JP4113205B2 - Cryptographic processing device - Google Patents

Description

  The present invention relates to an encryption processing apparatus that performs packet encryption processing and relay processing.

Conventionally, IPsec (Security Architecture for the Internet Protocol) is known as a standard for performing cryptographic communication over a network such as the Internet (see Non-Patent Document 1). In this IPsec standard, a database called SPD (Security Policy Database) that stores application conditions (Security Policy) of encryption processing and decryption processing for packets, and an agreement used for encryption processing and decryption processing for packets ( It is defined to have a database called SAD (Security Association Database) that stores SA (Security Association) information. A device that performs encryption processing refers to an SPD for an input / output packet and determines processing such as decryption / encryption, discard, and transmission for the packet. In addition, when performing encryption or decryption, agreement information necessary for the processing is used with reference to SAD.
Stephen Kent, 1 other, "Security Architecture for the Internet Protocol", [online], November 1998, RFC (Request for Comments) 2401, IETF (Internet Engineering Task Force) [June 6, 2005] Internet (URL: http://www.ipa.go.jp/security/rfc/RFC2401EN.html)

  In the cryptographic processing apparatus, the source IP address and the destination IP address are used as keys as SPD and SAD entries. Here, the SPD entry has a single value IP address (unicast, anycast, broadcast (IPv4 only), or as a source IP address and a destination IP address so that setting and management of application conditions can be simplified, or Not only a multicast group, but also an address group (address range (upper limit value and lower limit value), network address, wild card address) can be specified.

  However, in the SAD, although it is allowed on the RFC to specify both addresses as a destination IP address and a source IP address as an address group, which entry is given priority when a plurality of entries are matched. Since the point is not defined, in such a case, a specific entry cannot be obtained accurately according to the network configuration or the like. In addition, when both addresses are designated as an address group as a destination IP address and a source IP address, there is a problem that cooperation with the SPD cannot be achieved. For these reasons, in the SAD, it is actually necessary to specify a single value IP address for either one of the addresses. For this reason, when the network configuration is changed, it is necessary to update the SAD as appropriate even if the IP address is changed but the network address is not changed. That is, there is a problem that management of SAD is complicated.

  In order to solve this problem, it is common to use an automatic key exchange function (IKE: Internet Key Exchange (specified in RFC 2409)) for setting SAD. However, when an automatic key exchange function is implemented in the cryptographic processing apparatus, there is a problem that the system becomes complicated and expensive.

  Further, the SPD holds the order of each entry. Since this order is a factor that determines which entry is applied, it is important to manage the order as well as the contents of each application condition. For this reason, SPD management has been complicated in the conventional cryptographic processing apparatus.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a cryptographic processing apparatus that can easily manage application conditions and agreement information necessary for cryptographic processing. .

  In order to achieve the above object, in the present application, a packet transmitted from a terminal device on the first network side to a counterpart device on the second network side is encrypted and relayed to the counterpart device, and from the counterpart device to the terminal Application conditions for storing application conditions for encryption processing and decryption processing for packets in order, using destination address and source address as keys, in an encryption processing device that decrypts encrypted packets addressed to the device and relays them to the terminal device Storage means, agreement information storage means for storing agreement information used in packet encryption processing and decryption processing in order using a destination address and a source address as keys, and a destination address of a packet received from the first network side And the application conditions are obtained from the application condition storage means according to the order using the transmission source address as a key, The agreement determination information from the agreement information storage means in order using the encryption determination means for determining the processing contents for the packet based on the usage conditions, and the destination address and the source address of the packet determined as the encryption target by the encryption determination means as a key Therefore, the application condition storage means obtains the application condition from the application condition storage means using the encryption processing unit that performs the packet encryption process based on the agreement information, and the destination address and the source address of the encrypted packet received from the second network side as keys. In accordance with the order, and using as a key the decryption determination means for determining the processing content for the encrypted packet based on the application condition, and the destination address and the source address of the packet determined to be subject to decryption by the decryption determination means Agreement information is acquired from the agreement information storage means according to the order, and packets are restored based on the agreement information. The agreement information storage means can store both a destination address and a source address stored as a key of agreement information in an address group including a plurality of addresses, The encryption processing unit and the decryption processing unit propose that the agreement information in which both the destination address and the transmission source address of the packet are completely matched or partially matched is acquired from the agreement information storage unit in order. .

