JP3788802B2 - Inter-network secure communication method, packet secure processing device, processing method thereof, program, recording medium thereof, address conversion device - Google Patents

Description

  The present invention relates to a secure communication method that applies IPsec (standard for performing secure communication such as encryption) to inter-network communication that performs IP address conversion processing, an apparatus that performs secure processing compliant with IPsec, and a processing method therefor, The present invention relates to the program, the recording medium, and the address conversion device.

  Conventionally, when a host assigned a private IP address (RFC 1918) communicates with a host on the Internet, an IP packet sent from a host having a private IP address is assigned a private IP address by an address translation (NAT) device. It is rewritten to a global IP address and delivered to a host on the Internet. On the other hand, IPsec (IP Security Protocol) is known as a standard for performing secure communication such as encryption communication via a network such as the Internet. IPsec determines that the data has been tampered with and discards the packet on the receiving side when the contents of the data are rewritten during communication. On the other hand, since the address translation (NAT) device converts packet information (IP address) in the middle of the IPsec communication path, the receiving side determines that the IPsec packet whose address has been converted has been tampered with and discards it. . Therefore, it is not possible to simply use a secure communication method based on IPsec and a communication method with address conversion for inter-network communication.

In response to such a problem, IETF (Internet Engineering Task Force) proposes “IPsec NAT-Traversal” and defines “IPC-NAT (IPsec Policy Controlled NAT)”. (Refer nonpatent literature 1). Further, there is a method based on the “IPC-NAT”, in which the IPsec security association is updated in association with the address translation rule by the NAT device and the IPsec is started (see Patent Document 1).
RFC (Request for Comments) 2709 Patent No. 003393936

  In order to use the “IPsec NAT-Traversal”, a device having an IPsec function of a communication destination (host terminal or gateway on the Internet) must have this function. In addition, “IPsec NAT-Traversal” is defined only for ESP (Encapsulating Security Payload: RFC2406) traffic (communication that conceals data like encryption), and AH (Authentication Header: RFC2402) traffic (like signature) Communication guaranteeing against data tampering is not applicable. On the other hand, “IPC-NAT” (Non-patent Document 1) and similar technology (Patent Document 1) of “IPC-NAT” have problems when IPsec is used in a NAT environment by mounting an IPsec protocol stack on a NAT device. Although it has been solved, there is still a problem in a communication environment in which the NAT device and the IPsec device must be separated when the host terminal performs the IPsec processing, that is, the IPsec function cannot be implemented in the NAT device.

  An object of the present invention is to solve the problem in the case where IPsec is used in a NAT environment without requiring a special IPsec device as a communication partner. An object is to provide an inter-network communication method and a packet secure processing device capable of secure communication using AH and ESP, a processing method, a program, a recording medium thereof, and an address conversion device.

According to the present invention, in an inter-network secure communication method for converting an IP packet between a private IP address and a global IP address,
In particular, when performing secure processing, for an IP packet that has not been subjected to address translation, a new IP address to which the IP address of the IP packet will be translated is obtained, and the IP address that has undergone address translation For a packet, obtain the IP address before the IP address of the IP packet is translated,
The IP address of the IP packet is virtually replaced with the acquired IP address, and secure processing is performed on the IP packet virtually replaced with the IP address.

  Since the present invention is configured as described above, the IPsec apparatus can be used in the NAT environment regardless of the front-rear positional relationship between the NAT apparatus and the IPsec apparatus without mounting a special function such as the IPsec NAT-Travesal function in the communication partner apparatus. Secure communication using AH and ESP is possible, and secure communication can be performed in a communication environment in which the IPsec function is separated from the NAT device.

  Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 shows a configuration example of an inter-network secure communication system to which a communication method of the present invention is applied, including a packet secure processing device (hereinafter referred to as an IPsec device) NAT device of the present invention. For example, a host A terminal 13 is accommodated in a communication network 10 such as a LAN (Local Area Network), and a packet secure processing device (hereinafter referred to as an IPsec device) 11 that performs processing compliant with IPsec is accommodated. Are connected to a communication network 30 such as the Internet via an address translation device 12. A host B terminal 23 is accommodated in a communication network 20 such as a LAN, and an address translation device 22 is accommodated. The address translation device 22 is connected to the communication network 30 via the IPsec device 21. A partner host C device 31 is connected to the communication network 30.

