JP2010283450A - Communication apparatus, and communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce an amount of information which has been transmitted and received previously and to take over cryptographic communication. <P>SOLUTION: Communication apparatus 1 transmits session information including a part added or the like and a deletion instruction to communication apparatus 1A every time the session information is added, changed, or deleted (S15). When a failure or the like is detected (S23), the communication apparatus 1A transmits an address change instruction of the fact that an address or the like of the communication apparatus 1 in the session information is changed to an address or the like of the communication apparatus 1A (S25), to a communication apparatus 2. The communication apparatus 2 changes the address or the like of the communication apparatus 1 in the session information to the address or the like of the communication device 1, and the communication device 1A also changes an address AD1 or the like of the communication apparatus 1 in the session information stored to the address or the like of the communication apparatus 1A, and the communication apparatus 1A and 2 negotiate each other, newly generate cryptographic communication information (including an initial value of a sequence number), and store it (S27, S29). <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a communication device and a communication system.

  Conventionally, in a communication system based on IPSec (Security Architecture for Internet Protocol), encryption communication is performed between a communication device (referred to as communication device A) as a relay device and a communication device as a counterpart (referred to as communication device B). In the communication system, in preparation for a failure of the communication device A, another communication device (referred to as communication device A1) sequentially acquires session information used for encrypted communication and is on standby. The communication devices A and A1 have the same IP address (hereinafter referred to as an address), and the communication device B can perform encrypted communication in the same manner as both the communication devices A and A1. Therefore, when the communication device A1 detects a failure of the communication device A, the encrypted communication is performed with respect to the communication device B using the acquired session information, that is, the encrypted communication may be taken over.

  The above session information includes a sequence number. The communication devices A and B update the sequence number in the session information while transmitting and receiving packets including this sequence number. Therefore, a packet including an unscheduled sequence number can be regarded as an unauthorized access and discarded.

JP 2008-199421 A

  However, since the sequence number is included in the session information, the data amount of the session information increases, and transmission / reception of session information between the communication devices A and A1 is a heavy burden on the communication devices A and A1.

  Therefore, Patent Document 1 discloses a technique that can reduce the number of sequence number transmissions and prevent packets from being discarded as described above in non-illegal communication. In other words, the sequence number that has been transmitted every time it is updated is transmitted every time a fixed time longer than the update interval elapses, and the maximum number that can be added by updating to the sequence number on the transmitting side during that fixed time The expected number is added in advance to the received sequence number. In the communication device on the reception side, if the communication device on the transmission side breaks down, it starts using the sequence number after the addition, but since the sequence number is a large value, it is not equal to the sequence number used in the past. If it is used for a packet, the packet is not discarded.

However, it is still necessary to transmit the sequence number, which still places a burden on the communication device.
In addition, when a large sequence number is used, a so-called overflow may occur and communication may be disconnected.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a communication device and a communication system that reduce the amount of information to be transmitted / received and can take over encrypted communication. There is.

  In order to solve the above problems, a communication device according to a first aspect of the present invention is a communication device that takes over encrypted communication between a target communication device and a counterpart communication device from the target communication device, and Session information receiving means including an address indicating the communication apparatus and excluding the sequence number necessary for the encrypted communication, and storing the session information in a storage means provided in the takeover communication apparatus; and the counterpart communication apparatus In the stored session information, an address change instruction for changing the address indicating the target communication device to the address indicating the takeover communication device is transmitted to the counterpart communication device, and in the session information stored in the storage means Address change processing means for changing an address indicating a target communication device to an address indicating a communication device that takes over And encryption communication information generating means for generating encrypted communication information including an initial value of a sequence number necessary for communication with the counterpart communication apparatus by negotiating with the counterpart communication apparatus and storing the encrypted communication information in the storage means. It is characterized by.

  For example, the communication device according to the first aspect of the present invention includes a state monitoring unit that performs polling on the target communication device and operates so that the address change instruction is transmitted if there is no response from the communication device. .

  A communication system according to a second aspect of the present invention includes a communication device that takes over encrypted communication between a target communication device and a partner communication device from the target communication device, and a communication support device that is used together with the communication device. The communication support apparatus receives session information including an address indicating the target communication apparatus and excluding a sequence number necessary for the encrypted communication, and stores the received session information in a storage unit provided in the communication support apparatus The session information is read from the session information receiving means and the storage means, and the address indicating the target communication device in the session information stored in the partner communication device is changed to the address indicating the succeeding communication device together with the read session information. An instruction to send to the other communication device is sent to the partner communication device. Session information transmitting means for transmitting to the communication device to be succeeded, the communication device to be handed over, session information receiving means for storing the session information transmitted from the communication support device in a storage means provided in the communication device to be succeeded, Based on the transmission instruction, an address change instruction is transmitted to the partner communication apparatus to change the address indicating the target communication apparatus in the session information stored in the partner communication apparatus to the address indicating the takeover communication apparatus. And an address change processing means for changing an address indicating the target communication apparatus in the session information stored in the storage means to an address indicating the takeover communication apparatus, and based on the transmission instruction, Initial value of sequence number required for negotiation and communication with the communication device It generates the cryptographic communication information including characterized by comprising a cryptographic communication information generating means for storing in the storage means.

  For example, the communication support device includes a state monitoring unit that performs polling on the target communication device and operates so that the session information and the transmission instruction are transmitted if there is no response from the communication device. Features.

  For example, the session information receiving unit of the communication support device calculates the number of communication devices of the other party in the communication device to take over, and stores the number of communication devices of the other party in a storage unit provided in the communication support device, The session information transmitting means operates such that the sum of the number of counterpart communication devices stored in the storage means and the number of session information transmitted to the succeeding communication device is equal to or less than a predetermined number. And

  According to the first aspect of the present invention, session information receiving means for receiving session information including an address indicating a target communication apparatus and excluding a sequence number necessary for encrypted communication and storing the session information in a storage means provided in the succeeding communication apparatus And an address change instruction for changing the address indicating the target communication device in the session information stored in the partner communication device to the address indicating the communication device that takes over, is transmitted to the partner communication device and stored in the storage means. Address change processing means for changing the address indicating the target communication device in the session information to the address indicating the communication device, and the sequence number necessary for negotiation with the other communication device and communication with the other communication device The encryption communication information generation means for generating the encryption communication information including the initial value and storing the encryption communication information in the storage means Since obtain, may allow for reduced and the encrypted communication take over the amount of information to be transmitted and received.

  According to the second aspect of the present invention, the communication support apparatus receives session information including an address indicating the target communication apparatus and excluding a sequence number necessary for encrypted communication, and stores the session information in a storage unit provided in the communication support apparatus. Session information receiving means to be read, and session information is read from the storage means, and the read session information is changed to an address indicating the communication apparatus that takes over the address indicating the target communication apparatus in the session information stored in the other communication apparatus And a session information transmitting means for transmitting to the communication device that takes over the transmission instruction to send an address change instruction to the other communication device, and the take over communication device takes over the session information transmitted from the communication support device. Session information receiving means to be stored in storage means provided in the apparatus, and transmission instruction Based on this, an address change instruction for changing the address indicating the target communication device in the session information stored in the other communication device to the address indicating the communication device is transferred to the other communication device, and the storage means Address change processing means for changing the address indicating the target communication device in the stored session information to the address indicating the communication device, and based on the transmission instruction, negotiate with the other communication device and negotiate with the other communication device. And encryption communication information generating means for generating encrypted communication information including an initial value of a sequence number necessary for communication and storing it in the storage means, so that the amount of information to be transmitted and received can be reduced and encryption communication can be taken over. Can be possible.

