JP2011077887A - Packet transfer system, packet transfer method, communication apparatus and packet transfer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To transmit an encryption packet while reducing a header size of the packet rather than a conventional generic routing encapsulation (GRE)-over-IPsec communication system, and to perform packet transmission while reducing tunnel setup steps. <P>SOLUTION: In a packet transfer system, a transfer packet is encapsulated according to a predetermined key exchange protocol and transferred between a first communication apparatus and a second communication apparatus which is opposed to the first communication apparatus. The first communication apparatus has a mode notifying means for notifying the second communication apparatus of an encapsulation system that the first communication apparatus requests, in the case of negotiation with the second communication apparatus according to the key exchange protocol. The second communication apparatus has a mode recognizing means for recognizing the encapsulation system that the first communication apparatus requests. The first communication apparatus and the second communication apparatus have tunnel setting means for setting a tunnel according to the encapsulation system using the key exchange protocol. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a packet transfer system, a packet transfer method, a communication device, and a packet transfer program. For example, a packet transfer system, a packet transfer method, a communication device, and a packet transfer system that realize packet transfer on a virtual private network (VPN) It can be applied to a packet transfer program.

  Conventionally, as one method for realizing packet transfer between VPN gateway devices using a virtual private network, for example, there is a GRE Over IPSec communication method (see Patent Document 1 and Non-Patent Document 1), and this communication method is widely used. It's being used.

  GRE (Generic Routing Encapsulation) is one of the tunnel protocols, and is a standardized technology defined by RFC 1701 and RFC 2784 of IETF.

  In GRE tunneling, VPN gateway devices at both ends of the tunnel encapsulate an arbitrary protocol in an IP (Internet Protocol) tunnel to perform packet transfer, and decapsulate the received packet. Therefore, the VPN gateway devices at both ends of the tunnel appear to perform packet transfer directly connected.

  However, GRE does not have an encryption function. Therefore, even if routing security is maintained, security for the data itself is not maintained. Therefore, in order to maintain data safety, GRE Over IPsec is used as shown in FIG.

  Here, IPsec (Security Architecture For Internet Protocol) is a protocol that provides encryption prevention, confidentiality, and the like of data in units of IP packets using encryption technology.

  In IPsec, two security protocols are defined when AH (Authentication Header) and ESP (Encapsulating Security Payload). The AH provides a packet authentication function, and the ESP provides a packet authentication function and an encryption function. Either function can be selected according to the security policy.

  In addition, the IPsec operation mode includes a transport mode and a tunnel mode. The transport mode is a mode in which only the payload of the original IP packet is encapsulated in an IPsec packet, and the tunnel mode is a mode in which all of the original IP packet is encapsulated in an IPsec packet.

  When performing GRE Over IPsec communication, after establishing a GRE tunnel between VPN gateway devices, packets flowing on the GRE tunnel are encrypted using transport mode IPsec.

JP 2008-306725 A

Cisco Systems LLC, Technical Support, “Example of LAN-to-LAN connection configuration using GRE Over IPSec VPN”, January 27, 2006, first edition, Internet search, http://www.cisco.com/JP/support/public /loc/tac/100/1005663/gre_overipsec.shtml

  The GRE tunneling described above can use various layer 3 protocols such as IP, IPX, Apple Talk, CLNS, DECnet, VINES, and Banyan as encapsulated protocols.

  However, in an environment where only IP is used as a network protocol, when the conventional GRE over IPsec method is performed, encryption processing is performed after the GRE tunnel is established, and therefore, as shown in FIG. The packet size has a problem that the overhead increases by the GRE header size (8 bytes) compared to the IPsec packet in the tunnel mode.

Also, when establishing GER over IPsec communication, the operator (VPN gateway device)
(A) GRE tunnel establishment (b) Key exchange protocol setting such as IKE and two steps were required.

  Therefore, a packet transfer system and packet transfer capable of transmitting an encrypted packet with a smaller header size than the conventional GRE over IPsec communication method and transmitting a packet with a reduced number of tunnel establishment steps There is a need for a method, a communication device, and a packet transfer program.

  In order to solve such a problem, a packet transfer system according to a first aspect of the present invention provides a predetermined key exchange protocol between a first communication device and a second communication device facing the first communication device. In a packet transfer system for encapsulating a transfer packet and transferring the packet, (1) the first communication device requests a capsule method requested by itself when negotiating with the second communication device by a key exchange protocol. (2) the second communication device has mode recognition means for recognizing the capsule method requested by the first communication device, and (3) the first communication device The communication apparatus and the second communication apparatus include a tunnel setting unit that sets a tunnel by a capsule method using a key exchange protocol.

  The packet transfer method according to the second aspect of the present invention encapsulates a transfer packet according to a predetermined key exchange protocol between the first communication device and the second communication device facing the first communication device. (1) A mode in which the first communication device notifies the second communication device of the capsule method requested by itself when negotiating with the second communication device using the key exchange protocol. A notification step, (2) a mode recognition step in which the second communication device recognizes the capsule method requested by the first communication device, and (3) a key exchange between the first communication device and the second communication device. And a tunnel setting step for setting a capsule-based tunnel using a protocol.

