JP2009135920A - Communications system, security association continuation method, mobile communications terminal, server apparatus, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To continue a security association (SA), which has been set between a mobile communications terminal and a communications partner apparatus, in an environment where the mobile communications terminal cannot seamlessly move in the communications network. <P>SOLUTION: The mobile communications terminal 12 holds SA information decided between the mobile communications terminal 12 and a communications partner apparatus 15, updates the SA information, and performs encrypted communications between the mobile communications terminal 12 and the communications partner apparatus 15 based on the SA information. A maintenance and management server 17 carries out update of the SA information between the maintenance and management server 17 and the communications partner apparatus 15 in place of the mobile communications terminal 12 when the mobile communications terminal 12 is not connected to an IP network. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a communication system that performs encrypted communication, and in particular, when the continuation of communication by a mobile communication terminal is temporarily disabled, the security association between the mobile communication terminal and a communication partner apparatus is determined as a mobile communication terminal. Relates to a technology that continues until communication becomes possible again.

  An encrypted communication protocol that realizes secure communication by establishing a virtual encrypted communication path between communication terminals that perform communication in an IP (Internet Protocol) -based network is known. A typical example of such an encrypted communication protocol is IPsec (IP Security Protocol). The basic framework of IPsec is defined in IETF (Internet Engineering Task Force) RFC2401 to RFC2412.

  In order for a communication terminal to perform encrypted communication by IPsec, it is necessary to make an agreement with a communication partner in advance regarding parameters such as an authentication algorithm, an encryption algorithm, and an encryption key. Such an arrangement between communication terminals is called a security association (SA). In the present specification, parameters such as an encapsulation mode, an authentication algorithm, an encryption algorithm, and an encryption key negotiated in SA are referred to as SA information.

  IKE (Internet Key Exchange) is standardly used as a key exchange protocol for establishing an IPsec SA used for data encryption in IPsec. IKE is defined in IETF RFCs 2407, 2408, 2409, and 2412. The IKE is divided into two phases. The first half phase is called “IKE phase 1” and the second half phase is called “IKE phase 2”. In IKE phase 1, ISAKMP SA is established. In IKE phase 2, IPsec SA is established. Messages exchanged between communication terminals in the IKE phase 2 are encrypted using the ISAKMP SA established in the IKE phase 1.

  Prior to encrypted communication, it is necessary not only for IPsec but also for other encrypted communication protocols to negotiate parameters such as encryption keys to be used. For this reason, unless otherwise specified, the term SA in this specification is negotiated in advance between communication terminals that perform encrypted communication in general encryption communication protocols including not only IPsec but also other encrypted communication protocols. It means parameters such as authentication algorithm, encryption algorithm and encryption key.

  On the other hand, even when a mobile communication terminal wirelessly connected to an IP-based network moves from one subnet to another subnet with a different network prefix, the connection between the mobile communication terminal and the communication partner device is disconnected. Technological development is being carried out that makes it possible to continue without interruption. For example, mobile IPv4 and mobile IPv6 are techniques for realizing the mobility of mobile communication terminals that change the connection position on the network. The basic framework of Mobile IPv4 and Mobile IPv6 is defined in IETF RFC3344 and RFC3775.

  The IP address changes as the mobile communication terminal moves between subnets by combining the technology for realizing the mobility of mobile communication terminals such as Mobile IPv4 and Mobile IPv6 and the encrypted communication protocol such as IPsec. Even in this case, a technique is known in which encrypted communication between these terminals is continued before and after the movement between subnets without losing the SA between the mobile communication terminal and the communication partner device (for example, patents). Reference 1-5).

Patent Document 6 discloses a technology in which a plurality of security gateways for performing encrypted communication by IPsec are prepared and made redundant, SAs are transferred between the plurality of security gateways through a dedicated communication line, and the SAs are shared. It is disclosed.
JP 2000-332825 A JP 2006-246098 A Japanese Patent Laying-Open No. 2005-210645 JP 2007-184984 A JP 2005-269661 A JP 2002-247113 A

  The techniques disclosed in Patent Documents 1 to 5 described above are cases where the mobile communication terminal moves seamlessly between subnets having different network prefixes, such as when the mobile communication terminal moves between wireless LANs that are set to different subnets. Assumed. In other words, when the physical link between the IP network and the mobile communication terminal that guarantees mobility is temporarily disconnected and the mobile communication terminal cannot move seamlessly between the networks, the IPsec SA validity period elapses. The connection with the communication partner by IPsec is forcibly disconnected. For example, assume that the mobile communication terminal roams from a wireless LAN to a mobile phone network. At this time, when the mobile communication terminal goes out of the wireless LAN area, if the location is out of the service area of the cellular phone network, the IP network The physical link between the mobile communication terminals is temporarily disconnected. In this case, since the mobile communication terminal is wirelessly connected to the mobile phone network, even if the mobile communication terminal reconnects to the IP network, the mobile communication terminal needs to start again from establishment of ISAKMP SA.

  The inventor of the present application studied to keep the past SA as it is even during a period in which the mobile communication terminal is temporarily outside the network area by setting a long SA validity period. However, the encryption communication protocol such as IPsec improves the security by updating the encryption key by periodically updating the SA. For this reason, the method of setting the SA validity period long results in a situation in which the same encryption key is used for a long time, and may not satisfy the necessary security requirements.

  The present invention has been made based on the above-described knowledge, and the object of the present invention is set between a mobile communication terminal and a communication partner device in an environment in which the mobile communication terminal cannot move seamlessly within a communication network. Another object of the present invention is to provide a communication system and an SA continuation method that can continue the SA that has been performed.

  A first aspect of the present invention is a communication system having a mobile communication terminal capable of communicating with a communication partner device while moving in a communication network, and a maintenance management server provided in the communication network. . The mobile communication terminal holds SA information negotiated with the communication partner device, updates the SA information, and performs encrypted communication with the communication partner device based on the SA information. The maintenance management server updates the SA information with the communication partner device instead of the mobile communication terminal when the mobile communication terminal and the communication network are not connected.

  The second aspect of the present invention is an SA continuation method for continuing SA used for encrypted communication between a mobile communication terminal that performs communication while moving in a communication network and a communication partner apparatus. In the SA continuation method according to this aspect, when the mobile communication terminal and the communication network are not connected, the maintenance management server provided in the communication network is configured such that the mobile communication terminal, the communication counterpart device, Updating the SA information negotiated between the mobile communication terminals on behalf of the mobile communication terminal.

  As described above, in the communication system according to the first aspect of the present invention, when the mobile communication terminal and the communication network are not connected, the maintenance management server includes the mobile communication terminal instead of the mobile communication terminal. The SA information is updated with the communication partner apparatus. In other words, even when the mobile communication terminal exists in an environment where it is not possible to move seamlessly within the communication network, until the mobile communication terminal that has been temporarily unable to continue communication is able to communicate again, SA can be continued by the maintenance server. Further, since the maintenance management server updates the SA information with the communication counterpart device, it is not necessary to unnecessarily lengthen the SA validity period.

  The present invention provides a communication system and an SA continuation method capable of continuing an SA set between a mobile communication terminal and a communication partner apparatus in an environment in which the mobile communication terminal cannot move seamlessly within a communication network. be able to.

  Hereinafter, specific embodiments to which the present invention is applied will be described in detail with reference to the drawings. In the drawings, the same elements are denoted by the same reference numerals, and redundant description is omitted as necessary for the sake of clarity.

<Embodiment 1 of the Invention>
The communication system according to the present embodiment includes a mobile communication terminal 12, a home agent 13, and a maintenance management server 17. FIG. 1 is a diagram showing an arrangement example of a mobile communication terminal 12, a home agent 13, and a maintenance management server 17 in an IP-based network (hereinafter referred to as IP network) 1. In the example of FIG. 1, a plurality of subnets 11 </ b> A to 11 </ b> C are connected via a core network 10 to form an IP network 1.