  In the communication network 10, the host A terminal 13 is connected to the partner host C device 31 via the network 30 in the order of the IPsec device 11 and the NAT device 12. On the other hand, in the communication network 20, the host B terminal 23 is connected to the partner host C device 31 via the network 30 in the order of the NAT device 22 and the IPsec device 21. In the present invention, the counterpart host C device 31 has an IPsec function, and may be either an IPsec terminal or an IPsec gateway. In the following, it will be written as the partner host C device 31 in that it represents any of these. Further, the host A terminal 13 and the host B terminal 23 may or may not be equipped with the IPsec function, but in this embodiment, neither of the host terminals is equipped with the IPsec function. And In addition, it is assumed that keys required for IPsec communication are set in advance in each of the IPsec apparatuses 11 and 21 and the counterpart host C apparatus 31. An example of the functional configuration of the IPsec apparatuses 11 and 21 is shown in FIG. 2, and an example of the functional configuration of the NAT apparatuses 12 and 22 is shown in FIG.

[First Embodiment]
FIG. 4 shows a packet flow, and FIG. 5 shows a processing procedure of the IPsec apparatus 11. In the first embodiment, what is connected to both sides of each device in FIGS. 2 and 3 is indicated by a solid line.
Communication from host A to partner host C Host A terminal 13 and partner host C device 31 perform secure communication based on IPsec.
The IPsec apparatus 11 takes in the IP packet A1 sent from the host A terminal 13 from the LAN side network interface 111 (FIG. 2) (step S11). The received IP packet A1 is delivered to the security policy search unit 113 via the transmission path 112, and is sent from the security policy storage unit 114 by the security policy search unit 113 using the start point IP address, end point IP address, protocol, etc. of the IP packet A1 as keys. The corresponding security policy is searched. When a corresponding security policy is found (step S13), the IP packet A1 is delivered via the transmission path 115 to the processing unit 116 that performs encryption and creation of authentication data.

  The IPsec apparatus 11 acquires IP address conversion information (step S14). For example, the IP address conversion information acquisition unit 117 uses UPnP (Universal Plug and Play: a protocol that allows a DPnP-compatible device to automatically recognize the presence of a counterpart device simply by connecting to the network, and the device exchanges data with each other). The NAT device 12 is used to communicate with the NAT device 12 to request address translation information for the IP packet A1, and the NAT device 12 extracts the address translation information for the IP packet A1 from the address translation information storage unit 211. Address conversion information is transmitted to the IPsec apparatus 11 via the transmission unit 212. As described above, the IPsec apparatus 11 acquires the IP address conversion information from the NAT apparatus 12 connected to the WAN side network interface 119 via the address conversion information acquisition unit 117 and stores it in the address conversion information storage unit 118. Thereby, the IPsec apparatus 11 knows a new IP address that will be rewritten in the future of the received IP packet A1, that is, an IP address before conversion. In this embodiment, the IP address conversion information of the IPsec device 11 is acquired by communication with the NAT device 12. For example, the communication network 10 is a LAN, and the IP address conversion information storage unit is manually operated by the administrator. It is also possible to store directly in 118. In the case of direct storage, it is important to make the storage contents of the IP address conversion information storage unit 118 of the IPsec device 11 and the IP address conversion information storage unit 211 of the NAT device 12 equal. Accordingly, the acquisition of the IP address conversion information (the IP address before conversion and the IP address after conversion) includes acquisition through communication and acquisition from the storage unit 118.

  The processing unit 116 that performs encryption and authentication data creation of the IPsec apparatus 11 performs encryption or authentication data creation based on ESP or AH obtained by the security policy search in step S12. Before performing the process, a new IP address that will be rewritten in the future from the received IP packet A1, that is, an IP address after conversion is acquired from the address conversion information storage unit 118. After the acquisition, the IP header of the IP packet A1 is virtually replaced with the acquired new IP address, and encryption and authentication data creation complying with IPsec are performed and embedded in the packet (step S15). At this time, it should be noted that the IP header of the IPsec packet A2 generated by the encryption processing by the processing unit 116 is not actually rewritten.