  The communication device according to the third aspect of the present invention is a communication device that encapsulates a transfer packet in accordance with a predetermined key exchange protocol with the opposite device and transfers the packet. (1) Negotiation with the opposite device using the key exchange protocol (2) mode notification means for notifying the opposite device of the capsule method requested by the own device when negotiating between the opposite device by the negotiation means; and (3) the capsule method requested by the opposite device. And (4) tunnel setting means for setting a capsule-based tunnel using a key exchange protocol.

  According to a fourth aspect of the present invention, there is provided a packet transfer program comprising: (1) a communication device that encapsulates a transfer packet in accordance with a predetermined key exchange protocol and transfers the packet to / from an opposite device; Negotiation means for performing negotiation, (2) Mode notification means for notifying the opposite apparatus of the capsule method requested by the own apparatus when negotiating with the opposite apparatus by the negotiation means, and (3) Capsule method requested by the opposite apparatus. A mode recognizing means for recognizing, and (4) functioning as a tunnel setting means for setting a capsule tunnel using a key exchange protocol.

  According to the present invention, an encrypted packet can be transmitted with a smaller header size than the conventional method (GRE over IPsec communication method), and a packet can be transmitted with fewer tunnel establishment steps. .

It is an internal block diagram which shows the internal structure of the communication apparatus of 1st Embodiment. It is explanatory drawing explaining the conventional GRE over IPsec communication. It is a figure which shows the packet size of the conventional GRE over IPsec. It is a block diagram which shows the structure of the packet transfer system of 1st Embodiment. It is a block diagram which shows the function structure of the tunnel setting part of 1st Embodiment. It is a block diagram which shows the function structure of the negotiation part of 1st Embodiment. It is a block diagram which shows the structural example of the security policy of 1st Embodiment. It is a block diagram which shows the structural example of the security association of 1st Embodiment. It is a sequence diagram which shows the IPIP over IPsec tunnel establishment process of 1st Embodiment. It is a flowchart which shows the process in the communication apparatus of 1st Embodiment. It is explanatory drawing explaining the structure of the message of IKEv1. It is a sequence diagram which shows the IPIP over IPsec tunnel establishment process of 2nd Embodiment. It is a sequence diagram which shows the IPIP over IPsec tunnel establishment process of 3rd Embodiment. It is a flowchart which shows the process in the communication apparatus of 3rd Embodiment.

(A) First Embodiment Hereinafter, a packet transfer system, a packet transfer method, a communication apparatus, and a packet transfer program according to a first embodiment of the present invention will be described with reference to the drawings.

  The first embodiment uses the present invention to, for example, an IPIP tunnel of a packet transfer system that encapsulates an IP packet with an Internet protocol (IP) and transfers the packet in the tunnel in an environment where IP is used as a network protocol. 2 illustrates an embodiment for realizing the establishment process.

  The present invention establishes an IPIP tunnel as will be described later, and can be applied to, for example, the provisions of RFC 1853 “IP in Tunneling” of IETF. In RFC1853, it is proposed to simply wrap an IP header with another IP header, and an IPIP tunnel packet encapsulation format is shown.

  The present invention can also be applied to the provisions of RFC 2003 “IP Encapsulation within IP” in which RFC1853 is expanded for mobile IP (Mobile IP) if the IP header is understood from the viewpoint of wrapping it with other headers.

(A-1) Configuration of the First Embodiment FIG. 4 is a configuration diagram showing the configuration of the packet transfer system 5 of the first embodiment. As shown in FIG. 4, the communication apparatus 10-1 connected to the network 20 and the subnet A, and the communication apparatus 10-2 connected to the network 20 and the subnet B are provided.

  The network 20 is assumed to be a communication network whose communication protocol is the Internet protocol (IP) as represented by the Internet, for example, and corresponds to, for example, a WAN (Wide Area Network) that performs packet transfer between bases.

  The subnet A and the subnet B are assumed to be a communication network whose communication protocol is the Internet protocol (IP), for example, and correspond to a subnetwork such as a local area network (LAN).

  The communication device 10-1 and the communication device 10-2 are communication devices that establish a tunnel according to a predetermined tunnel protocol with a facing communication device and perform packet transfer. For example, a VPN gateway device or a VPN router device A packet transfer apparatus such as can be applied.

  In addition, the communication device 10-1 and the communication device 10-2 notify the opposite device of the encapsulation method (encapsulation mode) used by the communication device 10-1 and the communication device 10-2 in the negotiation according to the key exchange protocol related to the encryption process. If the own device can cope with the encapsulation method notified from the opposite device, it responds to that effect, and establishes a tunnel according to the encapsulation method after key exchange.

  Here, in the first embodiment, IPsec is applied as a predetermined tunnel protocol, and IKEv1 (Internet Key Exchange Protocol version 1) is applied as a key exchange protocol.