  The mobile communication terminal 12 is wirelessly connected to the wireless base station 14, and belongs to the subnet 11A by performing location registration with the home agent 13. Specific examples of the mobile communication terminal 12 include a portable personal computer, a mobile phone terminal having a data communication function, and a PDA (Personal Digital Assistant). The mobile communication terminal 12 performs encrypted communication by IPsec with the communication partner apparatus 15 belonging to the subnet 11B. In addition, the mobile communication terminal 12 having the subnet 11A as a home network can handoff to a radio area formed by another radio base station (not shown) under the home agent 13 by movement, and a foreign network (not shown). ). The foreign network is another subnet (not shown) managed by another foreign agent (not shown) different from the home agent 13. Although not shown in FIG. 1, the mobile communication terminal 12 not only moves between single types of access networks, for example, between a plurality of wireless LANs, but also between different types of access networks, for example, It may move between a wireless LAN and a mobile phone network or between a wireless LAN and a wired LAN.

  The home agent 13 associates a home address (HoA) fixedly assigned to the mobile communication terminal 12 with a care-of address (CoA: Care of Address) that changes as the mobile communication terminal 12 moves. The data packet that has reached the home address is transmitted to the care-of address. For example, in a mobile IPv4 environment in which a foreign agent is used, the care-of address is the IP address of a foreign agent that exists in the subnet to which the mobile communication terminal 12 belongs. In addition, for example, in the mobile IPv6 environment, the care-of address is the IP address of the mobile communication terminal 12 itself generated by the mobile communication terminal 12 that has recognized that the router has moved to a different subnet by receiving the router advertisement.

  The maintenance management server 17 maintains the SA held by the mobile communication terminal 12 instead of the mobile communication terminal 12 when the mobile communication terminal 12 is temporarily unable to connect to the IP network 1. The situation where the mobile communication terminal 12 cannot temporarily connect to the IP network 1 is, in other words, the situation where the mobile communication terminal 12 cannot seamlessly move between subnets included in the IP network 1. Such a situation occurs, for example, when the mobile communication terminal 12 moves out of the radio wave coverage of the radio base station 14 and the location is not covered by another radio base station or the like. That is, this is a case where the mobile communication terminal 12 moves out of the IP network 1 range. In addition, for example, even when the power supplied to the mobile communication terminal 12 is not sufficient due to the discharge of the battery that supplies power to the mobile communication terminal 12, a situation occurs in which the mobile communication terminal 12 cannot temporarily connect to the IP network 1. To do.

  Of course, the network configuration shown in FIG. 1 is merely an example. For example, in the example of FIG. 1, the maintenance server 17 belongs to the subnet 11C and is connected to the core network 10 via the router 18, but the arrangement of the maintenance server 17 is not particularly limited. The maintenance management server 17 may be arranged in the same subnet 11A as the home agent 13 or may be arranged in the same subnet 11B as the communication partner apparatus 15. Further, the maintenance management server 17 may be accommodated in the same housing as the home agent 13. Further, the function of the maintenance management server 17 may be realized by the same computer as the home agent 13.

  Next, the configuration of the mobile communication terminal 12 and the maintenance management server 17 will be described in detail. FIG. 2 is a functional block diagram of the mobile communication terminal 12. In FIG. 2, a communication interface 120 is a communication interface for physically connecting to a connection point (for example, the wireless base station 14) with respect to the IP network 1 by wireless or wired transmission and reception of data. The mobile communication terminal 12 may include a plurality of communication interfaces for connecting to a plurality of access networks (for example, a wireless LAN, a mobile phone network, and a wired LAN).

  The encrypted communication unit 121 executes generation and management of SA for performing encrypted communication by IPsec, encryption and decryption of IP packets, authentication, and the like. More specifically, the encrypted communication unit 121 generates and manages an SA based on the IKE (Internet Key Exchange) protocol. Further, the encrypted communication unit 121 inputs an IP packet generated by a higher-level TCP / IP module (not shown), and based on the SA negotiated in advance with the communication device designated as the destination of the IP packet. ESP header generation and IP packet encryption. The encrypted communication unit 121 supplies an IP packet obtained by removing the ESP header and decrypting the IP packet to the data received by the communication interface 120 to a TCP / IP module (not shown).

  The security association database (SAD) 122 is a memory that holds SA information in association with a destination IP address (DA), a security parameter identifier (SPI), a protocol type, and the like. Here, the protocol type indicates whether it is AH (Authentication Header) protocol or ESP (Encapsulating Security Payload). As described above, the SA information is a parameter necessary for IPsec communication negotiated with the communication partner device. Specifically, the encapsulation information (tunnel mode or transport mode), authentication algorithm, encryption Algorithms and encryption keys.

The control unit 123 controls the update of the SA information by the maintenance management server 17. More specifically, the control unit 123 determines whether or not the maintenance server 17 needs to substitute in response to a notification from the detection unit 124, and maintains the SA information held in the SAD 122 when the substitution is necessary. Control for transmitting to the management server 17 is executed. In addition, when the mobile communication terminal 12 reconnects to the IP network 1, the control unit 123 requests the maintenance management server 17 to transmit SA information and can perform encrypted communication using the SA information received from the maintenance management server 17. The control to execute is executed. If the SA valid period _TL negotiated between the mobile communication terminal 12 and the communication partner device 15 has never passed while the maintenance management server 17 performs SA maintenance, the mobile communication terminal 12 The SA information received from the maintenance management server 17 is the same SA information stored in the SAD 122, that is, SA information that has not been updated.

  The detection unit 124 detects the occurrence of the cause of the disconnection between the mobile communication terminal 12 and the IP network 1 and notifies the control unit 123 of the occurrence. A specific example of the factor detected by the detection unit 124 is the reception power, reception SIR, or code error rate of the radio signal transmitted from the radio base station 14. Further, another example of the factor detected by the detection unit 124 is an echo response to an ICMP (Internet Control Message Protocol) echo request transmitted to a device (for example, the communication partner device 15 or the home agent 13) in the IP network 1. Is the response time until Eq. Is obtained, or the success rate of the echo request. In addition, the detection unit 124 monitors the output voltage of the battery 125 that supplies power to each unit of the mobile communication terminal 12, and notifies the control unit 123 when the output voltage has dropped below a predetermined reference value. You may go.

  FIG. 3 is a functional block diagram of the maintenance management server 17. The communication interface 170 is a communication interface for connecting to the IP network 1 and performing data transmission / reception. When the mobile communication terminal 12 is not connected to the IP network 1, the SA maintenance management unit 171 performs SA information update processing with the communication partner device 15 on behalf of the mobile communication terminal 12. In the present embodiment, SA information is transmitted to the maintenance server 17 from the mobile communication terminal 12 that has determined that the IP network 1 is likely to move out of range. Further, the SA maintenance management unit 171 transmits SA information to the mobile communication terminal 12 in response to a request from the mobile communication terminal 12 reconnected to the IP network 1.

  The SAD 172 is a memory that stores SA information to be updated by the maintenance management server 17.

  Subsequently, the operation of SA continuation by the communication system according to the present embodiment will be described below with reference to FIGS. FIG. 4 shows a situation where the mobile communication terminal 12 is connected to the subnet 11A, that is, the IP network 1, and encrypted communication by IPsec is possible with the communication partner apparatus 15. In FIG. 4, a binding cache 131 is a memory that stores a correspondence relationship between a home address (HoA) and a care-of address (CoA), and is provided in the home agent 13. SAD 151 indicates the SAD that the communication partner device 15 has. In the following description of FIGS. 4 to 7, the home address of the mobile communication terminal 12 is “ZZZ”, the care-of address of the mobile communication terminal 12 is “AAA”, the IP address of the communication partner device 15 is “BBBB”, and maintenance management is performed. The IP address of the server 17 is “CCCC”.