  The IP packet A2 converted to IPsec by the IPsec apparatus 11 is transmitted to the LAN side network interface 213 of the NAT apparatus 12 via the WAN side network interface 119. In the NAT device 12, based on the address translation information in the address translation information storage unit 211, the address translation processing unit 214 rewrites the IP address of the IP header (the same address as that of the IP packet A 1) with the IP address after the translation. The packet A3 is transmitted to the counterpart host C device 31 via the WAN side network interface 215 (step S16).

  The counterpart host C device 31 performs decryption of the received IPsec packet A3 and verification of the authentication data. The IPsec packet A3 received by the host C device 31 has its IP header rewritten by the NAT device 12, that is, the encrypted data or the authentication data embedded in the IPsec packet A3 has been altered by the NAT device 12 Since the processing unit 116 performs encryption processing on the virtual packet that has been converted, the host C device 31 does not notice the alteration of the packet by the NAT device 12, that is, without discarding the encrypted data or authentication data. Can be verified. If no security policy is found in step S13, the IP packet A1 is transmitted to the NAT device 12 without being subjected to encryption processing.

For the IPsec packet from the partner host C to the host A to the host A terminal 13 of the communication network 10 from the partner host C device 31, the NAT device 12 sends the IPsec packet C 1 from the partner host C device 31 via the WAN side network interface 215. Upon receipt, based on the address translation information in the address translation information storage unit 211, the address translation processing unit 214 rewrites the IP address of the IP header and transmits the IPsec packet C2 to the IPsec apparatus 11 via the LAN side network interface 215. To do.
When the IPsec apparatus 11 receives the IPsec packet C2 from the NAT apparatus 12 via the WAN side network interface 119 (step S17), the received IPsec packet performs processing for verifying authentication data and decrypting encryption via the transmission path 121. To the unit 122.

  The processing unit 122 that performs encryption decryption and authentication data verification of the IPsec apparatus 11 is rewritten by the IP address before conversion of the received IPsec packet C2, that is, the NAT apparatus 12, before performing decryption and authentication data verification. The previous IP address, that is, the IP address of the IPsec packet C1 is acquired from the address translation information storage unit 117 (step S18). After acquisition, the IP header of the IPsec packet C2 is virtually replaced with the acquired IP address before address conversion, and then decryption of encryption and verification of authentication data are performed (step S19). Since the IPsec apparatus 11 knows that the received IPsec packet C2 has been falsified by the NAT apparatus 12, the IPsec packet C1 sent out by the counterpart host C apparatus 31, that is, the state before the IP header is rewritten by the NAT apparatus 12 Encryption decryption and verification of authentication data are performed on the packet returned to step 1, and decryption and verification can be performed without discarding the IPsec packet C2. At this time, it should be noted that the IP header of the IP packet C3 output from the processing unit 122 is not actually rewritten.

  The processing unit 122 that performs decryption of the encryption of the IPsec apparatus 11 and verification of the authentication data delivers the packet to the security policy search unit 124 via the transmission path 123. The security policy search unit 124 searches for the corresponding security policy from the security policy storage unit 114 using the start point IP address, end point IP address, protocol, and the like of the IP packet C3 as keys (step S20). When the corresponding security policy is found (step S21), the IP packet C3 is transmitted to the host A terminal 13 via the LAN side network interface 111 (step S22), and the IPsec between the host A terminal 13 and the partner host C device 31 is transmitted. The secure communication used is established. On the other hand, if the corresponding security policy is not found in step S20, the discard unit 125 discards the packet C3 on the spot (step S23).

The basic configuration and effects of the first embodiment are summarized as follows.
In the first embodiment of the present invention, in the secure processing device, the IP header of the input packet is the packet before the address conversion with reference to the IP address conversion information storage unit storing the IP address information before and after being rewritten by the NAT device. If it is, the state is converted to the state after the address conversion, and if it is the packet after the address conversion, it is virtually replaced with the state before the address conversion, and then the encryption processing based on IPsec is performed on the input packet and output. Here, encryption processing means encryption processing for concealing data, decryption processing for restoring encrypted data to original data, authentication processing for ensuring that the data has not been tampered with, and data subjected to authentication processing. On the other hand, it represents one of verification processes for confirming whether or not tampering has occurred. This is the same in the following.

