JP4228291B2 - Security communication method and apparatus using the same - Google Patents

Description

  The present invention is IPsec (IP Security Architecture: hereinafter simply referred to as IPsec), which is a security communication protocol that performs packet encryption and authentication in a TCP / IP (Transmission Control Protocol / Internet Protocol: hereinafter simply referred to as TCP / IP) environment. In particular, even if the IPv6 (Internet Protocol Version 6: hereinafter simply referred to as IPv6) address system is used, the change in the IPv6 address due to the movement of the terminal. The present invention relates to a security communication method capable of performing security communication using IPsec regardless of the method and an apparatus using the same.

  Prior art documents relating to a conventional security communication method using IPsec and an apparatus using the same include the following.

Japanese Patent Laid-Open No. 2002-077242 JP 2003-051818 A JP 2003-115880 A

  FIG. 6 is a block diagram showing an example of an apparatus using such a conventional security communication method. In FIG. 6, reference numerals 1 and 2 denote computers that are devices that perform communication in a TCP / IP environment, and 100 denotes a general-purpose network such as the Internet.

  The computer 1 is connected to the network 100, and the computer 2 is also connected to the network 100.

  Here, the operation of the conventional example shown in FIG. 6 will be described. When communicating between the computer 1 and the computer 2 as indicated by “CM01” in FIG. 6, other computers connected to the network 100 are encrypted by transmitting and receiving packets encrypted using IPsec. Secure communication can be performed without eavesdropping or eavesdropping from (not shown).

  However, IPsec performs encryption, authentication, and the like in the IP layer, and is roughly classified into two functions: a function for processing packets that are actually transmitted and received and a function for exchanging keys necessary for packet processing.

  In the packet processing function, a rule for processing the packet is necessary, and the rule is generally set for the device address or address space (in addition to these, protocol, port number, etc.). is there.

  Therefore, in the conventional example as shown in FIG. 6, for example, IPsec is applied to communication from the address of the computer 1 to the address of the computer 2 (or communication from the address of the computer 2 to the address of the computer 1). Rules will be set.

  Also, in the IPv6 address system that has begun to be used in recent years, the field for representing an address is expanded from 32 bits of the conventional (IPv4: Internet Protocol Version 4) to 128 bits.

  FIG. 7 is an explanatory diagram showing a specific example of such an IPv6 128-bit address. As shown in FIG. 7, in IPv6, the upper 64 bits indicated by “PX11” in FIG. 7 are treated as a network identifier called a prefix, and the lower 64 bits indicated by “ID11” in FIG. Terminal).

  However, in the IPv6 address system, when a device moves between networks, the prefix indicated by “PX11” in FIG. 7 changes according to the destination network, and IPsec is used between the devices moving between networks. When performing security communication, it is extremely difficult to determine a rule that is set based on an IPv6 address, and there is a problem that all the expected IPv6 addresses must be set.

  FIGS. 8, 9 and 10 are explanatory diagrams for explaining problems in performing security communication using IPsec with such a device moving between networks.

  In FIG. 8, 3 is a computer that is a device that communicates in a TCP / IP environment, 4 and 5 are PDAs (Personal Digital (Data) Assistants) that are devices that communicate in a TCP / IP environment, 101 is the Internet, and the like. It is a general-purpose network.

  In FIG. 8, the computer 3 is connected to the network 101 by wire or wireless, and the PDA 4 and PDA 5 are also connected to the network 101 by wire or wireless. In FIG. 10, 3, 4 and 101 and other symbols and the like are assigned the same reference numerals as in FIG. 8.

  “CP21” in FIG. 8 is a network environment such as an intranet in a company (hereinafter simply referred to as a company network environment), and “HM21” in FIG. 8 is, for example, a home LAN (Local Area) at home. Network) (hereinafter simply referred to as home network environment).

  Therefore, the prefix that is the upper 64 bits of the IPv6 address of the computer 3 is, for example, “CP21”. Similarly, the prefix that is the upper 64 bits of the IPv6 address of the PDA 4 in the company network environment is also “CP21”. It becomes.

  On the other hand, the prefix that is the upper 64 bits of the IPv6 address of the PDA 5 in the home network environment is, for example, “HM21”.

  For simplicity of explanation, the interface IDs which are the lower 64 bits of the IPv6 address of the computer 3, PDA4 and PDA5 are “COMP”, “PDA4” and “PDA5”, respectively.