  In FIG. 4, a virtual encrypted communication path 60 based on bidirectional ISAKMP SA and a virtual network based on two IPsec SAs each unidirectional between the mobile communication terminal 12 and the communication partner apparatus 15. An encrypted communication path 61 is set. At this time, the SAD 122 of the mobile communication terminal 12 and the SAD 151 of the communication counterpart device 15 store the ISAKMP SA negotiated between the mobile communication terminal 12 and the communication counterpart device 15 and the SA information related to the two IPsec SAs. In FIG. 4, the SPI of the IPsec SA whose destination address (DA) is “ZZZ” is “5000”, and the SPI of the IPsec SA whose destination address (DA) is “BBBB” is “6000”.

  Next, FIG. 5 shows a situation where the mobile communication terminal 12 is likely to move out of the IP network 1 range. In the situation of FIG. 5, the mobile communication terminal 12 indicates that the connection with the IP network 1 is likely to be disconnected, that the reception quality of the signal from the radio base station 14 that is the connection point of the subnet 11A is reduced, or ICMP Detection is based on a delay in the echo response or a decrease in the success rate. The mobile communication terminal 12 that has detected that the connection with the IP network 1 is likely to be disconnected transmits the SA information regarding the ISAKMP SA and IPsec SA stored in the SAD 122 to the maintenance management server 17. Further, the mobile communication terminal 12 changes the care-of address associated with its own home address “ZZZ” from its own IP address “AAAAA” to the IP address “CCCC” of the maintenance management server 17. 13 is requested. This request is made by sending an update request message to the home agent 13. Further, the mobile communication terminal 12 deletes its own ISAKMP SA and IPsec SA from the SAD 122.

  In FIG. 5, after the binding cache 131 of the home agent 13 is updated, the data packet transmitted to the home address “ZZZ” of the mobile communication terminal 12 is transferred to the maintenance server 17 by the transfer process of the home agent 13. To reach. Therefore, after the update of the binding cache 131 and the transfer of the SA information from the mobile communication terminal 12 to the maintenance management server 17 are completed, the maintenance management server 17 cooperates with the communication partner device 15 to perform a periodic encryption key. Execute update etc. That is, the maintenance management server 17 continues the SA held by the mobile communication terminal 12 instead of the mobile communication terminal 12. The maintenance management server 17 may receive the data transmitted from the communication partner device 15 to the mobile communication terminal 12 and store it.

  FIG. 6 shows a situation where the mobile communication terminal 12 has moved out of the IP network 1 and the connection between the mobile communication terminal 12 and the IP network 1 has been disconnected. In the situation of FIG. 6, the maintenance management server 17 communicates with the communication partner device 15 to maintain and update the SA information held by the mobile communication terminal 12. When the maintenance management server 17 does not receive the SA information transmission request from the mobile communication terminal 12 reconnected to the IP network 1 until a predetermined time has elapsed since the SA continuation processing was started, Update of SA information for SA continuation may be stopped and the SA information may be deleted from the SAD 172. Thereby, it is possible to suppress the waste of resources required for the SA continuation of the communication partner device 15 and the maintenance management server 17.

  FIG. 7 shows a situation where the mobile communication terminal 12 has moved into the area of the IP network 1 and the mobile communication terminal 12 has reconnected to the IP network 1. In the situation of FIG. 7, the mobile communication terminal 12 requests the maintenance management server 17 to transmit SA information. Further, the mobile communication terminal 12 transmits to the home agent 13 an update request message requesting to change the care-of address corresponding to its own home address “ZZZ” to its own IP address “AAAAA”. After the update of the binding cache 131 and the transfer of SA information from the maintenance management server 17 to the mobile communication terminal 12, the mobile communication terminal 12 communicates using the SA information updated by the maintenance management server 17. Encrypted communication with the partner apparatus 15 is resumed.

8 and 9 are timing charts describing a series of operations described with reference to FIGS. FIG. 8 shows a case where the mobile communication terminal 12 reconnects to the IP network 1 before the SA maintenance maximum time T _MAX elapses. On the other hand, FIG. 9 shows a case where the SA maintenance maximum time T _MAX elapses before the mobile communication terminal 12 reconnects to the IP network 1 and the SA continuation processing by the maintenance management server 17 is stopped.

In FIG. 8, in step S101, the ISAKMP SA is created by the IKE phase 1 procedure and the IPsec SA is created by the IKE phase 2 procedure between the mobile communication terminal 12 and the communication partner device 15. The mobile communication terminal 12 and the communication partner device 15 periodically update the SA information with the SA valid period _{TL determined} by the other as a cycle (steps S102 and S103).

  In step S104, the mobile communication terminal 12 detects in advance that it is likely to be out of the range of the subnet 11A. In step S105, the mobile communication terminal 12 checks for the presence or absence of another access network that is the destination. When there is another access network that can continue to connect to the IP network 1, the mobile communication terminal 12 performs handoff to the access network, and performs encrypted communication with the communication partner device 15 via the new access network. continue.

On the other hand, when there is no other access network capable of continuing the connection to the IP network 1, the mobile communication terminal 12 transmits SA information to the maintenance management server 17 in order to request an SA update proxy (step). S106). Furthermore, the mobile communication terminal 12 requests the home agent 13 to change the care-of address corresponding to its own home address “ZZZ” to the IP address “CCCC” of the maintenance management server 17 (step S107). Thereafter, the maintenance management server 17 and the communication partner device 15 periodically update the SA with the SA valid period _TL as a cycle (steps S108 and S109).

In step S110, the mobile communication terminal 12 reconnects to the IP network 1. In step S111, the mobile communication terminal 12 accesses the maintenance management server 17 and confirms whether or not the SA (ISAKMP SA and IPsec SA) held by itself exists in the SAD 172 in the maintenance management server 17. To do. In the example of FIG. 8, the time T1 from when the mobile communication terminal 12 requests the maintenance server 17 to maintain the SA until the mobile communication terminal 12 returns to the network 1 is the SA maintenance maximum of the maintenance server 17. It is shorter than the time T _MAX and the maintenance of the SA by the maintenance management server 17 is continued. For this reason, the mobile communication terminal 12 acquires SA information from the maintenance server (step S112). In step S113, the mobile communication terminal 12 requests the home agent 13 to change the care-of address corresponding to its own home address “ZZZ” to its own real IP address “AAAAA”.

Next, FIG. 9 will be described. In FIG. 9, the same reference numerals as in FIG. 8 are assigned to the operations common to FIG. A duplicate description of these common operations will be omitted, and steps S2091, S210 and S212, which are the differences between FIG. 8 and FIG. 9, will be described. In step S2091, the maintenance server 17 stops updating the SA information received from the mobile communication terminal 12 when the elapsed time from the start of SA maintenance by the maintenance server 17 exceeds the SA maintenance maximum time T _MAX. The SA information related to the mobile communication terminal 12 is deleted from the SAD 172.

  In steps S210 and S211, as in steps S110 and S111, the mobile communication terminal 12 reconnected to the IP network 1 accesses the maintenance management server 17 and confirms the presence of SA (ISAKMP SA and IPsec SA). In the example of FIG. 9, since the SA information regarding the mobile communication terminal 12 is deleted from the SAD 172, the mobile communication terminal 12 cannot confirm the existence of the SA (ISAKMP SA and IPsec SA) held by itself. Therefore, in step S212, the mobile communication terminal 12 creates ISAKMP SA and IPsec SA again by redoing from the IKE phase 1 procedure with the communication partner apparatus 15.

As described above, in the communication system according to the present embodiment, the maintenance management server 17 is arranged in the IP network 1. When the mobile communication terminal 12 is not connected to the IP network 1, the maintenance management server 17 updates the SA information with the communication counterpart device 15. As a result, the SA maintained by the mobile communication terminal 12 can be continued by the maintenance server 17 until the mobile communication terminal 12 that has been temporarily unable to continue the communication is able to communicate again. Further, since the maintenance management server 17 performs the update process of the SA information such as the update of the encryption key with the communication partner apparatus 15, it is not necessary to unnecessarily lengthen the SA valid period _TL . Security risks due to not being updated can be avoided.