  With this configuration, it is assumed that the contents of the IP header are rewritten, and encryption and authentication data creation are performed on the IP packet. Even if the contents of the IP header are rewritten by the NAT device, the communication partner host device Therefore, it can be determined that the packet has been altered and the packet is not discarded. In addition, for the received IPsec packet, it is possible to perform the decryption of IPsec and the verification of the authentication data in a state before the contents of the IP header are rewritten by the NAT device, and the processing is performed correctly.

[Second Embodiment]
An embodiment of secure communication between the host B terminal 23 and the partner host C apparatus 31 via the communication network 20 and the network 30 will be described. In FIG. 2 and FIG. 3, what is connected to both sides of each device is indicated by a broken line. FIG. 6 shows the packet flow in this case, and FIG. 7 shows an example of the processing procedure of the IPsec apparatus 21.
When the communication NAT device 22 from the host B to the partner host C receives the IP packet B1 from the host B terminal 23 via the LAN side network interface 213, the address translation processing unit is based on the address translation information in the address translation information storage unit 211. In 214, the IP address of the IP header is rewritten, and the IP packet B2 is transmitted to the IPsec apparatus 21 via the WAN side network interface 215.

  Further, the NAT device 22 extracts the address conversion information from the address conversion information storage unit 211 and transmits the address conversion information to the IPsec device 21 via the address conversion information transmission unit 212. The address translation information storage unit 118 of the IPsec device 21 obtains IP address translation information from the NAT device 22 via the address translation information acquisition unit 117 and stores it. Thereby, the IPsec apparatus 21 can know a new IP address that will be rewritten in the future of the received packet, or an IP address before rewriting. In this case as well, the IP address translation information can be directly stored in the IP address translation information storage unit 118 without communication with the NAT device 22.

  The IPsec device 21 dynamically changes the security policy in the security policy storage unit 114 based on the address conversion information in the address conversion information storage unit 118. In this embodiment, the IP address stored in the address translation information storage unit 118 of the IPsec apparatus 21 and the IP address stored in the security policy storage unit 114 are matched by dynamic update, but the security policy storage unit It is possible to match the IP address stored in the address conversion information storage unit 118 by manually storing the IP address directly in 114.

  The IPsec device 21 takes in the IP packet B2 sent from the NAT device 22 from the LAN-side network interface 111, and delivers the received IP packet to the security policy search unit 113 via the transmission path 131 (step S31). Before starting the search, the security policy search unit 113 acquires the IP address of the received IP packet B2 before being rewritten by the NAT device 22, that is, the IP address of the IP packet B1 from the address translation information storage unit 118 (step S32). ). The IP header of the IP packet B2 is virtually replaced with the acquired IP address before conversion, and the corresponding security policy is retrieved from the security policy storage unit 114 using the start point IP address, end point IP address, protocol, and the like as keys. (Step S33). As described above, the security policy search is performed based on the information of the IP packet B1 immediately after the transmission by the host B terminal 23. Therefore, even if the IP address is rewritten by the NAT device 22, it is determined for each transmission source host. Security policy can be applied. When a corresponding security policy is found (step S34), the IP packet B2 is delivered via the transmission path 132 to the processing unit 116 that performs encryption and creation of authentication data. Note that the IP header of IP packet B2 is not actually rewritten at this time.

The processing unit 116 that performs encryption and creation of authentication data of the IPsec apparatus 21 performs encryption or authentication data creation conforming to IPsec based on ESP or AH obtained from the search result of the security policy, and this is converted into a packet. Embed (step S35), and transmit as an IPsec packet B3 to the counterpart host C device 31 via the WAN side network interface 119 (step S36).
The counterpart host C device 31 performs decryption of the received IPsec packet B3 and verification of the authentication data. Since this IPsec packet B3 has not been subjected to address rewriting by the NAT device 22 after the authentication data and encryption data are created by the IPsec device 21, the counterpart host C device 31 decrypts the cipher without discarding the packet. And verification of authentication data. As a matter of course, when the IPsec packet B3 is altered by a malicious person, it cannot be decrypted or cannot be verified successfully, and the altered packet is discarded.

