JP2014168204A - Communication device, communication method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce an amount of packets to be discarded, with a low processing amount.SOLUTION: When a signal to be transmitted using a session whose security is not secured is generated, a communication device holds the signal in association with the session. When processing for securing security of the session associated with the signal is completed, the communication device transmits the signal to a partner device.

Description

  The present invention relates to a technique for communication with security.

  In recent years, the importance of security on networks has increased, and in particular, the importance of ensuring security by encrypted communication has increased. At present, there are several protocols as security protocols, including IPsec (Security Architecture for Internet Protocol). IPsec includes an AH (Authentication Header) protocol and an ESP (Encapsulating Security Payload) protocol. The AH protocol is a function that provides source authentication and data integrity guarantee, and the ESP protocol is a function that provides IP packet confidentiality, security guarantee, and sender authentication. Since IPsec is a security protocol implemented at the IP level (network layer in the OSI reference model), AH and ESP IPsec processing is performed in units of IP packets.

  In the IPsec processing, the communication device uses IPsec SA (Security Association) having parameters such as algorithms and keys used in AH and ESP (see Non-Patent Document 1). Further, the communication apparatus establishes IPsec SA in IPsec by exchanging keys with a counterpart apparatus using IKE which is a key management protocol (see Non-Patent Document 2).

  When the IPsec SA is not established when starting the transmission of the IP packet by IPsec, the communication apparatus constructs the IPsec SA using IKE (Internet Key Exchange). At this time, since the communication device itself issues an IKE request to the counterpart device, it establishes an IPsec SA with the counterpart device as an initiator. Note that the communication device cannot perform IPsec processing until IPsec SA is established. Here, as a method of processing an IP packet when IPsec processing cannot be performed, a method of discarding an IP packet and a method of storing an IP packet in a queue during a period until IPsec SA is established (Patent Document) 1).

JP 2009-60245 A

IPsec (RFC2401, RFC2402, RFC2406) IKE (RFC2408, RFC2409)

  However, the method for discarding the IP packet has a problem that a packet loss occurs during the period until the IPsec SA is established, which causes a communication delay due to retransmission and a loss of communication data.

  On the other hand, in the method of storing IP packets in a queue, the IPsec function makes an IPsec SA establishment request to the IKE function, and the IKE function performs an IKE process as an initiator in response to the request to establish an IPsec SA. After receiving the IPsec SA establishment notification from the IKE function, the IPsec function takes out an IP packet corresponding to the established IPsec SA from the queue, performs an IPsec process, and then transmits the IP packet. Therefore, after establishing the IPsec SA, there is a problem that a certain amount of processing and processing time are required to search for an IP packet corresponding to the IPsec SA established from the queue.

  In some cases, an IKE process executed by the counterpart apparatus as an initiator and a communication apparatus as a responder, and an IKE process by the opposite role are executed simultaneously. Here, in the communication apparatus, when the IKE process executed as the initiator fails, the IPsec function receives an IPsec SA establishment failure notification, and the IP packet stored in the queue is deleted. For this reason, even if the IKE process executed by the communication device as a responder succeeds and an IPsec SA that can be used by the responder is established, there is a problem that the IP packet is deleted and cannot be transmitted. .

  The present invention has been made in view of the above problems, and an object thereof is to solve at least one of the above problems.

  In order to achieve the above object, when a signal to be transmitted is generated for a session for which security is not ensured, the communication device according to the present invention associates the session with the holding means for retaining the signal in association with the session. Transmitting means for transmitting the signal to the counterpart device when the process for ensuring the security of the session being completed is completed.

  According to the present invention, the amount of discarded packets can be reduced with a low processing amount.

The block diagram which shows the function structural example of a communication apparatus. The flowchart which shows the process of the SA establishment request | requirement which an IPsec process part performs with respect to an IKE process part. The flowchart which shows the process of Phase1 session of an IKE process part. The flowchart which shows the process of Phase2 session of an IKE process part. The flowchart which shows a process when an initiator fails at the time of simultaneous key exchange as an initiator and a responder, and a responder succeeds.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

<< Embodiment 1 >>
In the present embodiment, when the SA is not established for the communication session during IPsec communication, the IP packet is held in association with the communication session until the SA is established by the IKE, and the IKE performs proxy transmission after the SA is established. FIG. 1 is a block diagram illustrating a functional configuration example of a communication apparatus according to the present embodiment.