  Assuming that security communication using IPsec is performed between the PDA 4 and PDA 5 and the computer 3 as indicated by “RL21” and “RL22” in FIG. 8, (A) and (B) in FIG. It is necessary to set rules as shown in.

  For example, in the rule shown in FIG. 9A, the IPv6 address is “CP21: PDA4 (in this case, the upper 64 bit address: lower 64 bit address” indicates an IPv6 128 bit address). It shows that IPsec is applied to communication from the PDA 4 that is “IP” to the computer 3 whose IPv6 address is “CP21: COMP”.

  Similarly, for example, in the rule shown in FIG. 9B, IPsec is applied to communication from the PDA 5 having the IPv6 address “HM21: PDA5” to the computer 3 having the IPv6 address “CP21: COMP”. Indicates.

  In this manner, in a situation where the IPsec application rules as shown in FIGS. 9A and 9B are set, the PDA 4 is moved from the company network environment “CP21” to the home as shown by “MV31” in FIG. The IPv6 address of the PDA 4 is changed from “CP21: PDA4” to “HM21: PDA4”, in other words, from “CP21” to “HM21” according to the network environment to which the prefix is connected. Will be changed.

Therefore, when security communication using IPsec is performed between the PDA 4 and the computer 3 as indicated by “RL22” in FIG. 10, the IPv6 address after the movement of the PDA 4 in FIG. 9 (A) or (B ) Cannot be adapted to the rule as shown in FIG. 10, and security communication cannot be performed as indicated by “AD31” in FIG.
Therefore, the problem to be solved by the present invention is to realize a security communication method and an apparatus using the same that can perform security communication using IPsec regardless of the change of the IPv6 address caused by movement of the terminal. is there.

In order to achieve such a problem, the invention according to claim 1 of the present invention is:
In a security communication method using a security communication protocol for packet encryption and authentication,
An interface ID of lower 64 bits of an IPv6 address having a hash value based on an ID that can uniquely define each device and an identification bit of 1 bit is generated, and the security between the devices is generated using the interface ID By setting communication protocol application rules, it becomes possible to perform security communication using IPsec regardless of changes in the IPv6 address caused by movement of the terminal.

The invention according to claim 2
In the security communication method according to claim 1,
In the interface ID,
When one random bit is added and the interface ID is duplicated under the same network environment, the duplicated device can be distinguished by changing the random bit.

The invention described in claim 3
In the security communication method according to claim 1 or claim 2,
Using an automatic key exchange protocol that dynamically generates and exchanges encryption and authentication parameters enables key exchange.

The invention according to claim 4
In the security communication method according to claim 3,
By making the ID capable of uniquely defining the device and the ID used in the protocol for automatic key exchange the other party can be authenticated.

The invention according to claim 5
In the security communication method according to any one of claims 1 to 4,
An ID capable of uniquely defining the device is
By using the device serial number, user ID, FQDN, or public key certificate identification name, security communication using IPsec can be performed regardless of changes in the IPv6 address caused by the movement of the terminal. become.

The invention described in claim 6
In a device using a security communication method using a security communication protocol for packet encryption and authentication,
A first device that is connected to the network and has a hash value based on an ID that can uniquely define the device and an IPv6 address lower 64 bits interface ID having an identification bit of 1 bit, and is connected to the network A hash value based on an ID capable of uniquely defining a device, and a second device in which an interface ID of lower 64 bits of an IPv6 address having a 1-bit identification bit is generated, and using the interface ID By setting the application rule of the security communication protocol between the first device and the second device, the security communication using IPsec is performed regardless of the change of the IPv6 address due to the movement of the terminal. Is possible.

The invention described in claim 7
In the apparatus using the security communication method according to claim 6,
In the interface ID,
When one random bit is added and the interface ID is duplicated under the same network environment, the duplicated device can be distinguished by changing the random bit.

The invention described in claim 8
In the apparatus using the security communication method according to claim 6 or claim 7,
Using an automatic key exchange protocol that dynamically generates and exchanges encryption and authentication parameters enables key exchange.

The invention according to claim 9
In the apparatus using the security communication method according to claim 8,
By making the ID capable of uniquely defining the device and the ID used in the protocol for automatic key exchange the other party can be authenticated.

The invention according to claim 10 is:
In the apparatus using the security communication method according to any one of claims 6 to 9,
An ID capable of uniquely defining the device is
By using the device serial number, user ID, FQDN, or public key certificate identification name, security communication using IPsec can be performed regardless of changes in the IPv6 address caused by the movement of the terminal. become.