  According to the present invention, both the destination address and the transmission source address which are the keys of the agreement information can be specified by an address group including not only a single value address but also a plurality of addresses. It becomes easy. In addition, each agreement information is stored in the agreement information storage means in order, and the encryption processing unit and the decryption processing unit have agreement information in which both the destination address and the source address of the packet are completely coincident or partially coincident. Are acquired according to the order, and by appropriately managing each agreement information and the order, an appropriate encryption process according to the network configuration or the like can be performed. Here, the address specifies an apparatus or a program related to communication, and includes not only an address in one layer but also a case where it extends over a plurality of layers. For example, when a TCP / IP protocol suite is used as a communication protocol, a pair of an IP address and a port number is applicable.

  Further, in the present application, in such a cryptographic processing apparatus, management device means for rearranging the order of the application information stored in the application condition storage means and the agreement information stored in the agreement information storage means according to a predetermined rule We propose something with

  As the sorting rules, for example, (1) a method of rearranging so that the smaller the number of addresses included in the destination address and the transmission source address becomes higher, (2) what is used in the decryption process The higher the number of addresses included in the key source address, the higher the address, and the lower the number of addresses included in the key destination address, the higher the address used in the encryption process. Reordering method, (3) For those used in the decryption process, the lower the number of addresses included in the key destination address, the higher the order, and for those used in the encryption process, the key source A method of rearranging the addresses so that the lower the number of addresses included in the address is, the higher the order is.

  According to these inventions, the application conditions stored in the application condition storage means and the agreement information stored in the agreement information storage means are automatically rearranged, so that setting and management are facilitated.

  In the present application, in the cryptographic processing apparatus, the agreement information storage unit and the application condition storage unit are associated with each other using a destination address and a transmission source address as keys, and the encryption determination unit and the decryption determination unit When obtaining the application conditions from the storage means, the agreement information associated with the application conditions is obtained, and the encryption processing means and the decryption processing means are the agreement information obtained by the preceding encryption judgment means or the decryption judgment means. We propose the one that performs encryption or decryption using

  According to the present invention, not only the application conditions but also the agreement information can be acquired in the encryption determination means and the decryption determination means, so that the acquisition processing of the agreement information can be omitted in the subsequent encryption processing means and decryption processing means. This speeds up the processing.

  As described above, according to the present invention, the agreement information storage means includes both a destination address and a transmission source address that are keys of the agreement information, not only a single value address but also a plurality of addresses. Since it can be specified in groups, setting and management become easy.

(First embodiment)
A cryptographic processing apparatus according to a first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a functional block diagram of the cryptographic processing apparatus. In this embodiment, it is assumed that the above-described IPsec is used as a protocol for encrypted communication.

  As shown in FIG. 1, the cryptographic processing device 100 relays IP packets transmitted and received between the connected terminal device 1 and the counterpart device 2. Here, the cryptographic processing device 100 does not encrypt the IP packet between the terminal device 1 and the cryptographic processing device 100, and encrypts the packet passing through the network 3 between the terminal device 1 and the counterpart device 2. Operate. That is, the cryptographic processing apparatus 100 provides a cryptographic communication service to the terminal apparatus 1 that does not have a cryptographic processing function.

  The configuration of the cryptographic processing apparatus 100 will be described with reference to FIG. As shown in FIG. 1, the cryptographic processing apparatus 100 includes a terminal interface 101 for connecting to the terminal apparatus 1 and a terminal interface 102 for connecting to the network 3. Further, the cryptographic processing apparatus 100 includes an application condition storage unit 111 that stores application conditions (security policy) for cryptographic processing, and an agreement information storage unit 112 that stores agreement information (SA information) used in cryptographic processing. .