  In FIG. 1, the communication apparatus includes a protocol processing unit 101, an IPsec processing function unit 102, an IKE processing function unit 103, and a network interface unit 104. Note that the IPsec processing function unit 102 includes, for example, an SP management unit 201, an SA management unit 202, and an IPsec processing unit 203. Note that SP is an abbreviation for Security Policy. The IKE processing function unit 103 includes, for example, an IKE Policy management unit 301, a Phase 1 (ISAKMP SA) management unit 302, a Phase 2 management unit 303, and an IKE processing unit 304.

  The protocol processing unit 101 is a functional unit that performs processing of higher layers above the network layer in the OSI reference model, and performs processing for communication via the network. The protocol processing unit 101 passes the IP packet to the network interface unit 104.

  The IPsec processing function unit 102 performs an IPsec application process on the IP packet received from the protocol processing unit 101, and passes the IP packet after the IPsec application to the protocol processing unit 101.

  The IKE processing function unit 103 performs key exchange processing for SA establishment with the communication partner in response to a request from the IPsec processing function unit 102 or a request from the communication partner device. Then, the IKE processing function unit 103 passes the ISAKMP message to the protocol processing unit 101 when transmitting a signal in the key exchange process, and receives the ISAKMP message when receiving the signal.

  The network interface unit 104 is a functional unit that performs processing of the data link layer and the physical layer in the OSI reference model, and transmits IP packets onto the network.

  Note that the IP packet data used in the following encrypted communication method is a unit of data transmitted and received on the Internet. In the following, description of the composition method of the IP packet data is omitted, but the IP packet data can be composed using a general method.

  The key exchange required before starting encrypted communication is performed using a method such as IKE or SSL, and detailed description thereof is omitted.

  Next, the IPsec processing function unit 102 will be described. The SP management unit 201 manages an SPD (Security Policy Database) in which information on whether or not to actually apply IPsec security processing is registered. The SA management unit 202 manages a Security Association Database (SAD) in which information (IPsec SA) related to IPsec processing performed on an IP packet is stored. The SP management unit 201 and the SA management unit 202 are the same as those used in encrypted communication using normal IPsec, and thus detailed description thereof is omitted.

  The IPsec processing unit 203 applies IPsec to the IP packet received from the protocol processing unit 101. The IPsec processing unit 203 determines whether or not to apply IPsec to the IP packet in the transmission process. For this reason, the IPsec processing unit 203 first starts the SP corresponding to the IP packet from the SPD managed by the SP management unit 201 based on information such as the source IP address, destination IP address, protocol, and port number of the IP packet. Search for. When the SP corresponding to the IP packet indicates “discard”, the IPsec processing unit 203 discards the IP packet. When the SP corresponding to the IP packet indicates that “IPsec is not applied”, the IPsec processing unit 203 passes the IP packet to the protocol processing unit 101 without applying IPsec.

  On the other hand, when the SP corresponding to the IP packet indicates that “IPsec is applied”, the IPsec processing unit 203 searches the SAD managed by the SA management unit 202 for the SA corresponding to the IP packet. When the SA corresponding to the IP packet is established, the IPsec processing unit 203 executes an encryption process for the IP packet using an algorithm and a key described in the SA. Then, the IP packet after encryption processing is passed to the protocol processing unit 101. If the SA corresponding to the IP packet has not been established, the IPsec processing unit 203 passes the IP packet to the IKE processing function unit 103 and makes an SA establishment request.

  The IPsec processing unit 203 determines whether IPsec is applied to the received IP packet in the reception process. If IPsec is not applied to the IP packet, the IPsec processing unit 203 searches the SP from the SPD managed by the SP management unit 201. When the SP corresponding to the received IP packet indicates “discard”, the IPsec processing unit 203 discards the IP packet. When the SP corresponding to the received IP packet indicates that “IPsec is applied”, since IPsec is not applied to the received IP packet, the IPsec processing unit 203 discards the IP packet. When the SP corresponding to the received IP packet indicates that “IPsec is not applied”, the IPsec processing unit 203 passes the IP packet to the protocol processing unit 101 because the conditions match the received IP packet.

