JP2015050699A - Network system, brunch router, and control method of the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent a replay attack in an MPSA which shares a group key.SOLUTION: A gateway has distribution means (MPSA transmission section 15) for distributing MPSA information to a plurality of brunch routers configuring each group. The brunch router has: communication means (packet transmission/reception section 51) for mutually performing coding communication on the basis of the MPSA information; storage means (MPSA table 562) for storing a sequence number window which determines presence/absence of overlapping of sequence numbers imparted to the packet transmitted from another brunch router for each brunch router; determination means (MPSA searching section 561) for referring to the sequence number window stored in the storage means and determining presence/absence of overlapping of the sequence numbers, when receiving the packet from another brunch router; and discard means (MPSA searching section 561) for discarding the packet when it is determined that the sequence numbers are overlapped.

Description

  The present invention relates to a network system, a branch router, and control methods thereof.

  In VPN (Virtual Private Network) communication, a hub-and-spoke VPN network system including a gateway serving as a network hub and a plurality of branch routers serving as spokes connected to the gateway. Exists.

  By the way, in such a hub-and-spoke VPN network system, communication between bases always passes through a gateway. For example, even when branch routers are adjacent to each other, transmission is performed when the gateway is remote. Delay increases. Further, since all communications pass through the gateway, there is a problem that the communication amount increases and the equipment load of the gateway increases.

  Therefore, as described in Non-Patent Document 1, a group is configured by a plurality of branch routers, and communication between bases within each group is performed directly between branch routers using a common group key. There is a technique for distributing from a gateway to each branch router.

Star type and mesh type hybrid IP-VPN architecture, IEICE, IEICE Technical Report NS2012-20, May / 2012

  By the way, in the technique disclosed in Non-Patent Document 1, a plurality of branch routers constituting a group communicate using the same MPSA (Multi-point Security Association) sharing a group key. However, it is difficult to protect against replay attacks because it is difficult to manage.

  The present invention has been made in view of the above points, and in a network system sharing a single group key within a group, a network system capable of preventing a replay attack, a branch router, and these It aims to provide a control method.

In order to solve the above-described problems, the present invention provides a network system including one or more groups having a plurality of branch routers and a gateway that controls the one or more groups. Distribution means for distributing MPSA (Multi-point Security Association) information to the branch routers of the plurality of branch routers, and the plurality of branch routers mutually encrypt communication based on the MPSA information distributed by the distribution means. A communication means for performing the processing, a storage means for storing for each branch router a sequence number window that is information for determining the presence or absence of duplication of sequence numbers given to packets transmitted from other branch routers, When a packet is received from a branch router, it is stored in the storage means A determination means for determining whether or not there is a sequence number overlap with reference to the sequence number window, and a discarding means for discarding the packet when the determination means determines that the sequence number is duplicated. Features.
According to such a configuration, it is possible to prevent a replay attack in a network system that shares a single group key within a group.

Also, one aspect of the present invention is characterized in that the storage means stores the sequence number window of the branch router when communication occurs.
According to such a configuration, information is stored for the first time when communication occurs, so that a necessary storage area can be reduced.

One aspect of the present invention is characterized in that the storage means stores a common sequence number for transmitting a packet to another branch router.
According to such a configuration, a necessary storage area can be reduced by using a common sequence number at the time of transmission.

The present invention provides a method for controlling a network system having one or more groups having a plurality of branch routers and a gateway for controlling the one or more groups, wherein the gateway is connected to the plurality of branch routers constituting each group. A distribution step of distributing MPSA (Multi-point Security Association) information to the plurality of branch routers, wherein the plurality of branch routers perform encrypted communication with each other based on the MPSA information distributed in the distribution step; A storage step of storing a sequence number window, which is information for determining whether or not a sequence number assigned to a packet transmitted from another branch router is duplicated, in a storage device for each branch router; and another branch router When a packet is received from the A determination step for determining whether there is a duplication of sequence numbers with reference to the sequence number window, and a discarding step for discarding the packet when it is determined in the determination step that the sequence numbers are duplicated. It is characterized by that.
According to such a method, it becomes possible to prevent a replay attack in a network system that shares a single group key within a group.

In addition, the present invention controls one or more groups having a plurality of branch routers, and controls one or more groups, and MPSA (Multi-point Security Association) information for the plurality of branch routers constituting each group. In the branch router constituting a network system having a gateway having a distribution means for distributing the communication means, a communication means for performing encrypted communication with each other based on the MPSA information distributed by the distribution means, and another branch router Storage means for storing, for each branch router, a sequence number window, which is information for determining whether or not the sequence number assigned to the transmitted packet is duplicated, and when storing a packet from another branch router, the storage Refer to the sequence number window stored in the means Te, determination means for determining whether the duplicate sequence numbers, wherein when it is determined that the sequence number is duplicated by the determining means is characterized by having a discarding discarding means the packet.
According to such a configuration, it is possible to prevent a replay attack in a network system that shares a single group key within a group.

