JP2006033350A - Proxy secure router device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a proxy secure router device capable of proxying a secure process to a terminal device in which a secure function is not implemented without taking time for setting a communication partner.
Filter information for determining whether or not to apply encryption processing is stored in filter information storage means 15, and encryption processing is performed by encryption necessity determination means 19 and decryption necessity determination means 16 based on the filter information. The encryption unit 18 and the decryption unit 14 perform packet encryption processing.
[Selection] Figure 1

Description

  The present invention relates to a router device that relays packets between networks, and more particularly, to a proxy secure router device that performs secure processing for a terminal device that does not have a secure function such as IPsec.

  Conventionally, IPsec (Security Architecture for Internet Protocol) is known as a standard for performing cryptographic communication through a network such as the Internet (see, for example, Non-Patent Document 1). In addition to being implemented in the terminal device, the IPsec function is implemented in a proxy IPsec device configured by a VPN (Virtual Private Network) device or the like.

As such a proxy IPsec device, for example, encryption communication is performed with a terminal device connected to an open network connected to an open network connected via an arc and a gateway. Some are performed on behalf of a terminal device connected to a closed network (for example, see Patent Document 1).
Tatsuya Baba, “Mastering IPsec”, O'Reilly Japan, Inc., October 25, 2001, p. 73-89 JP 2003-304227 A

  However, in the conventional technology as described above, since the end of encryption by IPsec is a proxy IPsec device and the end of a packet transmission destination is a terminal device, when a proxy IPsec device is introduced, the communication partner side Therefore, it is necessary to change the setting information such as the IP address indicating the terminal device, and there is a problem that it takes time and effort to set the communication partner.

  The present invention has been made to solve such a problem, and proxy secure processing that can proxy secure processing to a terminal device that does not have a secure function implemented without setting a communication partner. An object is to provide a router device and a program.

  In order to achieve the above object, in the present application, in a proxy secure router device that relays a packet between a first network and a second network and performs encryption processing of the packet on behalf of a device on the second network side , Storage means storing rule information indicating whether or not to apply encryption processing, and applying encryption processing to a packet received from the first network or the second network based on the rule information stored in the storage means Encryption processing necessity determination means for determining whether or not to perform an encryption packet addressed to a device on the second network side relayed from the first network side to the second network side. And a decryption means for decrypting the encrypted packet on behalf of the destination device when the means determines to apply the encryption processing; and a second network When the non-encrypted packet relayed from the network side to the first network side is determined to apply the encryption process by the encryption process necessity determination means, the non-encrypted packet is encrypted on behalf of the source device. It proposes the thing characterized by having the encryption means to make.

  According to the present invention, the proxy secure router device performs an encryption process for a packet passing through the device on behalf of the device on the second network side based on the rule information. Therefore, the first network side device performs secure communication on the assumption that it has the secure function regardless of whether or not the second network side device as the communication partner has the secure function. be able to. In other words, the device on the first network side is highly convenient because it is not necessary to make settings in accordance with the device configuration on the second network side.

  As a preferred example of the present invention, in the present application, when the packet relaying between the first network and the second network is further determined to apply the encryption processing by the encryption processing necessity determination means. Encrypting the encrypted communication path information necessary for forming the encrypted communication path in the decryption means and the encryption means with the second network side apparatus on behalf of the second network side apparatus We propose a communication path information agreement means.

  According to the present invention, the proxy secure router device also makes an agreement on behalf of the device on the second network side for the encryption channel information necessary for forming the encryption channel, so that the above-described encryption processing is reliably performed. Can do.

  In addition, the present application proposes that the encryption processing necessity determination unit includes a packet validity determination unit that determines the validity of the encrypted packet received from the first network side.

  According to the present invention, since illegally encrypted packets can be detected, continuous reception of unnecessary packets in the second network side device can be prevented by discarding the packets.

  Further, the present application proposes a device characterized by comprising rule information generating means for collecting information of devices on the second network side and generating the rule information based on the device information.

