JPH1188403A - Moving computer device, relay device and data transfer method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize safe communication even if a moving computer moves to any place on a network by obtaining a position on the network of a packet relay device denying passage from a return message and adding a negotiation message code. SOLUTION: The moving computer 2 does not recognize peripheral network environment when it is reconnected to a moving destination network and it transmits the packet of a plain sentence to a communication opposite party. A gateway GW 1 returns an error message to the moving computer 2 since a negotiation code required for passing through the gateway GW 1 is not added to the packet. Necessary key information is exchanged between the moving computer 2 and the gateway GW 1 and the negotiation code between routes is calculated. When the inner packet is ciphered from the moving computer 2 and the packet to which the negotiation code is added is returned to the gateway GW 1, the packet can pass through the gateway GW 1.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a mobile computer capable of performing communication by moving between networks, a relay for receiving a packet transferred on the network, determining whether or not the packet can be passed, and transferring or returning the packet. The present invention relates to an apparatus and a data transfer method.

[0002]

2. Description of the Related Art The use of computer systems has expanded rapidly and widely in various fields as computer systems have become smaller, lower in price, and network environments have been enriched, and there has been a shift from centralized systems to distributed systems. Is progressing. In particular, in recent years, in addition to the progress and spread of computer network technology in addition to the advancement and enhancement of computer systems, not only sharing of resources such as files and printers within the office, but also communication outside the office and outside the organization (e-mail , E-news, file transfer, etc.), and these have begun to be widely used. In particular, in recent years, the use of the world's largest computer network "Internet" has become widespread. External users who connect to the Internet and use published information and services, or conversely, access the Internet through the Internet On the other hand, by providing information and services, a new computer business has been developed. New technologies are being developed and deployed for the use of the Internet.

[0003] In addition, with the spread of such networks, technical development for mobile communication has been performed. In mobile communication, a user having a portable terminal and a computer moves and communicates on a network. In some cases, the position on the network is changed while performing communication, and a system for managing the changing mobile computer on the network in such communication and properly reaching the communication content is required.

In general, when performing mobile communication, a router (home agent) for managing the destination data of the mobile computer is placed in the network to which the mobile computer belongs, and when the mobile computer moves, the home agent is Send a registration message indicating the location. When the registration message is received, transmission of data addressed to the mobile computer is performed by encapsulating an IP packet addressed to the original address of the mobile computer in a packet addressed to the current location address of the mobile computer via the home agent. Of the data is controlled. For example, in FIG. 1, the mobile computer 2 originally belonging to the home network 1a
Moves to another network 1b, and the network 1c
In a case where communication is performed with another computer (CH) 3 in the home computer, a home agent (HA) is provided to the mobile computer 2.
5 performs the above role. This system is a system called Mobile IP, which is being standardized by the IETF mobile-IP working group, which is an Internet standardization organization (Reference: RFC2002, IP mo).
billiy support (C. Perkin
s)).

In the mobile IP system, when a mobile computer moves to a new destination, the handling of messages issued by the mobile computer changes depending on the network to which the mobile computer has moved.

For example, when a user moves to a network close to the home network of the mobile computer and a gateway (firewall) placed at the exit of the network allows data packets to be freely sent outside, the mobile I
Operation can be performed with P specified.

On the other hand, in a general network in which a mobile computer is treated as staying (or intruding) from the outside to the inside, it is dangerous to freely transmit a registration message issued by the mobile computer to the outside due to security considerations. Is determined to be. In this case, the mobile computer recognizes that it is currently in a network that treats itself as an intruder, performs exchange processing of negotiation messages equivalent to identification, and obtains permission to pass through to the gateway. It is necessary to transmit data packets. Further, in the subsequent data transmission, it is necessary to add a negotiation message to the gateway for communication.

In general, when a mobile computer moves to an external network exchanging security information with a home network to which the mobile computer belongs, a negotiation message for a packet relay device that relays a packet at the exit of the external network is sent. If attached, the data can thereafter be safely transferred to the home network according to the security information exchanged in advance.

On the other hand, when the mobile computer moves to an external network that has not exchanged security information with the home network to which the mobile computer belongs, the mobile computer first negotiates to the packet relay device registered in itself. The packet with the message is sent out (if the packet arrives at the relay device, the packet is then safely transferred according to the preset security information). However, also in this case, there may be a packet relay device that rejects the relay of the packet generated by the mobile computer in the middle of the route. If there is such a packet relay device, the relay device returns a packet relay rejection message to the mobile computer. On the mobile computer side, the position of the packet relay device that rejected the packet relay on the network is determined. If it is not determined whether the relay device exists, the negotiation message cannot be correctly added to the relay device.

However, the conventional mobile IP system alone does not define the routing of the mobile computer originating packet based on such dynamic negotiation, and the mobile computer also correctly attaches the negotiation message on the packet relay device side. I didn't want to send a reject message containing enough information.

