JP2017188800A - Communication device, control method thereof, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable IPsec communication between communication devices having a different method of associating SP and SA.SOLUTION: A communication device being able to perform IPsec communication using packet processing information and key information searches for first packet processing information using information included in a transmission packet, encrypts the transmission packet using first key information associated with the first packet processing information to transmit to an opposite device, searches for second key information on the basis of the information included in the packet received from the opposite device, performs decoding or authentication processing on the received packet using the second key information, searches for second packet processing information using the information included in the received packet, and performs receiving processing on the processed packet based on a predetermined protocol. The communication device encrypts the transmission packet to transmit it to the opposite device according to whether or not the first key information is uniquely associated with the first packet processing information, and performs the receiving processing regardless of whether or not the second key information is uniquely associated with the second packet processing information.SELECTED DRAWING: Figure 1

Description

  The present invention relates to security communication technology. More specifically, the present invention relates to a security communication technology using IPsec that can improve interoperability.

  In recent years, there is an increasing need for ensuring security when data is transmitted and received over a network. IPsec (Security Architecture for Internet Protocol) is a protocol that ensures the security of data that flows over IP networks, and can ensure data confidentiality, data integrity, and source authentication in units of IP packets. It is.

  A communication device with a built-in IPsec encryption / authentication function can perform encrypted communication through a logical connection. This logical connection is called SA (Security Association). In the SA, encryption key information and encryption algorithm used in encryption communication, and encryption communication parameters such as an authentication key and authentication algorithm are managed as key information. The database that manages and holds this SA is called SAD (Security Association Database).

  When a communication device that performs encrypted communication using IPsec transmits an IP (Internet Protocol) packet, packet processing for performing communication from the SPD (Security Policy Database) according to the IP address or communication protocol of the IP packet. SP (Security Policy) that is packet processing information describing the above method is specified. The communication device specifies the SA required for the IPsec processing based on the specified SP. Subsequently, the communication apparatus transmits a packet subjected to encryption / authentication processing using the specified SA. When the communication device receives an IP packet, the SA is identified from the SAD by the header information of the IP packet. The communication device performs encryption (decryption) / authentication processing using the specified SA. The communication device identifies the SP from the SPD based on the IP address or communication protocol of the IP packet obtained as a result of the encryption (decryption) / authentication process, and performs the reception process according to the policy specified for the SP.

  The two communication devices on the transmission side and the reception side that perform encrypted communication using IPsec need to establish an SA before performing IPsec communication. As a method for establishing the SA, there is a manual key setting method for manually setting various SA information in each communication device. In addition, there is an automatic key exchange method using negotiation of IKE (Internet Key Exchange Protocol).

  The encryption algorithm and the shared key need to be exchanged prior to communication, and the shared key needs to be changed frequently in order to maintain the security level. Therefore, of these two methods, the manual key management method has a problem that it is not practical because it takes too much time to exchange keys frequently. On the other hand, the automatic key management method automatically performs key exchange that needs to be performed frequently, so it can be said that it is practical without any effort.

  When a common key is generated by the automatic key management method, it is necessary to set a pre-shared key for each SP in the SPD for authentication of the counterpart device. However, in SPD, when there are a plurality of SPs that include the address of the same counterpart device, there is a case where communication with the counterpart device cannot be performed normally. For example, in SPD, there may be a mixture of an SP that includes only the IP address of the partner device and an SP that includes a plurality of addresses including the IP of the partner device. Each SP has a priority of use and a pre-shared key. In such a situation, the pre-shared key set in the SP specified in consideration of the IP address of the packet to be transmitted and the priority of use may be different between the communication device and the partner device. In this case, there was a problem that IKE negotiations failed.

  For this problem, if the IP address included in the SP newly registered by the communication device overlaps with the IP address of the partner device included in the existing SP in the SPD, copy the pre-shared key included in the existing SP. A method has been proposed in which the same pre-shared key is used regardless of which SP is used (see Patent Document 1).

JP 2009-233962 A

  However, according to the technique described in Patent Document 1, depending on the communication partner mounting method, the communication device may not be able to perform IPsec communication when multiple SPs are set for the same partner device. That is, according to this method, when the communication device sets a plurality of SPs for the partner device, the pre-shared keys of the SPs are the same, and the IKE negotiation of each SP is successful. However, since the SA key information generated from each SP is generated from a random number in addition to the pre-shared key, it differs for each SP.