  Note that the mobile communication terminal 12 shown in FIGS. 8 and 9 performs out-of-network detection control, control related to transmission of SA information to the maintenance management server 17, and control related to acquisition of SA information from the maintenance management server 17 to the computer. This can be realized by executing the program. Further, the maintenance management server 17 can be realized by a computer system and a program including a CPU (Central Processing Unit), a RAM (Random Access Memory), a communication interface, and the like. At this time, the TCP / IP protocol stack that the operating system has as a standard may be used for processing such as encrypted communication with the communication partner device 15 based on the IPsec protocol and SA update.

<Embodiment 2 of the Invention>

  In the first embodiment of the present invention described above, the example in which the SA information is transmitted from the mobile communication terminal 12 to the maintenance server 17 has been described. On the other hand, the communication system according to the present embodiment is modified such that SA information is transmitted from the communication partner apparatus 15 to the maintenance management server 17.

  The configurations of the mobile communication terminal and the maintenance management server according to the present embodiment may be the same as those of the mobile communication terminal 12 and the maintenance management server 17 included in the communication system according to the first embodiment of the invention. For this reason, the reprint of the block diagram regarding the mobile communication terminal and maintenance management server concerning this Embodiment, and detailed description regarding these are abbreviate | omitted. In the following description, the reference numerals shown in FIGS. 1 to 3 are used when referring to the mobile communication terminal, the maintenance management server, and the components included in the mobile communication terminal according to the present embodiment.

  FIG. 10 shows a situation where the mobile communication terminal 12 according to the present embodiment is likely to move out of the IP network 1 range. That is, FIG. 10 corresponds to FIG. 5 described above. In the present embodiment, the mobile communication terminal 12 that has detected that the connection with the IP network 1 is likely to be disconnected transmits a message notifying that it is out of the network range to the communication partner apparatus 15. When receiving the message from the mobile communication terminal 12, the communication partner device 15 according to the present embodiment transmits SA information held by itself to the maintenance server 17. The maintenance management server 17 according to the present embodiment stores the SA information received from the communication partner device 15 in the SAD 172, and performs SA update in cooperation with the communication partner device 15 to continue the SA. The operation of transmitting SA information from the maintenance management server 17 to the mobile communication terminal 12 when the mobile communication terminal 12 reconnects to the IP network 1 may be the same as in the first embodiment of the invention.

  FIG. 11 is a timing chart showing the SA continuation procedure by the communication system of the present embodiment. Note that the difference between the timing chart shown in FIG. 8 and FIG. 11 is that step S106 shown in FIG. 8 is replaced with steps S3061 and S3062. If it is determined in step S105 that there is no other access network capable of continuing the connection to the IP network 1, the mobile communication terminal 12 notifies the communication partner device 15 that it is out of the network range in step S3061. To do. In step S <b> 3062, the communication partner apparatus 15 transmits SA information to the maintenance management server 17. Other processes in FIG. 11 are the same as those shown in FIG.

  As described above, the communication system according to the present embodiment does not transmit SA information to the maintenance management server 17 from the mobile communication terminal 12 that is going to move outside the network area, but maintains and manages it from the communication partner device 15. SA information is transmitted to the server 17. It is expected that the communication quality of the mobile communication terminal 12 trying to move out of the network area is deteriorated, and there is a possibility that the communication quality is suddenly changed and communication is impossible. According to the present embodiment, when the SA continuation operation is taken over by the maintenance management server 17, the amount of data to be transmitted by the mobile communication terminal 12 can be reduced, and the transmission of SA information to the maintenance management server 17 is communicated. This can be done reliably from the counterpart device 15. For this reason, the communication system according to the present embodiment can reliably perform the handover process of the SA continuation operation to the maintenance management server 17 as compared with the first embodiment of the invention.

<Third Embodiment of the Invention>
The communication system according to the present embodiment is a modification in which SA information is transferred between the mobile communication terminal 12 and the maintenance management server 17 using an encrypted communication path. Thereby, the security risk that SA information leaks to a third party can be reduced.

  The configurations of the mobile communication terminal and the maintenance management server according to the present embodiment may be the same as those of the mobile communication terminal 12 and the maintenance management server 17 included in the communication system according to the first embodiment of the invention. For this reason, the reprint of the block diagram regarding the mobile communication terminal and maintenance management server concerning this Embodiment, and detailed description regarding these are abbreviate | omitted. In the following description, the reference numerals shown in FIGS. 1 to 3 are used when referring to the mobile communication terminal and the maintenance server according to the present embodiment and the components included therein.

  FIG. 12 shows a situation where the mobile communication terminal 12 according to the present embodiment is connected to the subnet 11A, that is, the IP network 1, and can perform encrypted communication with the communication partner apparatus 15 by IPsec. Yes. That is, FIG. 12 corresponds to FIG. 4 described above. In FIG. 12, a virtual encrypted communication path 62 based on bidirectional ISAKMP SA is set between the mobile communication terminal 12 and the maintenance management server 17. When the mobile communication terminal 12 transmits the SA information to the maintenance management server 17, the encrypted communication path 62 is used.

FIG. 13 is a timing chart showing the SA continuation procedure by the communication system according to the present embodiment. FIG. 13 shows a case where the mobile communication terminal 12 reconnects to the IP network 1 before the SA maintenance maximum time T _MAX elapses. That is, FIG. 13 corresponds to FIG. 8 described above. The difference between the timing chart shown in FIG. 8 and FIG. 13 is that step S106 is replaced with S4061 and steps S4011 and S4062 are added.

In step S4011, an ISAKMP SA is created between the mobile communication terminal 12 and the maintenance management server 17. In step S4061, the mobile communication terminal 12 transmits SA information to the maintenance management server 17 in order to request an SA update proxy. For transmitting SA information at this time, the ISAKMP SA created in step S4011 is used. In step S4062, the ISAKMP SA validity period between the mobile communication terminal 12 and the maintenance management server 17 is changed to the SA maintenance maximum time T _MAX by the maintenance management server 17. In this way, by setting the effective period of the ISAKMP SA for SA information transfer, even though the mobile communication terminal 12 is reconnected to the IP network 1 before the SA maintenance maximum time T _MAX elapses, the SA information It is possible to avoid the situation where the ISAKMP SA for transfer is erased due to the expiration of the validity period, and the SA information can be transferred from the maintenance management server 17 to the mobile communication terminal 12 without delay.

FIG. 14 is a timing chart showing the SA continuation procedure by the communication system of the present embodiment. FIG. 14 shows a case where the SA maintenance maximum time T _MAX elapses before the mobile communication terminal 12 reconnects to the IP network 1 and the SA maintenance by the maintenance management server 17 is stopped. That is, FIG. 14 corresponds to FIG. 9 described above. The difference between the timing charts shown in FIGS. 9 and 13 and FIG. 14 is that step S4121 is added after step S212. The ISAKMP SA for SA information transfer created in step S4011 has been deleted from the SAD 172 of the maintenance management server 17 as the SA maintenance maximum period set in T _MAX elapses. For this reason, in step S 4121, an ISAKMP SA for SA information transfer is created again between the mobile communication terminal 12 and the maintenance server 17.

  In this embodiment, ISAKMP SA is used to transfer SA information. However, an encrypted communication path set between the mobile communication terminal 12 and the maintenance management server 17 can be any other encrypted communication protocol. The encrypted communication path created by the above may be used.

<Embodiment 4 of the Invention>

  In Embodiment 1 of the invention described above, the communication system includes a home agent, and the home agent assigns a home address fixedly assigned to the mobile communication terminal and a care-of address that changes as the mobile communication terminal moves. An example has been described in which the SA set between the mobile communication terminal and the communication partner device is continued when the association is performed and the data packet that has reached the home address is transmitted to the care-of address. On the other hand, the communication system according to the fourth embodiment corresponds to a new and improved version of IPSec called “Mobile” (IKEv2 Mobility and Multihoming Protocol). By adopting Mobile, Without using the home agent, the mobile communication terminal can move from a predetermined address to another address while maintaining a connection with the communication partner device. The basic framework of Mobile is defined in IETF RFC4621 and RFC4555.