It is a figure which shows the structure of the communication system which concerns on 1st Embodiment. 2 is a block diagram showing a configuration of each communication device 1. FIG. It is a block diagram which shows the structure of each communication apparatus 1A. 2 is a block diagram showing a configuration of each communication device 2. FIG. 3 is a diagram illustrating a configuration of an encryption rule information storage unit 103. FIG. 3 is a diagram showing a configuration of a key exchange communication information storage unit 104. FIG. 3 is a diagram illustrating a configuration of an encrypted communication information storage unit 105. FIG. It is a figure which shows the structure of session information. It is a sequence diagram which shows operation | movement of 1st Embodiment. It is a figure which shows the structure of an address change instruction | indication. 4 is a flowchart showing an operation when a packet is received by the communication device 1. It is a figure which shows the structure of a packet. 6 is a flowchart showing an operation when a packet is received by the communication device 2; It is a flowchart which shows operation | movement when the communication apparatus 1 transmits session information etc. to the communication apparatus 1A. 4 is a flowchart showing an operation when the communication device 1A receives session information and the like from the communication device 1. It is a flowchart which shows operation | movement when 1 A of communication apparatuses take over the encryption communication of the communication apparatus 1. FIG. It is a flowchart which shows operation | movement when the communication apparatus 2 receives an address change instruction | indication. It is a figure which shows the structure of the communication system which concerns on 2nd Embodiment. 3 is a block diagram showing a configuration of a communication support apparatus 4. FIG. 4 is a diagram illustrating a configuration of an encryption rule information storage unit 43. FIG. 4 is a diagram showing a configuration of a key exchange communication information storage unit 44. FIG. 3 is a diagram illustrating a configuration of an encrypted communication information storage unit 45. FIG. It is a sequence diagram which shows operation | movement of 2nd Embodiment. It is a figure which shows the structure of a transmission instruction | indication. 4 is a flowchart showing an operation when the communication support device 4 receives session information and the like from the communication device 1. It is a flowchart which shows operation | movement when the communication assistance apparatus 4 transmits a transmission instruction | indication etc. FIG. It is a flowchart which shows operation | movement when 1 A of communication apparatuses receive a transmission instruction | indication etc. FIG. It is a figure which shows the structure of the communication system which concerns on 3rd Embodiment. It is a block diagram which shows the structure of 4 A of communication assistance apparatuses. 3 is a diagram showing a configuration of a communication device management information storage unit 42. FIG. It is a sequence diagram which shows operation | movement of 3rd Embodiment. 4 is a flowchart showing an operation when the communication support device 4A receives session information or the like from the communication device 1. It is a flowchart which shows operation | movement when 4 A of communication assistance apparatuses transmit a transmission instruction | indication etc.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[First Embodiment]
FIG. 1 is a diagram illustrating a configuration of a communication system according to the first embodiment.

  Each communication device 1, 1 </ b> A is connected to a network N via a router R. Each of the plurality of communication devices 2 is connected to a network 3 assigned to the communication device 2. When two-way communication is performed between the terminal device A in one network 3 and the terminal device B in the network N, the communication device 2 connected to the network 3 and the communication device 1 assigned to the communication device 2 It is supposed to carry out cryptographic communication with. Similarly, encryption communication is also performed between the communication device 2 connected to the network 3 including the terminal device C and the communication device 1 assigned to the communication device 2. Here, it is assumed that the encryption communication conforms to the IPSec specification.

  In the description of the communication device 2, the communication device 1 that is to perform encrypted communication with the communication device 2 is simply referred to as the communication device 1.

  The communication device 1A normally does not perform the encryption communication as described above, that is, is on standby. The communication device 1 </ b> A takes over such encrypted communication when the communication device 1 fails. The communication device 1 and the communication device 1A have a one-to-one relationship.

  In the description of the communication device 1, the communication device 1A that takes over the encrypted communication of the communication device 1 is simply referred to as the communication device 1A, and vice versa.

  The communication devices 1 and 1A exist in different sub-networks, and the network addresses indicating the sub-networks are also different from each other. Each communication device 2 also exists in different sub-networks, and network addresses indicating the respective sub-networks are also different from each other.

  FIG. 2 is a block diagram showing the configuration of each communication device 1. FIG. 3 is a block diagram showing the configuration of each communication device 1A.

  The communication device 1 includes a line interface 101, a line interface 102, an encryption rule information storage unit 103, a key exchange communication information storage unit 104, an encryption communication information storage unit 105, an encryption related process application determination unit 106, an encryption related processing unit 107, An encryption key exchange unit 108 and a session information transmission unit 109 are provided.

  The communication device 1A includes a line interface 101, a line interface 102, an encryption rule information storage unit 103, a key exchange communication information storage unit 104, an encryption communication information storage unit 105, an encryption related process application determination unit 106, an encryption related processing unit 107, An encryption key exchange unit 108, a session information reception unit 109A, an address change processing unit 111, and a state monitoring unit 112 are provided.

  The line interface 101 transmits, to the router R, a packet addressed to the terminal device in the network N received by the line interface 102. The line interface 102 transmits the packet received by the line interface 101 and destined for the terminal device in any of the networks 3 to the communication device 2 connected to the network 3. The line interface 102 is also used for communication between the communication devices 1 and 1A.

The encryption rule information storage unit 103 stores encryption rule information used for determining whether packet encryption and decryption are necessary.
The key exchange communication information storage unit 104 stores key exchange communication information necessary for generating and exchanging keys used for packet encryption and decryption.

The encryption communication information storage unit 105 stores encryption communication information including a key used for packet encryption and decryption, a sequence number indicating the packet order, and the like.
The encryption-related process application determination unit 106 determines whether or not packet encryption / decryption is necessary.
The encryption related processing unit 107 encrypts and decrypts a packet.

  Session information transmission section 109 transmits session information stored separately in encryption rule information storage section 103 and key exchange communication information storage section 104 to communication apparatus 1A.

  The session information receiving unit 109A stores the session information transmitted from the communication device 1 separately in the encryption / encryption rule information storage unit 103 and the key exchange communication information storage unit 104.

The address change processing unit 111 transmits to the communication device 2 an instruction (address change instruction) to change the address of the communication device 1 to the address of the communication device 1A if the communication device 1 fails, etc. The address or the like of the communication device 1 in the session information stored separately in the conversion rule information storage unit 103 or the like is changed to the address or the like of the communication device 1A.
The state monitoring unit 112 monitors the state of the communication device 1 and detects a failure or the like.

  FIG. 4 is a block diagram showing the configuration of each communication device 2.

  The communication device 2 includes a line interface 21, a line interface 22, an encryption rule information storage unit 23, a key exchange communication information storage unit 24, an encryption communication information storage unit 25, an encryption related process application determination unit 26, an encryption related processing unit 27, An encryption key exchange unit 28 and an address change processing unit 29 are provided.

  The line interface 21 transmits the packet addressed to the terminal device in the network N received by the line interface 22 to the communication device 1. The line interface 22 transmits the packet addressed to the terminal device in the network 3 received by the line interface 21 to the terminal device.

The encryption rule information storage unit 23 stores encryption rule information used for determining whether packet encryption and decryption are necessary.
The key exchange communication information storage unit 24 stores key exchange communication information necessary for generating and exchanging keys used for packet encryption and decryption.