  When IPsec is applied to the received IP packet, the IPsec processing unit 203 first searches the SAD managed by the SA management unit 202 for the SA corresponding to the IP packet. Then, the IPsec processing unit 203 performs a decryption process on the IP packet using an algorithm and a key described in SA. Next, after the decryption process is performed, the IPsec processing unit 203 searches the SPD corresponding to the IP packet from the SPD. Then, the IPsec processing unit 203 determines whether or not the contents of the SP obtained by the search match the security processing applied to the received IP packet. The IPsec processing unit 203 discards the IP packet if they do not match, and passes the IP packet to the protocol processing unit 101 if they match.

  Next, the IKE processing function unit 103 will be described with reference to FIG. The IKE Policy management unit 301 manages an IKE Policy in which information for establishing an ISAKMP SA with a communication partner in the Phase 1 session is registered.

  The Phase 1 management unit 302 stores information in the Phase 1 session that has been negotiated with the counterpart device based on the information stored in the IKE Policy management unit 301. Then, the Phase 1 management unit 302 stores the ISAKMP SA established by the Phase 1 session information when the Phase 1 session ends.

  The Phase 2 management unit 303 stores information in the Phase 2 session that has been negotiated with the counterpart device using the information stored in the SP management unit 201. In addition, the Phase 2 management unit 303 holds an IP packet for which the IPsec processing unit 203 cannot apply IPsec because the SA is not established in the Phase 2 session information.

  When the IKE processing unit 304 receives an SA establishment request from the IPsec processing unit 203, the IKE processing unit 304 executes IKE processing as an initiator. At this time, the IKE processing unit 304 receives an IP packet that could not be transmitted because the SA has not been established from the IPsec processing unit 203 and registers the IP packet in the Phase 2 session information of the Phase 2 management unit 303. The IKE processing unit 304 also executes an IKE process as a responder in key exchange in which an IKE request is issued from the counterpart apparatus.

  In the IKE process, an ISAKMP SA is established by performing a Phase 1 session based on information stored in the IKE Policy management unit 301, and the established ISAKMP SA is stored in the Phase 1 management unit 302. After the Phase 1 session is completed, in the IKE process, the SA is established by the Phase 2 session encrypted using the ISAKMP SA, and the established SA is stored in the SA management unit 202. If an IP packet that could not be transmitted because the SA is not established in the Phase 2 session information, the IKE processing unit 304 performs proxy transmission processing of the IP packet after storing the SA in the SA management unit 202. Run. The proxy transmission process is a process in which the IKE processing function unit 103 (IKE processing unit 304) transmits an IP packet via the protocol processing unit 101 instead of the IPsec processing function unit 102 (IPsec processing unit 203). .

  Next, the flow of the SA establishment request performed by the IPsec processing unit 203 to the IKE processing unit 304 will be described based on the flowchart of FIG. First, in step S401, the IPsec processing unit 203 searches for an SP corresponding to the IP packet from the SPD managed by the SP management unit 201 based on the IP packet information received from the protocol processing unit 101. Here, the IP packet information includes, for example, IP packet source and destination IP addresses, protocol numbers, and source and destination port numbers.

  Subsequently, in S402, the IPsec processing unit 203 determines whether there is an SP corresponding to the IP packet in the SPD managed by the SP management unit. If there is no SP, the IPsec processing unit 203 passes the IP packet to the protocol processing unit 101 and ends the processing because it is not necessary to apply the IPsec processing. On the other hand, if the SP exists, the IPsec processing unit 203 advances the processing to S403, and searches the SA corresponding to the IP packet from the SAD managed by the SA management unit 202 based on the IP packet information. To do.

  In step S404, if there is an SA corresponding to the IP packet, the IPsec processing unit 203 advances the process to step S406, and applies the IPsec processing to the IP packet based on the corresponding SA. Then, the IP packet after application of the IPsec processing is passed to the protocol processing unit 101. On the other hand, if the SA corresponding to the IP packet does not exist, the IPsec processing unit 203 advances the processing to S405, passes the IP packet to the IKE processing function unit 103, and makes an SA establishment request. Note that the IP packet in this case is an IP packet to which IPsec cannot be applied because there is no SA.