[0011]

Conventionally, when a mobile computer performs communication while maintaining security, and when performing communication by moving to a network that exchanges security information with a home network, a predetermined method is used. If it followed, it could communicate correctly. However, when the mobile computer moves to a network that has not exchanged security information with the home network, the mobile computer transmits data to a packet relay device that has correctly exchanged security information with its registered home network. After arriving at the relay device, processing may be performed by a method based on registered security information. In this case as well, if a packet relay device existing in the middle of the route may refuse to relay the data packet,
The mobile computer determines whether or not the packet relay device has exchanged security information with its home network based on the rejection message from the packet relay device that rejected the data, and based on the information, negotiated a message for packet relay. Must be provided. However, in the conventional mobile IP system, the mobile computer cannot negotiate with the packet relay device that refused to relay the packet,
The packet could not reach the home network.

The present invention has been made in view of the above circumstances, and provides a mobile computer device, a relay device, and a data transfer method capable of performing secure communication regardless of where the user moves on a network. With the goal.

[0013]

Means for Solving the Problems The present invention (claim 1) provides:
A mobile computer device capable of performing communication by moving between mutually connected networks, the communication being capable of maintaining a security maintaining relationship from a network (home network) to which the own device belonged before moving. Storage means for storing address range information indicating the address range of the other party; and a destination computer in the network to which the own device belongs from the destination network in which the own device is currently located. Means for transmitting data to which negotiation information has been added to a first relay device (packet relay device; packet encryption gateway) installed in a second relay device (packet relay device; packet) on the route to the destination computer From the encryption gateway), a passage rejection message (error message) Means for comparing the address information of the second relay device with the address range information held in the storage means, and as a result of the comparison, the address information of the second relay device is If it is not included in the address range information, negotiation information for the second relay device is added before the negotiation information added to the transmission data that has been rejected, and the address of the second relay device is added. If the information is included in the address range information, after the negotiation information added to the transmission data rejected to pass, negotiation information for the second relay device is added, and the data is transmitted again. Means.

Preferably, when the passage rejection message is returned from the second relay device on the way to the data transmitted by the own device, key information for generating a mobile computer identifier in the relay device. And a means for generating the negotiation information based on the key information when the key information is returned from the relay device.

[0015] Preferably, when the negotiation information for the second relay device is added and transmitted again and it is recognized that the data has been passed by the second relay device, the data is transferred also in the subsequent data communication. The negotiation information may be added to the data and transmitted.

[0016] Preferably, the negotiation information may be a mobile computer identifier obtained by using a predetermined function (for example, a hash function) based on the contents of a predetermined portion of the transfer data and the key information. .

Preferably, the passage rejection message may include information indicating passage rejection and address information of the second relay device. Preferably,
As the address range information held in the storage unit,
The one obtained from the first relay device may be used.

The present invention (claim 7) is a relay device (packet relay device; packet encryption gateway) installed at an arbitrary point on a mutually connected network, and permits the transmission of transfer data. Storage means for holding a pass permission list including information indicating the address range of the transmission source computer, and exchanging the received data between the transmission source address corresponding to that included in the pass permission list and its own device If it contains legitimate negotiation information,
Means for removing the negotiation information and transferring the data to the next-stage relay device or destination address on the network; and If it does not include at least one of the legitimate negotiation information exchanged between, a pass reject message (error message) including the address information of its own device and information indicating pass reject,
Means for returning the data to the transmission source computer.

Preferably, when a message requesting key information for generating the negotiation information is received, a condition that must be satisfied by a transmission source computer of the message in order to accept the message and return the key information is received. Storage means for storing information indicating the key information, when receiving a message for key information from the same computer after returning the pass rejection message, when the computer is determined to satisfy the condition, the key information requested May be further provided.

Preferably, the negotiation information may be a mobile computer identifier obtained using a predetermined function (for example, a hash function) based on the contents of a predetermined portion of the transfer data and the key information. .

[0021] The present invention (claim 10) is a data transfer method in a mobile computer device capable of performing communication by moving between mutually connected networks. Transmits the data to which the negotiation information for the first relay device installed at the entrance of the network to which the own device belongs is added to the destination computer in the network to which the own device belongs, and transmits the data to the destination computer in the route to the destination computer. When a pass rejection message for the transmission data is returned from the second relay device,
The address information of the relay device is compared with the address range information indicating the range of the address of the communication partner that can communicate while maintaining the security preservation relationship from the network to which the own device belonged before moving, and as a result of the comparison, If the address information of the second relay device is not included in the address range information, the negotiation information for the second relay device is added before the negotiation information added to the transmission data that has been rejected. If the address information of the second relay device is included in the address range information, the negotiation information for the second relay device is added after the negotiation information added to the transmission data whose passage has been rejected. With
The data is transmitted again.