The encrypted communication information storage unit 25 stores encrypted communication information including a key used for packet encryption and decryption, a sequence number indicating the packet order, and the like.
The encryption-related process application determination unit 26 determines whether or not packet encryption / decryption is necessary.
The encryption related processing unit 27 encrypts and decrypts the packet.

  If the communication device 1 to be changed in the address change instruction transmitted from the communication device 1A is the current counterpart communication device 1, the address change processing unit 29 and the encryption rule information storage unit 23 and the key exchange communication The address of the communication device 1 in the session information stored separately in the information storage unit 24 is changed to the address of the communication device 1A.

  FIG. 5 is a diagram illustrating a configuration of the encryption rule information storage unit 103.

  The encryption rule information stored in the encryption rule information storage unit 103 of the communication device 1 includes (1) a network address NA1 indicating a subnetwork including itself (communication device 1) and (2) itself (communication device 1). Network address NA2 indicating the sub-network including the communication device 2 that is the other party, (3) the direction of communication, (4) (3) between itself (communication device 1) and the other communication device 2 Includes four rules that establish rules for directional communication. Different encryption rule information exists for different parties, opposite communication directions, different rules, and the like.

  Also, the encryption rule information stored in the encryption rule information storage unit 103 of the communication device 1A is transmitted from the communication device 1, and (1) a network address NA1 indicating a subnetwork including the communication device 1 and (2) a network address NA1 indicating a sub-network including the communication device 2 that is the counterpart of the communication device 1, (3) the direction of communication, and (4) between the communication device 1 and the counterpart communication device 2. This includes four rules that define rules for communication in the direction (3). Different encryption rule information exists for different parties, opposite communication directions, different rules, and the like.

  Although not shown, the encryption rule information stored in the encryption rule information storage unit 23 of the communication device 2 includes (1) a network address NA2 indicating a subnetwork including itself (communication device 2), and (2) a partner. Network address NA1 indicating the sub-network including the communication device 1 being configured, (3) communication direction, and (4) communication in the direction (3) between itself (communication device 2) and the partner communication device 1 Including the four that set the rules for Different encryption rule information exists for different parties, opposite communication directions, different rules, and the like.

  FIG. 6 is a diagram illustrating a configuration of the key exchange communication information storage unit 104.

  The key exchange communication information stored in the key exchange communication information storage unit 104 of the communication device 1 includes (1) identification information uniquely indicating the key exchange communication information, (2) an address AD1 of itself (communication device 1), ( 3) It includes four addresses: the address AD2 of the communication device 2 that is the counterpart of itself (the communication device 1), and (4) information about the key including the encryption and decryption keys. Different key exchange communication information exists for another partner, another key, and the like.

  The key exchange communication information stored in the key exchange communication information storage unit 104 of the communication device 1A includes (1) identification information uniquely indicating the key exchange communication information, (2) an address AD1 of the communication device 1, and (3) communication. 4 includes the address AD2 of the communication device 2 that is the counterpart of the device 1, and (4) information about the key including the encryption and decryption keys. Different key exchange communication information exists for another partner, another key, and the like.

  Although not shown, the key exchange communication information stored in the key exchange communication information storage unit 104 of the communication device 2 includes (1) identification information uniquely indicating the key exchange communication information, and (2) the own (communication device 2). Address AD2, (3) itself (communication device 2) address AD1 of communication device 1 that is the partner, and (4) information related to the key including encryption and decryption keys. Different key exchange communication information exists for another partner, another key, and the like.

  FIG. 7 is a diagram illustrating a configuration of the encrypted communication information storage unit 105.

  The encrypted communication information stored in the encrypted communication information storage unit 105 of the communication device 1 includes (1) identification information uniquely indicating the encrypted communication information, (2) the address AD1 of itself (communication device 1), and (3) itself. It includes four addresses: the address AD2 of the communication device 2 that is the counterpart of the (communication device 1), and (4) information related to encrypted communication. The information related to the encryption communication (4) includes a key and a sequence number. Different encryption communication information exists for another partner, another key, and the like.

  The encrypted communication information stored in the encrypted communication information storage unit 105 of the communication device 1A includes (1) identification information uniquely indicating the encrypted communication information, (2) the address AD1 of the communication device 1, and (3) the communication device 1 It includes four addresses: AD2 of the communication device 2 that is the partner, and (4) information related to encrypted communication. The information related to the encryption communication (4) includes a key and a sequence number. Different encryption communication information exists for another partner, another key, and the like.

  Although not shown, the encrypted communication information stored in the encrypted communication information storage unit 105 of the communication device 2 includes (1) identification information uniquely indicating the encrypted communication information, (2) the address AD2 of itself (communication device 2), (3) It includes four addresses: the address AD1 of the communication device 1 that is the other party (the communication device 2), and (4) information related to encrypted communication. The information related to the encryption communication (4) includes a key and a sequence number. Different encryption communication information exists for another partner, another key, and the like.

  FIG. 8 is a diagram showing a configuration of session information.

  In the communication device 1, the encryption rule information (1) includes one key exchange information and (2) a network address NA1 including the address AD1 in the key exchange information and a network address NA2 including the address AD2 in the key exchange information ( Information including two: one in each direction is referred to as session information.

The session information is communication information that does not include encrypted communication information, and therefore does not include a sequence number.
The session information refers to the same information in the communication device 1A and the communication device 2.

(Operation of the first embodiment)
FIG. 9 is a sequence diagram illustrating the operation of the first embodiment.

  The terminal device A transmits a communication request for communication with the terminal device B to the communication device 2 (S1). In response to this, the communication device 2 transmits a connection request to the communication device 1 (S3). On the other hand, the communication device 1 performs a procedure for authenticating the communication device 2, and if the authentication is successful, transmits a connection permission to the communication device 2 (S5). In addition, since communication between the communication devices 1 and 2 in communication between the terminal devices A and B needs to be encrypted communication, the communication devices 1 and 2 store session information for that purpose. The session information includes the addresses of the communication devices 1 and 2. The communication device 1 transmits session information to the communication device 1A in preparation for a failure of the communication device 1 (S7). The communication device 1A stores session information.

  When the terminal device A transmits a packet including the destination address that is the address of the terminal device B, the packet arrives at the communication device 2. The communication device 2 encrypts the packet, and transmits the encrypted packet to the communication device 1 because the address of the communication device 1 is in the stored session information. The communication device 1 decodes the packet. The decrypted packet is transmitted from the communication device 1 to the terminal device B in accordance with the destination address in the packet. The same applies to the transmission of packets from the terminal device B to the terminal device A. Thus, when two-way communication is performed between the terminal devices A and B (S11), communication between the communication devices 1 and 2 is encrypted communication.

  Each time the session information is added, changed, or deleted, the communication device 1 transmits session information including the added portion and an instruction for deletion to the communication device 1A (S15).

  The communication device 1A continuously polls the communication device 1 (S17) and receives a response.

  When the communication device 1 is faulty or congested (S19), communication between the communication devices 1 and 2 and between the communication device 1 and the terminal device B cannot be performed (S21). However, since the communication device 1A cannot receive a response due to a failure of the communication device 1 or the like, the communication device 1A can detect the failure or the like (S23).

  If the communication device 1A detects a failure or the like, the communication device 1A transmits an instruction (referred to as an address change instruction 100) to change the address or the like of the communication device 1 in the session information to the address or the like of the communication device 1A (S25). ).