  When the IPsec processing unit 203 makes an SA establishment request to the IKE processing function unit 103, the IKE processing unit 304 subsequently executes a Phase 1 session of the IKE processing. The operation of the Phase 1 session of the IKE process processed in the IKE processing unit 304 will be described with reference to the flowchart of FIG.

  The IKE processing unit 304 starts the IKE process in response to the IPsec processing unit 203 executing the SA establishment request. First, in step S <b> 501, the IKE processing unit 304 confirms whether the Phase 2 session information corresponding to the IP packet exists in the Phase 2 management unit 303 based on the information of the IP packet received from the IPsec processing unit 203. If there is Phase 2 session information corresponding to the IP packet, the IKE processing unit 304 advances the process to S502, registers the IP packet in the discovered Phase 2 session information, and ends the process. If there is no Phase 2 session information corresponding to the IP packet, the IKE processing unit 304 advances the process to S503.

  In step S503, the IKE processing unit 304 generates Phase 2 session information based on the IP packet information received from the IPsec processing unit, and registers the IP packet in the generated Phase 2 session information. In addition, the IKE processing unit 304 registers the Phase 2 session information in the Phase 2 management unit 303, and advances the processing to S504. Note that the IP packet information here includes, for example, information on the IP addresses of the transmission source and destination, the protocol number, and the port numbers of the transmission source and destination.

  In step S504, the IKE processing unit 304 searches the IKE Policy management unit 301 for the IKE Policy corresponding to the IP packet based on the information on the transmission source and the destination IP address, and advances the processing to S505. In S505, the IKE processing unit 304 determines whether there is an IKE Policy corresponding to the IP packet. If no such IKE Policy exists, the process proceeds to S507. In this case, the IKE processing unit 304 cannot start the Phase 1 session because there is no IKE Policy. Therefore, in step S507, the IKE processing unit 304 deletes the generated Phase 2 session information and the received IP packet, and ends the process.

  On the other hand, if there is an IKE Policy corresponding to the IP packet, the IKE processing unit 304 advances the process to S506. In step S506, the IKE processing unit 304 generates Phase 1 session information based on the information on the source and destination IP addresses, registers the information in the Phase 1 management unit 302, and executes the Phase 1 session. In step S508, the IKE processing unit 304 checks whether the Phase 1 session has ended normally. If the Phase 1 session has not ended normally, the process proceeds to step S509. In step S509, the IKE processing unit 304 deletes the generated Phase 1 session information.

  On the other hand, in S509, when the Phase 1 session information in the session having the same source and destination IP addresses exists in the Phase 1 management unit, the generated Phase 2 session information and the IP packet are not deleted. Similarly, when Phase 2 session information in the session having the same source and destination IP addresses, protocol numbers, and source and destination port numbers exists in the Phase 2 management unit, the generated Phase 2 session information and IP packet Is not deleted. That is, in these cases, the generated Phase 2 session information and the IP packet are not deleted, and are left in the Phase 2 management unit. If there is no Phase 1 session information or Phase 2 session information in the session, the IKE processing unit 304 deletes the generated Phase 2 session information and the received IP packet, and ends the process.

  On the other hand, when the Phase 1 session ends normally in S508, the IKE processing unit 304 subsequently executes the Phase 2 session of the IKE process. Next, the operation of the Phase 2 session of the IKE process processed by the IKE processing unit 304 will be described with reference to the flowchart of FIG.

  The IKE processing unit 304 starts Phase 2 session processing in response to the successful Phase 1 session. In step S <b> 601, the IKE processing unit 304 first acquires Phase 2 session information from the Phase 2 management unit 303 based on information on the source and destination IP addresses. In step S602, the IKE processing unit 304 searches the SP corresponding to the IP packet from the SP management unit 201 based on the information on the source and destination IP addresses, the protocol number, and the source and destination port numbers. In step S603, the IKE processing unit 304 checks whether there is an SP corresponding to the IP packet. If not, the IKE processing unit 304 proceeds to step S605, deletes the Phase 2 session information and the IP packet, and ends the processing. To do.