  On the other hand, there are communication devices in the market where communication between SP and SA is compliant with RFC, and communication devices that are not compliant. RFC is a technical specification by IETF (Internet Engineering Task Force). Even if a plurality of SPs are set for the same counterpart device, a device that does not comply with RFC shares one SA with a plurality of SPs if the security protocol, the IPsec mode, and the destination IP address match. When a plurality of SPs are set for the same counterpart device, a device compliant with RFC creates and uses an SA for each SP. Therefore, when IPsec communication is performed between a device that conforms to RFC and a device that does not comply, there is a problem that although the IKE negotiation is successful, the IPsec communication may fail due to a difference in SA to be used.

  In view of the above problems, an object of the present invention is to enable IPsec communication between communication apparatuses having different SP and SA association methods.

  As a means for achieving the above object, the communication apparatus of the present invention has the following configuration. That is, a communication device capable of performing IPsec communication using packet processing information and key information, and a first search means for searching for first packet processing information using information included in a transmission packet; Based on information included in a packet received from the counterpart device, transmission means for encrypting the transmission packet using the first key information associated with the first packet processing information and transmitting the encrypted packet to the counterpart device Second search means for searching for the key information of 2; processing means for performing decryption or authentication processing on the received packet using the second key information; and information contained in the received packet. A third search means for searching for second packet processing information using the protocol, and a protocol for performing a reception process based on a predetermined protocol for the packet processed by the processing means. Processing means, wherein the transmission means encrypts the transmission packet according to whether or not the first key information is uniquely associated with the first packet processing information. The protocol processing means performs the reception process regardless of whether or not the second key information is uniquely associated with the second packet processing information.

  According to the present invention, it is possible to perform IPsec communication between communication apparatuses having different SP and SA association methods.

The figure which showed the structure of the communication apparatus in 1st and 2nd embodiment. The figure which showed the packet transmission processing flow of the communication apparatus in 1st Embodiment. The figure which showed the packet reception processing flow of the communication apparatus in 1st Embodiment. The figure which showed the SA negotiation request | requirement processing flow in 1st and 2nd embodiment. The figure which showed the SP registration process flow in 1st and 2nd embodiment. The figure which showed the SA registration processing flow in 1st Embodiment. The figure which showed the packet transmission processing flow of the communication apparatus in 2nd Embodiment. The figure which showed the packet reception processing flow of the communication apparatus in 2nd Embodiment. The figure which showed the SA registration processing flow in 2nd Embodiment.

  Hereinafter, the present invention will be described in detail based on the embodiments with reference to the accompanying drawings. The configurations shown in the following embodiments are merely examples, and the present invention is not limited to the illustrated configurations.

[First Embodiment]
FIG. 1 is a diagram illustrating a configuration example of a communication device 101 according to the first embodiment. The communication apparatus 101 includes an application processing unit 105, an IKE (Internet Key Exchange Protocol) processing unit 106, a network protocol processing unit 104, a network interface unit 103, and an IPsec processing unit 107. The IPsec processing unit 107 includes an IPsec protocol processing unit 112, an encryption / authentication processing unit 108, an SA management unit 110, an SP management unit 109, a timer unit 113, and an SP / SA update management unit 111.

  The communication device 101 is connected to the network 102 via the network interface unit 103 and can communicate with other communication devices by transmitting and receiving data packets. The network protocol processing unit 104 performs processing based on a network protocol such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), or IP. A packet received via the network interface unit 103 is subjected to MAC and IP protocol processing by the network protocol processing unit 104, and IPsec reception processing is performed by the IPsec processing unit 107. The application processing unit 105 performs application processing on the packet that has undergone IPsec reception processing. If the received packet is an IKE packet, the IKE processing unit 106 performs IKE processing.

  The application processing unit 105 and the IKE processing unit 106 make a transmission request to the network protocol processing unit 104 when transmitting a packet to a partner device serving as a communication partner. In response to this, the network protocol processing unit 104 performs protocol processing such as TCP, UDP, and IP. The IPsec processing unit 107 performs an IPsec process on the packet on which the protocol processing has been performed, and transmits the packet on which the IPsec processing has been performed via the network interface unit 103.

  The IPsec protocol processing unit 112 performs processing based on the IPsec protocol such as ESP and AH. In addition, the IPsec protocol processing unit 112 makes an SP search request to the SP management unit 109 in order to specify a policy of transmission / reception packets. In addition, the IPsec protocol processing unit 112 makes an SA search request to the SA management unit 110 in order to specify an SA required for encryption / authentication processing. In addition, the IPsec protocol processing unit 112 counts the expiration date based on the number of bytes, and requests the SA management unit 110 to update the expiration date count.