  Also, as shown in FIG. 4, the description will focus on the case where only IP is used as the network protocol, and the communication device 10-1 and the communication device 10-2 establish an IPIP over IPsec tunnel. By establishing an IPIP over IPsec tunnel, a specific packet can be encrypted between the own device and the opposite device.

  FIG. 1 is an internal configuration diagram illustrating an internal configuration of the communication device 10-1 and the communication device 10-2. Note that the internal configurations of the communication device 10-1 and the communication device 10-2 are the same, and in the description of the common components, the communication device 10-1 and the communication device 10-2 will be described as “communication device 10”.

  In FIG. 1, the communication device 10 includes at least a user interface unit 100, a program unit 200, and a network stack unit 300.

  The user interface unit 100 is a processing unit or device that accepts input of predetermined setting information by a user. The user interface unit 100 can apply, for example, a GUI (Graphical User Interface) using an HTTP (HyperText Transfer Protocol) server or the like, and inputs setting information necessary for establishing an IPIP over IPsec tunnel.

  Here, the setting information necessary for establishing an IPIP over IPsec tunnel mainly includes setting information related to establishment of an IPIP tunnel and setting information related to setting of a key exchange protocol.

  Specifically, the setting information (tunnel establishment setting information) related to the IPIP tunnel establishment includes (a) the address (IP address, etc.) of the opposite device, (b) the address (IP address, etc.) of the own device, and (c) IPIP. There are tunnel addresses (for example, addresses belonging to the subnet side network address of the own device), (d) routing settings for traffic to be passed through the IPIP tunnel (for example, information specifying the subnet of the opposite device), and the like.

  In addition, as the setting information (key exchange setting information) related to the setting of the key exchange protocol, specifically, (e) the address of the opposite device (IP address, etc.), (f) the address of the own device (IP address, etc.), (G) There is a pre-shared key (PSK) authentication puff phrase (password), a digital certificate for RSA authentication, or the like.

  The user interface unit 100 receives the input of the setting information as described above, and gives the input setting information to the key exchange management unit 210 of the program unit 200. The key exchange management unit 210 sets the same value for “(a) and (e)” and “(b) and (f)” when the setting information is input. The same value is automatically inserted into the other. Thereby, an operator's setting work can be reduced.

  The program unit 200 provides each processing function unit executed on the OS (operating system) of the own device (communication device) 10. As shown in FIG. 1, the program unit 200 includes at least a key exchange management unit 210, an SP (security policy) setting unit 220, an SA (security association) unit 230, a tunnel setting unit 240, and a negotiation unit 250.

  The key exchange management unit 210 performs negotiation management with the opposing device in accordance with the setting information from the user interface unit 100, and controls key exchange processing safely with the opposing device.

  The key exchange management unit 210 gives the key exchange setting information received from the user interface unit 100 to the SA setting unit 230 and causes the SAD (security database) 320 to set and register the security association setting information.

  In addition, the key exchange management unit 210 gives the tunnel setting setting information received from the user interface unit 100 to the tunnel setting unit 240. Thereby, the tunnel setting unit 240 can establish an IPIP tunnel with the opposite device using the tunnel establishment setting information.

  In addition, the key exchange management unit 210 establishes an IPIP over IPsec tunnel with the opposite device when transmitting the current packet to the opposite device by IPIP over IPsec communication based on the setting information from the user interface unit 100. An instruction to the effect is given to the negotiation unit 250 and the tunnel setting unit 240.

  Furthermore, when the key exchange management unit 210 receives from the negotiation unit 250 that the opposite device has requested establishment of an IPIP over IPsec tunnel, the key exchange management unit 210 causes the tunnel setting unit 240 to determine whether or not the encapsulation methods match. Instructing that an IPIP tunnel should be established with the opposite device.

  The SP setting unit 220 sets the security policy in the SPD (security policy database) 310 of the network stack unit 300 through the key exchange management unit 210 using the setting information from the user interface unit 100.

  The SA setting unit 230 sets the security association in the SAD (security association database) 320 of the network stack unit 300 through the key exchange management unit 210 with the setting information (key exchange setting information) from the user interface unit 100.

  Based on the tunnel establishment setting information from the user interface unit 100, the tunnel setting unit 240 recognizes that the IPIP tunnel mode is used as the encapsulation mode between the own device and the opposite device, and then sets the IPIP tunnel. Is to do.

  FIG. 5 is a block diagram illustrating a functional configuration of the tunnel setting unit 240. As illustrated in FIG. 5, the tunnel setting unit 240 includes at least an IPIP tunnel processing activation setting unit 241, an IPIP tunnel generation unit 242, a routing setting unit 243, and a tunnel establishment setting information storage unit 244.

  When the IPIP tunnel process activation setting unit 241 recognizes that the IPIP tunnel mode is to be used between the own apparatus and the opposite apparatus, the IPIP tunnel process activation setting unit 241 performs settings related to the generation of the IPIP tunnel on the OS of the own apparatus.