The present invention (claim 11) is a data transfer method in a relay device installed at an arbitrary point on an interconnected network, wherein when data to be transferred is received, a data transmission source Whether or not the address is included in the passage permission list including information indicating the range of the address of the transmission source computer that permits passage of the transfer data,
And whether the received data includes valid negotiation information exchanged between the transmission source computer and the own device. If it contains legitimate negotiation information to be exchanged with the device, the negotiation information is removed and the data is transferred to the next relay device or the destination address on the network, and the received data is transmitted through the pass permission device. If it does not include at least one of the source address corresponding to the one included in the list and the valid negotiation information exchanged with the own device, the pass includes the address information of the own device and the information indicating the refusal of passage. A rejection message is returned to the transmission source computer of the data.

The present invention relating to the apparatus is also realized as an invention relating to a method, and the present invention relating to a method is also realized as an invention relating to an apparatus. Further, the above-described invention is also realized as a machine-readable medium storing a program for causing a computer to execute a corresponding procedure or means.

According to the present invention, when a message indicating that a data packet transmitted from a destination by a mobile computer is permitted to pass by a relay device on a route is returned, the passage rejection is performed from the reply message. By determining the position of the relay device on the network and adding an appropriate negotiation message code according to the position, secure communication can be performed regardless of where the mobile computer moves on the network.

[0025]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 shows an example of a basic configuration of a communication system according to the present embodiment. It is assumed that the communication system of FIG. 1 supports communication of a mobile computer by a mobile IP (document: IETF RFC2002). The mobile IP protocol is based on the assumption that there is a router called a foreign agent that performs packet delivery in a destination network, and the mobile computer itself has a Co-Located Care functioning also as a foreign agent.
Although this mode is sometimes called -of address mode, in the present embodiment, it is assumed that there is no foreign agent on the assumption of the latter.

In FIG. 1, the home network 1a, the first network
The other department network 1b and the second other department network 1c are connected to each other via the Internet 6, and the mobile computer (MN) 2 and the communication partner host (CH) 3 of the mobile computer include: Alternatively, it is connected to the Internet 6 as an external node.

In this embodiment, the mobile computer (M) having a home position inside the network 1a of FIG.
N) 2 and its communication partner computer (CH) 3 will be mainly described for packet communication. Therefore, in FIG. 1, the network 1a is a home network, the network 1b,
1c is shown as another department home network.

The home network 1a, the first other department network 1b, and the second other department network 1c include:
Home agents (HA) 5a, 5b, and 5c for supporting the mobile IP protocol are installed respectively (however, in this embodiment, it is assumed that the mobile computer 2 originally existed in the home network, and therefore, the other department network 1b, 1c home agent 5b, 5c
Does not intervene in the explanation communication).

The networks 1a, 1b, and 1c are provided with packet relay devices 4a, 4b, and 4c that perform predetermined packet processing on input packets and transfer the packets. In the present embodiment, the packet relay device 4
It is assumed that a, 4b, and 4c have a packet encryption authentication processing function. It is assumed that the mobile computer 2 has a packet encryption authentication processing function at least during movement (in the figure, the mobile computer 2 that performs packet encryption authentication processing on its own device is denoted by MN ⁺ ). Note that GW and GWi (i is a number or symbol) indicate a packet relay device (packet encryption gateway; hereinafter, abbreviated as gateway).

The encryption / decryption of communication data in the packet encryption / authentication process is described in, for example, a document (IETF).
RFC1825, 1827). In the packet encryption authentication process, the addition / check of the negotiation code with the terminal or the negotiation code with the next stage (such as the hash function value generated from the contents of the transfer packet and the generated key) is performed, for example, according to a specification called IP security It can be defined by an authenticator and a packet encryption using (Ref: IETF RFC1825-182)
9).

The gateway according to the present embodiment holds a pass permission list including a source address that permits a packet to pass. The gateway is
Packets from transmission sources not included in this passage permission list are rejected.

Further, when the gateway according to the present embodiment receives a message for key information from the mobile computer 2, the gateway computer of the message should satisfy the message in order to accept the message and return the key information. It is assumed that information indicating conditions is held.

The condition for the gateway 4b to pass the public key information to the key request message depends on the security policy managed by the gateway. For example: Check the user identification information (user affiliation information) added in a predetermined format to the key request message, and return the key information if the user is an in-house user. -If the user is outside the company, pass the key information if the user is within a predetermined organization. Otherwise, if the user is a registered user, pass the key information. Is registered in the gateway.

FIG. 2 shows a packet format processed by each gateway. (A) is a normal IP packet format. (B) is an encryption / terminal authentication format in which packet encryption and authentication are performed between terminal (terminal) gateways or between a terminal gateway and a mobile computer.

(C) is an encryption / inter-route authentication format, and this format is used when authentication between gateways on an intermediate route or between a gateway on a halfway route and a mobile computer is required.

