JP2009207049A - Communications device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To materialize the configuration capable of performing a key exchange only by a cipher-communication apparatus. <P>SOLUTION: The cipher-communication apparatus 20 is equipped with a processing systems A 110 and B 120 each comprising a receiver 1, a transmitter 2, a key managing unit 3, and a cipher-communication processor 4. At a key-exchange time when the cipher communication is performed by the cipher-communication processor 4 of the processing system A 110, the key managing unit 3 of the processing system B 120 performs the key exchange with the apparatus of the communication party and also establishes a communication channel. The cipher-communication processor 4 of the processing system A 110 stops carrying out the cipher communication, simultaneously with the initiation of the cipher communication by the cipher-communication processor 4 of the processing system B 120. Thus, the key exchange can be performed only by the cipher-communication apparatus 20, and the cipher communication can be continued while the key is exchanged. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an encryption communication device or the like that receives a packet transmitted and received on a network and performs encryption or decryption.

In recent years, it has been pointed out that the performance of cryptographic communication may become a bottleneck in the speeding up of LAN (Local Area Network) and the spread of multimedia applications.
Taking IKE (Internet Key Exchange), which is a protocol for automatically updating a secret key for encryption, as an example, in phase 1, the ISAKMP (Internet SA and Key Management Protocol) SA (Security Association) contents are negotiated and shared. Generation of a secret key, mutual authentication from ID and hash, and in phase 2, processing of negotiation of the SA contents and generation of the shared secret key is performed, so the processing load is large and the processing takes a lot of time. Sometimes.

  Japanese Patent Application Laid-Open No. 2003-179592 discloses a method of reducing the burden of key exchange processing by preparing a key exchange proxy server separately from a communication device when performing key exchange processing.

Japanese Patent Laid-Open No. 2007-219577 discloses that in a data processing apparatus using a multi-core CPU (Central Processing Unit), the cores are allocated to the processing means so as to optimize the throughput by measuring the load of the processing means. The method of changing is shown.
In this way, for example, for an apparatus that performs encryption processing and decryption processing simultaneously, the load of both processes is measured, and the core allocation is changed with respect to the ratio of the loads, thereby optimizing the throughput. be able to.
Japanese Patent Laid-Open No. 2003-179592 JP 2007-21957 A

  In the encryption communication device described in Japanese Patent Application Laid-Open No. 2003-179592, a key exchange proxy server is prepared separately from the communication device for the problem that the processing time increases when the load of key exchange processing increases. If it does so, it will be necessary to perform encryption communication between an apparatus and a server, and the subject that the load of encryption communication arises occurs.

For example, when IKE is used for key exchange, there may be double SAs in SA update, and these two SAs are designated as SA1 and SA2.
At this time, when the SA2 application packet arrives, the SA is searched in the order of SA1 and SA2, and the SA1 is always inquired. Therefore, when the SA2 application packet arrives more than the SA1 application packet, the time for the inquiry to the SA1 There is a problem that only processing time is wasted.

Further, in the core allocation dynamic update method described in Japanese Patent Application Laid-Open No. 2007-219577, the core allocation to the processing unit is changed so as to optimize the throughput by measuring the load of the processing unit.
In this way, for example, for an apparatus that performs encryption processing and decryption processing simultaneously, the load of both processes is measured, and the core allocation is changed with respect to the ratio of the loads, thereby optimizing the throughput. be able to.
However, for example, when IKE is used for key exchange and a core is assigned to the IKE processing means, it is sufficient that the core is assigned only while IKE is activated. Until the next load measurement is performed and the core allocation is changed, the core is allocated to the IKE processing means that has already been processed.

  The main object of the present invention is to solve the above-described problems, and the encryption communication information used for the encryption communication can be updated only by the encryption communication device, and the encryption communication information is updated. The main objective is to realize a configuration that sometimes allocates resources efficiently.

The communication device according to the present invention is
An encryption communication unit that performs encryption communication with the communication partner device, and an information update unit that performs update of the information for encryption communication used for encryption communication with the communication partner device each include two processing units,
Prior to the update timing of the encryption communication information, the encryption communication unit of one processing unit performs encryption communication with the communication partner device, and at the update timing of the encryption communication information, the information update unit of the other processing unit The encryption communication information is updated with the communication partner device, and the encryption communication unit of the other processing unit starts encryption communication with the communication partner device and the encryption communication unit of the one processing unit The encryption communication is terminated.

According to the present invention, when two processing units are provided and one of the processing units performs cryptographic communication, when the update timing comes, the other processing unit updates the information for cryptographic communication and the other The processing unit starts encryption communication and ends encryption communication of one processing unit.
For this reason, the encryption communication information can be updated only by the communication device, and the encryption communication can be continued while the encryption communication information is being updated.

Embodiment 1 FIG.
First, a system configuration example of the network according to the first to third embodiments will be described with reference to FIG.
FIG. 2 shows a configuration example of a system to which an encryption communication device is connected.
Terminals (31, 32) are connected to the in-house network (30) via the encryption communication device (20).
When a packet is transmitted from the terminal (31) to the terminal (32), the packet is encrypted by the encryption communication device (20) (encrypting side), then transmitted to the in-house network (30), and received by the terminal (32). When receiving, the encrypted communication device (20) (decryption side) decrypts the encrypted packet and receives it.
As an encryption communication protocol used in the encryption communication, for example, there is IPsec, and this makes it possible to protect packets on the in-house network from network threats such as eavesdropping and tampering.