  The encryption / authentication processing unit 108 performs encryption, decryption, and authentication processing based on the SA encryption algorithm, encryption key, authentication algorithm, authentication key, and the like. The SP / SA update management unit 111 controls SP, SA registration, update, deletion, and reference processing in a memory (not shown) from the IKE processing unit, and requests necessary for the SA management unit 110 and the SP management unit 109. I do. Also, as a result of the IPsec protocol processing unit 112 sending an SA search request to the SA management unit 110 during packet transmission, if there is no desired SA, the SP / SA update management unit 111 receives the SA negotiation from the IPsec protocol processing unit 112. The request is accepted, and the request is notified to the IKE processing unit 106. The SP / SA update management unit 111 also makes an SA negotiation request to the IKE processing unit 106 even when the software expiration date notification is received from the SA management unit 110. The timer unit 113 notifies the SP / SA update management unit 111 that the time specified by the settings from the SA management unit 110 and the SP / SA update management unit 111 has elapsed. The SA management unit 110 holds the SAD, performs an operation on the SAD based on the requested processing, and returns a processing result. The SP management unit 109 holds the SPD, performs an operation based on the requested process, and returns a process result.

  Each functional block shown in FIG. 1 is configured by hardware or software. When configured as software, a computer program for realizing each function is stored in a storage unit (not shown), and a CPU (Central Processing Unit, not shown) included in the communication device 101 executes the program. This function is realized by.

  Next, packet transmission processing in the present embodiment will be described with reference to FIG. FIG. 2 is a diagram showing a packet transmission processing flow of the communication apparatus 101 in the present embodiment. In step S201, the application processing unit 105 performs application transmission processing on the transmission target data. Subsequently, the application processing unit 105 makes a data transmission request to the network protocol processing unit 104. When the IKE processing unit 106 transmits an IKE packet, the IKE processing unit 106 makes a transmission request to the network protocol processing unit 104.

  In step S202, the network protocol processing unit 104 receives a data transmission request from the application processing unit 105. Subsequently, the network protocol processing unit 104 performs TCP or UDP transport layer protocol processing and IP protocol processing on the data subjected to the application transmission processing by the application processing unit 105 to create an IP packet. The network protocol processing unit 104 notifies the created IP packet to the IPsec processing unit 107.

  In step S <b> 203, the IPsec protocol processing unit 112 of the IPsec processing unit 107 receives an IP packet from the network protocol processing unit 104. The IPsec protocol processing unit 112 makes an SP search processing request specifying the packet information such as the IP address, transport layer protocol type, and port number of the received IP packet to the SP management unit 109. Receiving the SP search processing request, the SP management unit 109 searches the SPD for an SP corresponding to the specified packet information, and notifies the IPsec protocol processing unit 112 of the search result.

  In step S204, the IPsec protocol processing unit 112 determines the search result notified from the SP management unit 109. If there is a (desired) SP corresponding to the specified packet information and the policy specified for the SP is Apply IPsec (Yes in step S204), the IPsec protocol processing unit 112 The SP is specified, and the process proceeds to step S205. If there is no SP corresponding to the designated packet information, or if the policy designated in the SP corresponding to the designated packet information is not applicable to IPsec (No in step S204), the process proceeds to step S219. Proceed to

  In step S219, the IPsec protocol processing unit 112 checks the policy when the SP is not found in the communication apparatus 101. If the policy is a discard (Discard) (Yes in step S219), the IPsec protocol processing unit 112 discards the packet and the process ends. If the policy is pass (Bypass IPsec) (Yes in step S219), the process proceeds to step S213.

  In step S205, the IPsec protocol processing unit 112 searches whether the SA information associated with the SP and the SA corresponding to the packet information described above are registered, and notifies the IPsec protocol processing unit 112 of the search result. In step S206, the IPsec protocol processing unit 112 determines the result notified from the SA management unit 110. If there is a (desired) SA corresponding to the SA information and packet information (Yes in step S206), the SA is specified, and the process proceeds to step S207. If there is no such SA (No in step S205), the process proceeds to step S217. In step S217, the IPsec processing unit 107 performs SA request processing. After the processing of step S217, in step S218, the IPsec protocol processing unit 112 discards the transmission packet and ends.

  Here, the SA negotiation request processing in step S217 will be described with reference to FIG. FIG. 4 is a diagram showing a SA negotiation request processing flow in the present embodiment. The IPsec protocol processing unit 112 makes an SA negotiation request to the SP / SA update management unit 111. When the SP / SA update management unit 111 receives the SA negotiation request, in step S401, the SP / SA update management unit 111 searches for a temporary SA to confirm whether the SA request has already been made. The SP / SA update management unit 111 creates and holds a temporary SA when making an SA request, and deletes it when the SA negotiation is completed. If the SA request is not completed even after a predetermined time has elapsed, the SP / SA update management unit 111 determines that a timeout has occurred and deletes the temporary SA. In step S402, if the same SA as the temporary SA has already been registered (Yes in step S402), the SP / SA update management unit 111 determines that the SA request has already been made, and discards the SA request. To finish. If the same SA as the temporary SA has not been registered (No in step S402), the process proceeds to step S403.