In addition, the present invention controls one or more groups having a plurality of branch routers, and controls one or more groups, and MPSA (Multi-point Security Association) information for the plurality of branch routers constituting each group. In the control method of the branch router constituting the network system having a gateway having a distribution means for distributing the communication, a communication step for performing encrypted communication with each other based on the MPSA information distributed by the distribution means; When storing a sequence number window, which is information for judging whether there is duplication of sequence numbers given to packets sent from a branch router, for each branch router, and when receiving a packet from another branch router , The sequence number stored in the storage means A determination step for determining whether there is a duplication of sequence numbers with reference to the window; and a discarding step for discarding the packet when it is determined in the determination step that the sequence numbers are duplicated. .
According to such a method, it becomes possible to prevent a replay attack in a network system that shares a single group key within a group.

  According to the present invention, it is possible to provide a network system, a branch router, and a control method thereof that can prevent a replay attack in a network system that shares a single group key within a group. .

It is a figure which shows the structural example of the network system which concerns on embodiment of this invention. It is a figure which shows the detailed structural example of the gateway and branch router as described in embodiment shown in FIG. FIG. 3 is a diagram illustrating a detailed configuration example of an MPSA processing unit illustrated in FIG. 2. It is a figure which shows an example of the correspondence of MPSA. It is an example of the MPSA table shown in FIG. It is a figure explaining an example of operation | movement of a sequence number window. It is a figure which shows an example of the format of an IP packet and an ESP packet. It is a figure which shows an example of the detailed format of the ESP packet shown in FIG. It is a flowchart for demonstrating an example of the process performed when receiving a packet. It is a flowchart for demonstrating an example of the process performed when transmitting a packet. It is a flowchart for demonstrating an example of the process performed by a gateway when a branch router is restarted. It is a flowchart for demonstrating an example of the process performed by a branch router when a branch router is restarted.

  Next, an embodiment of the present invention will be described.

(A) Description of Configuration of Embodiment FIG. 1 is a diagram illustrating a configuration example of a network system according to an embodiment of the present invention. As shown in this figure, a network system according to an embodiment of the present invention includes a gateway 10, a transit network 20, an I-IP (Internal-Internet Protocol) network 30, branch routers 50 and 60, an E-IP (External-Internet). Protocol) client networks 70 and 80 exist. The branch routers 50 and 60 perform encrypted communication based on MPSA (Multi-point Security Association).

  Here, the gateway 10 receives a group key via an IKE_SA (Security Association) that is an encrypted communication path for key exchange established with the branch routers 50 and 60 by IKEv2 (Internet Key Exchange Protocol Version 2). In addition to distribution, route information is exchanged by BGP (Border Gateway Protocol) via CHILD_SA, which is an encrypted communication channel for data communication established by IKEv2. This route information includes information indicating which branch router is to be passed in order to reach an E-IP client network existing under the control of another branch router from a certain branch router via MPSA. Details are disclosed in RFC5512 and RFC5566.

  The transit network 20 is a network that relays traffic of the I-IP network 30 and the MPSA 40.

  The I-IP network 30 is a virtual network provided by CHILD_SA on the transit network 20. The E-IP client networks 70 and 80 are external networks provided at each base of the client.

  FIG. 2 is a diagram showing a configuration example of the gateway 10 and the branch routers 50 and 60 shown in FIG. As shown in FIG. 2, the gateway 10 includes a packet transmission / reception unit 11, an SA (Security Association) processing unit 12, an IKE (Internet Key Exchange) processing unit 13, a route protocol processing unit 14, an MPSA transmission unit 15, and an MPSA management unit 16. And a packet transmitting / receiving unit 17.

  Here, the packet transmission / reception unit 11 transmits and receives packets to and from the branch routers 50 and 60. When performing encrypted communication by IPsec with the branch routers 50 and 60, the SA processing unit 12 performs SA (Security Association) by IKE_SA or CHILD_SA based on the authentication algorithm and encryption algorithm notified from the IKE processing unit 13. Execute the process. As a result, the gateway 10 can distribute the group key between the branch routers 50 and 60 by encrypted communication.

  The IKE processing unit 13 executes processing for determining an encryption algorithm necessary for IPsec and sharing an encryption key before performing encrypted communication by IPsec. The route protocol processing unit 14 executes processing for exchanging the route information table with the branch routers 50 and 60.