FIG. 1 is a configuration example relating to the cryptographic communication device (20) according to the first embodiment.
The encryption communication device (20) includes a reception unit (1), a transmission unit (2), a key management unit (3) (information update unit), an encryption communication processing unit (4) (encryption communication unit), a processing system determination unit ( 5) Consists of a (packet analysis unit) and a device control unit (6), each having two processing means (1) to (4).
A group of the processing means (1) to (4) is defined as a processing system A (110) and a processing system B (120), respectively.
The processing system A (110) and the processing system B (120) are examples of processing units, respectively.
The encryption communication device (20) includes a multi-core CPU (Central Processing Unit), and different CPU cores are assigned to the two processing systems.

In this embodiment, encryption communication processing and key exchange processing are performed in either processing system, and processing system A (110) and processing system B (120) are switched according to the key update time.
The receiving unit (1) and the transmitting unit (2) perform packet transmission / reception processing in the processing system.
The key management unit (3) performs key exchange protocol processing and private key management, and the encryption communication processing unit (4) performs packet encryption and decryption processing.
The processing system discrimination unit (5) discriminates whether the packet received by the cryptographic communication device (20) is a packet for cryptographic communication processing or a packet for key exchange processing, and transmits the packet to each processing system.
The device control unit (6) controls a flag of processing system discrimination data referred to by the processing system discrimination unit (5) or the like.

Although details will be described later, in this embodiment, before the update timing of the encryption communication information, one processing system (for example, the encryption communication processing unit (4) of the processing system A (110) is connected to the communication partner device (communication). The key management unit (3) of the other processing system (for example, processing system B (120)) communicates with the communication partner apparatus at the update timing of the encryption communication information. The encryption communication information is updated by the encryption communication processing unit (4) of the other processing system (for example, processing system B (120)) and the encryption communication processing unit 4 starts encryption communication with the communication partner apparatus. The encryption communication processing unit (4) of the processing system A (110) ends the encryption communication.
Here, the information for encryption communication is information used for encryption communication, and is a key or various control information. In the following, key updating will be described as a representative example of information for encryption communication.

  In each processing system, the key management unit (3) updates the key with the communication partner device at the key update timing, and uses a logical connection used for encryption communication with the communication partner device. A certain SA is set.

In each processing system, the cryptographic communication processing unit (4) performs cryptographic communication with the communication partner device at the SA set by the key management unit (3), and before the key update timing, one processing is performed. In the SA set by the key management unit (3) of the system (for example, processing system A (110)), the encryption communication processing unit (4) of one processing system (for example, processing system A (110)) communicates with the communication partner. Perform cryptographic communication with the device.
Then, at the key update timing, the key management unit (3) of the other processing system (for example, processing system B (120)) updates the key with the communication partner device and communicates with the communication partner device. SA is set, and the cryptographic communication processing unit (4) of the other processing system (for example, processing system B (120)) starts cryptographic communication with the communication partner apparatus.
At the same time, the key management unit (3) of one processing system (for example, processing system A (110)) deletes the SA, and the cryptographic communication processing of one processing system (for example, processing system A (110)). The encryption communication of unit (4) is terminated.

  The processing system discriminating unit (5) is configured such that after the key management unit (3) of the other processing system (for example, processing system B (120)) sets SA, one processing system (for example, processing system A (110)). When the packet is received before the key management unit (3) deletes the SA, the received packet is analyzed to determine which SA the received packet belongs to, and the received packet The received packet is output to the processing system in which the SA to which the message belongs is set.

In the present embodiment, the CPU core allocation method to each processing system is not limited.
For example, a plurality of encryption communication processing units having a large processing load may be assigned. At this time, one processing thread may be divided and assigned to a plurality of cores, or one core may perform one process.

Next, with respect to the operation flow when a packet for cryptographic communication processing is received, processing system A (110) performs cryptographic communication processing, and processing system B (120) performs key exchange processing at the key exchange time (key update timing). First, the operation when a packet is received by the plaintext LAN (21) (LAN between the encryption communication device (20) and the terminal) will be described with reference to FIG.
The processing system B (120) does not perform any processing until the key exchange time (key update timing) is reached.

When receiving the packet, the processing system discrimination unit (5) discriminates whether the received data is a packet for encryption communication processing or a packet for key exchange processing (step 1).
In the case of key exchange processing, the processing system discrimination unit (5) refers to the processing system discrimination data and transmits a packet to the key management unit (3) through the reception unit (1) of the processing system B (120). (Steps 2 and 3).
On the other hand, in the case of cryptographic communication processing, the processing system discrimination unit (5) refers to the processing system discrimination data and sends a packet to the cryptographic communication processing unit (4) through the reception unit (1) of the processing system A (110). Is transmitted (step 4).
Here, the processing system discrimination data is data (a flag or the like) indicating which of the current processing system A (110) or processing system B (120) is performing cryptographic communication processing.

If the packet is an encryption communication processing packet, the encryption communication processing unit (4) of the processing system A (110) receives the packet via the reception unit (1), and searches for an SPD (Security Policy Database) (step 5). ) When the ciphertext is set (when the packet is instructed to be encrypted), the encryption process is performed in the next step.
In addition, although the branch of the setting other than the ciphertext is omitted in the flowchart, when the plaintext is set (when the packet is not instructed to be encrypted), the packet is transmitted to the transmission unit (2). When discarding is set, the packet is discarded.