  For example, when the OS of the own apparatus is Linux (registered trademark), the IPIP tunnel processing activation setting unit 241 includes a module (for example, ipip.o) related to the IP / IP protocol decoder processing or a module (for example, new_tunnel.o (for example) related to tunnel processing). tunnel.o), etc.) is loaded so that the IPIP tunnel processing can be performed on the OS.

  The IPIP tunnel processing activation setting unit 241 confirms whether or not the module related to the generation processing of the IPIP tunnel rotated as described above has been normally loaded.

  For example, the IPIP tunnel processing activation setting unit 241 determines whether or not normal loading has been performed by checking whether or not the loaded module exists in the list of loaded modules.

  When IPIP tunnel setting preparation is completed, the IPIP tunnel generation unit 242 generates and sets a pseudo device (for example, tun10) used for tunnel communication on the OS, and uses the tunnel establishment setting information to communicate with the opposite device. To generate an IPIP tunnel.

  For example, when the IPIP tunnel generation unit 242 generates a pseudo device, the IPIP tunnel generation unit 242 generates an IPIP tunnel by associating with the IP address of the opposite device.

  The routing setting unit 242 sets the routing related to the network through the generated IPIP tunnel.

  For example, the routing setting unit 243 sets the communication path of the interface A of the communication processing unit, which is a WAN interface that communicates with the opposite device, to pass through the generated IPIP tunnel.

  The tunnel establishment setting information storage unit 244 stores tunnel establishment setting information.

  The negotiation unit 250 performs negotiation according to a predetermined key exchange protocol with the opposite device via the packet processing unit 330 under the control of the key exchange management unit 210.

  When the negotiation unit 250 receives an instruction from the key exchange management unit 210 to establish an IPIP over IPsec tunnel in love with the opposite device, the negotiation unit 250 negotiates with the key exchange protocol (hereinafter, key exchange negotiation). In this case, the opposite device is notified of the encapsulation method used by itself (hereinafter also referred to as encapsulation mode notification).

  In the first embodiment, a case where IKEv1 is adopted as a key exchange protocol is illustrated. This is because the notification procedure of the encapsulation method used by the own device differs depending on the key exchange negotiation procedure. Therefore, the first embodiment illustrates the case of IKEv1, and the second embodiment illustrates the case of IKEv2. Illustrate.

  Here, the notification timing of the encapsulation mode is exemplified when the key exchange negotiation is in progress, but is not limited to during the key exchange negotiation, and may be performed after the key exchange negotiation. In other words, when the encapsulation mode is notified after the key exchange negotiation, since the IPsec encryption communication in the normal transport mode is possible, it is possible to notify the opposite device of the encapsulation mode using this encryption communication path. It is.

  FIG. 6 is a block diagram illustrating a functional configuration of the negotiation unit 250. As illustrated in FIG. 6, the negotiation unit 250 includes at least an operation mode notification unit 251.

  The operation mode notification unit 251 notifies the opposite device of the encapsulation mode used by the own device. It also responds to the received encapsulation mode notification. The operation mode notification unit 251 extends IKEv1 of the key exchange protocol, and exchanges an encapsulation mode notification with the opposite device during negotiation.

  Next, the network stack unit 300 is generally a network stack on an OS that executes communication processing. As illustrated in FIG. 1, the network stack unit 300 includes at least an SPD 310, an SAD 320, a packet processing unit 330, an interface unit A 340-1, and an interface unit B 340-2.

  The SPD 310 is a database that holds a security policy. FIG. 7 is an explanatory diagram for explaining the configuration of the security policy held in the SPD 310. FIG. 7 illustrates a security policy in the communication device 10-1, for example.

  In FIG. 7, the security policy includes “local IP address”, “remote IP address”, “operation”, IPsec “mode”, “SA link”, and the like as items.

  If necessary, the selector column may have items such as a local port number, a remote port number, and an upper layer protocol. You may make it have items, such as a security protocol, an encryption algorithm, an authentication algorithm, in the column of IPsec.

  The “local IP address” stores the address of the terminal belonging to the subnet connected to the own device 10-1. In the case of FIG. 7, “192.168.1.0” to “198.162.1.255” are set as network addresses belonging to the subnet B to which the communication device 10-2 is connected.

  “Remote IP address” stores the address of a terminal belonging to the subnet connected to the opposite apparatus. In the case of FIG. 7, “192.168.2.0” to “198.162.2.255” are set as network addresses belonging to the subnet A to which the communication terminal 10-2 is connected as one of the opposing devices.

  “Operation” holds the operation mode. For example, FIG. 7 illustrates a case of operating as IPIP over IPsec.

  “Mode” stores whether to use the transport mode or the tunnel mode when performing IPsec. In FIG. 7, it is set to select a transport when performing IPIP over IPsec communication.

  The “SA link” stores an identifier associated with the SA in the SAD 320. In FIG. 7, “1” that adopts IKEv1 as the key exchange protocol is set.

  The SAD 320 is a database that holds a security association. FIG. 8 is an explanatory diagram for explaining the configuration of the security association held in the SAD 320. FIG. 8 illustrates, for example, the security association in the communication device 10-1.