  The MPSA transmission unit 15 executes processing for transmitting a group key to the branch routers 50 and 60. The MPSA management unit 16 is a processing unit that manages a group key transmitted to the branch routers 50 and 60. The packet transmitting / receiving unit 17 is connected to a network device other than the branch routers 50 and 60, and transmits and receives packets.

  The branch router 50 includes a packet transmission / reception unit 51, an SA processing unit 52, an IKE processing unit 53, a route protocol processing unit 54, an MPSA reception unit 55, an MPSA processing unit 56, and a packet transmission / reception unit 57.

  Here, the packet transmission / reception unit 51 transmits and receives packets between the gateway 10 and the branch router 60. When performing encrypted communication by IPsec with the gateway 10, the SA processing unit 52 executes SA processing by IKE_SA or CHILD_SA based on the authentication algorithm and encryption algorithm notified from the IKE processing unit 53. As a result of the SA processing, the branch router 50 can receive the group key by encrypted communication with the gateway 10.

  The IKE processing unit 53 executes a process for determining a necessary encryption algorithm and sharing an encryption key in the SA processing unit 52 that performs the encrypted communication before performing the encrypted communication. The route protocol processing unit 54 executes processing for exchanging the route information table with the gateway 10.

  The MPSA receiver 55 executes a process for receiving the group key distributed from the gateway 10. The MPSA processing unit 56 executes SA processing based on the group key. The packet handled by the MPSA processing unit 56 can use the same ESP (Encapsulated Security Payload) as CHILD_SA handled by the SA processing unit 52, and belongs to any SA by the SPI (Security Parameter Index) stored in the header part of the ESP. Identifies whether it is a packet. The packet transmission / reception unit 57 transmits / receives a packet to / from the E-IP client network 70.

  Since the branch router 60 has the same configuration as that of the branch router 50, detailed description thereof is omitted. In FIG. 3, the connection between the branch router 60 and the gateway 10 is omitted to simplify the drawing, but the branch router 60 is connected to the gateway 10 like the branch router 50.

  FIG. 3 is a diagram showing a detailed configuration of the MPSA processing unit 56 shown in FIG. Since the MPSA processing unit 66 has the same configuration, the description thereof is omitted.

  As illustrated in FIG. 3, the MPSA processing unit 56 includes an MPSA search unit 561, an MPSA table 562, a transmission source address check unit 563, an ESP decoding unit 564, and an MPSA management unit 565.

  Here, when communicating with the branch router 60, the MPSA search unit 561 searches the MPSA table 562 for an MPSA that is an agreement regarding a group key and the like, obtains the corresponding MPSA, and a sequence number described later. Discard packets with duplicate sequence numbers based on the window. The MPSA table 562 is a table for storing information such as the above-described MPSA and sequence number window.

  The transmission source address inspection unit 563 refers to the route information table 59 based on the transmission source address of the IP address given to the packet, and determines whether or not the transmission source of the packet is valid.

  The ESP decryption unit 564 refers to the MPSA table 562 and decrypts the encrypted packet.

  The MPSA registration unit 565 registers and updates information such as the MPSA and the sequence number window in the MPSA table 562 when communicating with other branch routers.

  The route information table 59 stores the route information acquired by the route protocol processing unit 54, and the routing processing is executed based on this route information.

(B) Description of Operation of Embodiment Next, the operation of the embodiment of the present invention will be described. In the following, first, the general operation of this embodiment will be described, and then the detailed operation will be described.

  FIG. 4 is a diagram showing the relationship among MPSA, sequence number, and sequence number window when the branch router 50 shown in FIG. 1 communicates with n other branch routers 60-1 to 60-n. 4A shows a case where the branch router 50 transmits a packet, and FIG. 4B shows a case where the branch router 50 receives a packet.

  As shown in FIG. 4A, when the branch router 50 transmits a packet, MPSA is set between the other branch routers 60-1 to 60-n based on MPSA0. Each time the branch router 50 transmits a packet, it increments the sequence number, and assigns the counted sequence number to each packet for transmission. As will be described later with reference to FIG. 4B, the branch routers 60-1 to 60-n have a sequence number window independently for each communication partner, and packets received based on this sequence number window. Judging the legitimacy of

  As shown in FIG. 4B, when the branch router 50 receives a packet, an MPSA is set between the other branch routers 60-1 to 60-n based on MPSA0. Further, the branch router 50 has a sequence number window for each of the branch routers 60-1 to 60-n as communication partners, and refers to the sequence number window to duplicate packets with the same sequence number. If it is received, the packet is discarded as an invalid packet.