(D) is a mobile IP format, which is a packet format in which a route is controlled by a home agent to a mobile computer. In (b) and (c) above, the key information header is header information including information for obtaining a key used for the authentication process and a key used for the decryption process on the receiving side. For example, when the key is generated from a packet processing key, a packet processing key encrypted with a master key shared between nodes performing authentication is written. In addition, information for designating an authentication algorithm, a data encryption algorithm, and a key encryption algorithm is written as needed.

The authentication header is header information including authentication data generated using a predetermined key (for example, an authentication key generated from the packet generation key). The encryption header is
Header information including information designating an algorithm for decrypting internal data (here, an internal IP header and its data portion) encrypted using a predetermined key (for example, an encryption key generated from the packet generation key). is there.

The internal IP protocol is an encapsulated packet, and includes an internal IP header including a source address and a destination address of a computer performing communication, and a data portion thereof. For example, it is in TCP, UDP format or IP format.

As the authentication data used by the gateway and the mobile computer, for example, a one-way hash function value (for example, Ke
Yed MD5 system) can be used.

A master key shared between two gateways or between a gateway and a mobile computer is:
For example, it can be generated by exchanging a secret key or deriving using a public key and a secret key (for example, Diffie-Hellman method).

Some examples of packet transfer will be described. As described above, the gateway determines whether to permit or reject the packet by referring to the pass permission list, and checks the authentication code to determine whether to permit or reject the packet. (It is assumed that both of the above conditions are satisfied.) In the following, it is assumed that the condition regarding the pass permission list is satisfied, and the description regarding the pass permission list is omitted.

First, the flow of processing when transmitting a packet to the communication partner 3 in the home network 1a when the mobile computer 2 moves to a network protected by the gateway GW will be described with reference to FIG. Here, in FIG. 3A, GW (N) is the gateway 4a of the home network 1a, GW1 is the gateway of the destination network (not shown), and GW2 to GW (N−
1) indicates a gateway in the middle of a route (not shown). Here, it is assumed that the gateways GW on the route exchange authentication key information for negotiation with each other. It is also assumed that each gateway GW knows the address range of the partner node with which it can communicate with security.

When the mobile computer 2 is reconnected to the destination network, it does not know anything about the surrounding network environment, and first, as shown in FIG. (FIG. 2A).
The gateway GW1 that has received this message returns an error message to the mobile computer 2 because the negotiation code necessary for passing through the gateway GW1 is not added to the packet.

Next, the mobile computer 2 and the gateway GW1
The necessary key information is exchanged between the two, and a negotiation code between the paths is calculated. The negotiation code between the routes is denoted by N (M, 1). In the negotiation code, M indicates a mobile computer, and values 1 to N indicate the next value of the GW.

Next, as shown in FIG.
Is transmitted to the gateway GW1 after encrypting the internal packet and adding the negotiation code N (M, 1) to the gateway GW1, the packet can now pass through the gateway GW1. Thereafter, the packets are transferred from the gateway GW2 to the gateway GW (N-1) based on the preset information. That is, the gateway GW1
Negotiation code E (M, N) between the terminal and gateway GW (N) which is the terminal in the encryption authentication of the packet
Is added to the packet, and a negotiation code N (1,2) between the routes to the next gateway GW2 is added, and the packet (in the form of FIG. 2C) is transferred. The gateway GW2 inspects and removes the negotiation code N (1,2) between the gateway GW1 and the preceding gateway GW1, and replaces it with the negotiation code N between the routes to the next gateway GW3.
(2, 3) is added, and since the negotiation code between the ends has already been added, the packet is transferred to the next gateway GW3 without performing any processing relating to the negotiation code between the ends. Thereafter, packets are similarly transferred between the gateways one after another, and finally, the gateway GW (N) transmits the negotiation code N (N-1, N) between the paths and the negotiation code E (M, N) between the terminals. The added packet arrives.

When the packet arrives at the gateway GW (N), the gateway GW (N) examines a negotiation message with the gateway GW (N-1) at the preceding stage, and extracts the packet inside. Next, when the negotiation code between the terminals is inspected, an error occurs again because the negotiation code between the terminals of the mobile computer 2 and the gateway GW (N) is not added. And the gateway GW (N)
Returns an error message including information necessary for the negotiation code between the terminals as shown in FIG. 3 (c).

Mobile computer 2 receiving the error message
Then, the negotiation code E (M, N) between the terminals with the gateway GW (N) can be calculated from the information required for the negotiation code between the terminals.

Thus, as shown in FIG. 3D, the mobile computer 2 establishes a route between the negotiation code E (M, N) at the end between the gateway GW (N) and the next-stage gateway GW2. If the packet (in the form of FIG. 2 (c)) is retransmitted with the negotiation code N (1,2) between the gateway G
The negotiation code between the routes is changed in W2 to GW (N-1), and packet transfer is performed one after another, so that the packet can correctly reach the gateway GW (N).