  In the communication system according to the first embodiment described above, for example, as shown in FIG. 15, when the mobile communication terminal 12 moves to another subnet 11A ′ as a foreign agent, the mobile communication terminal 12 becomes another foreign agent. The home agent 13 is notified of the care-of address assigned in connection with the movement to the subnet 11A ′, and the home agent 13 associates the care-of address with the home address. In MobileIPv4, when data is sent from the communication partner device to the mobile communication terminal, it is necessary to always go through the home agent, so there may be a problem due to traffic concentration. In FIG. 15, reference numeral 19 denotes a router of the subnet 11A '.

  On the other hand, in the communication system according to the fourth embodiment, as shown in FIG. 16, the Mobile technology defined in IETF RFC4621 and RFC4555 is applied, and any arbitrary without using a home agent. Data communication can be performed directly between the mobile communication terminal 12 that has moved to the subnet and the communication partner device 15.

  Here, as the IP address of the mobile communication terminal 12, an address assigned by the network, an address manually assigned by the user to the mobile communication terminal 12, or the like is used.

  In the communication system according to the fourth embodiment, as shown in FIG. 16, the mobile communication terminal 12, the communication counterpart device 15, and the maintenance management server 17 support the Mobile technology.

 Further, as the radio base station 14, for example, a base station used for mobile phone communication as mobile communication is used, but is not limited to this, and the types of subnets 11A, 11A ′, 11A ″ Accordingly, a base station used for wireless communication in a small-scale area such as a hot spot, a router having a wireless communication function used in a wireless LAN at home, and the like are used.

  Below, the operation | movement of SA continuation by the communication system concerning this Embodiment 4 is demonstrated using FIGS.

  FIG. 17 shows a situation where the mobile communication terminal 12 is connected to the subnet 11A, that is, the IP network 1, and encrypted communication by IPsec is possible with the communication partner device 15. As shown in FIG. 16, for example, when the mobile communication terminal 12 exists in the subnet 11A, the mobile communication terminal 12 has an IP address unique to the mobile communication terminal 12.

  SAD 151 indicates the SAD that the communication partner device 15 has. In the following description of FIGS. 17 to 21, the IP address of the mobile communication terminal 12 in the area of the subnet 11A is “aaa”, and the IP address of the mobile communication terminal 12 in the area of the subnet 11A ′ is “AAA”. The fixed IP address of the communication partner device 15 is “bbbb”, and the fixed IP address of the maintenance server 17 is “cccc”.

  In FIG. 17, similarly to the first embodiment described above, the virtual encrypted communication path 60 based on the bidirectional ISAKMP SA is unidirectional between the mobile communication terminal 12 and the communication partner apparatus 15. A virtual encrypted communication path 61 based on two IPsec SAs is set. At this time, the SAD 122 of the mobile communication terminal 12 and the SAD 151 of the communication counterpart device 15 store the ISAKMP SA negotiated between the mobile communication terminal 12 and the communication counterpart device 15 and the SA information related to the two IPsec SAs. In addition, between the control unit 123 of the mobile communication terminal 12 and the control unit of the communication partner device 15, “supporting Mobile” is notified to each other. In FIG. 17, the SPI of the IPsec SA whose destination address (DA) is “aaa” is “5000”, and the SPI of the IPsec SA whose destination address (DA) is “bbbb” is “6000”.

  Next, FIG. 18 shows a situation where the mobile communication terminal 12 has moved within the IP network 1 but moved from the subnet 11A into the subnet 11A ', which is a hot spot area. In FIG. 18, for the sake of convenience, the subnet 11A and the subnet 11A ′ are shown apart from each other, but both are within the IP network 1 and block communication when the mobile communication terminal 12 moves from the subnet 11A to the subnet 11A ′. Shall not occur. In the situation of FIG. 18, since the mobile communication terminal 12 is within the IP network 1, the connection with the IP network 1 is not disconnected.

  Then, the mobile communication terminal 12 is switched to communication within the subnet 11A ', which is a hot spot area, automatically or manually. At this time, the IP address of the mobile communication terminal 12 is changed from “aaaa” to “AAAA”.

  Accordingly, the mobile communication terminal 12 changes the address in the ISAKAMP SA stored in the SAD 122 to the new IP address “AAAAA” and changes the address in the IPSec SA to the new IP address “AAAAA”.

  After that, the mobile communication terminal 12 transmits “UPDATE_SA_ADDRESS”, which is an IKEv2 information message supported by Mobile, to the communication partner device 15 to notify the update of the IP address.

  Then, as shown in FIG. 18, the communication partner apparatus 15 changes the address in the ISAKAMP SA of the mobile communication terminal 12 stored in the SAD 151 to the new IP address “AAAA” based on the notification from the mobile communication terminal 12. At the same time, the address in IPSec SA is changed to a new IP address “AAAA”, and the ISAKAMP SA and IPSec SA change processing is completed.

  On the other hand, FIG. 19 shows a situation where the mobile communication terminal 12 is likely to move out of the range of the IP network 1. In the situation of FIG. 19, the mobile communication terminal 12 indicates that the connection with the IP network 1 is likely to be disconnected, that the reception quality of the signal from the radio base station 14 that is the connection point of the subnet 11A is reduced, or ICMP Detection is based on a delay in the echo response or a decrease in the success rate. The mobile communication terminal 12 that has detected that the connection with the IP network 1 is likely to be disconnected transmits the SA information regarding the ISAKMP SA and IPsec SA stored in the SAD 122 to the maintenance management server 17. At that time, the mobile communication terminal 12 may transmit identification information for identifying the mobile communication terminal 12 itself to the maintenance management server 17 together with the SA information. Thereby, security association information of a plurality of mobile communication terminals can be held by one maintenance management server. As the identification information for identifying the mobile communication terminal 12 itself, for example, authentication is performed when the mobile communication terminal 12 accesses the maintenance management server 17, and ID information used when receiving the authentication is used. It is done. Since the address of the transmitted SA information is different from the address of the maintenance management server 17 itself, the maintenance management server 17 uses the address “aaaa” in the ISAKAMP SA and IPSec SA of the mobile communication terminal 12 stored in the SAD 172. Change to its own IP address “cccc”.

  Thereafter, the maintenance management server 17 transmits “UPDATE_SA_ADDRESS”, which is an information message, to the communication partner apparatus 15 to notify the update of the IP address.

  As shown in FIG. 19, the communication partner device 15 uses the ISAKAMP SA address “aaa” of the mobile communication terminal 12 stored in the SAD 151 based on the notification from the maintenance management server 17 as “the address of the maintenance management server 17”. In addition to changing to “cccc”, the address “aaaa” in IPSec SA is changed to the address “cccc”. Further, the mobile communication terminal 12 deletes its own ISAKMP SA and IPsec SA from the SAD 122.

  Therefore, after the update of the SAD 172 and the transfer of the SA information from the mobile communication terminal 12 to the maintenance management server 17 are completed, the maintenance management server 17 cooperates with the communication partner device 15 to periodically update the encryption key, etc. Execute. That is, the maintenance management server 17 continues the SA held by the mobile communication terminal 12 instead of the mobile communication terminal 12.

  FIG. 20 shows a situation in which the mobile communication terminal 12 has moved out of the IP network 1 and the connection between the mobile communication terminal 12 and the IP network 1 has been disconnected. In the situation shown in FIG. 20, the maintenance management server 17 communicates with the communication partner device 15 to maintain and update the SA information held by the mobile communication terminal 12. When the maintenance management server 17 does not receive the SA information transmission request from the mobile communication terminal 12 reconnected to the IP network 1 until a predetermined time has elapsed since the SA continuation processing was started, Update of SA information for SA continuation may be stopped and the SA information may be deleted from the SAD 172. Thereby, it is possible to suppress the waste of resources required for the SA continuation of the communication partner device 15 and the maintenance management server 17.