  FIG. 10 is a diagram showing the configuration of the address change instruction 100. As shown in FIG.

  Address change instruction 100 includes addresses 100a and 100a, and a command 100c for changing address 100a to address 100b. As the address 100a, the address of the communication device 1 that has failed is set. As the address 100b, the address of the communication device 1A that detects a failure or the like is set.

  Returning to FIG. 9, if the address 100a in the address change instruction is the address AD1 of the communication device 1 in the stored session information, the communication device 2 addresses the address AD1 of the communication device 1 in the session information. The communication device 1A also changes the address AD1 and the like of the communication device 1 in the stored session information to the address and the like of the communication device 1A. 2 negotiate with each other to newly generate and store encrypted communication information (including the initial value of the sequence number) (S27, S29).

  As described above, when the terminal device A transmits a packet including the address of the terminal device B, the packet arrives at the communication device 2. The communication device 2 encrypts the packet and transmits the encrypted packet to the communication device 1A because the stored session information includes the address of the communication device 1A. The communication device 1A decodes the packet. The decrypted packet is transmitted from the communication device 1A to the terminal device B in accordance with the destination address in the packet. The same applies to the transmission of packets from the terminal device B to the terminal device A. Thus, when two-way communication is performed between the terminal devices A and B (S31), the packet passes through the communication device 1A, and communication between the communication device 1A and the communication device 2 becomes encryption communication.

  FIG. 11 is a flowchart showing an operation when a packet is received by the communication apparatus 1.

  When one of the line interfaces 101 and 102 receives a packet (START), the encryption-related process application determination unit 106 determines whether at least one of encryption and decryption of the received packet is necessary (T1).

  FIG. 12 is a diagram illustrating a packet configuration.

  The packet includes (1) a header, (2) an SPI index, (3) a sequence number, and (4) a payload. The header includes a source address and a destination address. (1) Header, (2) SPI index, (3) Sequence number is not encrypted, (4) Only payload is encrypted.

  Returning to FIG. 11, specifically, if the packet is received by the line interface 101, the encryption-related process application determination unit 106 stores (1) itself (communication device 1) in the encryption rule information storage unit 103. (2) a network address NA2 equal to the network address including the transmission destination address in the packet, and (3) a direction from itself (communication device 1) to the other party (communication device 2). If there is a description that encryption is necessary in the rule (4), it is necessary, and if it is not necessary, encryption and decryption are unnecessary.

  On the other hand, if the packet is received by the line interface 102, the encryption related processing application determination unit 106 stores the network address NA indicating the subnetwork including (1) itself (communication device 1) in the encryption rule information storage unit 103. And (2) a network address NA2 equal to the network address including the source address in the packet, and (3) a direction from the partner (communication device 2) toward itself (communication device 1). If there is a description that decryption is required in the rule (4), it is necessary. If it is not necessary, it is judged that encryption and decryption are unnecessary.

  If it is determined that neither encryption nor decryption is necessary for the other line interface (T1: NO), the communication interface 2 having the address included in the network address NA2 including the destination address of the received packet in the packet or The data is transmitted to the router R (T2), and the processing is finished (END).

  On the other hand, if it is determined that at least one of packet encryption and decryption is necessary (T1: YES), the encryption-related process application determination unit 106 performs key exchange communication information and encryption communication including identification information equal to the SPI index in the packet. It is determined whether the information is in the key exchange communication information storage unit 104 and the encrypted communication information storage unit 105 (T7).

  If there is no key exchange communication information or the like, the encryption key exchange unit 108 generates a key generated by negotiation with the encryption key exchange unit 28 of the communication device 2 and the key exchange communication information including the information related to the key and the encryption communication. Information is acquired and stored in the key exchange communication information storage unit 104 and the encrypted communication information storage unit 105 (T9).

  The encryption key exchange unit 28 of the communication device 2 also acquires the key exchange communication information and the encryption communication information including the generated key and information related to the key, and obtains the key exchange communication information storage unit 24 and the encryption communication information storage unit 25. The encrypted communication information including information related to the encrypted communication using the key is acquired and stored in the encrypted communication information storage unit 25.

  Next, if the packet is received by the line interface 101, the encryption-related processing unit 107 uses the packet payload as a key (a key in the key exchange communication information including identification information equal to the SPI index in the packet, or the encryption). On the other hand, if the packet is received by the line interface 102, the payload of the packet is decrypted with the key (T11).

  Next, the encryption related processing unit 107 updates the sequence number in the encryption communication information including the identification information equal to the SPI index in the packet (T13).

  Next, the other line interface transmits a packet including the encrypted or decrypted payload to the communication device 2 or the router R (T2), and ends the processing (END).

  FIG. 13 is a flowchart illustrating an operation when a packet is received by the communication device 2.

The packet has a configuration similar to that shown in FIG.
When one of the line interfaces 21 and 22 receives a packet (START), the encryption related process application determination unit 26 determines whether at least one of encryption and decryption of the received packet is necessary (U1).

  Specifically, when the packet is received by the line interface 21, the encryption related process application determination unit 26 indicates (1) the subnetwork including itself (communication device 2) in the encryption rule information storage unit 23. There is encryption rule information including the network address NA2 and (3) the direction from the communication device 2 itself (communication device 2) to the communication device 1, and if there is a description that encryption is necessary in the rule (4), it is necessary. It is determined that encryption and decryption are unnecessary.

  On the other hand, if the packet is received by the line interface 22, the encryption related process application determination unit 26 stores the network address NA2 indicating the subnetwork including (1) itself (communication device 2) in the encryption rule information storage unit 23. And (3) the encryption rule information including the direction from the communication device 1 to the communication device 2 (communication device 2). Is deemed unnecessary.

  If it is determined that neither encryption nor decryption is necessary for the other line interface (U1: NO), the received packet is sent to the communication device 1 that is the communication partner of itself (communication device 2) or the address of the transmission destination in the packet. (U2), and the process ends (END).

  On the other hand, if it is determined that at least one of encryption and decryption of the packet is necessary (U1: YES), the encryption-related process application determination unit 26 is an encryption including identification information in which the sequence number in the packet is equal to the SPI index in the packet. It is determined whether it is newer than the sequence number in the communication information (U3).

  If the sequence number in the packet is the same as the sequence number in the encryption communication information or the sequence number in the packet is older than the sequence number in the encryption communication information (U3: NO), the encryption related process application determination unit 26 determines that the packet is Discard (U5) and finish the process (END).

  On the other hand, if the sequence number in the packet is newer than the sequence number in the encrypted communication information (U3: YES), the encryption related processing unit 27 performs key exchange communication information and encrypted communication information including identification information equal to the SPI index in the packet. Is stored in the key exchange communication information storage unit 24 and the encrypted communication information storage unit 25 (U7).

  If there is no key exchange communication information or the like, the encryption key exchange unit 28 and the key exchange communication information including the key generated by the negotiation with the encryption key exchange unit 108 of the communication device 1 and information related to the key and the encryption communication Information is acquired and stored in the key exchange communication information storage unit 24 and the encrypted communication information storage unit 25, respectively, and encrypted communication information including information related to encrypted communication using the key is acquired and stored in the encrypted communication information storage unit 25. (U9).

