JP4405440B2 - Communication method and communication apparatus - Google Patents

Description

  The present invention relates to a communication method and a communication apparatus, and in particular, a communication method capable of dynamically generating a security policy by IKE, which is a key exchange protocol, when applying IPsec to an IP communication network that requires reliability. And a communication apparatus.

  A communication system comprising: a communication device; an IP (Internet Protocol) communication network to which the communication device is connected; and a communication device connected to the IP communication network and exchanging communication data with the communication device. In general, in order to realize secure communication, communication is performed after establishing SA (Security Association) between communication apparatuses that perform communication. The SA is a secure communication path, and enables data to be protected by the SA to be protected from snooping and tampering by others.

On the other hand, as a protocol capable of automatically generating and exchanging a secret key for encryption and authentication between two communication devices that perform communication, IKE (Internet Key Exchange) described in Non-Patent Document 1 or the like is used. The SA generated by this IKE includes ISAKMPSA (Internet Security Association and Key Management Protocol Security Association) generated in phase 1 and IPsec SA (IP security protocol Security Association) generated in phase 2 It is comprised by two. Data necessary for establishing IPsec SA is protected by ISAKMPSA and communicated.
IETF (The Internet Engineering Task Force), “The Internet Key Exchange (IKE)”, [online], [searched on September 1, 2004], Internet <URL: http://www.ietf.org/rfc/ rfc2409.txt>

  IKE, which is an Internet key exchange protocol according to the prior art, aims to secure security by dynamically generating an IPsec SA so that the same key is not used permanently, in order to apply the generated IPsec SA. In addition, a selector as a security policy composed of a source IP address or a source IP network address, a destination IP address or a destination IP network address, an upper layer protocol, a source port, and a destination port between communication devices is set in advance. It is necessary to store the data in the storage device of the communication device that performs the IKE and the communication partner device.

  For this reason, in the communication system using the IKE according to the above-described conventional technology, the IPsec SA generated by the IKE is applied to each piece of communication data exchanged between a certain communication device and a communication device that is an unspecified number of communication partners. When necessary, it is necessary to store a security policy that serves as a selector with the communication partner that may cause the exchange of communication data in the storage means for each communication partner, and a large amount of storage capacity is required in a fixed manner. In addition, there is a problem that a large amount of storage capacity is required in a fixed manner even when communication data including IKE is not actually exchanged. In addition, a communication device that is connected to a communication network in which a communication device that dynamically assigns an IP address exists and dynamically assigns the assigned IP address cannot store the security policy in the storage unit in advance. Has the problem.

  The object of the present invention is to solve the above-mentioned problems of the prior art, omit the storage of security policy in the storage means in the communication device connected to the communication network to which IPsec is applied, and perform the presetting associated with this omission. The storage capacity occupied as selector information can be reduced to enable efficient use of the storage device. Furthermore, IPsec can be used for communication devices that expect to be assigned an IP address by dynamically assigning an IP address. An object of the present invention is to provide a communication method and a communication apparatus that can be applied.

According to the present invention, the object is that a plurality of communication devices are connected to a communication network, one of the plurality of communication devices is a communication subject, and one of the other communication devices is a communication partner to communicate between the communication devices. In the communication method for exchanging data, the communication device serving as the communication subject uses IKE, which is an Internet key exchange protocol, to apply IPsec to communication data exchanged with a communication device serving as a communication partner. When establishing an IPsec SA, the communication device serving as the communication subject, in addition to the IPsec SA determined by the IKE phase 2, the IP address or the IP network address of the communication device serving as a communication subject that exchanges communication data using IPsec SA And the IP address or IP network address of the communication device that is the communication partner, And Tokoru, a source port, identifies the selector consists of information of the destination port, dynamically generates a security policy by dynamically generating the IPsecSA and selector dynamically the selector When generating, if the same selector as the selector already exists in the storage means of the communication device that is the communication subject, it is achieved by rejecting the generation of duplicate selectors and dynamically generating only IPsec SA. .

In addition, the purpose is to exchange communication data between communication devices by connecting a plurality of communication devices to a communication network, one of the plurality of communication devices being a communication subject, and one of the other communication devices being a communication partner. Communication device
In order to establish IPsec SA using IKE, which is an Internet key exchange protocol, the communication device serving as the communication subject applies IPsec to communication data exchanged with a communication device serving as a communication partner. In addition to the IPsec SA determined by the above, the IP address or IP network address of the communication device that is the communication subject that exchanges communication data using the IPsec SA, the IP address or IP network address of the communication device that is the communication partner, A selector configured by information of a layer protocol, a source port, and a destination port is specified, and a security policy is dynamically generated by dynamically generating an IPsec SA and a selector. The same selector as the selector is already When present in the storage means of the communication device serving as, reject the creation of duplicate selector is achieved by having a means for dynamically generating only IPsecSA.