  According to the present invention, since the rule information is automatically generated, network construction can be performed more easily.

  A preferable example of the rule information includes at least packet source information, destination information, and protocol information, and a preferred example of the cryptographic processing protocol includes an IPsec protocol suite. Note that when the IPsec protocol suite is used as the cryptographic processing protocol, the present invention can be suitably implemented by using the transport mode as the encapsulation mode (also referred to as the IPsec protocol mode).

  As described above, according to the present invention, the proxy secure router device performs an encryption process on the packet passing through the device on behalf of the second network side device based on the rule information. Therefore, the first network side device performs secure communication on the assumption that it has the secure function regardless of whether or not the second network side device as the communication partner has the secure function. be able to.

  A proxy secure router device (hereinafter simply referred to as “router device”) according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram illustrating a configuration of a router device according to the present embodiment. In this embodiment, the TCP / IP protocol suite is used, and in particular, the IPsec protocol suite is used for realizing the secure function.

  As shown in FIG. 1, the router device 1 is interposed between a WAN (Wide Area Network) 2 such as the Internet and a LAN (Local Area Network) 3 to relay packets between both networks. The WAN 2 is connected to a partner terminal device 4 in which IPsec is implemented, and the LAN 3 is connected to a terminal device 5 in which IPsec is not implemented (or IPsec is not functioning). In the present invention, when viewed from the counterpart terminal device 4, the terminal device 5 has an IPsec function, and is equivalent to performing secure communication with the terminal device 5 using IPsec for transport. As described above, the router device 1 processes the secure function on behalf of the terminal device 5. The terminal device 5 is composed of an Internet communication device such as a personal computer or a home appliance having a communication function.

  The device configuration of the router device 1 will be described with reference to FIG. As shown in FIG. 1, the router device 1 includes a WAN-side network interface 10 that transmits and receives WAN2 packets and a LAN-side network interface 11 that transmits and receives packets with the LAN 3. Each interface 10, 11 is assigned an IP address on each network side.

  Further, the router device 1 includes an encrypted communication channel information agreement means 12 for agreeing encrypted communication channel information (hereinafter simply referred to as “SA (Security Association) information”) with the counterpart terminal device 4, and an encrypted communication channel. And encrypted communication path information storage means 13 for storing encrypted communication path information agreed by the information agreement means 12. The SA information is information agreed between both terminals for establishing a secure communication path on the WAN 2 in order to transmit a packet conforming to IPsec between the counterpart terminal apparatus 4 and the terminal apparatus 5. is there.

  Further, the router device 1 includes decryption means 14 for decrypting the packet transmitted by the counterpart terminal device 4 in accordance with IPsec, and filter information which is rule information indicating whether or not to perform the secure function as a proxy. Filter information storage means 15 that stores information, a decryption necessity determination means 16 that determines whether or not a packet transmitted by the counterpart terminal apparatus 4 is to be decoded by the decryption means 14, and a counterpart Received packet validity determining means 17 is provided for determining whether or not the encrypted packet transmitted by the terminal device 4 is valid. Details of the filter information stored in the filter information storage unit 15 will be described later.

  Further, the router device 1 encrypts a packet that is not compliant with IPsec transmitted by the terminal device 5 based on the SA information stored in the encrypted communication path information storage unit 13 according to IPsec. And encryption necessity determination means 19 for determining whether or not the encryption means 18 encrypts the packet transmitted by the terminal device 5 based on the filter information stored in the filter information storage means 15. Yes.

  The encrypted communication path information storage unit 13 is configured by a nonvolatile storage medium. The SA information includes an identification number (SPI: Security Parameter Index) for identifying each SA information, protocol information indicating any one of AH (Authentication Header) and ESP (Encapsulation Security Payload), encryption and authentication. Each of them includes encryption algorithm and key information used, mode information indicating one of the tunnel mode and the transport mode, an identifier composed of an IP address and a port number, and the lifetime of SA information.