  Note that the encryption key exchange unit 108 of the communication apparatus 1 also acquires the key exchange communication information and the encryption communication information including the generated key and information about the key, and obtains the key exchange communication information storage unit 104 and the encryption communication information storage unit 105. The encrypted communication information including information related to encrypted communication using the key is acquired and stored in the encrypted communication information storage unit 105.

  Next, if the packet is received by the line interface 21, the encryption-related processing unit 27 uses the packet payload as a key (a key in the key exchange communication information including identification information equal to the SPI index in the packet, or the encryption). If the packet is received by the line interface 22, the packet payload is decrypted with the key (U11).

  Next, the encryption related processing unit 27 updates the sequence number in the encryption communication information including the identification information equal to the SPI index in the packet (U13).

  Next, the other line interface transmits a packet including the encrypted or decrypted payload to the communication device 1 or the terminal device (U2), and ends the processing (END).

  FIG. 14 is a flowchart showing an operation when the communication device 1 transmits session information or the like to the communication device 1A.

  The session information transmission unit 109 newly stores the session information separately in the encryption rule information storage unit 103 or the like, or if any of the stored session information is changed or deleted except for the sequence number ( (START), an instruction to delete the changed session information or the deleted session information is transmitted from the line interface 102 to the communication device 1A (T21), and the processing ends (END).

  FIG. 15 is a flowchart showing an operation when the communication apparatus 1A receives session information or the like from the communication apparatus 1.

  When the line interface 102 receives session information or the like (START), the session information receiving unit 109A distributes the session information to the encryption rule information storage unit 103 or the like, and overwrites and stores the existing session information. Alternatively, the session information is deleted in accordance with the instruction (V1), and the process ends (END).

  FIG. 16 is a flowchart illustrating an operation when the communication device 1 </ b> A takes over encrypted communication of the communication device 1.

  The state monitoring unit 112 continuously polls the communication device 1 via the line interface 102 (V11). If there is no response from the communication device 1 (V13: NO), the state monitoring unit 112 notifies the address change processing unit 111 to that effect. As a result, the address change processing unit 111 reads the partner address AD2 in the key exchange communication information including the address AD1 of the communication device 1 in the key exchange communication information storage unit 104. That is, the address change processing unit 111 reads the address of the communication device 2 that is performing cryptographic communication with the communication device 1 that has stopped responding due to a failure or the like (V15).

  Next, the address change processing unit 111 encrypts the address change instruction having the configuration shown in FIG. 10 with the key in the corresponding session information, and the line interface 102 transmits this to the communication device 2 (V17). As the address 100a in the address change instruction, the address of the communication device 1 that has not responded is set. As the address 100b in the address change instruction, the address of the communication device 1A itself that transmits the address change instruction is set. The encryption key is included in the session information including the address of the communication device 1 that has not responded.

  Next, when a response indicating that the address or the like has been changed is returned, the address change processing unit 111 includes the address AD1 of the communication device 1 that has not been responded and is stored separately in the encryption rule information storage unit 103 and the like. Change the address AD1 and network address NA1 of the communication device 1 in the session information to a network address (that is, its own address and network address) including the address 100b and the address 100b in the address change instruction transmitted in Step V17. The encryption key exchange unit 108 negotiates with the encryption key exchange unit 28 of the communication device 2 using the key exchange communication information, generates encryption communication information including information related to encryption communication (such as an initial value of a sequence number), and performs encryption. The data is stored in the communication information storage unit 105 (V19), and the process ends (END).

  FIG. 17 is a flowchart showing an operation when the communication device 2 receives an address change instruction.

  When the address change instruction transmitted in step V17 of FIG. 16 is received (START), the encryption related processing unit 27 decrypts the address change instruction with the key in the session information (U21).

  Next, the address change processing unit 29, if the address 100a in the decrypted address change instruction is the address AD1 of the communication device 1 in the session information stored separately in the encryption rule information storage unit 23 or the like, The address AD1 and the network address NA1 in the session information are changed to a network address including the address 100b and the address 100b in the address change instruction, and the encryption key exchange unit 28 uses the key exchange communication information to communicate with the communication device. 1 to negotiate with the encryption key exchange unit 108, generate encrypted communication information including information related to encrypted communication (such as an initial value of the sequence number), and store the encrypted communication information in the encrypted communication information storage unit 25 (U23). END).

  Therefore, in the first embodiment, the communication device 1A is a communication device that takes over the encrypted communication between the target communication device 1 and the counterpart communication device 2 from the communication device 1, and has an address indicating the communication device 1. Session information including the sequence number required for encrypted communication is received (FIG. 15: START), and stored in the storage means (encryption rule information storage unit 103 and key exchange communication information storage unit 104) provided in the communication device 1A. (Step V1) Session information receiving means (line interface 102 and session information receiving unit 109A) to be stored and the address indicating communication device 1 in the session information stored in communication device 2 are changed to the address indicating communication device 2 Is sent to the communication device 2 (step V17) and stored in the storage means. The address indicating the communication device 1 in the session information is changed to the address indicating the communication device 1A (step V19). Address change processing means (line interface 102 and address change processing unit 111) is negotiated with the communication device 2 of the other party and communicated The encrypted communication information including the initial value of the sequence number necessary for communication with the apparatus 2 is generated and stored in the storage means (encrypted communication information storage unit 105) (step V19). The encrypted communication information generation means (line interface 102 and key) Exchange unit 108), it is not necessary to transmit / receive encrypted communication information between the communication devices 1 and 1A, reduce the amount of information transmitted and received between the communication devices 1 and 1A, and take over encrypted communication. Can be made possible.

  Moreover, since the encrypted communication information including the initial value of the sequence number is generated, it is difficult to cause so-called overflow, and the possibility of communication being disconnected can be reduced.

  In addition, since the encrypted communication information including the sequence number that is frequently updated is excluded from the session information transmitted / received between the communication apparatuses 1 and 1A, the amount of information can be further reduced.

  Further, the communication device 1A polls the communication device 1 (step V11), and if there is no response from the communication device 1 (step V13: NO), the communication device 1A operates such that an address change instruction is transmitted (step V17). Since the state monitoring means (the line interface 102 and the state monitoring unit 112) is provided, encryption communication can be taken over in the event of a failure of the communication device 1 or the like.

[Second Embodiment]
FIG. 18 is a diagram illustrating a configuration of a communication system according to the second embodiment.

Unlike the communication system of the first embodiment, a communication support device 4 (so-called server) is connected to the router R. About others, it is the same as that of 1st Embodiment.
The communication device 1 has the same configuration as that of the first embodiment (see FIG. 2).
The communication device 1A has a configuration in which the state monitoring unit 112 is excluded from the first embodiment and configuration (see FIG. 3).
The communication device 2 has the same configuration as that of the first embodiment (see FIG. 4).
FIG. 19 is a block diagram illustrating a configuration of the communication support apparatus 4.

  The communication support apparatus 4 includes a line interface 41, an encryption rule information storage unit 43, a key exchange communication information storage unit 44, an encrypted communication information storage unit 45, a session information transmission unit 46, a session information reception unit 47, and a state monitoring unit 48. Prepare.

The line interface 41 transmits and receives session information and the like.
The encryption rule information storage unit 43 stores encryption rule information used for determining whether packet encryption and decryption are necessary.
The key exchange communication information storage unit 44 stores key exchange communication information necessary for generating and exchanging keys used for packet encryption and decryption.