Then, in the gateway GW (N), the negotiation code E (M, N) between the terminals and the preceding gateway G
Negotiation code N (N-1, N-1) between the routes to W (N-1)
N) is inspected, these are removed, the internal packet (the format of FIG. 2A) is decoded, and the destination computer (CH) 3
Transfer to

Next, referring to FIG.
A description will be given of the flow of processing when transmitting a packet to the communication partner 3 (in FIG. 4, within the network 1e) when the user moves to a position that does not belong to the organization protected by the specific gateway GW.

In this case, the mobile computer 2 must be set in advance so that secure communication can be performed from the destination to at least one of the gateways GW with which the mobile computer 2 can safely communicate. That is, FIG.
Here, it is assumed that the network 1a is the home network of the mobile computer, and the networks 1d and 1e are networks capable of communicating with the home while maintaining security. In this case, information necessary for secure communication with at least one of the gateway 4a, the gateway 4d, and the gateway 4e is mounted on the mobile computer 2.

The mobile computer 2 communicates with the gateway GW
(For example, assuming the gateway 4d), the packet is transmitted in the encryption / terminal authentication format shown in FIG. The gateway 4d interprets this and proceeds to FIG.
In the same manner as in the above procedure, the packet is transferred including the authentication between the paths (the gateway 4d corresponds to the GW 1 in FIG. 3A,
The gateway 4e corresponds to the GW (N) in FIG.

By now, all the gateways G
The description has been made on the assumption that Ws exchange required security information with each other. However, generally, there may be a gateway GW that does not exchange security information.

FIG. 5 shows an example in which the mobile computer 2 moves to such a security-isolated network. 5A, the other department net is the network 1b in FIG. 1, the destination net is the home network 1a, the GW (N) is the gateway 4a of the home network 1a, and the GW 1 is the gateway 4b of the network 1b.
Shall be shown. Here, it is assumed that the gateway GW1 of the network 1b to which the mobile computer 2 has moved has not exchanged security information with the home network 1a to which the mobile computer originally belonged. It is also assumed that the mobile computer 2 has information on an address range in which the mobile device 2 can communicate while maintaining security.

First, as in the case of FIG. 4, the mobile computer 2 encrypts the internal packet to the gateway GW (N) at the entrance of the home network 1a as shown in FIG. (M, N) is transmitted (in the format of FIG. 2B). When this packet reaches the destination gateway GW1, the gateway GW1
In No. 1, since an negotiation code required for passing through the gateway GW1 is not added to the packet, an error message is returned.

Here, the error message includes the address information of the gateway GW 1 and the mobile computer 2
From this address and the address range information held by itself that can hold and communicate with security, it can be seen that this error message came from a gateway that has not exchanged security information in advance. Therefore, it is necessary to add a negotiation code for the gateway GW1 to the packet and transmit the packet.

Then, the mobile computer 2 is connected to the gateway G
The necessary key information is exchanged with W1 to calculate the negotiation code between the routes, and as shown in FIG. 5 (c) (FIG. 7 (a))
The negotiation code N (M, 1) is further added to the outside of the packet for the gateway GW (N) (see FIG. 2).
(Format of (c)).

The gateway GW1 receiving this packet
Inspects and removes the negotiation code N (M, 1),
Packet addressed to internal gateway GW (N) (FIG. 2 (b)
Format).

Here, the gateway GW supports the transfer of the packet to the outside according to the exchange of the key information for the mobile computer that does not exchange security information, when the mobile computer satisfies certain conditions. However, subsequent encryption / authentication using a negotiation code between paths is not supported.

The gateway GW receiving this packet
(N) indicates that the negotiation code E (M, N) between the terminations is inspected and removed, and the internal packet (the format of FIG. 2A)
Is decrypted and transferred to the destination computer (CH) 3.

Next, in FIG. 5, between the mobile computer 2 and the gateway GW1 and / or the gateway GW1
A case where another gateway GW exists between the gateway GW (N) and / or between the gateway GW (N) and the communication partner 3 will be described. Here, as shown in FIG. 6A, the gateway GW (P) is provided between the mobile computer 2 and the gateway GW1, the gateway GW (Q) is provided downstream of the gateway GW1, and the gateway GW is provided downstream of the gateway GW (N). The case where (S) exists will be described.

(I) First, as in the case of FIG. 5, the mobile computer 2 encrypts the internal packet and transmits the negotiation code E (M, N) to the gateway GW (N) at the entrance of the home network 1a. The added packet (the format of FIG. 2B) is transmitted.

When this packet reaches the gateway GW (P), the gateway GW (P) returns an error message because the negotiation code necessary for passing through the gateway GW (P) is not added to the packet. (FIG. 6 (b)).

Here, the error message includes the address information of the gateway GW (P), and the mobile computer 2 calculates the address based on the address and the address range information that the mobile computer 2 can hold while maintaining the security. It can be seen that this error message comes from a gateway that has not exchanged security information in advance. Therefore,
It is necessary to add a negotiation code for the gateway GW (P) to the packet and transmit the packet.