  In FIG. 8, the security association includes “SPI”, “mode”, “security protocol”, “encryption parameter”, “authentication parameter”, and the like.

  “SPI” stores an identifier for uniquely identifying a security association.

  “Mode” stores whether to use the transport mode or the tunnel mode when performing IPsec.

  The “security protocol” stores a security protocol, and stores, for example, types such as AH and ESP.

  The “encryption parameter” stores an encryption algorithm, a key, and the like.

  The “authentication parameter” stores an authentication algorithm, a key, and the like.

  The packet processing unit 330 is a processing unit or device that performs packet transmission processing, reception / analysis processing, transfer processing, encryption / decryption processing, and the like. The packet processing unit 330 retrieves the security policy of the packet from the SPD 310 at the time of packet transmission / reception, and if there is a security policy, retrieves the security association associated with the security policy from the SAD 320 and associates it with the security policy. The encrypted key is used for encryption / decryption processing and packet transfer is performed.

  The interface unit A340-1 is a communication interface connected to the network 20, and the interface unit B340-2 is a communication interface connected to the subnet A or B.

(A-2) Operation of the First Embodiment Next, the operation of the packet transfer process of the first embodiment will be described with reference to the drawings.

  FIG. 9 is a sequence diagram illustrating an IPIP over IPsec tunnel establishment process according to the first embodiment. FIG. 10 is a flowchart of key exchange processing in the communication apparatus 10.

  In FIG. 9, the communication apparatus 10-1 automatically establishes an IPIP over IPsec tunnel using the main mode of IKEv1 by extending IKEv1 to the key exchange protocol with the communication 10-2 as the opposite apparatus. The case where it does is illustrated.

  First, in the communication device 10-1, the user interface unit 100 reads the input of setting information by the user (step S201), and the root seating unit 250 is a counter device under the control of the key exchange management unit 210. Key exchange negotiation is started with the communication device 10-2 (step S202).

  The key exchange management unit 210 confirms the encapsulation mode of its own device based on the input setting information, and if the encapsulation mode is the IPIP tunnel mode (step S203), requesting the IPIP tunnel mode is performed. Notification is made during the negotiation with the opposing device 10-2 (step S204). If the mode is not the IPIP tunnel mode, a key exchange process based on the input setting information is performed.

  At this time, if the key exchange negotiation fails between the communication device 10-1 and the communication device 10-2 (step S203), the resource is released as a negotiation error (step S212), and the process ends.

  On the other hand, if the key exchange negotiation is successful, in each of the communication devices 10-1 and 10-2, the SP setting unit 220 performs SP setting based on the input setting information (step S206), and the SA setting unit 230 further SA setting is performed (step S207), and the key exchange negotiation is completed (step S208).

  Here, a process for establishing an IPIP over IPsec tunnel during key exchange negotiation will be described with reference to FIG.

  As shown in FIG. 9, when the key exchange management unit 210 requests establishment of an IPIP over IPsec tunnel (step S101), the negotiation unit 250 uses the main mode of IKEv1 and the encapsulation mode used by the own device is the IPIP tunnel mode. The main mode first message describing that is transmitted to the communication device 10-2 (step S102).

  For the notification of the encapsulation mode, for example, the encapsulation mode defined in Chapter 4.5 of RFC2407 is extended to notify that the encapsulation mode is the IPIP tunnel mode.

  For example, FIG. 11A is a configuration diagram illustrating a configuration example of a message in IKEv1, and FIG. 11B is a configuration diagram illustrating a configuration example of a Transform payload included in the message. The negotiation unit 250 describes information (for example, attribute value etc.) indicating that the encapsulation mode is the IPIP tunnel mode in the SA Attributes (SA attribute) of the Transform payload of the Main mode first message. 2 can be used. That is, the IKEv1 protocol is expanded to notify that the encapsulation mode is the IPIP tunnel mode during key exchange negotiation.

  The communication device 10-2 receives the Main mode first message from the communication device 10-1, and recognizes that the negotiation unit 250 requests the IPIP tunnel mode as the encapsulation mode of the communication device 10-1 (step S1). S103), if it is possible to respond, the main mode second message for setting the encapsulation mode of the communication device 10-2 to the IPIP tunnel mode is returned to the communication device 10-1 (step S104).

  Also at this time, for example, the negotiation unit 250 returns information indicating that the encapsulation mode is the IPIP tunnel mode in the SA Attributes of the Transform payload of the Main mode second message and returns it to the communication device 10-1.

  Thereafter, normal IKEv1 key exchange negotiation is performed between the communication device 10-1 and the communication device 10-2 (step S105).

  It is confirmed that the key exchange negotiation is completed between the communication device 10-1 and the communication device 10-2, and the encapsulation mode is the IPIP tunnel mode (step S209).

  The tunnel setting unit 240 loads a module (for example, ipip.o, tunnel.o, etc.) related to the IPIP tunnel mode, checks the loaded module, and then uses a pseudo device (for example, tunnel communication on the OS) , Tun10, etc.) to generate / set an IPIP tunnel (step S106 in FIG. 9, step S210 in FIG. 10).