The present invention has the following effects.
According to the inventions of claims 1, 5, 6 and 10, a 64-bit interface ID having a 60-bit hash value and a 1-bit identification bit generated based on an ID capable of uniquely defining a device. And setting the IPsec application rule using the interface ID, it is possible to perform security communication using IPsec regardless of the change in the IPv6 address caused by the movement of the terminal.

  According to the invention of claim 2 and claim 7, when the interface ID is duplicated in the same network environment, the random bit is changed (from “0” to “1” or “1”). ”To“ 0 ”), the duplicated devices can be distinguished.

  Further, according to the inventions of claims 3 and 8, key exchange is possible by using an automatic key exchange protocol called IKE (Internet Key Exchange) which dynamically generates and exchanges encryption and authentication parameters. become.

  According to the invention of claim 4 and claim 9, it is possible to make the counterpart device by making the ID that can uniquely define the device from which the hash value is generated the same as the ID used in IKE (key exchange). It becomes possible to authenticate.

  Hereinafter, the present invention will be described in detail with reference to the drawings. 1 and 2 are a configuration block diagram showing an embodiment of a security communication method using IPsec according to the present invention and an explanatory diagram for explaining an interface ID generation method. FIGS. 3, 4 and 5 are explanatory diagrams for explaining a case where security communication using IPsec is performed with a device moving between networks.

  In FIG. 1, 6 is a computer that is a device that communicates in a TCP / IP environment, 7 is a PDA (Personal Digital (Data) Assistants) that is a device that communicates in a TCP / IP environment, and 102 is a general-purpose device such as the Internet. Network.

  In FIG. 1, a computer 6 is connected to the network 102 by wire or wirelessly, and the PDA 7 is also connected to the network 102 by wire or wirelessly. 4 and 5, the reference numerals 6, 7, 102 and other symbols are the same as those in FIG.

  “CP41” in FIG. 1 is a network environment such as an intranet in a company (hereinafter simply referred to as a company network environment), and “HM41” in FIG. 1 is, for example, a home LAN (Local Area) at home. Network) (hereinafter simply referred to as home network environment).

  On the other hand, in the 64-bit interface ID shown in “ID51” in FIG. 2, the upper 60 bits shown in “HA51” in FIG. 2 are hash values generated based on the ID that can uniquely define the device. One bit indicated by “DS51” is an identification bit, and one bit indicated by “RB51” in FIG. 2 is a random bit. Here, the ID that can uniquely define a device may be any device serial number or user ID, for example.

  The IPv6 address is determined based on the interface ID indicated by “ID51” in FIG. 2 and the prefix defined by the network environment indicated by “PX51” in FIG.

  Assuming the case where security communication using IPsec is performed between the PDA 7 and the computer 6 as indicated by “RL61” in FIG. 3, a rule as shown in FIG. 4A is set.

  However, when setting a rule to apply IPsec, instead of using all 128 bits of the IPv6 address, the rule is set using the lower 64 bits (63 bits + random bits) including the hash value generated previously. To do. In other words, prefixes that depend on the network environment are excluded.

  For example, in the rule shown in FIG. 4A, IPsec is applied to communication from the PDA 7 whose lower 64 bits of the IPv6 address is “Hash1” to the computer 6 whose lower 64 bits of the IPv6 address is “Hash2”. Indicates.

  Thus, in a situation where the IPsec application rules as shown in FIG. 4A are set, the PDA 7 changes from the company network environment “CP41” to the home network environment ”as indicated by“ MV71 ”in FIG. When moving to “HM41”, the IPv6 address of PDA 7 is changed from “CP21: Hash1” to “HM21: Hash1”, in other words, from “CP21” to “HM21” according to the network environment to which the prefix is connected. .

  However, even when security communication using IPsec is performed between the PDA 7 and the computer 6 as indicated by “RL62” in FIG. 5, (B) in FIG. 4 is replaced with (A) in FIG. The PDA 7 does not change the setting of the IPsec application rule because it is the same as the rule shown, and the PDA 7 keeps the IPsec application rule set under the company network environment “CP41” from the home to the company computer 6. Security communication can be performed.

  In actual communication of encrypted packets, packet communication is performed using the generated 128-bit IPv6 address, which is no different from the conventional example.

  As a result, a 64-bit interface ID having a 60-bit hash value and a 1-bit identification bit generated based on an ID that can uniquely define a device is generated, and IPsec is applied using the interface ID. By setting the rule, it becomes possible to perform security communication using IPsec regardless of the change of the IPv6 address due to the movement of the terminal.