  In step S403, the SP / SA update management unit 111 notifies the IKE processing unit 106 of an SA request. Here, the SP / SA update management unit 111 notifies the SA request with the SP identifier, which is the SP identification information of the SP (the SP identified in step S204). Receiving the SA request, the IKE processing unit 106 performs SA negotiation with the counterpart device based on the IKE protocol. Specifically, the IKE processing unit 106 negotiates SA with the counterpart device through transmission / reception of the IKE packet. In step S404, the SP / SA update management unit 111 makes a timer processing request to the timer unit 113 as a timer for the temporary SA that has requested the SA, and ends the processing. The timer unit 113 notifies the SP / SA update management unit 111 when the temporary SA timer times out. Upon receiving the notification, the SP / SA update management unit 111 deletes the temporary SA.

  Returning to FIG. 2, the description of the packet transmission process will be continued. In step S207, the IPsec protocol processing unit 112 determines whether the SP identifier included in the SP identified in step S204 matches the SP identifier included in the SA identified in step S206. That is, the IPsec protocol processing unit 112 determines whether the SP and the SA are uniquely associated (that is, only one-to-one). If they match (Yes in step S207), the process proceeds to step S208. If the two do not match (No in step S207), the process proceeds to step S217.

  In step S208, the IPsec protocol processing unit 112 performs the ESP or AH IPsec protocol processing specified in the SA specified in step S204. In step S209, the IPsec protocol processing unit 112 requests the encryption / authentication processing unit 108 to perform encryption and authentication processing in the IPsec protocol processing. When receiving the request, the encryption / authentication processing unit 108 performs encryption and authentication processing based on SA information such as an encryption key, an encryption algorithm and an authentication key, and an authentication algorithm. In step S210, the IPsec protocol processing unit 112 updates the count value of the expiration date based on the number of used SA bytes, and requests the SA management unit 110 to update the count value. Upon receiving a count value update request, the SA management unit 110 updates the SA byte count counter.

  In step S211, the SA management unit 110 confirms whether the software expiration date (time limit for updating the SA) has expired. If the software expiration date has expired (Yes in step S211), the process proceeds to step S215. In other cases (when the software expiration date has not expired or has already expired) (No in step S211), the process proceeds to S212. In step S215, the IPsec processing unit 107 performs SA negotiation request processing. Since the SA request process in step S15 is the same process as the SA negotiation request process in step S217, the description thereof is omitted. In step S212, the SA management unit 110 confirms whether the hardware expiration date (time limit for invalidating the SA) has expired. If the hardware expiration date has expired (Yes in step S212), the process proceeds to step S216. If the hardware expiration date has not expired (No in step S212), the process proceeds to step S213.

  In step S216, the IPsec protocol processing unit 112 notifies the SP / SA update management unit 111 that the hardware expiration date has expired. The SP / SA update management unit 111 that has received the notification of the hardware expiration date notifies the IKE processing unit 106 of the hardware expiration date. Also, the SP / SA update management unit 111 requests the SA management unit 110 to delete the hard expired SA, and the SA management unit 110 deletes the SA from the SAD. In step S213, the network protocol processing unit 104 performs IP protocol processing such as fragment processing and MAC header processing on the packet. Thereafter, the network protocol processing unit 104 sends a packet transmission request to the network interface unit 103. In step S214, the network interface unit 103 transmits a packet to the network and ends the process.

  Next, packet reception processing in this embodiment will be described with reference to FIG. FIG. 3 is a diagram showing a packet reception processing flow of the communication apparatus 101 in the present embodiment. In step S301, when the network interface unit 103 detects a packet to be received from the network 102, the network interface unit 103 receives the packet and notifies the network protocol processing unit 104 of the packet. In step S302, the network protocol processing unit 104 performs header analysis of the received packet and performs MAC and IP protocol processing. In step S303, the network protocol processing unit 104 notifies the received packet to the IPsec processing unit 107. The IPsec protocol processing unit 112 of the IPsec processing unit 107 analyzes the header of the received packet and determines whether it is an IPsec packet. If the received packet is an IPsec packet (Yes in step S303), the process proceeds to step S304. If the received packet is not an IPsec packet (No in step S303), the process proceeds to step S311.