  According to the present invention, a security policy, which is a selector for determining in advance whether or not IPsec is applied, between communication devices that exchange or transfer communication data is stored in advance in the storage unit of the communication device. Without limitation, IPsec SA generation using IKE and communication using IPsec SA are possible.

  Embodiments of a communication method and a communication apparatus according to the present invention will be described below in detail with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of a communication system including a communication apparatus according to an embodiment of the present invention. In FIG. 1, reference numeral 1 denotes a communication apparatus (hereinafter simply referred to as communication entity), 2 is a communication apparatus (hereinafter simply referred to as communication partner), 10 is an IKE processing unit, and 11 is an IKE phase 1 process. , IKE phase 2 processing unit, 13 selector setting processing unit, 14 IPsec SA setting processing unit, 20 security policy management unit, 21 selector storage unit, 22 IPsec SA storage unit, 30 communication interface, 40 A communication network 90 is a storage means. As elements constituting the selector storage unit, a source address / source network address 21-1, a destination address / destination network address 21-2, an upper layer protocol 21-3, an upper layer protocol source port 21-4, An upper layer protocol destination port 21-5 is used.

  In the communication system shown in FIG. 1, when establishing an IPsec SA by IKE, a communication subject 1 that is a device that receives an establishment request and a communication partner 2 that is a device that makes an establishment request are connected by a communication network 40. Has been configured. The communication system shown in FIG. 1 is shown as a configuration in which only the communication subject 1 and the communication partner 2 are connected to the communication network 40. However, in the present invention, a number of communication devices are connected to the communication network 40. One communication device serves as a communication subject, and any one of the other communication devices serves as a communication partner to exchange data with each other. Each of the plurality of communication devices may be capable of dynamically setting the IP address of the own communication device, or may be one in which the IP address is fixedly set. Further, all communication devices including the communication main body 1 and the communication partner 2 are each configured as a computer including at least a memory serving as a storage unit used when performing arithmetic processing and an arithmetic device performing the arithmetic processing. The Further, the memory may be configured by a RAM (Rondom Access Memory) or the like, and the arithmetic device may be configured by a CPU (Central Processing Unit). In the embodiment of the present invention, the arithmetic device executes a program on the memory. It is realized by doing.

  In the above description, the communication subject 1 includes the communication interface 30 that communicates IKE data with the communication partner 2, the IKE processing unit 10 that transmits and receives the actual IKE, and the security policy management unit 20 that stores information generated by the IKE. And is configured.

  The IKE processing unit 10 includes an IKE phase 1 processing unit 11 that performs data transmission / reception and data processing in IKE phase 1, an IKE phase 2 processing unit 12 that performs data transmission / reception and data processing in IKE phase 2, and IKE phase 2. An IPsec SA setting processing unit 14 for setting the established IPsec SA information and a selector setting processing unit 13 for setting the selector information from the IPsec SA information established by the IKE phase 2 are provided.

  The security policy management unit 20 includes a selector storage unit 21 that stores information generated by the selector setting processing unit 13 and an IPsec SA storage unit 22 that stores information generated by the IPsec SA setting processing unit 14. It is stored and configured inside.

  Further, although the communication partner 2 does not show the details of its configuration, it may be configured exactly the same as the communication subject 1.

  FIG. 2 is a sequence chart and flowchart for explaining the processing operation in the embodiment of the present invention for performing processing for storing the IPsec SA and the selector generated by IKE phase 2 in the storage means as a security policy. Next, this will be explained. . FIG. 2 shows the components in each apparatus in the upper part of the drawing so that it is easy to understand which component is being processed. It is assumed that the communication partner 2 is a communication device in which authentication of the partner has been normally performed by the IKE phase 1 process.

(1) In the communication partner 2 that starts the IKE phase 2, first, the IKE processing unit 10 transmits an IKE phase 2 first message in order to propose an IPsec SA. Note that the IKE phase 2 first message is provided with an ID payload serving as the source address of the selector and an ID payload serving as the destination address for the case where the selector is insufficient as an IPsec SA selector (step S11). .

(2) When the communication subject 1 receives the IKE phase 2 first message, the IKE phase 2 processing unit 12 selects one content of the IPsec SA proposed by the communication partner 2 and is necessary for the configuration of the IPsec SA and the selector. The source IP address or source IP network address, destination IP address or destination IP network address, upper layer protocol, source port, destination port are saved, and the selected result is used as the IKE phase 2 second message. It transmits to the communication partner 2 (steps S12 and S13).

(3) Upon receiving the IKE phase 2 second message, the communication partner 2 transmits the IKE phase 2 third message as a response confirmation (step S14).

(4) When the communication subject 1 receives the IKE phase 2 third message and confirms its normality, the selector setting processing unit 13 issues a request for setting the saved selector information to the security policy management unit 20. This is performed (step S15).