  Each parameter of SA is agreed with a communication partner by a key exchange protocol such as IKE (Internet Key Exchange), and the encrypted communication path information agreement means 12 replaces each of the SA information on behalf of the terminal device 5. The parameter is agreed with the counterpart terminal device 4, and the SA information reflecting the agreed parameter is stored in the encryption channel information storage unit 13.

  Based on the encryption algorithm and key information included in the SA information stored in the encryption channel information storage unit 13, the decryption unit 14 conforms to the IPsec transmitted from the counterpart terminal device 4 to the terminal device 5. The encrypted packet is decrypted without changing the transmission source and transmission destination of the packet.

  The decryption necessity determination unit 16 refers to the filter information stored in the filter information storage unit 15 and restores the packet transmitted from the counterpart terminal device 4 to the terminal device 5 or directly transmits the LAN to the terminal device 5. It is determined whether to transmit through the side network interface 11 or to discard the packet, and the packet is output or discarded according to the determination result.

  The received packet validity determination unit 17 determines whether the packet is valid based on an integrity check value, a sequence number, and the like included in the packet encrypted in accordance with IPsec. Note that an algorithm for calculating an integrity check value (ICV) is determined by an authentication algorithm.

  Based on the encryption algorithm and key information included in the SA information stored in the encryption channel information storage unit 13, the encryption unit 18 converts the packet transmitted from the terminal device 5 toward the counterpart terminal device 4 into the packet Encryption is performed according to IPsec without changing the transmission source and transmission destination.

  The encryption necessity determination unit 19 refers to the filter information stored in the filter information storage unit 15 and either encrypts the packet transmitted by the terminal device 5 or directly connects the WAN side network interface 10 to the counterpart terminal device 4. Whether the packet is to be transmitted or the packet is to be discarded, and the packet is output or discarded according to the determination result.

  By providing the encryption necessity determination unit 19, the router device 1 can prevent an unauthorized terminal device from being connected among a plurality of terminal devices in the LAN 3, and further, the router device 1 can communicate with an unauthorized partner terminal device 4. Thus, it is possible to prevent encrypted communication from being performed.

  Next, filter information stored in the filter information storage unit 15 will be described with reference to FIG. The filter information includes transmission source identification information for identifying the transmission source of the packet, transmission destination identification information for identifying the transmission destination of the packet, and packet information corresponding to protocol information indicating a communication procedure for transmitting the packet. Contains processing information.

  In the specific example of FIG. 2, the IP address of the transmission source constituting the transmission source identification information, the IP address of the transmission destination constituting the transmission destination identification information, the protocol, the port number of the transmission source constituting the transmission source identification information, and the transmission destination It includes information indicating the port number of the transmission destination constituting the identification information and how to process the packet.

  For example, in the first line, the source IP address (IPv4) is 10.0.1.1/32, and the destination address is 10.0.0. When included in * / 24 and the protocol is tcp (Transmission Control Protocol), it indicates that IPsec processing is applied to the received packet (apply).

  The second line shows that the source IP address (IPv6) is 2001: 1, the destination IP address is 2001 :: 2, the protocol is udp (User Datagram Protocol), and the source port number and transmission. When the previous port number is 137, it indicates that the received packet is transmitted as it is (bypass).

  In the third line, the source IP address (IPv6) is 2001 :: 1/128, the destination IP address is 2001 :: 2/128, the protocol is icmp (Internet Control Message Protocol), and the source When the port number is 135, it indicates that the received packet is to be dropped.

  As described above, the packet transmitted and received by the terminal device that implements the IPsec function is applied to the packet transmitted and received by the terminal device 5 that does not implement the IPsec function based on the filter information. It can be set to transmit as it is (bypass).

  When the decryption necessity determination unit 16 determines to decrypt the packet transmitted by the counterpart terminal device 4, the decryption necessity reference unit 16 refers to the packet transmitted by the counterpart terminal device 4, and the referred packet conforms to IPsec. If it is determined that the packet is not encrypted, the packet may be discarded.