  In step S304, the IPsec protocol processing unit 112 sends an SA search processing request specifying packet information such as the IP address, IPsec protocol type, and IPsec header of the received IPsec packet to the SA management unit 110. The SA management unit 110 that has received the SA search processing request searches whether the SA corresponding to the packet information specified in the SAD is registered, and notifies the IPsec protocol processing unit 112 of the search result. In step S305, the IPsec protocol processing unit 112 determines the search result. If the (desired) SA corresponding to the packet information is not found (No in step S305), the process proceeds to step S321. If such an SA is found (Yes in step S305), the process proceeds to step S306.

  In step S306, the IPsec protocol processing unit 112 performs ESP or AH IPsec protocol processing using the SA obtained as a result of the search. In step S307, the IPsec protocol processing unit 112 requests the encryption / authentication processing unit 108 to perform decryption / authentication processing during the IPsec protocol processing. When receiving the request, the encryption / authentication processing unit 108 performs a decryption / authentication process based on SA information such as an encryption key, an encryption algorithm, an authentication key, and an authentication algorithm. Here, the encryption / authentication processing unit 108 may perform only the decryption process according to the request. In step S308, the IPsec protocol processing unit 112 updates the count value of the expiration date based on the number of used SA bytes, and requests the SA management unit 110 to update the count value. Upon receiving the count value update request, the SA management unit 110 updates the used SA byte counter. In step S309, the SA management unit 110 confirms whether the software expiration date has expired. If the software expiration date has expired (No in step S309), the process proceeds to step S318. In other cases (when the software expiration date has not expired or has already expired) (Yes in step S309), the process proceeds to step S310.

  In step S318, the IPsec processing unit 107 performs SA negotiation request processing. The SA negotiation request process in step S318 is a process common to the SA negotiation request process in step S217, and thus description thereof is omitted. In step S310, the SA management unit 110 confirms whether the hardware expiration date has expired. If the hardware expiration date has expired (Yes in step S310), the process proceeds to step S319. If the hardware expiration date has not expired (No in step S310), the process proceeds to step S311.

  In step S319, the IPsec protocol processing unit 112 notifies the SP / SA update management unit 111 that the hardware expiration date has expired. The SP / SA update management unit 111 that has received the notification of the hardware expiration date notifies the IKE processing unit 106 of the hardware expiration date. Also, the SP / SA update management unit 111 requests the SA management unit 110 to delete the hard expired SA, and the SA management unit 110 deletes the SA from the SAD. In step S311, the IPsec protocol processing unit 112 makes an SP search request specifying packet information such as the IP address, transport layer protocol type, and port number of the received IP packet to the SP management unit 109. Upon receiving the SP search processing request, the SP management unit 109 searches the SPD for whether a (desired) SP corresponding to the designated packet information is registered, and notifies the IPsec protocol processing unit 112 of the search result.

  In step S312, the IPsec protocol processing unit 112 determines the search result notified from the SP management unit 109. If there is an SP corresponding to the packet information and the policy specified for the SP is IPsec application (Yes in step S312), the process proceeds to step S313. If there is no SP corresponding to the packet information, or if the policy specified for the SP corresponding to the packet information is other than IPsec application (No in step S312), the process proceeds to step S318.

  In step S318, the IPsec protocol processing unit 112 confirms the policy when the SP is not found in the communication apparatus. If the policy is “Discard” (Yes in step S318), the process proceeds to step S319, and the IPsec protocol processing unit 112 discards the packet and the process ends. If the policy is pass (BypassIPsec) (No in step S318), the process proceeds to step S314.

  In step S313, the IPsec protocol processing unit 112 determines the IPSec policy (tunnel mode or transport mode and whether the security protocol is AH or ESP) indicated by the SA obtained as a result of the search in step S304. Confirms whether it matches the IPSec policy indicated by the SP obtained as a result of the search in step S311. If the two policies do not match (No in step S313), the process proceeds to step S319, and the IPsec protocol processing unit 112 ends the packet discarding. If both policies match (Yes in step S313), the process proceeds to step S314. In step S314, the IPsec protocol processing unit 112 performs header analysis of the IP packet for which the IPsec processing has been completed, and performs IP protocol processing. Thereafter, the IPsec protocol processing unit 112 analyzes the IP upper protocol header and performs transport layer protocol processing such as TCP and UDP. The IPsec protocol processing unit 112 notifies the application processing unit 105 of the packet data that has been subjected to the transport layer protocol processing.

  In step S315, the application processing unit 105 performs application reception processing on the received data. If the received packet is an IKE packet, the network protocol processing unit 104 notifies the IKE processing unit 106, and the IKE processing unit 106 performs IKE protocol processing.

  As described above, in the packet transmission process in the present embodiment, the transmission process is performed when the SP and the SA are uniquely associated, whereas in the packet reception process, the SP and the SA are uniquely associated. Even if not, the reception process is performed.