  FIG. 21 shows a situation where the mobile communication terminal 12 has moved into the area of the IP network 1 and the mobile communication terminal 12 has reconnected to the IP network 1. In the situation of FIG. 21, when it is detected that the mobile communication terminal 12 has returned to the area within the IP network 1, the maintenance management server 17 is requested to transmit SA information, and the SA information is acquired from the maintenance management server 17. At that time, the mobile communication terminal 12 may transmit identification information for identifying the mobile communication terminal 12 itself to the maintenance server 17 when requesting transmission of SA information. In this case, the maintenance server 17 Identifies the SA information of the mobile communication terminal 12 itself based on the identification information. Further, since the address “cccc” of the acquired SA information is different from the address “aaaa” of the mobile communication terminal 12 itself, the mobile communication terminal 12 uses the address “cccc” in the ISAKAMP SA and IPSec SA of the SAD 122. Change the IP address to “aaaa”.

  Next, the mobile communication terminal 12 transmits “UPDATE_SA_ADDRESS”, which is an information message, to the communication partner device 15 to notify the update of the IP address.

  As shown in FIG. 21, the communication partner apparatus 15 uses the mobile communication terminal 12's address “cccc” as the ISAKAMP SA address “cccc” of the mobile communication terminal 12 stored in the SAD 172 based on the notification from the mobile communication terminal 12. In addition to changing to “aaaa”, the address “cccc” in IPSec SA is changed to the address “aaaa”. Thereafter, the mobile communication terminal 12 resumes encrypted communication with the communication partner apparatus 15 using the SA information updated by the maintenance management server 17.

22 and 23 are timing charts describing a series of operations described with reference to FIGS. FIG. 22 shows a case where the mobile communication terminal 12 reconnects to the IP network 1 before the SA maintenance maximum time T _MAX elapses. On the other hand, FIG. 23 shows a case where the SA maintenance maximum time T _MAX elapses before the mobile communication terminal 12 reconnects to the IP network 1 and the SA continuation processing by the maintenance management server 17 is stopped.

In FIG. 22, in step S101, the ISAKMP SA is created by the IKE phase 1 procedure and the IPsec SA is created by the IKE phase 2 procedure between the mobile communication terminal 12 and the communication partner device 15. The mobile communication terminal 12 and the communication partner device 15 periodically update the SA information with the SA valid period _{TL determined} by the other as a cycle (steps S102 and S103). In addition, between the control unit 123 of the mobile communication terminal 12 and the control unit of the communication partner apparatus 15 is notified to each other that “Mobile is supported”.

  In step S104, the mobile communication terminal 12 detects in advance that it is likely to be out of the range of the subnet 11A. In step S105, the mobile communication terminal 12 checks for the presence or absence of another access network that is the destination. When there is another access network that can continue to connect to the IP network 1, the mobile communication terminal 12 performs handoff to the access network, and performs encrypted communication with the communication partner device 15 via the new access network. continue.

On the other hand, when there is no other access network capable of continuing the connection to the IP network 1, the mobile communication terminal 12 transmits SA information to the maintenance management server 17 in order to request an SA update proxy (step). S106). At that time, as described above, the mobile communication terminal 12 may transmit identification information for identifying the mobile communication terminal 12 itself together with the SA information. Since the transferred SA information of the mobile communication terminal 12 is different from the address of the mobile communication terminal 12 managed by the maintenance management server 17, the maintenance server 17 receives the address of the mobile communication terminal 12 in the received SA. The address of the maintenance management server 17 is changed to (Step S107). In addition, the maintenance management server 17 transmits an information message to the communication partner device 15 to notify the change of the address of the mobile communication terminal 12 (S1071). The communication partner device 15 changes the address of the mobile communication terminal 12 to the address of the maintenance server 17 according to the information message (S1072). Thereafter, the maintenance management server 17 and the communication partner device 15 periodically update the SA with the SA valid period _TL as a cycle (steps S108 and S109).

In step S110, the mobile communication terminal 12 reconnects to the IP network 1. In step S111, the mobile communication terminal 12 accesses the maintenance management server 17 and confirms whether or not the SA (ISAKMP SA and IPsec SA) held by itself exists in the SAD 172 in the maintenance management server 17. To do. At this time, the mobile communication terminal 12 may transmit together with identification information for identifying the mobile communication terminal 12 itself when confirming whether the SA exists. In the example of FIG. 22, the time T1 from when the mobile communication terminal 12 requests the maintenance server 17 to maintain SA until the mobile communication terminal 12 returns to the network 1 is the SA maintenance maximum of the maintenance server 17. It is shorter than the time T _MAX and the maintenance of the SA by the maintenance management server 17 is continued. For this reason, the mobile communication terminal 12 acquires SA information from the maintenance server (step S112). In step S114, the mobile communication terminal 12 changes the address of the mobile communication terminal 12 itself in the received SA information from the address of the maintenance management server 17 to the actual address. Thereafter, the mobile communication terminal 12 transmits an information message to the communication partner device 15 to notify the change of the address of the mobile communication terminal 12 (S115), and the communication partner device 15 follows the received information message. Is changed to an actual address (S116).

Next, FIG. 23 will be described. In FIG. 23, operations common to those in FIG. 22 are denoted by the same reference numerals as in FIG. A duplicate description of these common operations will be omitted, and steps S2091, S210 and S212, which are the differences between FIG. 22 and FIG. 23, will be described. In step S2091, the maintenance server 17 stops updating the SA information received from the mobile communication terminal 12 because the elapsed time from the start of SA maintenance by the maintenance server 17 has exceeded the SA maintenance maximum time T _MAX. The SA information related to the mobile communication terminal 12 is deleted from the SAD 172.

  In steps S210 and S211, as in steps S110 and S111, the mobile communication terminal 12 reconnected to the IP network 1 accesses the maintenance management server 17 and confirms the presence of SA (ISAKMP SA and IPsec SA). In the example of FIG. 23, since the SA information related to the mobile communication terminal 12 is deleted from the SAD 172, the mobile communication terminal 12 cannot confirm the presence of the SA (ISAKMP SA and IPsec SA) held by itself. Therefore, in step S212, the mobile communication terminal 12 creates ISAKMP SA and IPsec SA again by redoing from the IKE phase 1 procedure with the communication partner apparatus 15.

As described above, in the communication system according to the present embodiment, the maintenance management server 17 is arranged in the IP network 1. When the mobile communication terminal 12 is not connected to the IP network 1, the maintenance management server 17 updates the SA information with the communication counterpart device 15. As a result, the SA maintained by the mobile communication terminal 12 can be continued by the maintenance server 17 until the mobile communication terminal 12 that has been temporarily unable to continue the communication is able to communicate again. Further, since the maintenance management server 17 performs the update process of the SA information such as the update of the encryption key with the communication partner apparatus 15, it is not necessary to unnecessarily lengthen the SA valid period _TL . Security risks due to not being updated can be avoided.

  Further, in the communication system according to the fourth embodiment, data communication can be performed between the mobile communication terminal 12 and the communication partner device 15 without using the home agent, and traffic can be concentrated on the home agent. In addition, in an environment where the mobile communication terminal cannot move seamlessly within the communication network, it is possible to continue the SA set between the mobile communication terminal and the communication partner apparatus.

  FIG. 24 is a timing chart showing the SA continuation procedure by the communication system of the present embodiment, corresponding to FIG. 11 of the second embodiment. Note that the difference between the timing chart shown in FIG. 22 and FIG. 24 is that step S106 shown in FIG. 22 is replaced with steps S3061 and S3062. If it is determined in step S105 that there is no other access network capable of continuing the connection to the IP network 1, the mobile communication terminal 12 notifies the communication partner device 15 that it is out of the network range in step S3061. To do. In step S <b> 3062, the communication partner apparatus 15 transmits SA information to the maintenance management server 17. Other processes in FIG. 24 are the same as those shown in FIG.

  FIGS. 25 and 26 are timing charts respectively showing the SA continuation procedure by the communication system of the present embodiment, corresponding to FIGS. 13 and 14 of the third embodiment described above.

FIG. 25 shows a case where the mobile communication terminal 12 reconnects to the IP network 1 before the SA maintenance maximum time T _MAX elapses. That is, FIG. 25 corresponds to FIG. 22 described above. The difference between the timing chart shown in FIG. 22 and FIG. 25 is that step S106 is replaced with S4061 and steps S4011 and S4062 are added.