  Below, operation | movement of the router apparatus 1 is demonstrated. In each operation of the router device 1 described below, the SA information reflecting the parameters agreed by the encryption channel information agreement unit 12 is already stored in the encryption channel information storage unit 13. To do.

  FIG. 3 is a flowchart showing a packet receiving operation from the WAN 2 side of the router device 1. The packet reception operation of the router device 1 starts when a packet transmitted from the counterpart terminal device 4 to the terminal device 5 via the WAN 2 is received by the WAN-side network interface 10.

  First, whether the decryption necessity determination unit 16 decrypts a packet received by the WAN side network interface 10, transmits it to the terminal device 5 as it is through the LAN side network interface 11, or discards the packet. A determination is made based on the filter information stored in the filter information storage means 15 (steps S1 and S2).

  If it is determined that the packet is to be decrypted, the received packet validity determining means 17 determines the validity of the received packet (step S3). If it is determined that the received packet is not valid, the received packet validity determination unit 17 discards the received packet (step S4).

  When it is determined that the packet received by the WAN-side network interface 10 is valid, the decryption unit 14 decrypts the received packet based on the SA information stored in the encrypted communication path information storage unit 13. (Step S5), and the decrypted packet is transmitted to the terminal device 5 via the LAN-side network interface 11 and the LAN 3 (step S6).

  On the other hand, when it is determined that the packet received by the WAN side network interface 10 is transmitted as it is to the terminal device 5 via the LAN side network interface 11 (step S2), the decryption necessity determination unit 16 transmits the received packet to the LAN side. The data is transmitted to the terminal device 5 via the network interface 11 and the LAN 3 (step S6).

  On the other hand, if it is determined that the packet received by the WAN side network interface 10 is not decoded and is not transmitted to the terminal device 5 as it is (steps S1 and S2), that is, if it is determined that the packet is to be discarded, the necessity of decoding is determined. The determination unit 16 discards the received packet (step S4).

  Next, a packet transmission operation to the WAN 2 side of the router device 1 will be described with reference to the flowchart of FIG. The packet transmission operation of the router device 1 starts when a packet transmitted from the terminal device 5 to the counterpart terminal device 4 via the LAN 3 is received by the LAN-side network interface 11.

  First, whether the encryption necessity determination unit 19 encrypts a packet received by the LAN-side network interface 11, transmits it to the counterpart terminal device 4 as it is through the WAN-side network interface 10, or discards the packet Is determined based on the filter information stored in the filter information storage means 15 (steps S11 and S12).

  If it is determined that the packet is to be encrypted, the encryption unit 18 encrypts the packet received by the LAN-side network interface 11 in accordance with IPsec based on the SA information stored in the encryption channel information storage unit 13. (Step S13), and transmits the encrypted packet to the destination terminal device 4 via the WAN side network interface 10 and the WAN 2 (step S14).

  On the other hand, when it is determined that the packet received by the LAN-side network interface 11 is to be transmitted as it is to the counterpart terminal device 4 via the WAN-side network interface 10 (step S12), the encryption necessity determining unit 19 transmits the packet to the WAN. It transmits to the counterpart terminal device 4 via the side network interface 10 and WAN 2 (step S14).

  On the other hand, if it is determined that the packet received by the LAN-side network interface 11 is not encrypted and is not transmitted to the counterpart terminal device 4 as it is (steps S11 and S12), that is, if it is determined that the packet is to be discarded, encryption is performed. Necessity determining means 19 discards the received packet.

  Each component of the router device 1 described above may cause a processor to execute a program describing the operation described above. That is, the encryption channel information agreement unit 12, the decryption unit 14, the decryption necessity determination unit 16, the received packet validity determination unit 17, the encryption unit 18, and the encryption necessity determination unit 19 execute the above program. You may make it comprise with the processor to perform.