  Next, the SP registration process and the SA registration process will be described with reference to FIGS. FIG. 5 is a diagram showing an SP registration processing flow in the present embodiment. In step S501, the SP / SA update management unit 111 searches the SPD for an SP having the same selector as the SP selector (IP address, protocol, etc.) to be registered with the SP management unit 109. Make a request. The SP management unit 109 searches whether an SP whose selector matches the SPD is registered, and notifies the SP / SA update management unit 111 of the search result. In step S502, the SP / SA update management unit 111 determines the result notified from the SP management unit 109. If an SP with the same selector exists in the SPD (Yes in S502), the process ends. If there is no SPD with the same selector (No in S502), the process proceeds to step S503.

  In step S503, the SP / SA update management unit 111 assigns an SP identifier that is unique within the SPD to the newly added SP. In step S504, the SP / SA update management unit 111 requests the SP management unit 109 to add a new SP. Upon receiving a new SP addition request, the SP management unit 109 registers the new SP in the SPD and ends the process.

  FIG. 6 is a diagram showing an SA registration processing flow in the present embodiment. In step S601, the IKE processing unit 106 assigns the SP identifier (step S403 in FIG. 4) notified from the SP / SA update management unit 111 at the time of SA request to the newly registered SA. In step S602, the SP / SA update management unit 111 searches for a temporary SA corresponding to the SA to be registered. If there is a temporary SA corresponding to the SA to be registered, a request to stop the timer of the temporary SA is made to the timer unit 113. Thereafter, the SP / SA update management unit 111 deletes the corresponding temporary SA. If there is no temporary SA corresponding to the SA to be registered, the SP / SA update management unit 111 does not perform special processing. In step S603, the SP / SA update management unit 111 requests the SA management unit 110 to add a new SA. When the SA management unit 110 receives a new SA addition request, the SA management unit 110 registers the new SA in the SAD and ends the process.

  According to this embodiment, when a communication device performs communication by setting a plurality of SPs for the same counterpart device, at the time of transmission, only the SA generated from the SP that has been hit by searching the SPD is searched. Use to send. On the other hand, at the time of reception, the communication device can select whether to use only the SA generated from the SP. As a result, even if multiple SPs are set for the partner device, the communication device can communicate with the partner device that has a different SP and SA association method without requiring special settings by the user. Can be performed.

[Second Embodiment]
In the first embodiment, a method has been described in which IPsec communication can be performed when a plurality of SPs are set regardless of differences in SP and SA association methods in the partner apparatus. The second embodiment described below is a method of changing the association between SP and SA for each counterpart device by using an IKE vendor ID payload. The configuration of the communication apparatus 101 (FIG. 1), the SA negotiation request process (FIG. 4), and the SP registration process flow (FIG. 5) in this embodiment are the same as those described in the first embodiment, and thus description thereof is omitted. To do.

  The packet transmission process in this embodiment will be described with reference to FIG. FIG. 7 is a diagram showing a packet transmission processing flow of the communication apparatus 101 in the present embodiment. The processes in steps S701 to S706 and S708 to S720 are the same as the processes from step S201 to step S219 in FIG. 2, and thus the description thereof will be omitted and the process of step S707 will be described.

  In step S707, the IPsec protocol processing unit 112 determines whether an SP identifier is assigned to the corresponding SA. If the SP identifier is not assigned to the SA (No in step S707), the process proceeds to step S709, and the IPsec protocol processing unit 112 performs the IPsec protocol process. When the SP identifier is assigned to the SA (Yes in step S707), the process proceeds to step S708, and the IPsec protocol processing unit 112 determines the SP identifier of the SP and the SA.

  Next, packet reception processing in this embodiment will be described with reference to FIG. FIG. 8 is a diagram showing a packet reception processing flow of the communication apparatus 101 in the present embodiment. The processes in steps S801 to S812 and S814 to S821 are the same as the processes in steps S301 to S312 and S314 to S321 in FIG. 3, and thus the description thereof will be omitted and the process of step S813 will be described.

  In step S813, the IPsec protocol processing unit 112 determines whether an SP identifier is assigned to the SA. If no SP identifier is assigned to the SA (No in step S813), the process proceeds to step S815, and the IPsec protocol processing unit 112 performs SA matching processing. If the SP identifier is assigned to the SA (Yes in step S813), the process proceeds to step S814, and the IPsec protocol processing unit 112 determines the SP identifier of the SP and SA.

  FIG. 9 is a diagram showing SA registration processing in the present embodiment. Since the processes in step S907 and step S908 are the same as those in step S602 and step S603 in FIG.