  Further, the tunnel setting unit 240 sets the routing of the network related to the network that passes through the generated IPIP tunnel (step S211).

  As a result, the establishment of the bidirectional IPIP tunnel between the communication device 10-1 and the communication device 10-2 is completed, and when the IPIP over IPsec communication is established at the interface A340-1, the establishment of the IPIP over IPsec tunnel is completed. (Step S107).

(A-3) Effects of the First Embodiment As described above, according to the first embodiment, the IPIP over which can transmit an encrypted packet with less overhead than the conventional GRE over IPsec tunnel. An IPsec tunnel can be established.

  In addition, according to the first embodiment, in order to establish a GRE over IPsec tunnel, a two-step operation by an operator is required. By extending the IKEv1 protocol, an IPIP over IPsec tunnel is established in a one-step procedure. can do.

(B) Second Embodiment Next, a second embodiment of the packet transfer system, packet transfer method, communication apparatus, and packet transfer program of the present invention will be described with reference to the drawings.

(B-1) Configuration and Operation of Second Embodiment Since the configuration of the second embodiment is the same as the configuration described in the first embodiment, FIG. 1 is also used in the second embodiment. explain.

  The second embodiment is different from the first embodiment in that IKEv2 (Internet Key Exchange Protocol version 2) is adopted as a key exchange protocol, and the negotiation unit 250 is defined in RFC4307 of IETF. The IKEv2 is extended to notify the encapsulation mode.

  Therefore, the following description will focus on the operation of the IPIP over IPsec tunnel establishment process between the own device and the opposite device when IKEv2 is used.

  FIG. 12 is a sequence diagram illustrating an IPIP over IPsec tunnel establishment process according to the second embodiment. FIG. 12 is a sequence diagram when authentication is not used according to the extended authentication protocol (EAP).

  As in the first embodiment, the key exchange management unit 210 of the communication device 10-1 requests establishment of an IPIP over IPsec tunnel (step S301), as described later, with the communication device 10-2. In the key exchange negotiation, the encapsulation mode is notified.

  The negotiation unit 250 of the communication device 10-1 transmits the IKEv2 IKE_SA_INIT first message to the communication device 10-2 (step S302).

  The negotiation unit 250 of the communication device 10-2 recognizes that the communication device 10-1 requests establishment of the IPIP over IPsec tunnel based on the IKE_SA_INIT first message received from the communication device 10-1 (step S303). IKE_SA_INIT second message is returned to the communication device 10-1 (step S304).

  The negotiation unit 250 of the communication device 10-1 transmits a IKE_AUTH first message describing that the encapsulation mode is an IPIP tunnel by NOTIFY MESSEAGE to the communication device 10-2 (step S305).

  Further, the negotiation unit 250 of the communication device 10-2 returns a IKE_AUTH second message describing that the encapsulation mode is an IPIP tunnel in NOTIFY MESSAGE to the communication device 10-2 (step S306).

  Here, the notification of the encapsulation mode can be applied by extending NOTIFY MESSAGE defined in section 3.10.1 of RFC4306 and notifying that it is in the IPIP tunnel mode.

  Thereafter, in the communication device 10-1 and the communication device 10-2, the tunnel setting unit 240 performs processing related to the IPIP tunnel mode (for example, ipip.o, tunnel.o, etc.) in the same manner as in the first embodiment. After confirming the loaded module, a pseudo device (for example, tun 10) used for tunnel communication is generated and set on the OS to generate an IPIP tunnel (step S307).

  Further, in each of the communication device 10-1 and the communication device 10-2, the tunnel setting unit 240 sets the network routing related to the network through the generated IPIP tunnel, and the establishment of the bidirectional IPIP tunnel is completed. When the IPIP over IPsec communication is established at the interface A340-1, the establishment of the IPIP over IPsec tunnel is completed (step S308).

  In the communication apparatus 10-1, the SA rekey process is started (step S309), and the negotiation unit 250 transmits CREATE_CHILD_SA request describing that the encapsulation mode is an IPIP tunnel with NOTIFY MESSEAGE to the communication apparatus 10-2. (Step S310).

  Further, the negotiation unit 250 of the communication device 10-2 returns a CREATE_CHILD_SA response describing that the encapsulation mode is an IPIP tunnel in NOTIFY MESSAGE to the communication device 10-2 (step S311).

  Here, FIG. 12 shows a sequence when EAP authentication is not used. This is because when EAP authentication is used, the number of message transmission / reception of IKE_AUTH differs, and the place where NOTIFY MESSAGE is inserted is different.

  When EAP authentication is used, the number of message transmission / reception of IKE_AUTH differs. In this case, NOTIFY MESSAGE notifying that the encapsulation mode is “IPIP tunnel” is inserted in the first message and the final message of IKE_AUTH. Can be realized.

(B-2) Effects of Second Embodiment As described above, according to the second embodiment, even when IKEv2 is used as a key exchange protocol, the overhead is smaller than that of the conventional GRE over IPsec tunnel. An IPIP over Ipsec tunnel that can transmit encrypted packets can be established.