  An example of the agreement information stored in the agreement information storage unit 112 is shown in FIG. The agreement information storage unit 112 has a database corresponding to the direction of the packet, and specifically includes an input database and an output database as shown in FIG. Application conditions for packets received from the network 3 are stored in the input database, and application conditions for packets received from the terminal device 1 are stored in the output database. The format of the input database and the output database is common.

  The agreement information storage unit 112 stores agreement information used in encryption processing for a packet matching the address set, using the set of the source address and the destination address as a key. A characteristic point of the present invention is that both the source address and the destination address can be stored as an address group. Examples of the address group include (address range (upper limit value and lower limit value), network address, wild card address) and the like. In this embodiment, the network address is stored at the end of the IP address in the format of “/ bit number”. As shown in FIG. 2, the agreement information includes various information such as SPI (Security Parameter Index), ESP (Encapsulating Security Payload) / AH (Authentication Header), and encryption keys used in encryption processing. Used. The agreement information storage means 112 stores each agreement information in order. In the example of FIG. 2, it is shown that the lines are ordered in the upper and lower directions, and the rank is higher in the upper line.

  An example of application conditions stored in the application condition storage unit 111 is shown in FIG. The application condition storage unit 111 has a database corresponding to the direction of the packet, and specifically includes an input database and an output database as shown in FIG. The input database stores agreement information for packets received from the network 3, and the output database stores agreement information for packets received from the terminal device 1. The format of the input database and the output database is common.

  Similar to the agreement information storage unit 112, the application condition storage unit 111 is information that determines what processing is performed on a packet that matches the set of the source address and the destination address as a key. Memorize certain application conditions. Further, similar to the agreement information storage unit 112, the application condition storage unit 111 can store both the transmission source address and the destination address as an address group. Moreover, as an application condition, as shown in FIG. 3, Mode, Action etc. which process with respect to the packet which met this application condition are mentioned. In addition, the application condition storage unit 111 stores the application conditions in order as in the agreement information storage unit 112. In the example of FIG. 3, it indicates that the lines are ordered in the upper and lower directions, and the upper line has a higher rank.

  Further, as shown in FIG. 1, the cryptographic processing device 100 refers to the application condition stored in the application condition storage unit 111 for the packet received from the terminal device 1, and the encryption determination unit 121 determines the processing content. An encryption processing unit 122 that performs encryption processing with reference to the agreement information stored in the agreement information storage unit 112 with respect to the packet that is determined to be encrypted by the encryption determination unit 121; 2, it is determined that the decryption determination unit 131 that determines the processing content of the application condition stored in the application condition storage unit 111 for the packet received from the network 3 through the network 3, and the decryption determination unit 131 performs decoding. A decryption processing unit 132 that performs decryption processing on the received packet with reference to the agreement information stored in the agreement information storage unit 112, and a decrypted packet. And a reception packet determining unit 133 for determining a decision to process contents.

  The encryption determination unit 121 and the decryption determination unit 131 are the source IP address of each application condition in which the source IP address and the destination IP address of the IP header of the input packet are stored in the application condition storage unit 111, respectively. Whether the destination IP address matches or partially matches with the destination IP address is determined according to the order, the application condition that first matches or partially matches is acquired from the application condition storage unit 111, and the process is determined according to the processing content included in the application condition To do. For example, if the processing content is transparent, the packet is passed through without encryption / decryption. If the processing content is discarded, the packet is discarded. Further, if the processing content is encryption / decryption, the packet is transferred to the subsequent encryption processing means 122 or decryption processing means 132. The encryption determination unit 121 refers to the output database of the application condition storage unit 111, and the decryption determination unit 131 refers to the input database.