Next, in the processing after the SPD search, the cryptographic communication processing unit (4) of the processing system A (110) searches the SAD (Security Association Database) (step 6) and determines the presence or absence of the SA (step 7). .
When there is no SA, it waits for establishment of SA and discards the packet (steps 8 and 9).
When there is SA, the encryption communication processing unit (4) of the processing system A (110) performs encryption processing of encryption operation, hash, IP header processing (steps 10, 11, and 12), and transmits the packet. (2) is transmitted (step 13). Then, the transmission unit (2) transmits the encrypted packet from the ciphertext side LAN (22) (step 14).

Next, it is assumed that the processing system A (110) performs cryptographic communication processing, and the processing system B (120) performs key exchange processing at the key exchange time (key update timing). The operation flow when a communication processing packet is received will be described with reference to FIG.
In this case as well, the processing system B (120) does not perform any processing until the key exchange time (key update timing) is reached.

When receiving the packet, the processing system determination unit (5) determines whether the received packet is a packet for encryption communication processing or a packet for key exchange processing (step 1).
In the case of key exchange processing, the packet is transmitted to the key management unit (3) through the reception unit (1) of the processing system B (120) with reference to the processing system discrimination data (steps 2 and 3).
On the other hand, in the case of encryption communication processing, the packet is transmitted to the encryption communication processing unit (4) through the reception unit (1) of the processing system A (110) with reference to the SPI (Security Parameters Index) of the packet (step) 17, 4).

If the packet is an encryption communication processing packet, the encryption communication processing unit (4) of the processing system A (110) receives the packet via the reception unit (1), searches for the SAD (step 6), and whether there is an SA. Is discriminated (step 7).
When there is no SA, it waits for establishment of SA and discards the packet (steps 8 and 9).
When there is SA, the cryptographic communication processing unit (4) of the processing system A (110) performs the decryption processing of the hash and decryption calculation (steps 11 and 16), and then searches for the SPD (step 5), and the SP. If it does not violate (Security Policy), the packet is transmitted to the transmission unit (2) (step 13).
Then, the transmission unit (2) transmits the packet decrypted from the plaintext LAN (21) (step 17).

Next, with regard to switching between processing system A (110) and processing system B (120) at the key exchange time (key update timing) of the cryptographic communication apparatus, an example using IKE as the key exchange protocol is shown. ) Operation flowchart (FIG. 5).
Here, as an example, when processing system A (110) is performing cryptographic communication processing, processing system B (120) starts key exchange processing and switches cryptographic communication processing to processing system B (120). Will be explained.

First, the key management unit (3) of the processing system A (110) determines whether it is a key exchange time (step 18).
When it is the exchange time, the key management unit (3) of the processing system A (110) passes the apparatus control unit (6) to the key management unit (3) of the processing system B (120) at the exchange time. Notify that there is.
The key management unit (3) of the processing system B (120) activates IKE and establishes a new SA with the communication partner device (steps 19 and 20).
At this time, two types of SA have been established (the SA already established by the key management unit (3) of the processing system A (110) and the key management unit (3) of the processing system B (120) are newly established). Therefore, the processing system A (110) and the processing system B (120) perform encryption communication processing for each SA, so that the apparatus control unit (6) has an encryption communication processing system. The key management unit (3) of the processing system B (120) notifies that there are two (step 21).
Upon receiving the notification, the device control unit (6) updates the processing system discrimination data on the assumption that both the processing system A (110) and the processing system B (120) perform cryptographic communication processing (step 22). Up to this point, the cryptographic communication processing unit (4) of the processing system B (120) has also been activated, and the cryptographic communication processing unit (4) of the processing system B (120) determines the SA newly established in step 20. It is possible to perform encrypted communication with a communication partner device.

Next, when the SA switching time comes, the key management unit (3) of the processing system A (110) and the processing system B (120) starts the SA switching processing (step 23). At this time, the SA (old SA) of the processing system A (110) expires, and the key management unit (3) of the processing system A (110) deletes the old SA (step 24).
If the old SA is erased, the number of established SAs is one. Therefore, the key management unit (3) of the processing system A (110) switches the processing system, that is, the processing system B (120 ) Notifies the device controller (6) that encryption communication processing is to be performed (step 21), and the device controller (6) updates the processing system discrimination data (step 22).

As described above, in the cryptographic communication apparatus according to the first embodiment, out of the two processing systems, one processing system performs cryptographic communication processing and the other performs key exchange processing.
That is, in the cryptographic communication apparatus according to the first embodiment, the processing system that performs the cryptographic communication process at each key update time is alternately switched between the two processing systems.
By operating in this way, the cryptographic communication apparatus according to the present embodiment has a problem with the cryptographic communication apparatus disclosed in Japanese Patent Application Laid-Open No. 2003-17992, that is, a key exchange proxy server separately from the communication apparatus for key exchange processing. This solves the problem that a load of encryption communication is generated between the apparatus and the server when the server is prepared.
In other words, in the present embodiment, key exchange can be performed only with the encryption communication device, and encryption communication can be continued during the key exchange.