(Ii) The mobile computer 2 is a gateway GW
(P) is exchanged with necessary key information to calculate a negotiation code between the routes, and the negotiation code N (M, P) is further added to the outside of the packet for the gateway GW (N), and the packet is added. (FIG. 2C).

The gateway GW receiving this packet
(P) inspects and removes the negotiation code N (M, P), and removes the packet to the internal gateway GW (N) (FIG. 2).
(Format of (b)).

When this packet reaches the gateway GW1, the gateway GW1 returns an error message because a negotiation code required for passing through the gateway GW1 is not added to the packet (FIG. 6).
(B)).

Here, the error message includes the address information of the gateway GW 1 and the mobile computer 2
From this address and the address range information held by itself that can hold and communicate with security, it can be seen that this error message came from a gateway that has not exchanged security information in advance. Therefore, it is necessary to add a negotiation code for the gateway GW1 to the packet and transmit the packet.

(Iii) The mobile computer 2 is a gateway GW
1 to exchange necessary key information with each other to calculate a negotiation code N (M, 1) between the routes, and to negotiate with the negotiation code N (M, P) outside the packet for the gateway GW (N). The packet is transmitted with the code N (M, 1) added.

The gateway GW receiving this packet
(P) inspects and removes the negotiation code N (M, P), and transfers the packet addressed to the gateway GW (N) to which the negotiation code N (M, 1) is added.

The gateway GW1 receiving this packet
Inspects and removes the negotiation code N (M, 1),
A packet addressed to the internal gateway GW (N) is transferred.
When the packet reaches the gateway GW (Q), the gateway GW (Q) adds the packet to the gateway G (Q).
Since a negotiation code required for passing through W (Q) is not added, an error message is returned (FIG. 6).
(B)).

Here, the error message includes the address information of the gateway GW (Q), and the mobile computer 2 calculates the address based on the address and the address range information that the mobile computer 2 can hold while maintaining the security. It can be seen that this error message comes from a gateway that has not exchanged security information in advance. Therefore,
It is necessary to add a negotiation code for the gateway GW (Q) to the packet and transmit the packet.

(Iv) The mobile computer 2 is a gateway GW
(Q), necessary key information is exchanged to calculate the negotiation code N (M, Q) between the routes, and as shown in FIG. 7 (b), the outside of the packet to the gateway GW (N) is calculated. A negotiation code N (M, P), a negotiation code N (M, 1) and a negotiation code N (M, Q) are added to the packet and the packet is transmitted (FIG. 6 (c)).

Gateway GW receiving this packet
(P) inspects and removes the negotiation code N (M, P), and negotiates with the negotiation code N (M, 1) and N (M, P).
The packet addressed to the gateway GW (N) to which Q) is added is transferred (FIG. 6C).

The gateway GW1 receiving this packet
Inspects and removes the negotiation code N (M, 1),
Gateway GW with negotiation code N (M, Q)
(N) Transfer the packet addressed to it.

Gateway GW receiving this packet
(Q) inspects and removes the negotiation code N (M, Q) and transfers the packet addressed to the internal gateway GW (N) (FIG. 6 (c)).

As described above, for the gateway GW (P), the gateway GW1, and the gateway GW (Q), a negotiation message based on the same route authentication as in the case of FIG. (P) → GW1 → GW (Q) in the order from the outside (the address information of the GW added to the error messages of these GWs does not match the security holding address information of the mobile computer 2) Therefore, by transmitting a data packet as shown in FIG. 6C, a packet addressed to the gateway GW (N) can be passed through the gateway GW (Q).

When the packet that has passed through the gateway GW (Q) reaches the gateway GW (N), the gateway GW (N) negotiates the negotiation code E between the terminals.
(M, N) is inspected and removed, the internal packet (the format of FIG. 2A) is decoded, and the destination computer (CH) 3 is decoded.
Transfer to

When the packet arrives at the gateway GW (S), the gateway GW (S) does not add a negotiation code between the terminals of the mobile computer 2 and the gateway GW (S). . Then, the gateway GW (S), as shown in FIG.
Returns an error message.

The mobile computer 2 can determine that the gateway GW (S) is in the home network and the address area where the security is maintained, based on the address range information that the mobile computer 2 can hold and communicate with.

When receiving an error message from such a gateway GW, the mobile computer 2 returns the gateway GW (in this case, G
W (S)), and change the packet format to perform inter-path authentication with the gateway GW (GW (N) in this case) that has performed terminal authentication up to that point. I do. This modified packet format is shown in FIG.
It is shown in (c).

(V) As shown in FIG. 7 (c), the mobile computer 2 encrypts the internal packet and encrypts the authentication code E (M,
S), the negotiation code N (M, P) and the negotiation code N are provided outside the packet for the gateway GW (S).
(M, 1) and negotiation code N (M, Q) and negotiation code N
(M, N) is added and the packet is transmitted (FIG. 6
(D)).