  Address matching and partial matching will be described with reference to the example of FIG. For example, “2001: DB8: 9abc: def0: 1234: 5678: 9abc: def0 / 128” on the first line of the input database in FIG. 2 is an IPv6 address having a prefix length of 128 bits, so only the same address is applicable (match). . Also, since “010.056.078.090/32” in the second line is an IPv4 address having a prefix length of 32 bits, only the same address is applicable (match). Since “2001: DB8: 9abc: def0 :: / 64” in the third line is an IPv6 address having a prefix length of 64 bits, an address where the front 64 bits match (partial match) corresponds. Since “010.078.090.0/28” in the fourth line is an IPv4 address having a prefix length of 28 bits, an address where the front 28 bits match (corresponds partially). “:: / 0” in the fifth line matches the forward 0 bits of IPv6, that is, all (wildcard) IPv6 addresses correspond (partial match). “0.0.0.0/0” in the sixth row matches the forward 0 bits of IPv4, that is, all (wildcard) IPv4 addresses correspond (partial match).

  The encryption processing unit 122 and the decryption processing unit 132 are configured so that the transmission source IP address and the destination IP address of the IP header of the input packet are the transmission source IP addresses of the agreement information stored in the agreement information storage unit 112, respectively. And the destination IP address are determined in accordance with the order, and agreement information that first matches or partially matches is acquired from the agreement information storage unit 112, and encryption processing or decryption processing is performed using the agreement information. I do. The encryption processing unit 122 refers to the output database of the agreement information storage unit 112, and the decryption processing unit 132 refers to the input database.

  The received packet determining unit 133 determines handling of the packet by referring to the payload of the received packet decoded by the decoding processing unit 132, and processes the packet based on the determination. In this determination processing, processing is performed based on the application conditions stored in the application condition storage unit 111 in the same manner as the decoding determination unit 131.

  Next, the operation of the cryptographic processing apparatus 100 according to the present embodiment will be described with reference to the drawings. First, encryption or decryption application determination processing for a packet received by the cryptographic processing apparatus 100 will be described with reference to the flowchart of FIG.

  When a packet is input to the cryptographic processing apparatus 100 (step S1), if the direction of the packet is input (in-bound), the decryption determination unit 131 is stored in the packet address and application condition storage unit 111. It is determined whether the address of the application condition matches or partially matches (steps S2 and S3), and if the direction of the packet is output (out-bound), the encryption determination unit 121 uses the address of the packet and the application condition storage unit It is determined whether the address of the application condition stored in 111 matches or partially matches (steps S2 and S4). Then, the decryption determination unit 131 or the encryption determination unit 121 executes a process according to the processing content acquired from the application condition storage unit 111 (step S5), and the subsequent decryption processing unit 132 or the encryption processing unit 122. Etc. (step S6).

  Next, application determination processing for encryption processing or decryption processing will be described with reference to the flowchart of FIG. First, when a packet is input (step S11), if the direction of the packet is input (in-bound), the decryption processing unit 132 agrees with the address of the packet and the agreement information stored in the agreement information storage unit 112. Is coincident or partial coincidence (steps S12 and S13), and if the direction of the packet is output (out-bound), the encryption processing means 122 stores the address of the packet in the agreement information storage means 112. It is determined whether the addresses of the agreement information being matched match or partially match (steps S12 and S14). Then, the decryption processing unit 132 or the encryption processing unit 122 executes the decryption processing or the encryption processing according to the agreement information acquired from the agreement information storage unit 112 (Step S15), and outputs a packet (Step S15). S16).

  As described above, according to the cryptographic processing apparatus 100 according to the present embodiment, both the destination IP address and the source IP address can be stored as a group of addresses as a key for each piece of agreement information stored in the agreement information storage unit 112. This makes it easy to set and manage agreement information.

(Second Embodiment)
Next, a cryptographic processing apparatus according to the second embodiment of the present invention will be described with reference to the drawings. FIG. 6 is a functional block diagram of the cryptographic processing apparatus. The cryptographic processing apparatus according to the present embodiment is different from the first embodiment in that data managing each data stored in the application condition storage means 111 and the agreement information storage means 112 as shown in FIG. The management means 141 is provided. Since other configurations are the same as those in the first embodiment, only the differences will be described here.