Communication from the partner packet C to the packet B When the IPsec device 21 receives the IPsec packet C4 from the partner host C device to the host B terminal 23 accommodated in the communication network 20 to the WAN side network interface 119 (step S37), the transmission is performed. The IPsec packet C4 is transmitted via the path 133 to the processing unit 122 that performs encryption decryption and authentication data verification. The processing unit 122 performs decryption of the encryption and verification of the authentication data (step S38), and if successful, sends the IP packet C5 to the security policy search unit 124 via the transmission path 134.

  In the security policy search unit 124, before starting the search, a new IP address that will be rewritten in the future, that is, the IP address after rewritten by the NAT device 22 is read from the address translation information storage unit 118. Obtain (step S39). The IP header of the IP packet C5 is virtually replaced with the acquired IP address, and the corresponding security policy is retrieved from the security policy storage unit 114 using the start point IP address, end point IP address, protocol, and the like as keys (step) S40). As described above, the security policy search is performed based on the packet information immediately before reception by the host B terminal 23. Therefore, even if the NAT device 22 rewrites the IP address, the security policy is determined for each destination host. Policy can be applied. Note that the IP header of the IP packet C5 is not actually rewritten at this time. When the corresponding security policy is found (step S41), the IP packet C5 is transmitted to the NAT device 22 via the LAN side network interface 111 (step S42).

If no corresponding security policy is found in step S41, the IP packet C5 is discarded by the discard unit 125 (step S43).
In the NAT device 22, when the IP packet C5 is received by the WAN side network interface 215, the IP address of the IP header is rewritten by the address translation processing unit 214 based on the address translation information in the address translation information storage unit 211, and the IP packet C6 is changed. The data is transmitted to the host B terminal 23 through the LAN side network interface 213. In this way, secure communication conforming to IPsec is performed between the counterpart host C device 31 and the host B terminal 23.

The basic configuration and effects of the second embodiment are summarized as follows.
According to the second embodiment, the IP address conversion information storage unit that stores the IP address conversion information before and after being rewritten by the NAT device is referred to, the IP header for the input packet and the address conversion for the packet after the address conversion. The security policy is applied to the previous packet before the address translation after virtually replacing the address after the address translation.
With this configuration, when both the NAT device and the IPsec device are in a local network and are connected to a partner host via the network in the order of the NAT device and the IPsec device, a packet whose IP address has been rewritten by the NAT device A security policy can be applied to each source host terminal. Further, it is possible to apply the security policy for each destination host terminal on the assumption that the contents of the IP header are rewritten by the previous NAT device with respect to the IPsec packet.

In the above description, the address conversion information is acquired by the IPsec apparatus 11 or 21 by communication with the NAT apparatus 21 or 22, but may be acquired by communication with the server apparatus 32 that manages the conversion between the private IP address and the global IP address. . Note that the control unit 137 in FIG. 2 reads / writes the storage units 114 and 118 and sequentially operates other units.
Furthermore, in the first embodiment, the input IP packet (IPsec packet) is encrypted as an IP address virtual replacement. However, in the second embodiment, whether or not the input IP packet (IPsec packet) is encrypted is determined. Since searching is performed and ESP or AH is determined when found by searching, it can be said that searching as this virtual replacement is a secure process. Accordingly, when the first embodiment and the second embodiment are combined from this point, the principle of the packet secure processing device and the processing procedure in the present invention is as follows. FIG. 8 shows the functional configuration, and FIG. 9 shows the processing procedure.

  When an IP packet (including an IPsec packet) is received by the IPsec apparatus (step S50), the determination unit 141 determines whether the input IP packet has been subjected to address translation (step S51). That is, as shown in FIG. 2, the host A terminal 13 and the address translation device 12 indicated by the solid line are connected to the both sides of the IPsec device, and the address translation device 22 and the partner host device 31 indicated by the broken line are connected. Since these connection states are known in advance, when a packet is received by the LAN side network interface 111, in the former case, it is determined from the host A terminal 13 and it is determined that the address is not translated. In the latter case, it is from the address translation device 22, and it is determined that the address translation has been performed. Similarly, when a packet is received by the WAN-side network interface 119, it is determined that the former is from the address translation device 12 and the address translation is being performed, and in the latter case, from the counterpart host C device 31. Yes, it is determined that the address has not been converted. Therefore, the determination unit 141 may not be provided independently as actual hardware.