Further, when considering cryptographic communication processing when two types of SA from the establishment of a new SA to the disappearance of the old SA are considered, first, the two types of SA are designated as SA1 and SA2, respectively.
At this time, when the SA2-applied packet arrives more than the SA1-applied packet, the operation of the cryptographic communication apparatus disclosed in Japanese Patent Application Laid-Open No. 2003-179592 always makes an inquiry to SA1, so that there is a problem that the processing time is wasted. .
However, in the cryptographic communication apparatus (20) of the first embodiment, when the processing system A (110) performs cryptographic communication processing using SA1 and the processing system B (120) uses SA2, the processing system discrimination unit ( 5) distributes packets with reference to the SPI, and inquires the SA in each processing system.
Therefore, even when a large number of SA2-applied packets arrive, the processing system discriminating unit (5) does not need to make an inquiry to SA1, and it is possible to eliminate waste of processing time for the inquiry. It is possible to solve the problem of the encryption communication device disclosed in Japanese Patent Publication No. Gazette.

  As described above, in the present embodiment, the reception unit (1), transmission unit (2), key management unit (3), encryption communication processing unit (4), processing system determination unit (5), and device control unit (6) On the other hand, the cryptographic communication apparatus has two processing units (1) to (6), and the set of the two processing units is the processing system A (110) and the processing system B (120). In the above description, the encryption communication apparatus and the encryption information exchange process are performed in one of the processing systems, and the encryption communication apparatus that switches between the processing system A (110) and the processing system B (120) according to the encryption information update time has been described.

Embodiment 2. FIG.
FIG. 6 shows a configuration example of the cryptographic communication device (20) according to the present embodiment.
The encryption communication device (20) according to the present embodiment includes a reception unit (1), a transmission unit (2), a key management unit (3) (information update unit), and an encryption communication processing unit (4) (encryption communication unit). The device control unit (6) and the core allocation change unit (7) (core allocation control unit).

The receiving unit (1) receives the packet, determines whether the received packet is encryption communication processing or key exchange processing, and sends the packet to the encryption communication processing unit (4) or the key management unit (3).
The transmission unit (2) transmits a packet.
The key management unit (3) performs key exchange protocol processing and secret key management, and the encryption communication processing unit (4) performs packet encryption and decryption processing.
The core assignment changing unit (7) assigns the core to the key management unit (3) when the key exchange time (key update timing) is reached.
The device control unit (6) controls the core assignment change notification from the key management unit (3) to the core assignment change unit (7).
Here, the core allocation change means that the content of the process executed by the core is changed to execute the process of another processing means.
Further, in the method of using the multi-core CPU in the cryptographic communication apparatus (20) of the second embodiment, one process is performed by one core, and a plurality of processes are performed in parallel in a processing unit to which a plurality of cores are assigned.

  Although details will be described later, in the present embodiment, the core assignment changing unit (7) transmits at least one of the multi-core CPU cores to the cryptographic communication processing unit (4) before the key exchange time (key update timing). And at least one CPU core is assigned to the key management unit (3) at the key exchange time (key update timing) and the key is exchanged with the communication partner device. Let it be updated.

  More specifically, before the key exchange time (key update timing), the core allocation changing unit (7) allocates a plurality of CPU cores to the cryptographic communication processing unit (4) and performs cryptographic communication with the communication partner device. And at least one CPU core among the plurality of CPU cores assigned to the cryptographic communication processing unit (4) is assigned to the key management unit (3) at the key exchange time (key update timing).

The key management unit (3) includes a key management unit (hereinafter referred to as a key management unit A) operating before the key exchange time, and a key management unit (hereinafter referred to as key management unit B) operating from the key exchange time. It is classified). Key management unit A is an example of a first information update unit, and key management unit B is an example of a second information update unit.
The key management unit A allocates at least one CPU core by the core allocation change unit (7) before the key exchange time, and is a logical connection SA (first) used for encryption communication with the communication partner device. In the key management unit B, at the key exchange time, at least one CPU core is allocated by the core allocation changing unit (7), and a new SA (No. Second logical connection).
The key management unit A erases the SA set before the key exchange time after the new SA is set by the key management unit B, and the core allocation change unit (7) has the key management unit A set the SA. After erasing, at least a part of the CPU core assigned to the key management unit A is assigned to the encryption communication processing unit (4).

  The cryptographic communication processing unit (4) performs cryptographic communication with the communication partner apparatus using the SA set by the key management unit A before the key exchange time, and the SA set by the key management unit B at the key exchange time. To perform encrypted communication with the communication partner device.

  Next, the operation of the cryptographic communication apparatus (20) according to the second embodiment will be described. First, regarding the operation flow when a packet for cryptographic communication processing is received, the operation when the packet is received on the plaintext LAN (21). Will be described with reference to FIG.

First, when receiving a packet from the plaintext LAN (21), the receiving unit (1) determines whether the received packet is a packet for encryption communication processing or a packet for key exchange processing (step 1).
When it is a key exchange process, a packet is transmitted to the key management unit (3) (step 3), and when it is an encryption communication process, the packet is transmitted to the encryption communication processing unit (4) (step 4).

When the encrypted communication processing unit (4) receives the packet, the SPD is searched (step 5), and if the ciphertext is set, the encryption process is performed in the next step.
Although branching of settings other than ciphertext is omitted in the flowchart, the packet is transmitted to the transmission unit (2) when the plaintext is set, and the packet is discarded when the discard is set.