Gateway GW receiving this packet
(P) inspects and removes the negotiation code N (M, P), and negotiates with the negotiation code N (M, 1) and N (M, P).
Q) and a packet addressed to the gateway GW (N) to which the negotiation code N (M, N) is added.

Gateway GW1 receiving this packet
Inspects and removes the negotiation code N (M, 1),
A packet addressed to the gateway GW (N) to which the negotiation code N (M, Q) and the negotiation code N (M, N) are added is transferred.

Gateway GW receiving this packet
(Q) inspects the negotiation code N (M, Q) and removes it, and transfers the packet addressed to the gateway GW (N) to which the negotiation code N (M, N) is added.

Gateway GW receiving this packet
(N) inspects and removes the negotiation code N (M, N) and transfers the packet addressed to the internal gateway GW (N). Then, the gateway GW (S) inspects and removes the negotiation code E (M, S) between the terminals, decodes the internal packet (the format of FIG. 2A), and sends it to the destination computer (CH) 3. Forward.

By the way, the negotiation code with each gateway GW includes key information shared between the mobile computer 2 and the gateway GW, and a one-way hash function calculated from the contents of a predetermined part (all or part) of the internal packet. Authentication code (mobile computer identifier) such as
Further, once a pass rejection message (error message) is returned from the gateway GW in the middle of the route, a message for requesting key information for the mobile computer identifier is transmitted to the gateway GW, and the returned key information is used again. The authentication code of the mobile computer can be calculated and added to the second message as a negotiation message and transmitted.

For example, as the first message, the registration message (registration request) shown in FIG.
It is assumed that (st) has been transmitted. This message is rejected by the gateway GW on the way, and the passage rejection message (f
return message). In this case, a key inquiry message (Key request) is generated as shown in FIG. 10 using the address of the gateway GW included in the passage rejection message.

In response to this request, the key response message (Key reply) of FIG. 11 returned from the gateway.
When the key shared by the gateway GW and the mobile computer is obtained, the registration message shown in FIG. 12 is transmitted as the second message.

Since this message is addressed to the gateway that has returned the above-mentioned passage rejection message, and the message is provided with the authentication code AH for the gateway, the gateway performs an authentication process. Can pass. Note that KEY is a header including key information shared by both parties.

As described above, according to the present embodiment, when the mobile computer moves to the destination network which has no security relation with the home network to which the mobile computer originally belongs and determines the route using the negotiation code, the gateway included in the error message is used. Based on the address information, the packet can be shaped by an appropriate negotiation code assignment method, no matter where the mobile computer moves or how the gateway is arranged on the route, the correct mobile computer generation Can be processed.

The present invention is applicable not only to the mobile IP described in RFC2002 but also to various other mobile communication protocols. Further, a method other than the encryption processing and the authentication processing described in the present embodiment can be used.

Note that each of the above functions can also be realized as software. Further, the present invention can be embodied as a machine-readable medium storing a program for causing a computer to execute the above-described procedures or means. The present invention is not limited to the above-described embodiment, and can be implemented with various modifications within the technical scope.

[0094]

According to the present invention, when a message indicating that a data packet transmitted from a destination by a mobile computer has been rejected by a packet relay device on the route is returned, the message is rejected from the reply message. No matter where the mobile computer moves on the network, by calculating the location of the packet relay device on the network, and adding an appropriate negotiation message code accordingly,
Secure communication can be performed.

[Brief description of the drawings]

FIG. 1 is a diagram showing an example of a basic configuration of a communication system according to an embodiment of the present invention.

FIG. 2 is a diagram showing an example of a packet format.

FIG. 3 is a diagram for explaining a communication procedure;

FIG. 4 is a diagram for explaining a communication procedure.

FIG. 5 is a diagram for explaining a communication procedure.

FIG. 6 is a diagram for explaining a communication procedure.

FIG. 7 is a diagram showing an example of a packet format.

FIG. 8 is a diagram showing an example of a format of a registration message.

FIG. 9 is a diagram showing an example of the format of a passage rejection message.

FIG. 10 is a diagram showing an example of a format of a key inquiry message.

FIG. 11 is a diagram showing an example of a format of a key response message.

FIG. 12 is a diagram showing an example of a format of a registration message.