  FIG. 5 is a diagram illustrating an example of information stored in the MPSA table 562. FIG. 5A is information referred to when the branch router 50 transmits a packet, and FIG. 5B is information referred to when the branch router 50 receives a packet. As shown in FIG. 5A, when the branch router 50 transmits a packet, the same MPSA0 is used and the same sequence number is used regardless of the ground (branch routers 60-1 to 60-n). Therefore, for example, when one packet is transmitted to the branch router 60-1 and then one packet is transmitted to the branch router 60-n, the sequence number is assigned to the branch router 60-1, for example, “1”. "," And the packet "2" with the sequence number incremented by 1 is transmitted to the branch router 60-n. For example, in the case of an ESP packet, the sequence number is data having a bit length of 32 bits, and is set to 0 at the start of transmission. When the packet is transmitted, the sequence number is counted up to the maximum value. Discard MPSA based on the set policy or return to 0 and repeat the same operation. The MPSA that does not specify the ground as shown in FIG. 5A is hereinafter referred to as “ground non-specific MPSA” as necessary.

  As shown in FIG. 5B, when the branch router 50 receives a packet, the same MPSA0 is used, but the sequence number window is set for each ground, that is, for each branch router 60-1 to 60-n. Set up windows and manage them individually. The MPSA that specifies the ground as shown in FIG. 5B is hereinafter referred to as “ground-specific MPSA” as necessary. In actual processing, “ground non-specific MPSA” is set first, and when a legitimate packet is received from the ground, it is set to “ground specific MPSA”. Details of this processing will be described later with reference to FIG.

  FIG. 6 is a diagram for explaining the operation of the sequence number window. In FIG. 6, only 16 bits (16 packets) of information is shown as an example. Of course, the present invention is not limited to 16 bits, and an infinite bit length is supported by expanding the replay protection window. As shown in FIG. 6A, in the initial state (the state before the packet arrives), all the bits in the sequence number window are set to “0”. The broken-line rectangle in the figure indicates the replay protection window, and the sequence number window manages only information in this range, and has 0 bits in this range or a corresponding sequence number on the right side of this range. Only received packets are subject to reception, and packets with other sequence numbers are discarded even if received. In the initial state, the replay protection window is set at a position where the bit corresponding to the sequence number 0 is the left end.

  In such a state, if a packet with a sequence number “1” arrives from a specific ground, the LSB (Least Significant Bit) of the sequence number window is set to “1” as shown in FIG. The Next, if a packet having a sequence number “2” arrives from a specific ground, the second bit from the LSB of the sequence number window is set to “1” as shown in FIG. 6C. Next, when the packet with the sequence number “4” arrives without receiving the packet with the sequence number “3” (for example, transmitted to another branch router), as shown in FIG. The third bit from the LSB of the sequence number window remains “0”, and the fourth bit from the LSB of the sequence number window is set to “1”. In this state, as shown in FIG. 6E, when an illegal packet with a sequence number “4” arrives, the fourth bit from the LSB of the sequence number window is already set to “1”. The packet is discarded as invalid. Next, when the packet with the sequence number “9” arrives, the replay protection window is moved to the MSB (Most Significant Bit) side by 1 bit as shown in FIG. The ninth bit from the LSB is set to “1”. Note that when the replay protection window moves, the LSB goes out of range. For example, even if the packet with the sequence number “1” has not yet arrived, the sequence number “ Even if a 1 ″ packet arrives, it is discarded. In more detail, when a packet is received, a duplication check is performed using a sequence number window, and when the decoding process of a non-duplicate packet is successful, the corresponding bit is set to “1” and replay protection is performed as necessary. Perform window movement.

  Next, a more specific operation will be described. First, between the gateway 10 and the IKE processing units 13 and 53 of the branch router 50, an encryption algorithm (encryption method or authentication method) used in IKE_SA is determined by IKE_INIT exchange, and an encryption key is shared by key exchange. Further, through IKE_SA, an encryption algorithm used in communication through IPsec CHILD_SA is determined, and an encryption key is shared. As a result, as shown in FIG. 1, IKE_SA used for exchanging IKE messages and CHILD_SA for transmitting and receiving packets to be protected by IPsec are formed between the gateway 10 and the branch router 50 as an encrypted tunnel. . The MPSA transmission unit 15 receives the group key from the MPSA management unit 16 and transmits the group key to the branch router 50 via the encrypted tunnel. The MPSA receiving unit 55 of the branch router 50 receives the encryption algorithm and group key from the gateway 10 and supplies them to the MPSA processing unit 56.

  A similar process is executed between the gateway 10 and the branch router 60, and the MPSA receiving unit 65 of the branch router 60 receives the same group key received by the branch router 50 from the gateway 10 and sends it to the MPSA processing unit 66. Supply. As a result, the branch router 50 and the branch router 60 hold the same group key.