  On the other hand, if there is an SP corresponding to the IP packet, the IKE processing unit 304 executes a Phase 2 session in S604 and advances the process to S606. In step S606, the IKE processing unit 304 determines whether the Phase 2 session has been successful. If the phase 2 session has failed, the process proceeds to step S607, and if successful, the process proceeds to step S608. In S607, when the Phase 1 session information in the session having the same source and destination IP addresses exists in the Phase 1 management unit, the generated Phase 2 session information and the IP packet are not deleted. Similarly, when Phase 2 session information in the session having the same source and destination IP addresses, protocol numbers, and source and destination port numbers exists in the Phase 2 management unit, the generated Phase 2 session information and IP packet Is not deleted. That is, in these cases, the generated Phase 2 session information and IP packet are not deleted and are left in the Phase 2 management unit. On the other hand, if there is no Phase 1 session information or Phase 2 session information in the session, the IKE processing unit 304 deletes the generated Phase 2 session information and the received IP packet, and ends the process.

  In step S <b> 608, the IKE processing unit 304 passes the IP packet to the protocol processing unit 101 in order to perform proxy transmission of the IP packet after the SA established by the Phase 2 session is registered in the SA management unit 202. In step S609, based on the information on the source and destination IP addresses, the protocol number, and the source and destination port numbers, it is checked whether Phase2 session information about the same counterpart device exists in the Phase2 management unit 303. Then, the IKE processing unit 304 ends the process when there is no Phase 2 session information for the same counterpart device. If Phase 2 session information for the same counterpart device exists and the IP packet is registered in the Phase 2 session information, the IKE processing unit 304 returns the process to S608 and executes proxy transmission of the IP packet. S608 and S609 are repeated when there is Phase2 session information of the same communication partner.

  As described above, in the present embodiment, processing for ensuring security (SA establishment and IKE processing therefor) is performed for each communication session. When a signal (IP packet) to be transmitted is generated in a session in which the processing is not completed and security is not ensured, the IP packet is held in association with the session (Phase 1 session information, Phase 2 session information). ). Then, after the processing for ensuring security for the session associated with the IP packet is completed, the IP packet is transmitted. As a result, when the establishment of SA for a session is completed, an IP packet is associated with the session, so that the process of searching for an IP packet from the queue becomes unnecessary. Further, since the IP packet is held until the SA is established, it is not discarded and no packet loss occurs, and as a result, communication data is not retransmitted or lost.

<< Embodiment 2 >>
In the present embodiment, when simultaneous key exchange is executed as an initiator and a responder with a counterpart apparatus, a case where the process as the initiator fails in the Phase 2 session and the process as the responder succeeds is considered. The IP packet proxy transmission processing by the IKE processing unit 304 in this case will be described below with reference to the flowchart of FIG.

  The IKE processing unit 304 first executes a Phase 1 session as an initiator and a responder based on the IKE Policy in S701. In step S702, the IKE processing unit 304 checks whether the executed key exchange has been performed as an initiator or a responder. If the key exchange has been performed as an initiator, the process proceeds to step S703. . On the other hand, if the executed key exchange is performed as a responder, the IKE processing unit 304 advances the process to S704. In S703, the IKE processing unit 304 generates Phase 2 session information, registers an IP packet in association with the Phase 2 session, and advances the process to S704.

  When the Phase 1 session ends normally in S704, the IKE processing unit 304 starts the Phase 2 session based on the IPsec SP in S705. In step S706, the IKE processing unit 304 determines whether the phase 2 session as the responder is successful or unsuccessful. If unsuccessful, the processing ends. If successful, the process proceeds to step S707. In S707, the IKE processing unit 304 determines whether there is a Phase 2 session as an initiator that has failed in the simultaneous key exchange. If there is no Phase 2, the process ends. If it exists, the process proceeds to S708. In S708, if an IP packet is registered in the Phase 2 session information as the initiator that failed in the found simultaneous key exchange, the IKE processing unit 304 performs proxy transmission of the IP packet and ends the processing.