[Description of Signs] 1a, 1b, 1c, 1d, 1e Network 2 Mobile computer 3 Communication partner host 4a, 4b, 4c, 4d, 4e Packet relay device 5a, 5b, 5c Home agent 6 Internet

────────────────────────────────────────────────── ─── Continued on the front page (51) Int.Cl. ⁶ Identification symbol FI H04L 9/32 H04L 9/00 673B 12/66 11/20 B // G09C 1/00 660 (72) Inventor Etsuyuki Tsuda Kanagawa 1 Toshiba R & D Center, Komukai Toshiba-cho, Kawasaki-shi, Kanagawa Prefecture (72) Inventor Toshio Okamoto 1 Toshiba R & D Center, Komukai Toshiba-cho, Kawasaki-shi, Kawasaki

Claims (11)

[Claims] 1. A mobile computer device capable of performing communication by moving between mutually connected networks, wherein the mobile computer device can communicate with a security maintaining relationship from a network to which the own device belonged before moving. A storage unit for storing address range information indicating a range of addresses of a communication partner; and a destination computer in the network to which the own device belongs from a destination network in which the own device is currently located. Means for transmitting data to which the negotiation information for the first relay device installed at the entrance is added; and when a second rejection device on the route to the destination computer returns a passage rejection message for the transmission data, Means for comparing the address information of the second relay device with the address range information held in the storage means; As a result, when the address information of the second relay device is not included in the address range information,
Before the negotiation information added to the transmission data rejected to pass, negotiation information for the second relay device is added,
When the address information of the second relay device is included in the address range information, negotiation information for the second relay device is added after the negotiation information added to the transmission data that has been rejected. And a means for transmitting data again. 2. When the passage rejection message is returned from the second relay device on the way to the data transmitted by the own device, key information for generating a mobile computer identifier is transmitted to the relay device. Means for transmitting a request message; and means for, when the key information is returned from the relay device, generating the negotiation information based on the key information, further comprising: 2. The mobile computer device according to 1. 3. When the negotiation information for the second relay device is added and transmitted again, and it is recognized that the data has been passed by the second relay device, the transfer data is transmitted even in the subsequent data communication. The mobile computer device according to claim 1, wherein the negotiation information is transmitted after adding the negotiation information. 4. The mobile communication system according to claim 1, wherein said negotiation information is a mobile computer identifier obtained by using a predetermined function based on the contents of a predetermined portion of the transfer data and said key information. A mobile computer device according to any one of the preceding claims. 5. The mobile computer device according to claim 1, wherein said passage rejection message includes information indicating passage rejection and address information of said second relay device. 6. The mobile computer device according to claim 1, wherein the address range information stored in the storage unit is obtained from the first relay device. . 7. A relay device installed at an arbitrary point on a mutually connected network, wherein the relay device holds a passage permission list including information indicating an address range of a transmission source computer permitted to pass transfer data. If the received data includes the source address corresponding to the one included in the pass permission list and valid negotiation information exchanged with the own device, the negotiation information is removed. Means for transferring data to the next-stage relay device or destination address on the network, and legitimate exchange of the received data between the source address corresponding to the one included in the passing permission list or the own device. If the message does not include at least one of the negotiation information, a passing rejection message including the address information of the own device and the information indicating the passing rejection is transmitted to the data. Relay apparatus characterized by comprising a means for returning to the source computer for data. 8. When a message requesting key information for generating the negotiation information is received, a condition to be satisfied by a sender computer of the message to accept the message and return the key information is indicated. Storage means for holding information, when a message for key information is received from the same computer after returning the pass rejection message, when the computer is determined to satisfy the condition, the requested key information is The relay device according to claim 7, further comprising a returning unit. 9. The mobile communication system according to claim 8, wherein the negotiation information is a mobile computer identifier obtained by using a predetermined function based on the contents of a predetermined portion of the transfer data and the key information. Relay device. 10. A data transfer method in a mobile computer device capable of performing communication by moving between mutually connected networks, wherein the own device belongs to a destination network where the own device is currently located. To the destination computer in the network, to which the negotiation information for the first relay device installed at the entrance of the network to which the own device belongs is added, and from the second relay device on the route to the destination computer. When a pass rejection message for the transmission data is returned, the address information of the second relay device and the address of a communication partner with which communication can be performed while maintaining security from the network to which the own device belonged before moving. The address information of the second relay device is compared with the address range information indicating the range. If this is not intended to be included,
Before the negotiation information added to the transmission data rejected to pass, negotiation information for the second relay device is added,
When the address information of the second relay device is included in the address range information, negotiation information for the second relay device is added after the negotiation information added to the transmission data that has been rejected. And transmitting the data again. 11. A data transfer method in a relay device installed at an arbitrary point on an interconnected network, wherein, when data to be transferred is received, a source address of the data is passed through the transfer data. Is included in the passage permission list including information indicating the range of the address of the transmission source computer that permits the transmission, and includes valid negotiation information exchanged between the transmission source computer and the own device of the data. If the received data includes the source address corresponding to the one included in the pass permission list and valid negotiation information exchanged with the own device, the negotiation information is removed. Then, the data is transferred to the next-stage relay device or destination address on the network, and the received data corresponds to the data included in the passage permission list. If it does not include at least one of the source address or valid negotiation information exchanged with the own device, a transmission rejection message including the address information of the own device and information indicating rejection of transmission is sent to the transmission of the data. A data transfer method characterized by sending a reply to the original computer.