  The branch router 50 and the branch router 60 use the group key acquired in this way, so that the authentication method and encryption parameters used in IPsec communication are not exchanged individually between the branch routers. As shown in FIG. 1, an MPSA serving as an encrypted tunnel is formed between the branch router 50 and the branch router 60, and encrypted communication can be performed via the MPSA. As shown in FIG. 4, when there are n branch routers 60, the same processing as described above is executed between the gateway 10 and each of the branch routers 60-1 to 60-n. An MPSA that spans all the branch routers is formed without individually passing parameters between the branch routers 60-1 to 60-n.

  In such a state, for example, a case where communication is performed between the branch router 50 and the branch router 60-1 illustrated in FIG. 4 will be described below as an example. When communication is performed between the branch router 50 and the branch router 60-1, first, IKE_SA and CHILD_SA are formed between the gateway 10 and these branch routers, and are further used by MPSA from the gateway 10 to each branch router. The encryption algorithm and group key to be notified are notified to form the MPSA. As a result, for example, in the branch router 50, the non-grounded MPSA0 shown in FIG. 4A is used in the transmission direction from the branch router 50 to the branch router 60-1, and the branch router 50-1 to the branch router 50 The ground-specific MPSA0 shown in FIG. 4B is used in the receiving direction. In addition, in the MPSA table 562 of the branch router 50, the information (non-ground specific MPSA) shown in FIG. 5A is stored with the sequence number having an initial value “0”, and the information shown in FIG. The information about the ground 60-1 (ground-specific MPSA) shown in the first row is stored with the sequence number window having the initial value “00000000”, and the replay protection window (not shown) is set at the MSB position. The In FIGS. 5A and 5B, information on all the grounds is stored. However, since information is actually generated and stored for the first time when communication is started, a necessary storage area is required. The amount of can be reduced. More specifically, if a ground-specific MPSA corresponding to the transmission source of the received ESP packet has not been generated, a temporary ground-specific MPSA whose sequence number window is in an initial value state is generated and reception processing is performed. Only when the ESP packet decoding process is successful can it be held as an official ground-specific MPSA. On the other hand, if the ground-specific MPSA corresponding to the transmission source of the received ESP packet has not been generated and if the decoding process fails, it is discarded as an invalid packet and the generated temporary ground-specific MPSA is also deleted. To do.

  As shown in FIG. 4A, when a packet is transmitted from the branch router 50 to the branch router 60-1, the sequence number is incremented by “1” every time one packet is transmitted. Such sequence number counting is performed not only for the branch router 60-1, but also for all the branch routers 60-1 to 60-n. For example, when a packet is transmitted to the branch router 60-1 and then a packet is transmitted to the branch router 60-2, “1” and “2” are sequence numbers as the ESP header of the ESP packet 200, respectively. 202 is assigned as a sequence number 202s. In the branch router 60-1 that has received such an ESP packet 200, a receiving process as described later is executed to determine the validity of the packet.

  As shown in FIG. 4B, when the branch router 50 receives a packet transmitted from the branch router 60-1, the branch router 60-1 sets the sequence number to “1” every time one packet is transmitted. Count up. Note that such sequence number count-up is performed not only for packets transmitted to the branch router 50 but also for packets transmitted to all branch routers. For example, when the branch router 60-1 transmits a packet to the branch router 50 and then transmits a packet to the branch router 60-2, “1” and “2” are the ESP packets as sequence numbers. It is given as a sequence number 202 s of 200 ESP headers 202.

  The branch router 50 that has received such an ESP packet 200 identifies the ground (branch router 60-1) from the source address 201s included in the outer IP header 201 of the ESP packet 200, and displays information corresponding to this ground. It specifies from the information shown in 5 (B). In the present example, the information on the first line in FIG. 5B is specified. Next, the sequence number 202s stored in the ESP header 202 of the ESP packet 200 is acquired, and the corresponding bit of the sequence number window is referred to. For example, when the sequence number 202 s is “1” and the MSB of the sequence number window is “0”, this packet is determined to be valid and received. On the other hand, when the MSB of the sequence number window is “1”, it is determined that this packet is not valid and is discarded.

  Note that, as described above, even when the branch router 60-1 transmits a packet to a branch router other than the branch router 50, the sequence router counts up, so that the branch router 60-1 is given to the packet received by the branch router 50. The sequence number is a skip value in some cases. However, even in this case, if the replay protection window moves, a packet that has not been received (a packet transmitted toward another branch router) is ignored, and thus no problem occurs.