  In step S901, the IKE processing unit 106 determines whether only one vendor ID payload is given in the IKE packet received from the communication partner during the SA negotiation. The vendor ID payload includes a unique vendor ID value. If no vendor ID payload is given in the received IKE packet (No in step S901), the process proceeds to step S906. Also, when two or more vendor ID payloads are added to the received IKE packet, the IKE processing unit 106 does not know which vendor ID value should be determined, and the process advances to step S906. On the other hand, when only 1 is provided as the vendor ID payload in the received IKE packet (Yes in step S901), the process proceeds to step S902.

  In step S902, the IKE processing unit 106 determines whether the SP / SA association method can be determined from the vendor ID payload. Specifically, the IKE processing unit 106 determines whether it is possible to determine whether or not the SP / SA association method conforms to a predetermined specification by using the value of the vendor ID included in the vendor ID payload. . In the present embodiment, the predetermined specification is RFC that is a technical specification according to IETF (Internet Engineering Task Force). The IKE processing unit 106 holds a list indicating the correspondence between the vendor ID value and the compliance / non-compliance with the RFC, and determines whether the vendor ID value indicated by the vendor ID payload exists in the list. judge. If the value of the vendor ID indicated by the vendor ID payload does not exist in the list, the IKE processing unit 106 cannot determine the association method of SP and SA (No in step S902), and the process proceeds to step S906. move on. When the value of the vendor ID indicated by the vendor ID payload exists in the list, the IKE processing unit 106 can determine the association method of SP and SA (Yes in step S902), and the process proceeds to step S903. .

  In step S906, the IKE processing unit 106 assigns the SP identifier notified from the SP / SA update management unit 111 to the newly registered transmission SA when the SA is requested. However, the IKE processing unit 106 does not give the SP identifier to the newly registered reception SA. In step S903, the IKE processing unit 106 refers to the value of the vendor ID indicated by the vendor ID payload in the above list, and determines whether or not the SP / SA association method is a method compliant with RFC. In the case of the association method of SP and SA compliant with RFC (Yes in step S903), the process proceeds to step S904. If the related method does not comply with RFC (No in step S903), the process proceeds to step S905.

  In step S904, the IKE processing unit 106 assigns the SP identifier notified from the SP / SA update management unit 111 at the time of the SA request to the newly registered transmission SA and reception SA. In step S905, the IKE processing unit 106 does not assign the SP identifier to the transmission SA and reception SA that are newly registered. If the SP-SA association method conforms to RFC according to these specifications, the SP identifier associated with the SA is assigned to the SA, and the SP-SA association method conforms to RFC. Otherwise, the SP identifier associated with the SA is not assigned to the SA.

  According to this embodiment, it is possible to switch the SP and SA association method of the communication apparatus 101 depending on whether the SP and SA association method in the counterpart device is RFC compliant or non-RFC compliant. As a result, in addition to the effects shown in the first embodiment, when communication is performed with a plurality of SPs set for a non-RFC compliant counterpart device, the communication device negotiates only the minimum necessary SA. Often, resource consumption due to registration of SAs not used for communication can be suppressed.

  The embodiment of the present invention has been described above. Although the present invention has been described by taking IPSec communication using SP and SA as an example, packet processing information describing other packet processing methods for performing communication instead of SP, and other key information instead of SA It is also possible to use. In other words, the present embodiment is applicable to communication using packet processing information describing other packet processing methods for performing such communication and other key information.

[Other Embodiments]
The present invention supplies a program that realizes one or more functions of the above-described embodiments to a system or apparatus via a network or a storage medium, and one or more processors in a computer of the system or apparatus read and execute the program This process can be realized. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

101 communication device 102 network 103 network interface unit 104 network protocol processing unit 105 application processing unit 105 IKE processing unit 107 IPsec processing unit 108 encryption / authentication unit 109 SP management unit 110 SA management unit 111 SP / SA update management unit, 112 IPsec protocol processing unit, 113 timer unit

Claims (14)