The encrypted communication information storage unit 45 stores encrypted communication information including a key used for packet encryption and decryption, a sequence number indicating the packet order, and the like.
The session information transmission unit 46 transmits the session information stored separately in the encryption rule information storage unit 43 and the key exchange communication information storage unit 44 to the communication device 1A.

The session information receiving unit 47 stores the session information transmitted from the communication device 1 separately in the encryption rule information storage unit 43 and the like.
The state monitoring unit 48 monitors the state of the other communication device 1 and detects a failure or the like.

  FIG. 20 is a diagram illustrating a configuration of the encryption rule information storage unit 43.

  The encryption rule information is transmitted from the target communication device, and (1) a network address NA1 indicating a sub-network including the target communication device, and (2) communication that is a partner of the target communication device. 4 includes a network address NA2 indicating a sub-network including the device 2, (3) a direction of communication, and (4) a rule for communication in that direction. Different encryption rule information exists for different objects, different parties, opposite communication directions, different rules, and the like.

  FIG. 21 is a diagram illustrating a configuration of the key exchange communication information storage unit 44.

  The key exchange communication information is transmitted from the target communication device. (1) Identification information uniquely indicating the key exchange communication information in the target communication device, (2) Address AD1 of the target communication device (3 4) the address AD2 of the communication device 2 that is the partner of the target communication device, and (4) information about the key including the encryption and decryption keys. Different key exchange communication information exists for another target, another partner, another key, and the like.

  FIG. 22 is a diagram illustrating a configuration of the encrypted communication information storage unit 45.

The encrypted communication information is transmitted from the target communication device. (1) Identification information uniquely indicating the encrypted communication information in the target communication device, (2) Address AD1 of the target communication device, (3) Target 4 of address AD2 of the communication apparatus 2 which is the other party of the communication apparatus, and (4) information related to the encryption communication. The information related to the encryption communication (4) includes a key and a sequence number. Different encryption communication information exists for another target, another partner, another key, and the like. ◎
Similar to the first embodiment, information having the configuration shown in FIG. 8 is referred to as session information.

(Operation of Second Embodiment)
FIG. 23 is a sequence diagram illustrating the operation of the second embodiment.

Since steps S1 to S5 are the same as those in the first embodiment, the description thereof is omitted.
Further, as in the first embodiment, the communication devices 1 and 2 store session information. The session information includes the addresses of the communication devices 1 and 2.
The communication device 1 transmits session information to the communication support device 4 in preparation for a failure of the communication device 1 (S107). The communication support apparatus 4 stores session information.

As in the first embodiment, when two-way communication is performed between the terminal devices A and B (S111), communication between the communication devices 1 and 2 is encrypted communication.
Each time the session information is added, changed, or deleted, the communication device 1 transmits session information including the added portion and an instruction for deletion to the communication support device 4 (S115).

The communication support apparatus 4 continuously polls the communication apparatus 1 (S117) and receives a response.
When the communication device 1 is faulty or congested (S119), communication between the communication devices 1 and 2 and between the communication device 1 and the terminal device B cannot be performed (S121).

Since the communication support device 4 cannot receive a response due to a failure of the communication device 1 or the like, the communication support device 4 can detect the failure or the like (S123).
When the communication support apparatus 4 detects a failure or the like, it communicates an instruction (referred to as a transmission instruction 200) to transmit the address change instruction having the configuration shown in FIG. 10 to the communication apparatus 2 together with the stored session information. The data is transmitted to the device 1A (S125).

  FIG. 24 is a diagram showing a configuration of the transmission instruction 200.

  The transmission instruction 200 includes addresses 201 and 202 and a command 203. The command 203 transmits the address change instruction 100 including the address 201 as the address 100a shown in FIG. 10 and the address of the communication apparatus that receives the transmission instruction 200 as the address 100b of FIG. 10 to the communication apparatus having the address 202. Command. As the address 201, the address of the communication device 1 that has failed is set. As the address 202, the address of the communication device 2 that is the counterpart of the communication device 1 in the corresponding session information is set.

  Returning to FIG. 23, the communication device 1A transmits an address change instruction to the communication device 2 based on the transmission instruction (S126). The address 201 in the transmission instruction is set as the address 100a in the address change instruction, and the communication device 1A address is set as the address 100b in the address change instruction. If the address 100a in the address change instruction is the address AD1 of the communication apparatus 1 in the stored session information, the communication apparatus 2 changes the address AD1 or the like to the address 100a or the like in the address change instruction. The communication device 1A also changes the address AD1 or the like equal to the address 100a in the address change instruction in the transmitted session information to the address 100b or the like in the address change instruction, and the communication devices 1A and 2 negotiate with each other. Then, the encryption communication information (including the initial value of the sequence number) is newly generated and stored (S127, S129).

  Thus, when two-way communication is performed between the terminal devices A and B (S131), the packet passes through the communication device 1A, and communication between the communication device 1A and the communication device 2 becomes encryption communication.

  The communication device 1 performs processing in the same flow as in the first embodiment (see FIGS. 11 and 14), except that the session information transmission unit 109 transmits session information and the like to the communication support device 4. (Step T21 in FIG. 14 is different).

  FIG. 25 is a flowchart showing an operation when the communication support apparatus 4 receives session information or the like from the communication apparatus 1.

  If the line interface 41 receives the session information or the like (START), the session information receiving unit 47 divides the session information into the encryption rule information storage unit 43 or the like, and overwrites and stores the existing session information, or In accordance with the instruction, the session information is deleted (W1), and the process ends.

  FIG. 26 is a flowchart showing an operation when the communication support apparatus 4 transmits the transmission instruction or the like in step S125 (FIG. 23).

  The state monitoring unit 48 continuously polls the communication device 1 via the line interface 41 (W11). If there is no response from the communication device 1 (W13: NO), the state monitoring unit 48 notifies the session information transmission unit 46 to that effect. Thereby, the session information transmission unit 46 reads the session information including the address AD1 equal to the address of the communication device 1 that does not respond from the encryption rule information storage unit 43 or the like (W15). That is, the session information transmitted from the communication device 1 that does not respond is read.

  Next, the session information transmission unit 46 transmits the transmission instruction having the configuration shown in FIG. 24 together with the read session information to the communication device 1A via the line interface 41 (W17), and the processing ends (END). . As the address 201 in this transmission instruction, the address of the communication device 1 that does not respond is set. As the address 202 in this transmission instruction, the address of the communication device 2 that is the counterpart of the communication device 1 in the read session information is set. The transmission destination is the communication apparatus having the address stored in advance in association with the address of the communication apparatus 1 that does not respond, that is, the communication apparatus 1A.

  As in the first embodiment, the communication device 1A receives and stores session information (see FIG. 15), but is different from receiving session information from the communication support device 4.

  FIG. 27 is a flowchart showing an operation when the communication device 1A receives the transmission instruction in step S125 (FIG. 23) / step W17 (FIG. 26).

  The address change processing unit 111 encrypts the address change instruction having the configuration shown in FIG. 10 with the key in the corresponding session information, and transmits it to the communication apparatus 2 via the line interface 102 (V117). The address 201 in the transmission instruction is set as the address 100a in the address change instruction. As the address 100b in the address change instruction, the address of the communication device 1A itself that transmits the address change instruction is set. The encryption key is included in the transmitted session information.