In step S4011, an ISAKMP SA is created between the mobile communication terminal 12 and the maintenance management server 17. In step S4061, the mobile communication terminal 12 transmits SA information to the maintenance management server 17 in order to request an SA update proxy. For transmitting SA information at this time, the ISAKMP SA created in step S4011 is used. In step S4062, the ISAKMP SA validity period between the mobile communication terminal 12 and the maintenance management server 17 is changed to the SA maintenance maximum time T _MAX by the maintenance management server 17. In this way, by setting the effective period of the ISAKMP SA for SA information transfer, even though the mobile communication terminal 12 is reconnected to the IP network 1 before the SA maintenance maximum time T _MAX elapses, the SA information It is possible to avoid the situation where the ISAKMP SA for transfer is erased due to the expiration of the validity period, and the SA information can be transferred from the maintenance management server 17 to the mobile communication terminal 12 without delay.

FIG. 26 shows a case where the SA maintenance maximum time T _MAX elapses before the mobile communication terminal 12 reconnects to the IP network 1, and the SA maintenance by the maintenance management server 17 is stopped. That is, FIG. 26 corresponds to FIG. 23 described above. The difference between the timing chart shown in FIG. 23 and FIG. 26 is that step S4121 is added after step S212. The ISAKMP SA for SA information transfer created in step S4011 has been deleted from the SAD 172 of the maintenance management server 17 as the SA maintenance maximum period set in T _MAX elapses. For this reason, in step S 4121, an ISAKMP SA for SA information transfer is created again between the mobile communication terminal 12 and the maintenance server 17.

<Other embodiments>
In the first, third, and fourth embodiments of the present invention described above, an example is shown in which SA information is transmitted to the maintenance management server 17 in response to detecting that the mobile communication terminal 12 is likely to be outside the network range. However, the mobile communication terminal 12 may execute the transmission of the SA information to the maintenance management server 17 independently of the advance detection outside the network area. For example, the mobile communication terminal 12 may transmit the updated SA information to the maintenance management server 17 every time the SA information is updated with the communication partner device 15. Thereby, the SA information held in the SAD 122 of the mobile communication terminal 12 and the SA information held in the SAD 172 of the maintenance management server 17 can be synchronized. According to such a configuration, when the mobile communication terminal 12 detects in advance that it is out of the network range, it is only necessary to transmit a message requesting the SA maintenance management proxy from the mobile communication terminal 12 to the maintenance management server 17. . For this reason, it is possible to reduce the amount of data to be transmitted by the mobile communication terminal 12 after pre-detecting the outside of the network area.

  However, in the case of the fourth embodiment, unlike the first and third embodiments, the maintenance management server receives its own SA request from the mobile communication terminal for the SA information maintenance management proxy. An additional process is required in which the address of the mobile communication terminal in the information is changed to the address of the maintenance server itself, and an information message notifying the address change is transmitted to the communication partner.

  Further, in the first to third embodiments of the present invention described above, an example in which a care-of address (CoA) update request to the home agent 13 is transmitted from the mobile communication terminal 12 has been described. However, at least one of the first update request for changing the care-of address to the IP address of the maintenance server 17 and the second update request for changing the care-of address to the real IP address of the mobile communication terminal 12 is: The maintenance management server 17 may be configured to transmit to the home agent 13.

  The transmission of SA information between the communication partner device 15 and the maintenance management server 17 according to the second embodiment of the invention and the fourth embodiment of the invention is the same as described in the third embodiment of the invention. You may carry out using encrypted communication paths, such as ISAKMP SA. Thereby, the security risk that SA information leaks to a third party can be reduced.

  In the first to fourth embodiments of the present invention, when the mobile communication terminal 12 is detected in advance to be out of the network and moves to another subnet, there is no other subnet as a destination. The example in which the threshold for pre-detection outside the network area is shared between the case where SA information is transmitted to the maintenance management server 17 has been described. However, the two threshold values in these two cases are not necessarily the same value. For example, the threshold value when there is no other subnet to be moved to is lower than the threshold value when moving to another subnet. You may set so that.

  In the first to third embodiments of the invention, the home agent 13 is always present in data transmission / reception between the mobile communication terminal 12 and the communication partner device 15 and data transmission / reception between the maintenance server 17 and the communication partner device 15. An example to do. However, for example, when using Mobile IPv6 capable of performing route optimization to solve the so-called triangular route problem, it is not always necessary to interpose the home agent 13 in all communications. is there.

  Further, in the first to fourth embodiments of the invention, the example in which the encrypted communication by IPsec is executed between the mobile communication terminal 12 and the communication partner device 15 has been described. However, the above-described embodiments of the present invention can be applied to continue the SA of the mobile communication terminal 12 not only when IPsec but also when another encrypted communication protocol is used.

  Furthermore, the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the gist of the present invention described above.

1 is a configuration diagram of a communication system according to a first exemplary embodiment of the present invention. It is a block diagram of the mobile communication terminal which the communication system concerning Embodiment 1 of this invention has. It is a block diagram of the maintenance management server which the communication system concerning Embodiment 1 of this invention has. In the communication system according to the first exemplary embodiment of the present invention, it is an operation explanatory diagram when a mobile communication terminal exists within a network area. In the communication system concerning Embodiment 1 of this invention, it is operation | movement explanatory drawing when a mobile communication terminal moves to a network boundary. In the communication system concerning Embodiment 1 of this invention, it is operation | movement explanatory drawing when a mobile communication terminal exists out of a network area. In the communication system according to the first exemplary embodiment of the present invention, it is an operation explanatory diagram when the mobile communication terminal moves from outside the network area to within the area. It is a timing chart which shows the process sequence regarding SA continuation by the communication system concerning Embodiment 1 of this invention. It is a timing chart which shows the process sequence regarding SA continuation by the communication system concerning Embodiment 1 of this invention. In the communication system concerning Embodiment 2 of this invention, it is operation | movement explanatory drawing when a mobile communication terminal moves to a network boundary. It is a timing chart which shows the process sequence regarding SA continuation by the communication system concerning Embodiment 2 of this invention. In the communication system concerning Embodiment 3 of this invention, it is operation | movement explanatory drawing when a mobile communication terminal exists in the network range. It is a timing chart which shows the process sequence regarding SA continuation by the communication system concerning Embodiment 3 of this invention. It is a timing chart which shows the process sequence regarding SA continuation by the communication system concerning Embodiment 3 of this invention. 1 is a configuration diagram of a communication system according to a first exemplary embodiment of the present invention. It is a block diagram of the communication system concerning Embodiment 4 of this invention. In the communication system concerning Embodiment 4 of this invention, it is operation | movement explanatory drawing when a mobile communication terminal exists in the network range. In the communication system concerning Embodiment 4 of this invention, it is operation | movement explanatory drawing when a mobile communication terminal exists in the network area, and when moving a subnet. In the communication system concerning Embodiment 4 of this invention, it is operation | movement explanatory drawing when a mobile communication terminal moves to a network boundary. In the communication system concerning Embodiment 4 of this invention, it is operation | movement explanatory drawing when a mobile communication terminal exists outside a network range. In the communication system concerning Embodiment 4 of this invention, it is operation | movement explanatory drawing when a mobile communication terminal moves into the area from the outside of the network area. It is a timing chart which shows the process sequence regarding SA continuation by the communication system concerning Embodiment 4 of this invention. It is a timing chart which shows the process sequence regarding SA continuation by the communication system concerning Embodiment 4 of this invention. It is a timing chart which shows the process sequence regarding SA continuation by the communication system concerning Embodiment 4 of this invention. It is a timing chart which shows the process sequence regarding SA continuation by the communication system concerning Embodiment 4 of this invention. It is a timing chart which shows the process sequence regarding SA continuation by the communication system concerning Embodiment 4 of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 IP (Internet Protocol) network 2 10 Core network 11A, 11A ', 11A "-11C Subnet 12 Mobile communication terminal 13 Home agent 14, 14' Wireless base station 15 Communication partner apparatus 16 Router 17 Maintenance management server 18, 19, 20 , 21, 22 Routers 60 to 62 Encrypted communication path 120 Communication interface 121 Encrypted communication unit 122 Security association database 123 Control unit 124 Detection unit 125 Battery 151 Security association database 131 Binding cache 170 Communication interface 171 SA maintenance management unit 172 Security Association Database