If the determination in step S51 is before address conversion, the IP address (post-translation IP address) obtained by converting the IP address of the received packet by the address conversion device is acquired (step S52), and the determination in step S51 is performed. If it is after the address translation, an IP packet before the IP address of the received packet is translated by the address translation device is acquired (step S53).
Next, for the received packet, the IP address of the IP header is virtually replaced with the IP address acquired in step S52 or step S53, and then the virtual replacement secure processing unit 142 or 143 performs secure processing (step S54). Output (step S55). The virtual replacement secure processing unit 142 is the security policy search unit 113 and the encryption / authentication data creation processing unit 116 when the IP address in FIG. 2 is virtually replaced and processed, and the virtual replacement secure processing unit 143 is illustrated in FIG. Decryption, authentication data verification unit 122, and security policy search unit 124 in the case of processing by virtually replacing the IP address.

  In the above description, the IPsec apparatus 11 may be mounted on the host A terminal 13. The IPsec apparatus shown in FIG. 2 may be operated by a computer. In that case, a program for causing the computer to execute each process shown in FIG. 5 or FIG. 7 is installed from a recording medium such as a CD-ROM, a magnetic disk, or a semiconductor storage device, or downloaded through a communication line. Then, the program may be executed on the computer.

1 is a configuration diagram showing an example of a packet communication system to which an inter-network secure communication method of the present invention is applied and which includes a packet secure processing device and an address translation device of the present invention. The block diagram which shows the function structural example of the IPsec (packet secure processing) apparatus of this invention. The block diagram which shows the function structural example of the address translation apparatus of this invention. The figure which shows the flow of the packet in 1st Embodiment. The flowchart which shows the example of the process sequence of the IPsec apparatus in 1st Embodiment. The figure which shows the flow of the packet in 2nd Embodiment. The flowchart which shows the example of the process sequence of the IPsec apparatus in 2nd Embodiment. The block diagram which shows the basic functional structural example of the packet secure processing apparatus by this invention. 9 is a flowchart showing an example of a processing procedure of the apparatus shown in FIG.

Claims (13)