  Next, when a response indicating that the address or the like has been changed is returned, the address change processing unit 111 changes the address NA1 and network address NA1 that are equal to the address 100a in the address change instruction in the transmitted session information. The address 100b in the instruction and the network address including the address 100b are changed and stored separately in the encryption rule information storage unit 103 and the like, and the encryption key exchange unit 108 uses the key exchange communication information to Negotiate with the encryption key exchange unit 28 to generate encryption communication information including information related to encryption communication (such as an initial value of the sequence number) and store it in the encryption communication information storage unit 105 (V119), and the processing ends (END). .

  The communication device 2 performs processing in the same flow as in the first embodiment (see FIGS. 13 and 17). That is, the address and network address of the communication device 1 in the session information including the address of the communication device 1 (the communication device 1 that has failed) stored in the communication device 2 are changed to the address and network address of the communication device 1A. Secure cryptographic communication information is generated and stored.

  Therefore, in the second embodiment, the communication system includes a communication device 1A that takes over encrypted communication between the target communication device 1 and the counterpart communication device 2 from the communication device 1, and a communication support device that is used together with the communication device 1A. The communication support apparatus 4 receives session information including an address indicating the communication apparatus 1 and excluding a sequence number necessary for encrypted communication (FIG. 25: START). Storage means (encryption rule information storage unit 43 and key exchange communication information storage unit 44) provided in (step W1) session information receiving unit (line interface 41 and session information receiving unit 47), and the storage unit Session information is read out from the session information stored in the communication device 2 together with the read session information. The communication device 1 transmits an address change instruction for changing the address indicating the communication device 1 to the address indicating the communication device 1A to the communication device 2 (step W17). The communication device 1A includes an interface 41 and a session information transmission unit 46), and the communication device 1A stores the session information transmitted from the communication support device 4 in the communication device 1A (encryption rule information storage unit 103 and key exchange communication information). (Step V1) session information receiving means (line interface 102 and session information receiving unit 109A) to be stored in the storage unit 104), and an address indicating the communication device 1 in the session information stored in the communication device 2 based on the transmission instruction Address change instruction to change the address to the address indicating the communication device 1A 2 (step V117) and the address indicating the communication device 1 in the session information stored in the storage means is changed to the address indicating the communication device 1A (step V119). Address change processing means (line interface 102 and address) The encryption processing information including the initial value of the sequence number necessary for communication with the communication device 2 is negotiated with the change processing unit 111) and the communication device 2 of the other party, and stored in the storage means (encrypted communication information storage unit 105). Since the encrypted communication information generation means (line interface 102 and key exchange unit 108) is stored (step V119), it is not necessary to transmit / receive encrypted communication information between the communication device 1 and the communication support device 4, and the communication device 1 to reduce the amount of information transmitted and received between the communication support device 4 and the transfer of encrypted communication. Can do.

  Moreover, since the encrypted communication information including the initial value of the sequence number is generated, it is difficult to cause so-called overflow, and the possibility of communication being disconnected can be reduced.

  In addition, since the encrypted communication information including the sequence number that is frequently updated is excluded from the session information transmitted / received between the communication apparatuses 1 and 1A, the amount of information can be further reduced.

  Further, the communication support device 4 polls the communication device 1 (step W11), and if there is no response from the communication device 1 (step W13: NO), session information and a transmission instruction are transmitted (step W17). Since the state monitoring means (the line interface 41 and the state monitoring unit 48) that operate in the same manner is provided, encryption communication can be taken over in the event of a failure of the communication device 1 or the like.

[Third Embodiment]
FIG. 28 is a diagram illustrating a configuration of a communication system according to the third embodiment.

Unlike the communication system of the second embodiment, a communication support device 4A is connected to the router R. In addition, there is no communication device 1A, that is, no communication device that normally stands by without performing encrypted communication, and the communication device 1 takes over the communication of the other communication device 1. About others, it is the same as that of 2nd Embodiment.
The communication device 1 has the same configuration as that of the first and second embodiments (see FIG. 2).
The communication device 2 has the same configuration as that of the first and second embodiments (see FIG. 4).

  FIG. 29 is a block diagram showing a configuration of the communication support apparatus 4A.

  4 A of communication assistance apparatuses are provided with the communication apparatus management information storage part 42 in which the communication apparatus management information regarding each communication apparatus 1 is memorize | stored in addition to each component of the communication assistance apparatus 4. FIG. In addition, since it overlaps about each component of the communication assistance apparatus 4, description is abbreviate | omitted.

  FIG. 30 is a diagram illustrating a configuration of the communication device management information storage unit 42.

  The communication device management information includes (1) the address (monitor IP) of the target communication device 1, (2) the number (N) of the communication devices 2 with which the target communication device 1 is to perform encrypted communication, (3 3), the maximum number (Nmax) of the number (N) that the target communication device 1 can tolerate.

(Operation of the third embodiment)
FIG. 31 is a sequence diagram illustrating the operation of the third embodiment.

  Unlike the second embodiment, if the communication support device 4A detects a failure or the like due to a failure or the like of the communication device 1 (S119) (S123), the communication support device 4A communicates with the communication device 1 that has failed or the like. In step S125, the transmission instruction or the like is transmitted to the other communication device 1 that can take over. In addition, if the communication device 1 that has failed or the like is performing a plurality of communications and cannot be taken over by one communication device 1, for example, one of the two communication devices 1 is instructed to transmit a part of the communication. Etc. are transmitted (S125), and a transmission instruction or the like is transmitted to the other communication device 1 regarding the remaining communication (S125). For example, if the communication device 1 that has failed is in cryptographic communication with two communication devices 2, one communication device 1 performs cryptographic communication with one communication device 2, and the other communication device 1 is in communication with the other communication device 2. Will perform cryptographic communication. That is, communication of the communication device 1 that has failed is taken over.

  At that time, the communication device 1 performs processing in the same flow as in the second embodiment. Further, the communication device 1 performs processing in the same flow as the communication device 1A of the second embodiment (see FIG. 27).

  Further, the communication device 2 performs processing in the same flow as in the first embodiment (see FIGS. 13 and 17).

  FIG. 32 is a flowchart showing an operation when the communication support apparatus 4A receives session information or the like from the communication apparatus 1.

  As in the second embodiment (see FIG. 25), the session information receiving unit 47 stores the session information in the encryption rule information storage unit 43 or the like, or deletes the session information according to the instruction (W1). .

  Next, the session information receiving unit 47 determines the number of session information including the address AD1 equal to the address of the communication device 1 that is the current transmission source, that is, the number of communication devices 2 that are to perform encrypted communication (N ), The corresponding number (N) in the communication device management information storage unit 42 is updated (W3), and the process ends.

  FIG. 33 is a flowchart showing an operation when the communication support apparatus 4A transmits the transmission instruction or the like in step S125 (FIG. 31).

  As in the second embodiment (see FIG. 26), the session information transmission unit 46, if there is no response from the communication device 1 (W13: NO), includes a session including the address AD1 equal to the address of the communication device 1 that does not respond. Information is read from the encryption rule information storage unit 43 and the like (W15).

  The session information transmission unit 46 assigns one or more communication devices 1 that have not failed or the like to the read session information (W16). That is, the session information transmission unit 46 assigns a transmission destination to the session information.

  Specifically, one or more numbers m such that the total is equal to the number of read session information are generated, and a communication device 1 (communication device 1 that is not faulty) is assigned to each number m. The number (N) and the maximum number (Nmax) in the communication device management information including the address of the device 1 are read from the communication device management information storage unit 42, and the sum of the number m and the number (N) is equal to or less than the maximum number (Nmax). To be.