  According to the above processing, one sequence number is prepared for a plurality of grounds when transmitting a packet, and one sequence number window is prepared for each ground when receiving a packet. Based on this sequence number window, packet duplication is determined. For this reason, even if the network shares one MPSA in the group, it becomes possible to prevent a replay attack. In addition, since the ground-specific MPSA is provided for the first time when a packet is received, the usage amount of the storage area can be reduced.

  Next, processing executed in the MPSA processing unit 56 shown in FIG. 3 will be described with reference to FIGS. FIG. 3 mainly describes processing from S11 to S14 in FIG. 9 to S19.

  FIG. 9 is a flowchart for explaining the flow of processing executed when a packet is received. When the processing of this flowchart is started, the following steps are executed.

  In step S <b> 10, the packet transmission / reception unit 51 receives the ESP packet 200. For example, the packet transmitting / receiving unit 51 receives a packet transmitted from the branch router 60-1.

  In step S11, the MPSA search unit 561 of the MPSA processing unit 56 refers to the SPI (Security Parameter Index) and the transmission source address 201s of the ESP packet 200 received in step S10, and searches the MPSA table 562 for the ground identification MPSA. For example, when the ESP packet 200 transmitted from the branch router 60-1 is received, the MPSA whose ground shown in FIG. 5B is 60-1 is searched.

  In step S12, the MPSA search unit 561 determines whether or not the ground-specific MPSA exists, and if it exists (step S12: Yes), the process proceeds to step S13, and otherwise (step S12: No). Advances to step S14. In the present example, if the ground-specific MPSA corresponding to the branch router 60-1 exists in the MPSA table 562, the process proceeds to step S13, and otherwise, the process proceeds to step S14.

  In step S13, if the ground identification MPSA exists, the subsequent processing is continued. More specifically, the process of determining the source address 201s included in the outer IP header 201 by the source address inspection unit 563 and determining whether or not a packet is transmitted from a valid source has already been specified for the ground. Since the MPSA is known to be a valid transmission source, it is omitted, and the ESP packet 200 is decoded by the ESP decoding unit 564 and the sequence number window of the ground-specific MPSA is updated, and the MPSA registration unit 565 Since the ground-specific MPSA has already been registered, the IP packet 100 obtained by decoding and skipping is transmitted to the E-IP client network 70.

  In step S14, the MPSA search unit 561 refers to the SPI of the ESP packet 200 received in step S10, and searches the MPSA table 562 for a specific “non” specific MPSA. The ground non-specific MPSA is an MPSA in which the ground shown in FIG. 5B is not specified. For example, the type of MPSA (for example, MPSA1) and a blank ground (for example, blank) are shown. “−”) And a sequence number window having an initial value “0”.

  In step S15, the MPSA search unit 561 determines whether or not the non-ground specific MPSA exists, and if it exists (step S15: Yes), the process proceeds to step S17, and otherwise (step S15: No). Then, the process proceeds to step S16. In the present example, if the above-mentioned ground non-specific MPSA exists in the MPSA table 562, the process proceeds to step S17, and otherwise, the process proceeds to step S16. In step S15, before performing the ESP decoding process in step S17, the source address checking unit 563 checks the source address 201s included in the IP header 201 to determine whether the packet is from a valid source. Can do. Since this determination is a rough determination process, it may be omitted.

  In step S16, the MPSA search unit 561 discards the packet to be processed.

  In step S17, the ESP decoding unit 564 decodes the ESP packet 200 based on the temporary ground specific MPSA generated from the ground non-specific MPSA identified in step S15. As a result, the IP packet 100 is obtained.

  In step S18, the ESP decoding unit 564 determines whether the packet to be processed is a valid packet as a result of the decoding process, and determines that the packet is a valid packet (step S18: Yes). The process proceeds to step S19, and otherwise (step S18: No), the process proceeds to step S16 and the packet is discarded. For example, if it is determined that the packet is a legitimate packet as a result of proper decoding, the process proceeds to step S19.

  In step S19, the MPSA registration unit 565 registers the temporary ground specific MPSA generated based on the ground non-specific MPSA specified in step S15 in the MPSA table 562 as a formal ground specific MPSA. For example, in the case of a packet from the branch router 60-1, the bit corresponding to the received sequence number in the sequence number window is set to “1” in the information shown in the first line of FIG. The ground-specific MPSA is registered in the MPSA table 562. When registration is completed, the ground-specific MPSA is present thereafter, so that the determination at Step S12 is Yes and the process at Step S13 is executed.

  In step S <b> 20, the packet transmitting / receiving unit 57 executes a process of transferring the packet to the E-IP client network 70.

  Next, with reference to FIG. 10, processing executed when a branch router transmits a packet will be described. Before the processing of the flowchart shown in FIG. 10 is started, the destination address (E-IP client network) of the packet to be transmitted is based on the route information received from the gateway 10 and the information received from the gateway 10. Address), the branch router (ground) serving as the transmission destination via MPSA and the MPSA to be used are specified. When the processing of the flowchart shown in FIG. 10 is started, the following steps are executed.