  The data management unit 141 is an interface that provides a management service for each data stored in the application condition storage unit 111 and the agreement information storage unit 112. Specifically, the input data from the outside is applied to the application condition storage unit 111. Alternatively, it is added to the agreement information storage unit 112, or the data stored in the application condition storage unit 111 or the agreement information storage unit 112 is deleted. Here, for example, the input data may be received from the terminal device 1 or from the network 3 side. For example, a portable storage medium may be attached to the cryptographic processing apparatus 100 and input from the storage medium. May be.

  A characteristic feature of the data management unit 141 is that the order of each data stored in the application condition storage unit 111 and the agreement information storage unit 112 is automatically managed. That is, as described above, the destination IP address and the source IP address that are keys of each data can specify not only a single value address but also an address group, but each data in each storage means 111 and 112 Order management (that is, rearrangement processing) is performed so that the smaller the sum of the number of addresses included in the destination IP address and the number of addresses included in the source IP address is, the higher. In this embodiment, since each address is represented by a set of an address and a prefix length, the data management unit 141 uses the prefix length of the destination IP address and the transmission source IP for each data in each storage unit 111 and 112. The order is managed so that the higher the prefix length of the address, the higher the order. As a result, each means such as the encryption judgment means 121 preferentially obtains data having a large number of matching bits with respect to the input packet, so that the longest matching algorithm (Longest Match) is followed.

  The operation of the data management unit 141 will be described with reference to the flowchart of FIG. When data (information) is input from the outside (step S21), the data management means 141, when the data relates to the input direction, the prefix length of the destination IP address and the prefix length of the source IP address The ranking is determined based on the sum (step S22), and the data is stored in the input database of the application condition storage unit 111 or the agreement information storage unit 112 (step S23). On the other hand, if the data is related to the output direction, the rank is determined based on the sum of the prefix length of the destination IP address and the prefix length of the transmission source IP address (step S24), and the data is applied condition storage means. 111 or the output database of the agreement information storage means 112 (step S25).

  According to the cryptographic processing apparatus according to the present embodiment, the ordering of the data stored in the application condition storage unit 111 and the agreement information storage unit 112 is automatically processed, that is, the data is automatically arranged. Since replacement processing is performed, setting and management can be easily performed. Other operations and effects are the same as those in the first embodiment.

(Third embodiment)
Next, a cryptographic processing apparatus according to the third embodiment of the present invention will be described with reference to the drawings. The cryptographic processing apparatus according to the present embodiment is different from the second embodiment in the operation of the data management unit 141. Since other configurations are the same as those of the second embodiment described with reference to FIG. 6, only the differences will be described here.

  The data management unit 141 according to the present embodiment is arranged such that each data in the input database of the application condition storage unit 111 and the agreement information storage unit 112 is higher as the number of addresses included in the destination IP address is smaller. Order management (that is, rearrangement processing) is performed, and for each data in the output database, order management is performed so that the smaller the number of addresses included in the source IP address, the higher the order. Further, for each data in the input database of each storage unit 111 and 112, the order relationship between data having the same number of addresses included in the destination IP address is higher as the number of addresses included in the source IP address is smaller. The order is managed so that Similarly, for each data in the output database of each storage unit 111 and 112, regarding the order relationship between data having the same number of addresses included in the source IP address, the smaller the number of addresses included in the destination IP address is The order is managed so that it becomes higher. In the present embodiment, since each address is represented by a set of an address and a prefix length, the data management means 141 performs order management based on the prefix length of each data as in the second embodiment. Do.