A communication device capable of performing IPsec communication using packet processing information and key information,
First search means for searching for first packet processing information using information included in a transmission packet;
Transmission means for encrypting the transmission packet using the first key information associated with the first packet processing information and transmitting it to the counterpart device;
Second search means for searching for second key information based on information contained in a packet received from the counterpart device;
Processing means for performing decryption or authentication processing on the received packet using the second key information;
Third search means for searching for second packet processing information using information contained in the received packet;
Protocol processing means for performing reception processing based on a predetermined protocol for the packet processed by the processing means;
Have
The transmission means encrypts the transmission packet and transmits it to the counterpart device according to whether or not the first key information is uniquely associated with the first packet processing information,
The communication apparatus, wherein the protocol processing means performs the reception process regardless of whether the second key information is uniquely associated with the second packet processing information.   The communication apparatus according to claim 1, further comprising a first determination unit that determines whether or not the first key information is uniquely associated with the first packet processing information. Each of the first packet processing information and the second packet processing information is registered with identification information, and each of the first key information and the second key information is assigned identification information of the packet processing information. Has been registered,
The transmission means encrypts the transmission packet according to whether or not the identification information of the packet processing information given to the first key information matches the identification information of the first packet processing information. The communication apparatus according to claim 1, wherein the communication apparatus transmits the data to the partner apparatus. Second determination means for determining a method of associating packet processing information and key information in the counterpart device;
When the second determination means determines that the method for associating the packet processing information with the key information is a method compliant with a specific specification, each of the first packet processing information and the second packet processing information A registration unit for adding and registering identification information of packet processing information for each of the first key information and the second key information;
The communication device according to claim 3, further comprising:   If it is determined by the second determination means that the method of associating the packet processing information and the key information is not a method compliant with a specific specification, the registration means may include the first packet processing information and the second packet processing information. Each of the packet processing information is registered with identification information, and each of the first key information and the second key information is registered without adding identification information of the packet processing information. The communication device according to claim 3.   5. The transmission means encrypts the transmission packet and transmits it to the counterpart device even when packet processing information identification information is not attached to the first key information. Or the communication apparatus of 5.   6. The communication apparatus according to claim 4, wherein the protocol processing unit performs the reception processing even when packet processing information identification information is not added to the second key information. .   The communication device according to any one of claims 4 to 7, wherein the specific specification is RFC which is a technical specification according to IETF (Internet Engineering Task Force).   9. The communication apparatus according to claim 1, wherein the packet processing information and the key information are SP (Security Policy) and SA (Security Association) in IPsec communication, respectively. A method for controlling a communication device capable of performing IPsec communication using packet processing information and key information registered in a memory,
A first search step of searching for first packet processing information using information included in the transmission packet;
A transmission step of encrypting the transmission packet using the first key information associated with the first packet processing information and transmitting the encrypted transmission packet to the counterpart device;
A second search step of searching for second key information based on information included in the packet received from the counterpart device;
A processing step of performing decryption or authentication processing on the received packet using the second key information;
A third search step of searching for second packet processing information using information included in the received packet;
A protocol processing step of performing reception processing based on a predetermined protocol for the packet that has been processed in the processing step;
Have
In the transmission step, the transmission packet is encrypted and transmitted to the counterpart device according to whether or not the first key information is uniquely associated with the first packet processing information,
In the protocol processing step, the reception process is performed regardless of whether or not the second key information is uniquely associated with the second packet processing information.   The program for functioning a computer as a communication apparatus of any one of Claim 1 to 9. A communication device capable of performing IPsec communication using SP (Security Policy) and SA (Security Association) registered in a memory,
Transmission means for encrypting the transmission packet using the first SA having the same identification information as the identification information of the first SP specified from the information included in the transmission packet, and transmitting it to the counterpart device;
Processing means for performing decryption or authentication processing on the received packet using a second SA specified from information included in the packet received from the counterpart device;
The packet subjected to the processing regardless of whether or not the identification information of the second SP specified from the information included in the received packet is different from the identification information of the SP assigned to the second SA Protocol processing means for performing a receiving process based on a predetermined protocol,
A communication device characterized by comprising: A communication device capable of performing IPsec communication using SP (Security Policy) and SA (Security Association) registered in a memory,
A first having the same identification information as the identification information of the first SP specified from the information included in the transmission packet when the counterpart device is a specification compliant with RFC, which is a technical specification by IETF (Internet Engineering Task Force). Transmitting means for encrypting and transmitting the transmission packet using SA of
Processing means for performing decryption or authentication processing on the received packet using a second SA specified from information included in the packet received from the counterpart device;
When the identification information of the second SP specified from the information included in the received packet is the same as the identification information of the SP assigned to the second SA, a predetermined value is set for the packet subjected to the processing. Protocol processing means for performing reception processing based on the protocol;
A communication apparatus comprising: A communication device capable of performing IPsec communication using SP (Security Policy) and SA (Security Association) registered in a memory,
Whether or not the counterpart device has the same identification information as the identification information of the first SP specified from the information included in the transmission packet when the specification is not compliant with RFC which is a technical specification by IETF (Internet Engineering Task Force) Regardless of the transmission means for encrypting and transmitting the transmission packet using the first SA associated with the first SP;
Processing means for performing decryption or authentication processing on the received packet using a second SA specified from information included in the packet received from the counterpart device;
Protocol processing means for performing reception processing based on a predetermined protocol for the packet subjected to the processing;
A communication apparatus comprising:

Images