  As described above, in this embodiment, even if the IKE process as the initiator fails, the communication apparatus uses the key exchanged by the successful IKE process if the IKE process as the responder is successful. Security. On the other hand, if the IKE process is successful as an initiator, the communication device can transmit a signal while ensuring security by IPsec. At this time, even if the IKE process fails as a responder, the counterpart apparatus can transmit a signal while ensuring security by IPsec based on the successful IKE process. That is, an IP packet is held in association with a session, and as long as any one of a plurality of IKE processes associated with the session succeeds, communication with security secured by IPsec can be performed. As a result, any one of the plurality of IKE processes associated with one session only needs to be successful, so that the probability that the IKE process fails and the packet is discarded can be reduced.

  In the above-described two embodiments, the case where the IKE process is executed as an initiator due to the occurrence of an IP packet to be transmitted when the SA is not established in the communication apparatus has been described. However, the present invention is not limited to this. . That is, even if an IP packet to be transmitted occurs in a session for which SA is not established, the communication apparatus does not need to start the IKE process as an initiator. For example, when the counterpart apparatus that is the destination of the IP packet to be transmitted has already executed the IKE process as an initiator, the communication apparatus may wait for the IKE process with itself as a responder to be completed. Then, the IP packet may be held in association with the session for the IKE process in progress, and after the IKE process is completed, the IP packet may be encrypted and transmitted to the counterpart apparatus. That is, the IP packet may be transmitted either after completion of the IKE process started by the communication apparatus or after completion of the IKE process started by the counterpart apparatus. In addition, the communication device may start the IKE process as an initiator only when the counterpart device has not started the IKE process, or the communication device may start itself regardless of whether the counterpart device has started the IKE process. The IKE process using the initiator may be started separately.

<< Other Embodiments >>
The present invention can also be realized by executing the following processing. That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU, etc.) of the system or apparatus reads the program. It is a process to be executed.

Claims (12)

For a session for which security is not ensured, when a signal to be transmitted occurs, holding means for holding the signal in association with the session;
A transmission means for transmitting the signal to the counterpart device when processing for ensuring security for the session associated with the signal is completed;
A communication apparatus comprising: The security ensuring process is a key exchange process with the counterpart device,
The transmission means transmits the signal after encryption using the exchanged key after the key exchange processing is completed.
The communication apparatus according to claim 1. A start means for starting the process for ensuring security when a signal to be transmitted occurs in a session where security is not ensured;
The transmission unit transmits the signal associated with the session corresponding to the process after the process for ensuring security started by the communication apparatus is completed.
The communication apparatus according to claim 1 or 2, wherein The starting means performs the processing when a signal to be transmitted is generated in a session where security is not secured and the counterpart device has not started processing for securing the security corresponding to the session. Start,
The communication apparatus according to claim 3. When the transmission means generates a signal to be transmitted in a session in which security is not ensured, if the counterpart device has started the process for ensuring security corresponding to the session, the process is completed. Waiting to send the signal associated with the session,
The communication apparatus according to claim 4. The start means starts the process when the counterpart apparatus has started the process for ensuring the security corresponding to the session when a signal to be transmitted is generated in the session where the security is not ensured. do not do,
The communication apparatus according to claim 5. The transmission means transmits the signal associated with the session corresponding to the processing after the processing for ensuring security started by the counterpart device is completed.
The communication apparatus according to claim 1 or 2, wherein The transmission means transmits the signal associated with the session after one of the processes for ensuring security started by the communication device and the counterpart device for one session is completed.
The communication apparatus according to claim 1 or 2, wherein When the process for ensuring security fails, the holding means deletes the signal for the session corresponding to the process,
The communication apparatus according to claim 1, wherein the communication apparatus is configured as described above. The transmission unit repeats the transmission of the signal after the process for ensuring the security is completed until there is no signal held associated with the session corresponding to the process,
The communication apparatus according to any one of claims 1 to 9, wherein A communication method in a communication device,
A holding step of holding a signal in association with the session when a signal to be transmitted is generated for a session for which security is not secured;
When the transmission means completes the process for ensuring security for the session associated with the signal, a transmission step of transmitting the signal to the counterpart device;
A communication method characterized by comprising:   The program for functioning a computer as each means with which the communication apparatus of any one of Claim 1 to 10 is provided.

Images