  When the interface ID is duplicated in the same network environment, the random bit indicated by “RB51” in FIG. 2 is changed (from “0” to “1”, or from “1” to “0”). By doing so, it is possible to distinguish duplicate devices. Therefore, “RB51” in FIG. 2 is not an essential bit, and the object of the present application is achieved if the interface ID has a 60-bit hash value and a 1-bit identification bit.

  In FIG. 2, for simplicity of explanation, the upper 60 bits of the 64-bit interface ID are a hash value generated based on an ID that can uniquely define a device, and the subsequent 2 bits are an identification bit and a random number. Although it is described as a bit, it is not particularly limited to this bit position, and it may be a 64-bit interface ID including a 60-bit hash value, each 1-bit identification bit, and random bits. .

  When key exchange is necessary, an automatic key exchange protocol that dynamically generates and exchanges encryption / authentication parameters called IKE (Internet Key Exchange) can be used. This enables key exchange.

  It is also possible to authenticate the other party by making the ID that can uniquely define the device from which the hash value is generated the same as the ID used in IKE (key exchange).

  Examples of IDs that can uniquely define devices include device serial numbers and user IDs. In addition, FQDNs (Full Qualified Domain Names) and public key certificate standards are used. X. Of course, 509 identification names (Distinguished Names) may be used.

It is a block diagram showing the configuration of an embodiment of a security communication method using IPsec according to the present invention. It is explanatory drawing explaining the production | generation method of interface ID which concerns on this invention. It is explanatory drawing explaining the case where the security communication using IPsec is performed between the apparatuses which move between networks. It is explanatory drawing explaining the case where the security communication using IPsec is performed between the apparatuses which move between networks. It is explanatory drawing explaining the case where the security communication using IPsec is performed between the apparatuses which move between networks. It is a block diagram which shows an example of the apparatus using the conventional security communication method. It is explanatory drawing which shows the specific example of a 128-bit address of IPv6. It is explanatory drawing explaining the problem in the case of performing the security communication using IPsec between the apparatuses which move between networks. It is explanatory drawing explaining the problem in the case of performing the security communication using IPsec between the apparatuses which move between networks. It is explanatory drawing explaining the problem in the case of performing the security communication using IPsec between the apparatuses which move between networks.

Explanation of symbols

1,2,3,6 Computer 4,5,7 PDA
100, 101, 102 networks

Claims (10)

In a security communication method using a security communication protocol for packet encryption and authentication,
Generating a hash value based on an ID capable of uniquely defining each device and an interface ID of lower 64 bits of an IPv6 address having an identification bit of 1 bit;
A security communication method, wherein an application rule of the security communication protocol between the devices is set using the interface ID. In the interface ID,
The security communication method according to claim 1, wherein one random bit is added and the random bit is changed when the interface ID is duplicated in the same network environment. 3. The security communication method according to claim 1, wherein an automatic key exchange protocol for dynamically generating and exchanging encryption / authentication parameters is used. 4. The security communication method according to claim 3, wherein an ID capable of uniquely defining the device and an ID used in the automatic key exchange protocol are made the same. An ID capable of uniquely defining the device is
5. The security communication method according to claim 1, wherein the security communication method is a serial number of the device, a user ID, an FQDN, or an identification name of a public key certificate. In a device using a security communication method using a security communication protocol for packet encryption and authentication,
A first device in which a hash value based on an ID capable of uniquely defining a device connected to the network and an IPv6 address lower 64 bits interface ID having one identification bit is generated;
A second device in which a hash value based on an ID capable of uniquely defining a device connected to a network and an interface ID of lower 64 bits of an IPv6 address having a 1-bit identification bit is generated;
An apparatus, wherein an application rule of the security communication protocol between the first device and the second device is set using the interface ID. In the interface ID,
7. The apparatus according to claim 6, wherein one random bit is added, and the random bit is changed when the interface ID is duplicated under the same network environment. 8. The apparatus according to claim 6, wherein an automatic key exchange protocol for dynamically generating and exchanging encryption / authentication parameters is used. 9. The apparatus according to claim 8, wherein an ID capable of uniquely defining the device and an ID used in the automatic key exchange protocol are the same. An ID capable of uniquely defining the device is
The apparatus according to claim 6, wherein the apparatus is a serial number of the device, a user ID, an FQDN, or an identification name of a public key certificate.

Images