(5) The security policy management unit 20 performs duplication verification to determine whether the content of the requested selector already exists in the storage unit, and if there is no duplication, stores the selector information in the selector storage unit 21. (Steps S16 and S17).

(6) If the content of the requested selector already exists in the storage means in the verification in step S16, the generation of duplicate selectors is rejected and the selector information is not stored in the selector storage unit. In this case, only IPsec SA can be dynamically generated.

(7) Next, in the communication subject 1, the IPsec SA information setting processing unit 14 requests the security policy management unit 20 to set the saved IPsec SA information (step S18).

(8) The security policy management unit 20 stores the contents of the requested IPsec SA in the IPsec SA storage unit 22 (step S19).

  In the embodiment of the present invention described above, the format of the IP address serving as selector information may be either IPv4 (Internet Protocol version 4) or IPv6 (Internet Protocol version 6).

  The processing in the above-described embodiment of the present invention can be configured as a program, and the program can be provided by being stored in a recording medium such as FD, CD, MO, or DVDROM.

  According to the above-described embodiment of the present invention, the security policy is dynamically generated by the IKE process every time communication is performed between the communication apparatuses. The need to store the policy in advance can be eliminated, and the load on the storage device, for example, the security policy search load can be reduced.

  In addition, according to the above-described embodiment of the present invention, since the security policy is dynamically generated by the IKE process every time communication is performed between the communication apparatuses, data can be exchanged with an unspecified number of communication partners. Even in the case of exchanging, it is possible to perform communication by applying IPsecSA dynamically generated by IKE for each communication. Even if the communication device is a device to which the IP address is dynamically assigned, it is not necessary to store the security policy with the selector in the storage means in advance, and the security policy is dynamically changed every time communication is performed. It is possible to generate and perform communication using IPsec SA.

  Furthermore, according to the above-described embodiment of the present invention, when a security policy is dynamically generated, if the same selector as the selector already exists in the storage unit of the communication device, the generation of a duplicate selector is rejected. Therefore, it is possible to prevent a security policy that becomes the same selector from being generated and the storage capacity of the storage destination from being compressed.

  As an embodiment, when IKE is applied to communication data between a mobile agent using Mobile IPv6 and a mobile node, the present invention is applied, and IPsec SA generation by IKE is performed without setting a security policy in advance for each partner. realizable.

It is a block diagram which shows the structure of the communication system comprised with the communication apparatus by one Embodiment of this invention. It is the sequence chart and flowchart explaining the processing operation in embodiment of this invention which performs the process which stores the IPsecSA produced | generated by IKE phase 2 and a selector as a security policy in a memory | storage means.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Communication apparatus used as communication subject 2 Communication apparatus used as communication partner 10 IKE processing unit 11 IKE phase 1 processing unit 12 IKE phase 2 processing unit 13 Selector setting processing unit 14 IPsec SA setting processing unit 20 Security policy management unit 21 Selector storage unit 22 IPsec SA storage unit 30 communication interface 40 communication network,
90 storage means

Claims (3)

In a communication method in which a plurality of communication devices are connected to a communication network, one of the plurality of communication devices serves as a communication subject, and one of the other communication devices serves as a communication partner to exchange communication data between the communication devices.
When the communication device serving as the communication entity establishes IPsec SA using IKE, which is an Internet key exchange protocol, in order to apply IPsec to communication data exchanged with a communication device serving as a communication partner, the communication In addition to IPsec SA determined by IKE phase 2, the main communication device is an IP address or an IP network address of a communication device that is a communication main body that exchanges communication data using IPsec SA, and a communication device that is a communication partner The security policy is activated by specifying the selector consisting of the IP address or IP network address, higher layer protocol, source port, and destination port information, and dynamically generating the IPsec SA and selector. generated by, when dynamically generating said selector, said When the same selectors and selector already exists in the storage means of the communication device as a communication partner, refused to produce duplicate selector, communication method characterized by dynamically generate only IPsecSA. Each of the plurality of communication devices connected to the communication network, according to claim 1 Symbol placement communication method characterized in that it is a communication device that dynamically assigns IP addresses of the own communication device. In a communication device in which a plurality of communication devices are connected to a communication network, one of the plurality of communication devices is a communication subject, and one of the other communication devices is a communication partner, and exchanges communication data between the communication devices.
In order to establish IPsec SA using IKE, which is an Internet key exchange protocol, the communication device serving as the communication subject applies IPsec to communication data exchanged with a communication device serving as a communication partner. In addition to the IPsec SA determined by the above, the IP address or IP network address of the communication device that is the communication subject that exchanges communication data using the IPsec SA, the IP address or IP network address of the communication device that is the communication partner, A selector configured by information of a layer protocol, a source port, and a destination port is specified, and a security policy is dynamically generated by dynamically generating an IPsec SA and a selector. The same selector as the selector is already When present in the storage means of the communication device serving as, refused to produce duplicate selector communication apparatus characterized by comprising means for dynamically generating only IPsecSA.

Images