Next, in the processing after the SPD search, the cryptographic communication processing unit (4) searches the SAD (step 6) and determines the presence or absence of SA (step 7).
When there is no SA, it waits for establishment of SA and discards the packet (steps 8 and 9).
When there is SA, the cryptographic communication processing unit (4) performs encryption processing, hashing, IP header processing (steps 10, 11, and 12), and transmits the packet to the transmission unit (2) ( Step 13).
Then, the transmission unit (2) transmits the encrypted packet from the ciphertext side LAN (22) (step 14).

Next, an operation flow when an encrypted communication processing packet is received by the ciphertext side LAN (22) will be described with reference to FIG.
However, since the flow of processing in the receiving unit (1) after receiving the packet is the same as when the packet is received in the plaintext LAN, description thereof is omitted.

When the encrypted communication processing unit (4) receives the packet, the SAD is searched (step 6), and the presence or absence of SA is determined (step 7).
When there is no SA, it waits for establishment of SA and discards the packet (steps 8 and 9).
When there is SA, the cryptographic communication processing unit (4) searches for the SPD after performing the decryption processing of the hash and decryption operations (steps 11 and 16) (step 5). Is transmitted to the transmission unit (2) (step 13).
Then, the transmission unit (2) transmits the packet decrypted from the plaintext LAN (21) (step 17).

Next, regarding the core assignment switching to the key management unit (3) of the encryption communication device (20) at the key exchange time (key update timing), the key management unit (3) is an example using IKE as the key exchange protocol. The operation flowchart will be described with reference to FIG.
However, as described above, the original key management unit before the core allocation is referred to as a key management unit A, and the key management unit to which a new core is allocated is referred to as a key management unit B.

First, the key management unit A determines whether or not it is a key exchange time (step 18).
If it is the replacement time, a notification that it is the replacement time is sent to the core assignment changing unit (7) via the device control unit (6) (step 25).
Upon receiving the notification, the core assignment changing unit (7) performs a process of assigning one core of the cryptographic communication processing unit (4) to the key management unit B (step 26).

Next, when a core is allocated to the key management unit B, the key management unit B activates IKE and establishes a new SA (steps 19 and 20).
When the SA switching time comes, the key managers A and B start SA switching processing (step 23).
At this point, the SA (old SA) of the key management unit A expires, and the key management unit A erases the old SA (step 24).
When the old SA is deleted, the number of SAs established is one, so the key management unit A notifies the core allocation changing unit (7) via the device control unit (6), and the core allocation. The changing unit (7) assigns the core assigned to the key management unit A to the encryption communication processing unit (4) (steps 25 and 26).
As described above, in the cryptographic communication device (20) of the second embodiment, the operation in the key management unit (3) is switched.

In the core allocation dynamic update method disclosed in Japanese Patent Laid-Open No. 2007-219577, the core allocation to the processing unit is changed to optimize the throughput by measuring the load of the processing unit. For example, IKE is used in the key exchange protocol. When a core is allocated to the IKE processing means, it is only necessary to allocate a core while the IKE is activated. However, after the IKE processing is completed, the next load measurement is performed and the core allocation is performed. Until the change is made, a core is allocated to the IKE processing means that has already been processed, and there is a problem that resources are wasted during that time.
In contrast, in the cryptographic communication apparatus according to the second embodiment, each processing means is activated according to time, such as when IKE is activated to establish a new SA or when the old SA is deleted. Since assignment of cores can be changed, such a problem can be solved.
That is, in this embodiment, resource allocation is optimized by changing the allocation of CPU cores during key exchange.

  As described above, the present embodiment has described the cryptographic communication apparatus that dynamically changes the allocation of the core of each process according to the time when a multi-core CPU executes a plurality of processes.

Embodiment 3 FIG.
The method shown in the second embodiment can also be applied to the cryptographic communication apparatus of the first embodiment.
In this way, it is possible to solve the problems of both Japanese Patent Application Laid-Open Nos. 2003-179592 and 2007-219577.

FIG. 10 is a configuration example relating to the cryptographic communication apparatus according to the first embodiment using the method according to the second embodiment.
The encryption communication device (20) according to the present embodiment includes a reception unit (1), a transmission unit (2), a key management unit (3) (information update unit), and an encryption communication processing unit (4) (encryption communication unit). , A processing system discrimination unit (5) (packet analysis unit), a device control unit (6), a core allocation change unit (7) (core allocation control unit), and each processing means (1) to (4) A group of processing means (1) to (4) is defined as processing system A (110) and processing system B (120), respectively.
Further, the multi-core CPU in the present embodiment has 16 cores, and the allocation to each processing means is one for the processing system discrimination unit, one for the device control unit and the core allocation change unit, and two processing systems. 14 pieces.
In the operation of the cryptographic communication apparatus (20) of the third embodiment, the processing for the received packet is the same as that of the cryptographic communication apparatus of the first embodiment, and is omitted.

Although details will be described later, in the present embodiment, the core allocation changing unit (7) has one processing system (for example, processing system A (110)) before the key exchange time (key update timing). A plurality of CPU cores are allocated to the cryptographic communication processing unit (4) of one processing system (for example, processing system A (110)) to perform cryptographic communication with the communication partner device, and one process is performed at the key exchange time. At least one CPU core among a plurality of CPU cores assigned to a system (for example, processing system A (110)) is assigned to the key management unit (3) of the other processing system (for example, processing system B (120)). The key management unit (3) of the other processing system (for example, processing system B (120)) is assigned to exchange keys with the communication partner device.
Further, the core assignment changing unit (7) at least one of a plurality of CPU cores assigned to one processing system (for example, the processing system A (110)) at the key exchange time (key update timing). The CPU core is assigned to the encryption communication processing unit (4) of the other processing system (for example, processing system B (120)).
More specifically, the core allocation changing unit (7) is configured so that after the cryptographic communication processing unit (4) of one processing system (for example, processing system A (110)) ends the cryptographic communication, For example, at least one CPU core among a plurality of CPU cores assigned to the processing system A (110) is assigned to the encryption communication processing unit (4) of the other processing system (for example, the processing system B (120)). .