  In step S30, the MPSA search unit 561 searches the MPSA table 562 for a non-ground specific MPSA that matches the MPSA specified from the route information. Specifically, the non-ground specific MPSA shown in FIG. 5A is retrieved from the MPSA table 562.

  In step S31, the MPSA search unit 561 proceeds to step S32 when it is determined that the corresponding non-ground specific MPSA exists in the MPSA table 562 (step S31: Yes), and otherwise (step S31: No). Advances to step S33. For example, when the ground non-specific MPSA shown in FIG. 5A exists, the process proceeds to step S32.

  In step S32, the MPSA processing unit 56 continues the process. Specifically, the MPSA processing unit 56 performs an encryption process based on the ground-unspecified MPSA, assigns a sequence number, and generates an ESP packet. At the same time, the sequence number of the non-ground specific MPSA is counted up. Thereafter, the generated ESP packet is supplied to the packet transmitting / receiving unit 51. As a result, the packet transmitting / receiving unit 51 transmits the packet.

  In step S33, the MPSA processing unit 56 discards the packet to be processed.

  According to the above processing, it is possible to execute transmission processing for a packet whose destination is a partner for which the non-specific MPSA exists, and discard a packet that does not exist.

(C) Description of Modified Embodiment Each of the above embodiments is an example, and it is needless to say that the present invention is not limited to the case described above. For example, the embodiment shown in FIG. 1 shows the case where there are two branch routers, but the present invention can be applied even when there are three or more branch routers. In the embodiment shown in FIG. 1, the case where there is only one group having the branch routers 50 and 60 has been described as an example. However, two or more groups exist, and a common MPSA is used in each group. The present invention can also be applied when performing encrypted communication.

  The MPSA table shown in FIG. 5 is an example, and MPSA may be managed by other methods.

  Further, when a packet is received, the ground-specific MPSA is generated. However, all the ground-specific MPSAs may be always provided based on the route information received from the gateway 10.

  Further, the number of bits of the sequence number window and the number of bits of the replay prevention window shown in FIG. 6 are examples, and other numbers of bits may be used.

  In addition, when one of the branch routers is restarted due to a power failure or failure, the sequence number of the branch router is initialized, so that consistency with other branch routers may not be achieved. Therefore, as shown in FIGS. 11 and 12, when any branch router is restarted, MPSA may be re-registered. More specifically, FIG. 11 shows processing executed in the gateway 10, and FIG. 12 shows processing executed in the branch routers 50 and 60. When the process shown in FIG. 11 is started, the following steps are executed.

  In step S50, the SA processing unit 12 determines whether or not the validity of the predetermined branch router (BR) is confirmed. If the validity is confirmed (step S50: Yes), the process proceeds to step S51. In other cases (step S50: No), the process ends. For example, when the branch router 50 is restarted and a request is made from the branch router 50, if the legitimacy of the branch router 50 is confirmed, the process proceeds to step S51.

  In step S51, the MPSA management unit 16 searches to which MPSA the branch router whose validity is confirmed in step S50 belongs. For example, when the legitimacy of the branch router 50 can be confirmed, the MPSA to which the branch router 50 belongs is specified.

  In step S52, the SA processing unit 12 requests MPSA re-registration from all the branch routers identified in step S51. For example, when the legitimacy of the branch router 50 can be confirmed, MPSA re-registration is requested to all the branch routers 50 and 60 included in the MPSA to which the branch router 50 belongs.

  Next, the processing of the branch router when the request of FIG. 11 is made will be described with reference to FIG. When the processing of FIG. 12 is executed, the following steps are executed. In the following, the operation will be described by taking the branch router 60 as an example.

  In step S70, the MPSA processing unit 66 determines whether there is a request for re-registration of MPSA from the gateway (GW) 10, and when it is determined that there is a request (step S70: Yes), the process proceeds to step S71. In other cases (step S70: No), the process proceeds to step S71. For example, when the branch router 50 is restarted, a re-registration request is made from the gateway 10 by the process of step S53, so it is determined Yes and the process proceeds to step S71.

  In step S71, the MPSA processing unit 56 starts an MPSA re-registration process.

  In step S72, the MPSA processing unit 56 executes an MPSA initialization process including a sequence number. When MPSA re-registration and initialization processing is executed, a new MPSA is generated in addition to the old MPSA used so far, but the MPSA processing unit 66 immediately deletes the old MPSA. Rather than the old MPSA and the new MPSA coexisting temporarily, for example, when a predetermined time has elapsed since re-registration or the reception by the new MPSA was executed, the old MPSA By deleting the MPSA, it is possible to move from the old MPSA to the new MPSA without losing the packet.