  Further, in contrast to the fact that a two-step operation by an operation is necessary for establishing a GRE over IPsec tunnel, an IPIP over IPsec tunnel can be established by a one-step procedure by extending the IKEv2 protocol.

(C) Third Embodiment Next, a second embodiment of the packet transfer system, packet transfer method, communication apparatus, and packet transfer program of the present invention will be described with reference to the drawings.

(C-1) Configuration and operation of the third embodiment Since the configuration of the third embodiment is the same as the configuration described in the first embodiment, the third embodiment will also be described with reference to FIG. explain.

  The third embodiment is different from the first embodiment in that the encapsulation mode is notified after the key exchange negotiation.

  Therefore, a description will be mainly given of a procedure in which the tunnel setting unit 250 generates an IPIP tunnel after the key exchange negotiation by the negotiation unit 240.

  In the third embodiment, since the encapsulation mode is notified after the key exchange negotiation, the key exchange protocol can be widely applied to IKEv1, IKEv2, etc. as long as the protocol can establish an IPsec tunnel.

  FIG. 13 is a sequence diagram illustrating an IPIP over IPsec tunnel establishment process according to the third embodiment. FIG. 14 is a flowchart of key exchange processing in the communication apparatus 10.

  First, as in the first embodiment, in the communication device 10-1, the user interface unit 100 reads the setting information input by the user (step S <b> 501), and under the control of the key exchange management unit 210, the negotiation unit 250. Starts a key exchange negotiation with the communication device 10-2 as the opposite device (step S502).

  At this time, if the key exchange negotiation fails between the communication device 10-1 and the communication device 10-2 (step S503), the resource is released as a negotiation error (step S504), and the process ends.

  On the other hand, if the key exchange negotiation is successful, in each of the communication devices 10-1 and 10-2, the SP setting unit 220 performs SP setting based on the input setting information (step S505), and further, the SA setting unit 230 SA setting is performed (step S506), and the key exchange negotiation is completed (step S507).

  Here, as shown in FIG. 13, when the key exchange management unit 210 of the communication device 10-1 requests establishment of an IPsec tunnel (step S401), the negotiation unit 250 of the communication device 10-1 establishes an IPsec tunnel. A predetermined key exchange negotiation message is transmitted to the communication device 10-2 (step S402).

  Upon receiving the IPsec tunnel establishment request (step S403), the negotiation unit 250 of the communication device 10-2 returns a predetermined key exchange negotiation to the communication device 10-1 (step S404).

  As described above, the predetermined key exchange negotiation for establishing the IPsec tunnel is completed between the communication device 10-1 and the communication device 10-2. In the communication device 10-1 and the communication device 10-2, the tunnel setting unit 240 Then, an IPsec tunnel is established (step S405).

  The communication device 10-1 confirms that the key exchange negotiation has been completed with the communication device 10-2 and that the encapsulation mode is the IPIP tunnel mode (step S508).

  Then, the key exchange management unit 210 of the communication device 10-1 notifies the opposing communication device 10-2 that the encapsulation mode is the IPIP tunnel mode (S407 and S408 in FIG. 13 and FIG. 14). Step S509).

  At this time, since the IPsec tunnel is established, the communication device 10-1 notifies the encapsulation mode through the IPsec tunnel.

  When the encapsulation mode of the communication device 10-1 and the communication device 10-2 is the IPIP tunnel mode (step S510), the tunnel setting unit 240 performs processing related to the IPIP tunnel mode as in the first embodiment. After loading modules (eg, ipip.o, tunnel.o, etc.) and confirming the loaded modules, a pseudo device (eg, tun10 etc.) used for tunnel communication is created and set on the OS to create an IPIP tunnel Are generated (step S409 in FIG. 13 and step S511 in FIG. 14).

  In addition, the tunnel setting unit 240 sets network routing related to the network that passes through the generated IPIP tunnel (step S512).

  In step S510, when the encapsulation mode of the communication device 10-1 and the communication device 10-2 is not the IPIP tunnel mode, the resource is released after IPsec disconnection, and the process is terminated (step S513).

(C-2) Effects of the Third Embodiment As described above, according to the third embodiment, after establishing the IPIP tunnel after the key exchange negotiation, the GRE over IPsec tunnel, which is the conventional method, is also used. It is possible to establish an IPIP over IPsec tunnel that can transmit an encrypted packet with less overhead.

  Further, in contrast to the fact that the operator required two-stage operation to establish the GRE over IPsec tunnel, even if an arbitrary key exchange protocol is used, the encapsulation mode is notified to the opposite device through the generated encryption tunnel. An IPIP over IPsec tunnel can be established in a stepwise procedure.

(D) Other Embodiments In the first embodiment, the encapsulation mode is inserted into the specific payload of IKEv1 and notified, but if the opposite device can be notified of the encapsulation mode of its own device, Any bay road may be used. For example, in the first embodiment, the case where the IKEv1 Main mode first message is extended is illustrated, but the first message is not limited, and the third and fifth messages may be used.