  The operation of the data management unit 141 will be described with reference to the flowchart of FIG. When data (information) is input from the outside (step S31), the data management unit 141 performs rank determination based on the prefix length of the destination IP address when the data relates to the input direction (step S32). ), The data having the same prefix length of the destination IP address is further judged based on the prefix length of the source IP address (step S33), and the data is input to the application condition storage means 111 or the agreement information storage means 112. Store in the database (step S34). On the other hand, if the data relates to the output direction, the rank is determined based on the prefix length of the transmission source IP address (step S35), and for the data having the same prefix length of the transmission source IP address, the destination IP address is further determined. Is determined based on the prefix length (step S36), and the data is stored in the output database of the application condition storage means 111 or the agreement information storage means 112 (step S37).

  According to the cryptographic processing apparatus according to the present embodiment, the ordering of the data stored in the application condition storage unit 111 and the agreement information storage unit 112 is automatically processed, that is, the data is automatically arranged. Since replacement processing is performed, setting and management can be easily performed. Other operations and effects are the same as those in the first embodiment.

(Fourth embodiment)
Next, a cryptographic processing apparatus according to a fourth embodiment of the present invention will be described with reference to the drawings. FIG. 9 is a functional block diagram of the cryptographic processing apparatus.

  The cryptographic processing apparatus according to the present embodiment is different from the first embodiment in that the application condition storage unit 111 and the agreement information storage unit 112 are linked to each other as shown in FIG. More specifically, each data stored in the application condition storage unit 111 and each data stored in the agreement information storage unit 112 are linked with respect to a destination IP address and a transmission source IP address that match. . Thus, when the application condition is acquired from the application condition storage unit 111 using the destination IP address and the transmission source IP address as keys, the agreement information of the key can be acquired from the agreement information storage unit 112 at that time.

  When the encryption determination unit 121 and the decryption determination unit 131 acquire the application condition from the application condition storage unit 111 using the destination IP address and the transmission source IP address as keys, the encryption determination unit 121 and the decryption determination unit 131 acquire agreement information of the same key together with the application condition. Then, the agreement information is passed to the subsequent encryption processing means 122 or decryption processing means 132. The encryption processing unit 122 and the decryption processing unit 132 encrypt or decrypt using the agreement information received from the preceding encryption determination unit 121 or the decryption determination unit 132 without accessing the agreement information storage unit 112. Perform the process.

  According to the cryptographic processing apparatus according to the present embodiment, the number of steps for acquiring the application condition and the agreement condition is reduced, so that the processing speed can be increased. Other functions and effects are the same as those of the first embodiment.

  Although the present embodiment has been described as a modification of the first embodiment, the same modification as the present embodiment can be applied to the second or third embodiment.

  Although the first to fourth embodiments of the present invention have been described in detail above, the present invention is not limited to this. For example, in the second and third embodiments, the application information stored in the application condition storage unit 111 and the agreement information stored in the agreement information storage unit 112 are used as a destination IP address and a transmission source IP address. However, it is not always necessary to rearrange according to the rule. That is, the application information stored in the application condition storage unit 111 and the agreement information stored in the agreement information storage unit 112 may be arbitrarily rearranged. This enables flexible network design and operation.

  In the third embodiment, the application information stored in the application condition storage unit 111 and the agreement information stored in the agreement information storage unit 112 are used as the destination IP address that is a key for each data in the input database. Priority was given to those with a small number of addresses (those with a long prefix length), and for data in the output database, priority was given to those with a small number of addresses included in the key source IP address. For each data in the input database, priority is given to those with a small number of addresses included in the source IP address as a key, and for each data in the output database, priority is given to those with a small number of addresses included in the destination IP address as a key You may make it do.

  In each of the above embodiments, processing is performed using the destination IP address and the source IP address of the IP packet as a key. However, in addition to the destination IP address and the source IP address, a TCP that is an upper layer of the IP packet is used. Alternatively, the UDP port number (source / destination) may be used as a key. As a result, a more detailed network design is possible.

  In each of the above embodiments, the application condition storage unit 111 and the agreement information storage unit 112 are provided with an input database and an output database, respectively, according to the direction of the packet. May be managed. Furthermore, in each of the above embodiments, the application condition and the agreement information are stored in separate storage means, but may be managed collectively by a common storage means.