Claims (22)

A mobile communication terminal capable of communicating with a communication partner device while moving in a communication network;
A maintenance management server provided in the communication network,
The mobile communication terminal holds security association information negotiated with the communication counterpart device and updates the security association information, and performs encrypted communication with the communication counterpart device based on the security association information. The maintenance management server updates the security association information with the communication counterpart device on behalf of the mobile communication terminal when the mobile communication terminal and the communication network are not connected. A communication system.   The communication system according to claim 1, wherein the maintenance management server transmits the updated security association information to the mobile communication terminal when the mobile communication terminal reconnects to the communication network.   When the mobile communication terminal reconnects to the communication network without passing the validity period of the security association information, the maintenance management server transmits the security association information that has not been updated to the mobile communication terminal. The communication system according to claim 1 or 2.   4. The mobile communication terminal according to claim 1, wherein the mobile communication terminal transmits the security association information to the maintenance management server when the mobile communication terminal and the communication network are not connected. 5. Communications system. The mobile communication terminal sends a notification to the communication counterpart device when the mobile communication terminal and the communication network are not connected.
The communication counterpart device, based on the notification, transmits security association information held by itself to the maintenance management server,
The said maintenance management server starts the update of the said security association information between the said communicating party apparatuses using the security association information received from the said communicating party apparatus, The any one of Claims 1 thru | or 3 Communication system. The mobile communication terminal is
While the connection between the mobile communication terminal and the communication network is connected, by sending the security association information updated with the execution of encrypted communication with the communication partner device to the maintenance management server, Synchronizing the security association information held by the mobile communication terminal and the maintenance server,
When the mobile communication terminal and the communication network are not connected, send a proxy request message to the maintenance server,
The communication system according to claim 1, wherein the maintenance management server starts updating the security association information with the communication counterpart device based on reception of the proxy request message. Data that is provided in the communication network and that is associated with a home address that is fixedly assigned to the mobile communication terminal and a care-of address that changes as the mobile communication terminal moves, and that has reached the home address. A home agent that transmits the packet to the care-of address;
The mobile communication terminal is
When the mobile communication terminal and the communication network are not connected, an association update notification for requesting to change the care-of address associated with the home address to the address of the maintenance management server, Send it to the home agent,
The association update notification requesting to change the address associated with the home address to its own care-of address when reconnected to the communication network is transmitted to the home agent. The communication system according to any one of the above. The mobile communication terminal is assigned an address according to a subnetwork in which the mobile communication terminal exists, and is configured to be able to directly communicate with the communication partner apparatus using the address.
The mobile communication terminal is
When the mobile communication terminal and the communication network are not connected, the security association information of the mobile communication terminal itself is transmitted to the maintenance server,
When reconnecting to the communication network, obtaining the security association information from the maintenance server, changing its own address in the security association information to the address of the mobile communication terminal itself,
An address change notification for notifying the communication partner device of the change of the address and requesting to change the address of the mobile communication terminal in the security association information of the communication partner device to a new address is sent to the communication partner device. The communication system according to any one of claims 1 to 6, wherein the communication is performed. A security association continuation method for continuing a security association used for encrypted communication between a mobile communication terminal that performs communication while moving in a communication network and a communication partner device,
When the mobile communication terminal and the communication network are not connected, the security management information negotiated between the mobile communication terminal and the communication partner device is maintained by the maintenance server provided in the communication network. A security association continuation method including the step of performing update on behalf of the mobile communication terminal.   The security according to claim 9, further comprising: when the mobile communication terminal and the communication network are reconnected, a maintenance server transmits the updated security association information to the mobile communication terminal. Association continuation method.   11. The security association continuation method according to claim 9 or 10, wherein the mobile communication terminal transmits the security association information to the maintenance server when the mobile communication terminal and the communication network are not connected. The mobile communication terminal sends a notification to the communication counterpart device when the mobile communication terminal and the communication network are not connected.
The communication counterpart device, based on the notification, transmits security association information held by itself to the maintenance management server,
The security association continuation method according to claim 9 or 10, wherein the maintenance management server starts updating the security association information with the communication counterpart device using the security association information received from the communication counterpart device. . A mobile communication terminal that performs communication while moving in a communication network,
At least one communication interface unit connectable to the communication network;
An encrypted communication unit that performs encrypted communication based on security association information with a communication partner device via the communication interface unit;
A control unit that controls update processing of the security association information by a maintenance server provided in the communication network;
The controller is
Mobile communication characterized in that, when the mobile communication terminal and the communication network are not connected, the maintenance management server is requested to act as a proxy for update control of the security association information with the communication counterpart device. Terminal.   The control unit requests the maintenance server to transmit the updated security association information when the mobile communication terminal and the communication network are reconnected, and is transmitted from the maintenance server. The mobile communication terminal according to claim 13, wherein security association information is supplied to the encrypted communication unit. A detection unit for detecting the occurrence of a factor that causes no connection between the mobile communication terminal and the communication network;
The mobile communication terminal according to claim 13 or 14, wherein the control unit determines that the mobile communication terminal and the communication network are not connected based on detection of occurrence of the factor by the detection unit.   The factors include a decrease in received power of a signal transmitted from a radio base station that provides a radio link for connecting to the communication network to the mobile communication terminal, a battery that supplies power to each unit in the mobile communication terminal The mobile communication terminal according to claim 15, which is a drop in output voltage, a response time of an ICMP echo response, or a success rate of an ICMP echo response.   The control unit transmits the security association information to the maintenance management server via the communication interface unit in response to a disconnection between the mobile communication terminal and the communication network. The mobile communication terminal according to any one of the above.   The control unit notifies the maintenance management server to transmit the security association information held by the communication counterpart device in response to a disconnection between the mobile communication terminal and the communication network. The mobile communication terminal according to claim 13, wherein the mobile communication terminal is transmitted to the communication partner apparatus. A communication interface connected to a communication network;
With security association maintenance department
The security association maintenance manager
Security association information used for encrypted communication between a mobile communication terminal that communicates while moving in the communication network and a communication partner device is received via the communication interface unit,
In a period in which the mobile communication terminal and the communication network are not connected, update control of the security association information is performed with the communication counterpart device on behalf of the mobile communication terminal,
A server device, wherein when the mobile communication terminal and the communication network are reconnected, the updated security association information is transmitted to the mobile communication terminal via the communication interface unit. A program that causes a computer to execute control processing related to a mobile communication terminal that performs communication while moving in a communication network,
The mobile communication terminal has an encrypted communication unit that executes encrypted communication based on security association information with a communication partner device,
The control process is
When the mobile communication terminal and the communication network are not connected, a process of transmitting a notification requesting the maintenance management server to proxy update control of the security association information with the communication counterpart device;
Including programs. The control process is
A process for transmitting a notification requesting the maintenance management server to transmit the updated security association information when the mobile communication terminal and the communication network are reconnected;
A process of causing the encrypted communication unit to execute encrypted communication using the security association information received from the maintenance management server;
The program according to claim 20, further comprising: A program that causes a computer including a communication interface unit connected to a communication network to execute control processing related to maintenance management of a security association, wherein the control processing includes:
Processing for receiving security association information used for encrypted communication between a mobile communication terminal and a communication partner device that communicates while moving in the communication network via the communication interface unit;
A process of executing the update of the security association information on behalf of the mobile communication terminal during a period in which the mobile communication terminal and the communication network are not connected;
A program including a process of transmitting the updated security association information to the mobile communication terminal via the communication interface unit when the mobile communication terminal and the communication network are reconnected.

Images