Next, with regard to switching between processing system A (110) and processing system B (120) depending on the key exchange time of the encryption communication device, an example using IKE as the key exchange protocol, from the operation flowchart (FIG. 11) of the key management unit. explain.
However, as an example of switching here, the processing system A (110) performs cryptographic communication processing, and the processing system B (120) performs key exchange processing at the key exchange time (key update timing).
Also in the present embodiment, as in the first embodiment, the processing system B (120) does not perform any processing until the key exchange time (key update timing) is reached.
Further, in the processing system A (110), one core is allocated to the receiving unit (1), one to the transmitting unit (2), one to the key management unit (3), and the cryptographic communication processing unit (4). In the processing system B (120), one in the receiving unit (1), one in the transmitting unit (2), 0 in the key management unit (3), and 4 in the encryption communication processing unit (4). As an example, switching of processing systems will be described.

First, the key management unit (3) of the processing system A (110) determines whether it is a key exchange time (step 18).
When it is the exchange time, the key management unit (3) of the processing system A (110) notifies the core allocation changing unit (7) of the exchange time via the device control unit (6). (Step 25).
Upon receiving the notification, the core assignment changing unit (7) performs a process of assigning one core of the cryptographic communication processing unit (4) of the processing system A (110) to the key management unit (3) of the processing system B (120). (Step 26).
As a result, in the processing system A (110) and the processing system B (120), one core is allocated to the receiving unit (1), one to the transmitting unit (2), one to the key management unit (3), There are four encryption communication processing units (4).

Next, when a core is allocated to the key management unit (3) of the processing system B (120), the key management unit (3) of the processing system B (120) activates IKE and establishes a new SA (step 19). 20).
At this time, two types of SAs have been established, and the processing system A (110) and the processing system B (120) perform cryptographic communication processing for each SA. 6) The key management unit (3) of the processing system B (120) notifies that there are two cryptographic communication processing systems (step 21).
Upon receiving the notification, the apparatus control unit (6) updates the processing system discrimination data on the assumption that both the processing system A (110) and the processing system B (120) perform cryptographic communication processing (step 22). Up to this point, the cryptographic communication processing unit (4) of the processing system B (120) has also been activated, and the cryptographic communication processing unit (4) of the processing system B (120) determines the SA newly established in step 20. It is possible to perform encrypted communication with a communication partner device.

Next, when the SA switching time comes, the key management unit (3) of the processing system A (110) and the processing system B (120) starts the SA switching processing (step 23). At this time, the SA (old SA) of the processing system A (110) expires, and the key management unit (3) of the processing system A (110) deletes the old SA (step 24).
If the old SA is erased, the number of established SAs is one. Therefore, the key management unit (3) of the processing system A (110) switches the processing system, that is, the processing system B (120 ) Notifies the device controller (6) that encryption communication processing is to be performed (step 21), and the device controller (6) updates the processing system discrimination data (step 22).

Further, when the old SA is deleted, the key management unit (3) of the processing system A (110) does not need to be processed, so the core allocation changing unit (7) is notified by the key management unit (3) of the processing system A (110). 3) issues a notification (step 25), and the core assignment changing unit (7) sends the core assigned to the key management unit (3) of the processing system A (110) to the cryptographic communication of the processing system B (120). Assigned to the processing unit (4) (step 28).
Thereby, in the processing system A (110), one core is allocated to the receiving unit (1), one is transmitted to the transmitting unit (2), 0 is allocated to the key management unit (3), and the cryptographic communication processing unit (4) is allocated. ) In the processing system B (120), one in the reception unit (1), one in the transmission unit (2), one in the key management unit (3), and one in the encryption communication processing unit (4) There will be five.
As described above, the cryptographic communication apparatus according to Embodiment 3 switches the processing system.

  The core allocation method in the present embodiment allocates more cores to a processing system that performs cryptographic communication processing, and equalizes the cores in both processing systems at the switching stage (stage where old and new SAs coexist) When the processing system that performs the cryptographic communication process moves to the other, more cores are allocated to the other processing system, and the number of cores allocated is not limited to the above description.

Further, in the operation of the cryptographic communication apparatus (20) of the third embodiment, when the processing system A (110) performs cryptographic communication processing using SA1 and the processing system B (120) uses SA2, processing system discrimination The unit (5) distributes the packet with reference to the SPI, and inquires the SA in each processing system.
Therefore, even when a large number of SA2-applied packets arrive, the processing system discriminating unit (5) does not need to make an inquiry to SA1, and it is possible to eliminate waste of processing time for the inquiry. To solve the problems of the encryption communication apparatus of the present invention.

  Further, in the cryptographic communication apparatus (200) of the third embodiment, each processing means is activated according to the time, such as when IKE is activated to establish a new SA, or when the old SA is deleted. Since the assignment of cores can be changed, the problem of Japanese Patent Application Laid-Open No. 2007-219577 can be solved.