In an inter-network secure communication method for converting an IP packet between a private IP address and a global IP address,
When performing secure processing, for an IP packet that has not been subjected to address translation, obtain a new IP address to which the IP address of the IP packet will be translated,
For an IP packet that has undergone address translation, obtain the IP address before the IP address of the IP packet is translated,
A secure communication method between networks, wherein the IP address of the IP packet is virtually replaced with the acquired IP address, and secure processing is performed on the IP packet virtually replaced with the IP address. A secure processing device used in an inter-network secure communication system that converts a private IP address and a global IP address for an IP packet,
An address conversion information storage unit for storing correspondence between the IP address before conversion and the IP address after conversion;
A before / after determination unit that determines whether the IP address of the input IP packet is before or after conversion;
If the determination of the before / after determination unit is after conversion, the corresponding IP address before conversion in the address conversion information storage unit is the corresponding IP address after conversion in the address conversion storage unit if the determination is before the conversion. A secure packet processing apparatus comprising: a secure processing unit that securely processes and outputs an IP packet obtained by virtually replacing the IP address of the input IP packet using an address. The packet secure processing device is used between the host terminal on the own side and the address translation device,
The secure processing unit
Using the converted IP address to virtually replace the encryption, authentication data creation processing unit for performing encryption and authentication data creation for the input IP packet input from the host terminal on its own side,
The secure IP packet as the input IP packet from the counterpart host device inputted from the address translation device is virtually replaced by using the IP address before the translation, and the decryption of the encryption or the authentication data 3. The packet secure processing device according to claim 2, wherein the packet secure processing device is a decryption and authentication data verification processing unit for performing verification. A security policy storage unit for storing a security policy between the counterpart host device and the host host terminal;
The security policy storage unit is searched for the input IP packet input from the host terminal on its own side. If the IP packet is not found, the input IP packet is transmitted to the address translation device. A first security policy search unit for outputting to the encryption and authentication data creation processing unit,
An IP packet as a processing result from the decryption / authentication data verification processing unit is input, and the security policy storage unit is searched for the IP packet. If the IP packet is not found, the IP packet is discarded. A second security policy search unit for transmitting to the host terminal on the own side,
4. The packet secure processing apparatus according to claim 3, wherein the encryption / authentication data creation processing unit is a processing unit that performs the encryption or authentication data creation in accordance with an input search content. The packet secure processing device is used between an address translation device connected to its own host terminal and a counterpart host device connected via a network,
A security policy storage unit for storing a security policy for each set of the host terminal on the own side and the host apparatus on the other side;
The security processing part
A first security policy search unit that virtually replaces the IP packet of its own host terminal input from the address translation device, using the IP address before conversion, and searches the security policy storage unit;
A second security policy search unit that virtually replaces the secure IP packet input from the counterpart host device using the converted IP address and searches the security policy storage unit; 3. The packet secure processing apparatus according to claim 2, wherein The IP packet input from the first security policy search unit and the search content are input, and encryption or authentication data is generated for the input IP packet according to the search content. An encryption and authentication data creation unit for transmitting a secure IP packet to the counterpart host device;
The secure IP packet input from the counterpart host device is decrypted and the authentication data is verified, and the decrypted or verified IP packet is output to the second security policy search unit. A decryption and authentication data verification processing unit,
If the first security policy search unit is found by the search, the input IP packet and the search content are output to the encryption / authentication data creation processing unit. If not found, the input IP packet is output to the counterpart host. A search unit to send to the device,
The second security policy search unit transmits the IP packet input from the decryption / authentication data verification processing unit to the address translation device if found by the search, and discards the input IP packet if not found by the search. 6. The packet secure processing device according to claim 5, wherein the packet secure processing device is a processing unit.   Communicating with the address translation device or a server device that manages the address translation of the address translation device to obtain the correspondence of the IP address before and after the translation, and storing the address before and after the obtained IP address in the address translation information storage The packet secure processing device according to claim 2, further comprising an IP address conversion information acquisition unit stored in the unit.   Communicating with the address translation device or a server device that manages the address translation of the address translation device to obtain the correspondence of the IP address before and after the translation, and storing the address before and after the obtained IP address in the address translation information storage And a means for changing a security policy in the security policy storage unit in accordance with a change in a storage state of the address conversion information storage unit. The packet secure processing device according to any one of the above. A processing method of a packet secure processing device used between an own host terminal and an address translation device in an inter-network secure communication system that translates a private IP address and a global IP address for an IP packet,
When an IP packet is received from the host terminal on its own side, the IP address after the conversion is stored by referring to the address conversion information storage unit that stores the IP addresses before and after being converted by the address conversion device using the IP address of the IP packet Get
For the input IP packet, the IP header is virtually replaced with the state after address conversion using the acquired IP address, and then encrypted and created as authentication data, and sent to the address conversion device.
When a secure IP packet is received from the counterpart host device through the address translation device, the IP address of the secure IP packet is used to obtain an IP address before translation by referring to the address translation information storage unit,
A packet characterized in that the IP header of the secure IP packet is virtually replaced with the state before the address conversion by using the acquired IP address, and then the decryption of the encryption and the verification of the authentication data are performed. Processing method of secure processing device. In an inter-network secure communication system that translates a private IP address and a global IP address for an IP packet, between an address translation device connected to its own host terminal and a counterpart host device connected via the network A processing method of a packet secure processing device used in a position,
When an IP packet is received from the local host terminal via the address translation device, the IP address of the IP packet is used to store the IP address before and after the IP address is translated by the address translation device. To obtain the IP address before conversion,
The security policy is applied to the received IP packet after virtually replacing the IP header with the acquired IP address to the state before the address translation,
When receiving a secure IP packet from the counterpart host device, using the IP header of the secure IP packet, obtain the IP address after the translation from the address translation information storage unit,
A processing method for a packet secure processing device, wherein a security policy is applied to the secure IP packet after virtually replacing the IP header with the acquired IP address to a state after address translation. .   A program for causing a computer to function as the packet secure processing device according to claim 2.   A computer-readable recording medium on which the program according to claim 11 is recorded. In an address translation device used in an inter-network secure communication system that translates a private IP address and a global IP address for an IP packet,
An address translation information storage unit for storing a correspondence between an IP address before address translation and an IP address after translation;
An address conversion processing unit that converts the IP address of the IP header of the input IP packet into an IP address after conversion with reference to the address conversion information storage unit and outputs the IP packet;
An address conversion apparatus comprising: an IP address conversion information transmitting unit that transmits the converted IP address and the IP address before the conversion to an external device.

Images