  In step S73, the MPSA processing unit 56 executes response processing in order to notify the gateway 10 that re-registration has been completed in response to the request from the gateway 10 in step S70. As a result, the gateway 10 can know that the re-registration process has been completed in the branch router 50.

  According to the above processing, sequence number consistency can be maintained even when the branch router is restarted.

  Note that the processing of the flowcharts shown in FIGS. 9 to 12 described above is an example, and the present invention is not limited to such processing.

DESCRIPTION OF SYMBOLS 10 Gateway 11 Packet transmission / reception part 12 SA processing part 13 IKE processing part 14 Path | route protocol processing part 15 MPSA transmission part (distribution means)
16 MPSA management unit 20 Transit network 30 I-IP network 40 MPSA
50, 60 Branch router 51, 61 Packet transceiver (communication means)
52, 62 SA processing unit 53, 63 IKE processing unit 54, 64 Route protocol processing unit 55, 65 MPSA reception unit 56, 66 MPSA processing unit 57, 67 Packet transmission / reception unit 70, 80 E-IP client network 90 Tunnel 54, 64 Route protocol processing unit 56, 66 MPSA processing unit 59, 69 Route information table 561, 661 MPSA search unit (determination means, discarding means)
562, 662 MPSA table (storage means)
563, 663 Source address checking unit 564, 664 ESP decoding unit 565, 665 MPSA registration unit

Claims (6)

In a network system having one or more groups having a plurality of branch routers and a gateway for controlling the one or more groups,
The gateway is
Distribution means for distributing MPSA (Multi-point Security Association) information to a plurality of branch routers constituting each group;
The plurality of branch routers are:
Communication means for performing encrypted communication with each other based on the MPSA information distributed by the distribution means;
Storage means for storing, for each branch router, a sequence number window that is information for determining whether or not there is duplication of sequence numbers given to packets transmitted from other branch routers;
When receiving a packet from another branch router, with reference to a sequence number window stored in the storage means, a determination means for determining the presence or absence of duplication of sequence numbers;
A discarding unit that discards the packet when the determination unit determines that the sequence number is duplicated,
A network system characterized by this.   The network system according to claim 1, wherein the storage unit stores the sequence number window of the branch router when communication occurs.   The network system according to claim 1, wherein the storage unit stores a common sequence number for transmitting a packet to another branch router. In a control method of a network system having one or more groups having a plurality of branch routers and a gateway for controlling the one or more groups,
The gateway is
A distribution step of distributing MPSA (Multi-point Security Association) information to the plurality of branch routers constituting each group;
The plurality of branch routers are:
A communication step for performing encrypted communication with each other based on the MPSA information distributed in the distribution step;
A storage step of storing a sequence number window, which is information for determining whether or not the sequence number assigned to a packet transmitted from another branch router is duplicated, in a storage device for each branch router;
When receiving a packet from another branch router, referring to a sequence number window stored in the storage device, a determination step of determining whether there is a duplication of sequence numbers;
A discarding step of discarding the packet when it is determined that the sequence number is duplicated in the determination step;
A control method for a network system. One or more groups having a plurality of branch routers, and distribution means for controlling the one or more groups and distributing MPSA (Multi-point Security Association) information to the plurality of branch routers constituting each group In the branch router constituting a network system having a gateway comprising:
Communication means for performing encrypted communication with each other based on the MPSA information distributed by the distribution means;
Storage means for storing, for each branch router, a sequence number window that is information for determining whether or not there is duplication of sequence numbers given to packets transmitted from other branch routers;
When receiving a packet from another branch router, with reference to a sequence number window stored in the storage means, a determination means for determining the presence or absence of duplication of sequence numbers;
A discarding unit that discards the packet when the determination unit determines that the sequence number is duplicated,
A branch router characterized by that. One or more groups having a plurality of branch routers, and distribution means for controlling the one or more groups and distributing MPSA (Multi-point Security Association) information to the plurality of branch routers constituting each group In the control method of the branch router constituting a network system having a gateway comprising:
A communication step for performing encrypted communication with each other based on the MPSA information distributed by the distribution means;
A storage step of storing, for each branch router, a sequence number window that is information for determining whether or not there is duplication of sequence numbers given to packets transmitted from other branch routers;
When receiving a packet from another branch router, referring to a sequence number window stored in the storage means, a determination step of determining whether there is a duplication of sequence numbers;
A discarding step of discarding the packet when it is determined that the sequence number is duplicated in the determination step;
A branch router control method characterized by the above.

Images