Finally, a hardware configuration example of the cryptographic communication device (20) shown in the first to third embodiments will be described.
FIG. 12 is a diagram illustrating an example of hardware resources of the cryptographic communication device (20) illustrated in the first to third embodiments.
The configuration in FIG. 12 is merely an example of the hardware configuration of the cryptographic communication device (20), and the hardware configuration of the cryptographic communication device (20) is not limited to the configuration described in FIG. It may be a configuration.

In FIG. 12, the cryptographic communication device (20) includes a CPU 911 (also referred to as a central processing unit, a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, and a processor) that executes a program.
Note that the CPU 911 has a multi-core configuration as described above.
The CPU 911 is connected to, for example, a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a display device 901, a keyboard 902, a mouse 903, and a magnetic disk device 920 via a bus 912. Control these hardware devices.
Further, the CPU 911 may be connected to an FDD 904 (Flexible Disk Drive), a compact disk device 905 (CDD), a printer device 906, and a scanner device 907. Further, instead of the magnetic disk device 920, a storage device such as an optical disk device or a memory card (registered trademark) read / write device may be used.
The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are an example of a nonvolatile memory. These are examples of the storage device.
A communication board 915, a keyboard 902, a mouse 903, a scanner device 907, an FDD 904, and the like are examples of input devices.
The communication board 915, the display device 901, the printer device 906, and the like are examples of output devices.

  The communication board 915 is connected to a network as shown in FIG. For example, the communication board 915 may be connected to the Internet, a WAN (wide area network), etc., in addition to the LAN.

The magnetic disk device 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924.
The programs in the program group 923 are executed by the CPU 911 using the operating system 921 and the window system 922.

The RAM 914 temporarily stores at least part of the operating system 921 program and application programs to be executed by the CPU 911.
The RAM 914 stores various data necessary for processing by the CPU 911.

The ROM 913 stores a BIOS (Basic Input Output System) program, and the magnetic disk device 920 stores a boot program.
When the encryption communication device (20) is activated, the BIOS program in the ROM 913 and the boot program in the magnetic disk device 920 are executed, and the operating system 921 is activated by the BIOS program and the boot program.

  The program group 923 stores a program for executing the function described as “˜unit” in the description of the first to third embodiments. The program is read and executed by the CPU 911.

In the file group 924, in the description of the first to third embodiments, “determination of”, “switching of”, “exchange of”, “search of”, “comparison of”, “evaluation of” ”,“ Update of ”,“ setting of ”,“ registration of ”,“ selection of ”, etc. It is stored as each item of "~ file" and "~ database".
The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, editing, output, printing, and display.
Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
In addition, arrows in the flowcharts described in the first to third embodiments mainly indicate input / output of data and signals, and the data and signal values are the memory of the RAM 914, the flexible disk of the FDD904, the compact disk of the CDD905, and the magnetic field. Recording is performed on a recording medium such as a magnetic disk of the disk device 920, other optical disks, mini disks, DVDs, and the like. Data and signals are transmitted online via a bus 912, signal lines, cables, or other transmission media.

  In addition, what is described as “˜unit” in the description of the first to third embodiments may be “˜circuit”, “˜device”, “˜device”, and “˜step”, It may be “˜procedure” or “˜processing”. That is, what is described as “˜unit” may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes the computer to function as “to part” in the first to third embodiments. Alternatively, the computer executes the procedure and method of “to part” in the first to third embodiments.

  As described above, the encryption communication device (20) shown in the first to third embodiments includes a CPU as a processing device, a memory as a storage device, a magnetic disk, a keyboard as an input device, a mouse, a communication board, and a display device as an output device. The computer includes a communication board and the like, and realizes the functions indicated as “˜unit” as described above using these processing devices, storage devices, input devices, and output devices.

FIG. 3 is a diagram illustrating a configuration example of a cryptographic communication apparatus according to the first embodiment. 1 is a system configuration diagram of a network according to Embodiments 1 to 3. FIG. The flowchart figure which shows the operation example at the time of the packet reception from the plaintext side LAN of the encryption communication apparatus which concerns on Embodiment 1. FIG. The flowchart figure which shows the operation example at the time of the packet reception from the ciphertext side LAN of the encryption communication apparatus which concerns on Embodiment 1. FIG. FIG. 3 is a flowchart showing an operation example of a key management unit of the cryptographic communication apparatus according to the first embodiment. FIG. 4 shows a configuration example of a cryptographic communication apparatus according to a second embodiment. The flowchart figure which shows the operation example at the time of the packet reception from the plaintext LAN of the encryption communication apparatus which concerns on Embodiment 2. FIG. The flowchart figure which shows the operation example at the time of the packet reception from the ciphertext side LAN of the encryption communication apparatus which concerns on Embodiment 2. FIG. FIG. 9 is a flowchart showing an operation example of a key management unit of the cryptographic communication apparatus according to the second embodiment. FIG. 10 is a diagram illustrating a configuration example of a cryptographic communication apparatus according to a third embodiment. FIG. 9 is a flowchart showing an operation example of a key management unit of the cryptographic communication apparatus according to the third embodiment. The figure which shows the hardware structural example of the encryption communication apparatus which concerns on Embodiment 1-3.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 Reception part, 2 Transmission part, 3 Key management part, 4 Encryption communication process part, 5 Processing system discrimination | determination part, 6 Apparatus control part, 7 Core allocation change part, 20 Encryption communication apparatus, 21 Plaintext side LAN, 22 Ciphertext side LAN, 30 internal network, 31 terminals, 32 terminals, 110 processing system A, 120 processing system B.

