet is converted into an IPsec packet. And requests the NETWORK unit 210 to transmit the generated IPsec packet. Here, when there are a plurality of corresponding IP packets, all of them are extracted, and each of them is converted into IPsec to generate an IPsec packet. When the SA establishment failure is notified from the IKE task unit 250, the IP packet destined for the communication device 20 in which the SA establishment has failed is deleted from the hold buffer 310.

  FIG. 5 is a flowchart for explaining the flow of processing executed by the AH / ESP task unit 240. According to the figure, when the SA establishment request is made from the AH / ESP module unit 230 (step B1: YES), the AH / ESP task unit 240 stores the requested IP packet in the hold buffer 310 (step B1). B3) Requests the IKE task unit 250 to establish an SA with the communication device 20 that is the destination of this IP packet (step B5).

  If SA establishment is notified from the IKE task unit 250 (step B7: YES), an IP packet destined for the SA communication device 20 to which the establishment is notified is extracted from the hold buffer 310 (step B9). . Also, the IPsec-SA data of the established SA is searched from the IPsec-SAD 320 (step B11). Then, the extracted IP packet is subjected to IPsec processing according to the searched IPsec-SA data to generate an IP packet (step B13), and the NETWORK unit 210 is requested to transmit the generated IP packet (step B15). If SA establishment failure is notified from the IKE task unit 250 (step B7: NO to B17: YES), the IP packet destined for the SA communication device 20 with the establishment failure is deleted from the hold buffer 310. (Step B19). Then, it returns to step B1 and repeats the above process.

  Returning to FIG. 3, when an SA establishment request is made from the AH / ESP task unit 240, the IKE task unit 250 performs an IKE process of negotiating with the corresponding other communication device 20 to establish an SA. When the SA is established, SA data regarding the established SA is stored in IPsec-SAD 320, and SP (Security Policy) data is stored in IPsec-SPD 330. At the same time, the SA establishment is notified to the AH / ESP task unit 240. On the other hand, if SA establishment fails, the AH / ESP task unit 240 is notified of SA establishment failure.

  FIG. 6 is a flowchart for explaining the flow of processing executed by the IKE task unit 250. According to the figure, if the SA establishment request is made from the AH / ESP task unit 240 (step C1: YES), the IKE task unit 250 performs the IKE process with the requested communication device 20 (step C3). ). As a result, if the SA is successfully established (step C5: YES), the established SA's IPsec-SA data is registered in the IPsec-SAD 320 (step C7), and the SA is established in the AH / ESP task unit 240. (Step C9). On the other hand, if the SA establishment fails (step C5: NO), the AH / ESP task unit 240 is notified of the SA establishment failure (step C11). Thereafter, the process returns to step C1 and the above processing is repeatedly executed.

  Returning to FIG. 3, the IPsec-SAD 320 is a database that stores IPsec-SA data of the apparatus and each of the other communication apparatuses 20. At this time, the IPsec of the apparatus and the communication apparatus 20 in which the SA is established. -SA data is stored.

  The IPsec-SPD 330 is a database that stores IPsec-SP data of the device and each of the other communication devices 20, and, similar to the IPsec-SAD 320, the communication device 20 with which the device and SA are currently established IPsec-SP data is stored. “SP” is a rule that defines whether or not IPsec is applied to each packet. Specifically, a packet that applies IPsec according to the upper layer protocol, the IP address and port number of each of the source and destination, and the like. A “selector” for designating an IP address, an IPsec protocol (AH, ESP) and a mode (transport, tunnel) used when applying IPsec.

  The ISAKMP-SAD 340 is a database that holds ISAKMP-SA data with each other communication device 20 used when the IKE task unit 250 performs IKE processing with the other communication device 20. The ISAKMP-SPD 350 is a database that stores ISAKMP-SP data used when the IKE task unit 250 performs an IKE process with another communication apparatus 20.

  The hold buffer 310 is a buffer capable of storing a plurality of IP packets. FIG. 7A shows the configuration of the hold buffer 310. As shown in FIG. 5A, the hold buffer 310 stores hold packets in time series. FIG. 2B shows a schematic data structure of the hold packet. As shown in FIG. 4B, the pending packet includes, in the IP packet data, the IP address (source IP address) of the communication device that is the transmission source of the IP packet and the IP address (destination IP address) of the communication device that is the transmission destination. Header information such as an address) and a protocol number.

[Processing sequence]
FIG. 8 is a diagram showing a processing sequence at the time of transmitting an IPsec packet, and shows a case where an SA is not established with the destination communication device 20. According to the figure, when a packet transmission request is made from the PC 10 to the communication device 20 (1), the NETWORK unit 210 requests the AH / ESP module unit 230 to edit the IPsec packet (2). Then, the AH / ESP module unit 230 searches the IPsec-SAD 320 for IPsec-SA data corresponding to the requested IP packet, and determines whether or not an SA is established with the communication device 20 as the transmission destination (3). . As a result, when it is determined that the corresponding IPsec-SA data is “none”, the AH / ESP module unit 230 notifies the AH / ESP task unit 240 together with the communication device 20 that is the destination of the IP packet together with the requested IP packet. Request SA establishment during (4).