  In each of the above embodiments, IPsec is exemplified as the encryption processing protocol. However, the present invention can be implemented even with other protocols.

Functional block diagram of the cryptographic processing apparatus according to the first embodiment An example of agreement information stored in the agreement information storage means An example of application conditions stored in the application condition storage means Flow chart explaining the flow of application determination Flowchart explaining the flow of encryption / decryption processing Functional block diagram of the cryptographic processing apparatus according to the second embodiment Flow chart explaining the flow of data input Flow chart explaining the flow of data input Functional block diagram of the cryptographic processing apparatus according to the fourth embodiment

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Terminal device, 2 ... Partner apparatus, 3 ... Network, 100 ... Cryptographic processing apparatus, 101 ... Terminal interface, 102 ... Network interface, 111 ... Application condition storage means, 112 ... Agreement information storage means, 121 ... Encryption Determining means, 122 ... Encryption processing means, 131 ... Decryption determining means, 132 ... Decryption processing unit, 133 ... Received packet determining means, 141 ... Data management means

Claims (5)

A packet transmitted from the terminal device on the first network side to the partner device on the second network side is encrypted and relayed to the partner device, and an encrypted packet addressed to the terminal device is decrypted from the partner device. In the cryptographic processing device relaying to the terminal device,
Application condition storage means for storing application conditions of encryption processing and decryption processing for packets in order with a destination address and a source address as a key;
Agreement information storage means for storing agreement information used in packet encryption processing and decryption processing in order using a destination address and a source address as a key;
Encryption determination means for acquiring application conditions in order from the application condition storage means using the destination address and source address of the packet received from the first network side as keys, and determining the processing content for the packet based on the application conditions; ,
A cipher that obtains agreement information from the agreement information storage means according to the order using the destination address and source address of the packet that has been determined to be encrypted by the encryption determination means as a key, and performs packet encryption processing based on the agreement information The processing unit,
Decryption that obtains application conditions from the application condition storage means in order using the destination address and source address of the encrypted packet received from the second network side as keys, and determines the processing content for the encrypted packet based on the application condition A determination means;
Decoding that obtains agreement information from the agreement information storage means in the order using the destination address and source address of the packet determined to be decrypted by the decryption judgment means as a key, and performs packet decryption processing based on the agreement information And processing unit,
The agreement information storage means can store both a destination address and a transmission source address stored as a key of agreement information in an address group including a plurality of addresses,
The encryption processing unit and the decryption processing unit acquire agreement information in which both the destination address and the transmission source address of the packet are completely or partially matched from the agreement information storage unit according to an order. . The application information stored in the application condition storage means and the agreement information stored in the agreement information storage means are ordered so that the smaller the number of addresses included in the key destination address and the transmission source address, the higher the order. The cryptographic processing apparatus according to claim 1, further comprising a management unit that rearranges the scrambler. The application information stored in the application condition storage means and the agreement information stored in the agreement information storage means, the number of addresses included in the source address as a key for the application information or agreement information used in the decryption process Management means that rearranges the order so that the lower the number of addresses, the higher the order, and the application information or the agreement information used in the encryption process, the lower the number of addresses included in the key destination address, the higher the order. The cryptographic processing apparatus according to claim 1, wherein: The application information stored in the application condition storage means and the agreement information stored in the agreement information storage means are the number of addresses included in the destination address that is a key for the application information or the agreement information used in the decryption process. Management means for rearranging the order so that the smaller the number, the higher the order, and the application information or agreement information used in the encryption process, the lower the number of addresses included in the key transmission source address, the higher the order. The cryptographic processing apparatus according to claim 1, wherein: The agreement information storage means and the application condition storage means are associated with each other using a destination address and a source address as keys,
The encryption determination unit and the decryption determination unit acquire agreement information associated with the application condition when acquiring the application condition from the application condition storage unit,
The encryption processing means and the decryption processing means perform encryption processing or decryption processing using the agreement information acquired by the preceding encryption determination means or decryption determination means. The cryptographic processing device according to claim 1.

Images