Claims (11)

An encryption communication unit that performs encryption communication with the communication partner device, and an information update unit that performs update of the information for encryption communication used for encryption communication with the communication partner device each include two processing units,
Prior to the update timing of the encryption communication information, the encryption communication unit of one processing unit performs encryption communication with the communication partner device, and at the update timing of the encryption communication information, the information update unit of the other processing unit The encryption communication information is updated with the communication partner device, and the encryption communication unit of the other processing unit starts encryption communication with the communication partner device and the encryption communication unit of the one processing unit A communication apparatus for terminating encrypted communication. In each processing unit,
The information update unit
At the update timing of the encryption communication information, update the encryption communication information with the communication counterpart device, set a logical connection used for encryption communication with the communication counterpart device,
The encryption communication unit is
Perform cryptographic communication with the communication partner device in the logical connection set by the information update unit,
Before the update timing of the information for encryption communication, the encryption communication unit of the one processing unit performs encryption communication with the communication partner device in the logical connection set by the information update unit of the one processing unit, At the update timing of the encryption communication information, the information update unit of the other processing unit updates the encryption communication information with the communication partner device and sets a logical connection with the communication partner device. The encryption communication unit of the other processing unit starts encryption communication with the communication partner device, and the information update unit of the one processing unit deletes the logical connection to encrypt the encryption communication unit of the one processing unit. The communication apparatus according to claim 1, wherein communication is terminated. The information updating unit of the one processing unit is
After the information update unit of the other processing unit sets up a logical connection with the communication partner device and the encryption communication unit of the other processing unit starts encrypted communication with the communication partner device, the logical connection is deleted. And
The communication device further includes:
When the information update unit of the other processing unit sets a logical connection and before the information update unit of the one processing unit deletes the logical connection, the received packet is analyzed. And determining a logical connection to which the received packet belongs, and having a packet analysis unit for outputting the received packet in the processing unit that sets the logical connection to which the received packet belongs. Item 3. The communication device according to Item 2. The communication device
Multi-core CPU (Central Processing Unit)
The communication apparatus according to claim 1, wherein different CPU cores are assigned to the two processing units. The communication device
With multi-core CPU,
Furthermore,
Before the update timing of the encryption communication information, a plurality of CPU cores are allocated to the one processing unit, and the encryption communication unit of the one processing unit performs encryption communication with the communication partner device, and the encryption communication Information update timing of the other processing unit by allocating at least one CPU core among the plurality of CPU cores allocated to the one processing unit to the information updating unit of the other processing unit The communication apparatus according to claim 1, further comprising: a core allocation control unit that causes the unit to update the information for encrypted communication with the communication partner apparatus. The core allocation control unit
The at least one CPU core among the plurality of CPU cores allocated to the one processing unit is allocated to the cryptographic communication unit of the other processing unit at the update timing of the encryption communication information. Item 6. The communication device according to Item 5. The core allocation control unit
After the cryptographic communication unit of the one processing unit finishes the cryptographic communication, at least one CPU core among the plurality of CPU cores assigned to the one processing unit is used as the cryptographic communication unit of the other processing unit. 7. The communication apparatus according to claim 6, wherein the communication apparatus is assigned. A communication device comprising a multi-core CPU,
An encryption communication unit that performs encrypted communication with a communication partner device;
An information update unit for performing update of information for encryption communication used for encryption communication with the communication partner device;
Prior to the update timing of the encryption communication information, at least one CPU core is allocated to the encryption communication unit to perform encryption communication with the communication partner device, and the information update is performed at the update timing of the encryption communication information. And a core allocation control unit that allocates at least one CPU core to the communication unit and updates the information for encryption communication with the communication partner device. The core allocation control unit
Prior to the update timing of the encryption communication information, a plurality of CPU cores are assigned to the encryption communication unit to perform encryption communication with the communication partner device, and at the update timing of the encryption communication information, the encryption communication unit The communication apparatus according to claim 8, wherein at least one CPU core among the plurality of CPU cores assigned to the information updating unit is assigned to the information updating unit. The information update unit
It is divided into a first information update unit operating from before the update timing of the information for encrypted communication and a second information update unit operating from the update timing of the information for encrypted communication,
The first information updating unit
Prior to the update timing of the information for encryption communication, at least one CPU core is assigned by the core assignment control unit, and a logical connection used for encryption communication is set between the communication partner device,
The second information updating unit
At the update timing of the encryption communication information, at least one CPU core is assigned by the core assignment control unit, and a logical connection used for encryption communication is set between the communication partner device,
The encryption communication unit is
Prior to the update timing of the information for encryption communication, performing the encryption communication with the communication partner device in the first logical connection set by the first information update unit, at the update timing of the information for encryption communication, The communication apparatus according to claim 8 or 9, wherein the communication is performed with the communication partner apparatus by switching to the second logical connection set by the second information update unit. The first information updating unit
After the second logical connection is set by the second information update unit, the first logical connection is deleted,
The core allocation control unit
The at least part of the CPU core allocated to the first information update unit is allocated to the encryption communication unit after the first information update unit erases the first logical connection. The communication device according to 10.

Images