  Next, the AH / ESP task unit 240 stores the requested IP packet in the hold buffer 310 (5) and requests the IKE task unit 250 to establish SA with the requested communication device 20 (6). Then, the IKE task unit 250 establishes the SA with the requested communication apparatus 20 by performing the IKE process, and registers the IPsec-SA data of the established SA in the IPsec-SAD 320 (7), and the AH / ESP task The SA 240 is notified of the SA establishment (8).

  Then, the AH / ESP task unit 240 extracts (9) the IP packet destined for the communication apparatus 20 with the SA established from the hold buffer 310, and converts it into IPsec according to the IPsec-SA data of the established SA. An IPsec packet is generated (10). Then, the NETWORK unit 210 is requested to transmit the generated IPsec packet (11), and the NETWORK unit 210 transmits the requested IPsec packet to the corresponding other communication device 20 (12).

[Action / Effect]
As described above, according to the present embodiment, the communication device 20 that performs IPsec communication includes the hold buffer 310 that stores the IP packet, and the AH / ESP module unit 230 performs the SA communication with the communication device 20 that is the transmission destination. The IP packet in which the SA is established is subjected to IPsec processing according to the SA data and transmitted, and the AH / ESP task unit 240 holds the IP packet in which the SA with the destination communication device 20 is not established in the hold buffer 310. And the IKE task unit 250 performs the IKE process for establishing the SA, and the AH / ESP task unit 240 receives the IP packet corresponding to the SA established by the IKE process of the IKE task unit 250. Is taken out from the hold buffer 310, processed in IPsec according to the SA data, and transmitted. Each of which is carried out independently of the. That is, for each IP packet that is requested to be transmitted from the PC 10, either the IPsec processing or the storage in the hold buffer 310 is promptly performed. As a result, even if the SA with the destination communication device 20 has not been established, the process does not “wait” until the SA is established.

[Modification]
The application of the present invention is not limited to the above-described embodiment, and it is needless to say that the application can be appropriately changed without departing from the spirit of the present invention.

  For example, in the above-described embodiment, when the SA establishment by the IKE task unit 250 fails, the AH / ESP task unit 240 sends the IP packet destined for the communication apparatus 20 in which the SA establishment has failed to the hold buffer 310. However, the AH / ESP task unit 240 may cause the IKE task unit 250 to establish the SA with the communication device 20 again. Alternatively, the failure of establishment of the SA may be notified to the PC 10 and the IP packet may be deleted from the hold buffer 310 or the SA with the communication device 20 may be reestablished according to an instruction from the PC 10.

The block diagram of a communication system. The internal block diagram of a communication apparatus. The function block diagram regarding the IPsec packet transmission process of a communication apparatus. The flowchart of the process which an AH / ESP module part performs. The flowchart of the process which an AH / ESP task part performs. The flowchart of the process which an IKE task part performs. The block diagram of a pending buffer. Sequence of IPsec packet transmission processing.

Explanation of symbols

10 PC
20 Communication device (IPsec device)
210 NETWORK unit, 220 Authentication / encryption processing unit 230 AH / ESP module unit, 240 AH / ESP task unit 250 IKE task unit 310 Reserved buffer 320 IPsec-SAD, 330 IPsec-SPD
340 ISAKMP-SAD, 350 ISAKMP-SPD

Claims (4)

A communication control method when a communication device performs IPsec communication with another communication device,
Accepts an IP packet, determines whether SA data of another communication device designated as the destination of the IP packet is currently registered in the SA database in which SA data related to the established SA is registered, and is not registered In the case of, the IP packet is stored in the hold buffer, and in the case of registration, the IP packet is subjected to IPsec processing according to the registered SA data to generate an IPsec packet and transmitted to the other communication device of the transmission destination A first process;
A second IKE process is executed to establish an SA with another communication device designated as the destination of the IP packet stored in the hold buffer, and the SA data of the established SA is newly registered in the SA database. And processing
An IP packet that is newly registered in the SA database and has a new SA established as a transmission destination is searched from the holding buffer, and IPsec processing is performed according to the SA data to generate an IPsec packet. A third process of transmitting to the other communication device of the destination and deleting the IP packet from the hold buffer;
Is a communication control method that executes each independently. In the second process, when the establishment of SA by the IKE process fails, an IP packet destined for the other communication device of the other party of the IKE process is deleted from the hold buffer.
The communication control method according to claim 1.   A program for causing a computer built in a communication apparatus to execute the communication control method according to claim 1 or 2. A pending buffer for temporarily storing IP packets;
An IKE processing unit that executes IKE processing in accordance with a designated SA establishment request signal and generates SA data of the established SA;
An SAD management unit that registers and manages SA data generated by the IKE processing unit in an SA database;
A determination unit that receives a new IP packet and determines whether SA data of another communication device designated as a destination of the IP packet is registered in the SA database;
A first IP for generating an IPsec packet by performing IPsec processing on the determined IP packet in accordance with the registered SA data when the determination unit determines that it has been registered, and transmitting it to another communication device as a transmission destination A packet processing unit;
A hold control unit that stores the determined IP packet in the hold buffer when the determination unit determines that it is not registered;
The IKE processing unit establishes an SA with another communication device specified as the destination of the IP packet stored in the hold buffer, and the other communication device of the established SA is the destination. A second IP that retrieves the packet from the hold buffer, performs IPsec processing according to the SA data, generates an IPsec packet, transmits the packet to another communication device of the transmission destination, and deletes the IP packet from the hold buffer A packet processing unit;
A communication device comprising:

Images