  In the second embodiment, the encapsulation mode is inserted into the specific payload of IKEv2 and notified. However, as long as the opposite device can be notified of the encapsulation mode of its own device, any payload can be obtained. Also good.

  In the first and second embodiments, the encapsulation mode is inserted and notified in a specific payload of IKEv1 or IKEv2, but what if the encapsulation mode of the own device can be notified to the opposite device? A simple key exchange protocol may be used.

  In the first, second, and third embodiments, the IPIP tunnel is used as the encapsulation mode. However, any tunneling protocol such as “IPv6 over IPv4 tunnel”, “IPv4 over IPv6 tunnel”, or “IPv6 over IPv6 tunnel” may be used. good.

  In the first, second, and third embodiments, the IPIP tunnel is used as the encapsulation mode, but it may be other than the layer 3 tunneling protocol such as “Ether over IP” layer 2 tunnel.

  In the first embodiment, the address to be set for the IPIP tunnel itself is set by the user interface of the own device, but automatically from the opposite device using mode-config (draft-dukes-ike-mode-cfg-02.txt). Alternatively, the acquired address may be set.

  In the second embodiment, the address to be set for the IPIP tunnel itself is set by the user interface of the own device, but the address automatically obtained from the opposite device is set by using Configuration Payload (RFC4306 3.15). Also good.

  In the first, second, and third embodiments, IPIP over IPsec can be used instead of GRE over IPsec when handling traffic that cannot be transmitted and received over tunnel mode IPsec such as multicast packets. Thereby, the overhead for the GRE header can be reduced.

5 ... Packet transfer system, 10-1 and 10-2 ... Communication device,
100 ... User interface part, 200 ... Program part,
210 ... Key exchange management unit, 220 ... SP setting unit, 230 ... SA setting unit,
240 ... tunnel setting part, 250 ... negotiation part,
300 ... Network stack part,
310 ... SPD, 320 ... SAD, 330 ... packet processing unit,
340-1 ... interface unit (WAN side), 340-2 ... interface unit (LAN side).

Claims (8)

In a packet transfer system that encapsulates a transfer packet according to a predetermined key exchange protocol and transfers the packet between the first communication device and the second communication device facing the first communication device.
The first communication device has mode notification means for notifying the second communication device of a capsule method requested by the device when negotiating with the second communication device by the key exchange protocol. ,
The second communication device has mode recognition means for recognizing a capsule method requested by the first communication device;
The packet transfer system, wherein the first communication device and the second communication device include tunnel setting means for setting a tunnel by the capsule method using the key exchange protocol.   2. The packet transfer system according to claim 1, wherein the mode notification means notifies the second communication device of a capsule method requested by the device during negotiation using the key exchange protocol.   The mode notification means notifies the second communication device of a capsule method requested by the device after negotiation by the key exchange protocol and after establishment of password communication by the key exchange protocol. The packet transfer system described. The first communication device and the second communication device are:
Key exchange setting information setting means for setting key exchange setting information necessary for key exchange processing by the key exchange protocol;
Tunnel establishment setting means for setting tunnel establishment setting information necessary for establishing a tunnel by the capsule method, and
4. The tunnel establishment setting unit and the key exchange setting information setting unit complement each other of setting items that overlap between the tunnel establishment setting information and the key exchange setting information. The packet transfer system according to any one of the above.   5. The packet transfer system according to claim 1, wherein the key exchange protocol is IPsec, and the tunnel setting unit establishes the tunnel in an IPsec transport mode. In a packet transfer method for encapsulating a transfer packet according to a predetermined key exchange protocol and transferring the packet between the first communication device and the second communication device facing the first communication device,
A mode notification step in which the first communication device notifies the second communication device of a capsule method requested by the device when negotiating with the second communication device by the key exchange protocol;
A mode recognition step in which the second communication device recognizes a capsule method requested by the first communication device;
The first communication apparatus and the second communication apparatus have a tunnel setting step of setting a tunnel by the capsule method using the key exchange protocol. In a communication device that encapsulates a transfer packet according to a predetermined key exchange protocol and transfers the packet between the opposite device,
Negotiation means for negotiating with the opposing device by the key exchange protocol;
Mode notification means for notifying the opposite device of the capsule method requested by the own device when negotiating with the opposite device by the negotiation means;
Mode recognition means for recognizing the capsule method requested by the opposite device;
A communication apparatus comprising: a tunnel setting means for setting a tunnel by the capsule method using the key exchange protocol. A communication device that encapsulates a transfer packet according to a predetermined key exchange protocol and transfers the packet between the opposite device,
Negotiation means for negotiating with the opposing device by the key exchange protocol;
Mode notification means for notifying the opposite apparatus of the capsule method requested by the own apparatus when negotiating with the opposite apparatus by the negotiation means;
A mode recognizing means for recognizing the capsule method required by the opposing device;
A packet transfer program that functions as tunnel setting means for setting a tunnel by the capsule method using the key exchange protocol.

Images