  If there are two communication devices 1 that are not malfunctioning, the number (N) in the communication device management information including the address of one communication device 1 is 100 (N = 100) and the maximum number (Nmax) ) Is 1000 (Nmax = 1000), the number (N) in the communication device management information including the address of the other communication device 1 is 200 (N = 200), and the maximum number (Nmax) is 3000 (Nmax = 3000). Also, assume that the number of read session information is 1000.

  In this case, the session information transmission unit 46 generates a number m1 “500” that is one of the two numbers m and a number m2 “500” that is the other number m, and the number m1 “500” is generated as one of the aforementioned numbers m1 “500”. The number m2 “500” is assigned to the other communication device 1 described above.

  The sum of the number m1 “500” and the number (N = 100) is “600”, and the condition that the sum is not more than the maximum number Nmax “1000” is satisfied. The sum of the number m2 “500” and the number (N = 200) is “700”, and the condition that the sum is equal to or less than the maximum number Nmax “3000” is satisfied.

  Next, for example, as described in the above example, the session information transmission unit 46, for one communication apparatus 1, sends the transmission instruction having the configuration shown in FIG. 24 together with the session information assigned to the communication apparatus 1. The data is transmitted to one communication device 1 (W17). As the address 201 in this transmission instruction, the address of one communication device 1 is set. As the address 202 in this transmission instruction, the address of the communication device 2 that is the partner of one communication device 1 in the read session information is set. The same applies to the other communication device 1 (W17), and the process ends (END).

  Therefore, in the third embodiment, the session information receiving unit 47 constituting the session information receiving unit of the communication support apparatus 4A calculates the number (N) of the other communication apparatuses 2 in the communication apparatus 1 that takes over the encrypted communication. The number (N) is stored in the storage means (communication device management information storage unit 42) provided in the communication support device 4A (step W3), and the session information transmission unit 46 constituting the session information transmission unit The operation is performed so that the sum of the number (N) of partner communication devices stored in the means and the number of session information transmitted to the communication device 1 that takes over encrypted communication is equal to or less than a predetermined number (maximum number (Nmax)). (Step W16), it becomes possible for the communication device 1 that performs encrypted communication to take over the encrypted communication from the communication device 1 that performs another encrypted communication.

  Although each embodiment has been described above, the following aspects may be adopted.

  (1) For example, in the third embodiment, even if there is a communication device 1 that is normally on standby (that is, the communication device 1A in the first embodiment) among the plurality of communication devices 1. Good.

  (2) In the third embodiment, when it is necessary to intentionally stop the communication of a certain communication device 1, for example, when the firmware of the communication device 1 needs to be updated, the communication support device 4A is used. The operation after step W15 in FIG. 33 may be executed by an operation or the like. Although a failure or the like is not an opportunity, as a result, all communication of the communication device 1 is taken over and the communication device 1 can be stopped.

  (3) In addition, when the load in the communication device 1 is reduced, the communication device 1 has a margin for the allowable load for communication of the communication device 1 in order to save power by cutting off the power supply to the communication device 1. 1 may take over. Further, in this way, communication of a plurality of communication devices 1 may be integrated into one communication device 1.

  (4) Further, for example, in order to reduce the load that has increased in the communication device 1, another communication device 1 that is in operation, a communication device that is in standby (communication device 1A), or the communication support device 4 is changed from the communication device 1. 4A may be requested to take over the communication, and the communication may be taken over as a trigger.

  (5) Further, the communication support device 4 or 4A may have functions such as the communication support device 4 or 4A, and the communication support device 4 or 4A may not be provided.

  A computer program for realizing the communication system and communication device in each embodiment by a general-purpose computer or firmware is stored in a computer-readable recording medium such as a semiconductor memory, a magnetic disk, an optical disk, a magneto-optical disk, or a magnetic tape. And can be distributed for display. Alternatively, the computer program may be transmitted via a communication network such as the Internet.

DESCRIPTION OF SYMBOLS 1, 1A, 2 ... Communication apparatus 3, N ... Network 4, 4A ... Communication support apparatus 21, 22, 41, 101, 102 ... Line interface 23, 43, 103 ... Encryption rule information storage part 24, 44, 104 ... Key exchange communication information storage unit 25, 45, 105 ... Encryption communication information storage unit 26, 106 ... Encryption related processing application determination unit 27, 107 ... Encryption related processing unit 28, 108 ... Encryption key exchange unit 29, 111 ... Address change processing Unit 42 ... Communication device management information storage unit 46, 109 ... Session information transmission unit 47, 109A ... Session information reception unit 48, 112 ... Status monitoring unit 100 ... Address change instruction 200 ... Transmission instruction

Claims (5)

A communication device that takes over encrypted communication between a target communication device and a counterpart communication device from the target communication device,
Session information receiving means for receiving session information including an address indicating the target communication apparatus and excluding a sequence number necessary for the encrypted communication, and storing the session information in a storage means provided in the takeover communication apparatus;
An address change instruction for changing the address indicating the target communication device in the session information stored in the counterpart communication device to the address indicating the takeover communication device is transmitted to the counterpart communication device, and the storage means Address change processing means for changing an address indicating a target communication device in the stored session information to an address indicating the communication device to be taken over;
Comprising encrypted communication information generating means for negotiating with the counterpart communication apparatus and generating encrypted communication information including an initial value of a sequence number necessary for communication with the counterpart communication apparatus and storing the encrypted communication information in the storage means. A communication device.   2. The communication apparatus according to claim 1, further comprising a state monitoring unit that performs polling on the target communication apparatus and operates so that the address change instruction is transmitted when there is no response from the communication apparatus. A communication system including a communication device that takes over encrypted communication between a target communication device and a partner communication device from the target communication device, and a communication support device used together with the communication device,
The communication support device includes:
Session information receiving means for receiving session information including an address indicating the target communication apparatus and excluding a sequence number necessary for the encrypted communication, and storing the session information in a storage means provided in the communication support apparatus;
Read session information from the storage means, and together with the read session information, an address change instruction to change the address indicating the target communication device in the session information stored in the counterpart communication device to the address indicating the takeover communication device Session information transmission means for transmitting to the communication device that takes over a transmission instruction to transmit to the other communication device,
The communication device taking over is
Session information receiving means for storing the session information transmitted from the communication support apparatus in a storage means provided in the communication apparatus that takes over,
Based on the transmission instruction, an address change instruction is transmitted to the partner communication apparatus to change the address indicating the target communication apparatus in the session information stored in the partner communication apparatus to the address indicating the takeover communication apparatus. And address change processing means for changing the address indicating the target communication device in the session information stored in the storage means to the address indicating the communication device to be taken over,
Based on the transmission instruction, the encrypted communication information that is negotiated with the counterpart communication device, generates encrypted communication information including an initial value of a sequence number necessary for communication with the counterpart communication device, and is stored in the storage means A communication system comprising: generating means. The communication support device includes:
4. The apparatus according to claim 3, further comprising state monitoring means that performs polling on the target communication device and operates so that the session information and the transmission instruction are transmitted if there is no response from the communication device. Communications system. Session information receiving means of the communication support device,
Calculate the number of counterpart communication devices in the takeover communication device, and store the number of counterpart communication devices in the storage means provided in the communication support device,
The session information transmission means includes
5. The operation according to claim 3, wherein the sum of the number of partner communication devices stored in the storage means and the number of session information transmitted to the succeeding communication device is equal to or less than a predetermined number. The communication system described.

Images