  In addition, at least one of the encryption channel information storage unit 13 and the filter information storage unit 15 has an IC card, a USB (Universal Serial Bus) key, an SD (Secure) so that the user cannot change at least a part of the stored information. (Digital) A tamper-resistant detachable device such as a memory card may be used.

  On the other hand, at least one of the encrypted communication path information storage unit 13 and the filter information storage unit 15 may allow a user authenticated via the WAN 2 to change at least a part of the stored information.

  The router device 1 is connected with an information collection protocol such as ARP (Address Resolution Protocol) and NDP (Neighbor Discovery Protocol) and an interconnection function such as UPnP (Universal Plug and Play). IP address generation and information reference when collecting device information such as the IP address and service of the terminal device 5 being used, and generating at least one of encrypted communication path information and filter information based on the collected device information It is also possible to perform information management such as efficiency improvement and user input support.

  As described above, according to the router device 1, since the partner terminal device 4 can process the terminal device 5 as if the terminal of the encryption by IPsec is the terminal device 5, the transport mode can be adopted. It is possible to proxy the IPsec processing for the terminal device 5 in which the IPsec function is not implemented without taking time and effort for setting the user 4.

  The filter information stored in the filter information storage means 15 needs to be determined and set before the router device 1 operates. However, the router device 1 automatically generates the filter information. May be. For example, when the router device 1 has an address issue function such as a DHCP (Dynamic Host Configuration Protocol) function and RA (router advertisement), and the subordinate terminal device 5 is set to receive an address issue from the router device 1, the router In the device 1, the address status used by the subordinate terminal device 5 is known. Therefore, when the router device 1 issues an address, it transmits an IPsec session request to the terminal device 5 that has issued the address, determines whether the terminal device 5 can use IPsec, and the determination result. Filter information may be created based on the above. Further, the router device 1 detects that the terminal device 5 is connected to the LAN 3 by using a protocol for communication from the terminal device 5 to the router device 1 such as UPnP, and the IPsec session is detected with respect to the detected terminal device 5. A request may be transmitted, and filter information may be created based on the result.

  In the above embodiment, the IPsec protocol suite for realizing the secure function is used, but other protocols may be used. In the above embodiment, the TCP / IP protocol suite is used, but the network may be configured using other protocols.

Block diagram of proxy secure router device The figure explaining an example of filter information Flowchart explaining the operation of the router device when receiving a packet from the WAN side Flowchart for explaining the operation of the router device when receiving a packet from the LAN side

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Router apparatus, 2 ... WAN, 3 ... LAN, 4 ... Counterpart terminal apparatus, 5 ... Terminal apparatus, 10 ... WAN side network interface, 11 ... LAN side network interface, 12 ... Encryption communication path information agreement means, 13 ... Encryption channel information storage means, 14 ... Decryption means, 15 ... Filter information storage means, 16 ... Decryption necessity judgment means, 17 ... Received packet validity judgment means, 18 ... Encryption means, 19 ... Encryption required No decision means.

Claims (8)

In a proxy secure router device that relays a packet between a first network and a second network and performs encryption processing of the packet on behalf of a device on the second network side,
Storage means for storing rule information on whether or not to apply encryption processing;
Encryption processing necessity determination means for determining whether or not to apply encryption processing to a packet received from the first network or the second network based on the rule information stored in the storage means;
When the encrypted packet addressed to the second network side device relayed from the first network side to the second network side is determined by the encryption processing necessity determination means to apply the encryption processing, Decoding means for decoding the encrypted packet on behalf of the destination device;
When a non-encrypted packet relayed from the second network side to the first network side is determined to apply the encryption process by the encryption process necessity determination unit, the non-encrypted packet is proxyed to the source device And a proxy secure router device comprising: an encryption means for performing encryption. When a packet relayed between the first network and the second network is determined to apply the encryption process by the encryption process necessity determination unit, the encryption communication by the decryption unit and the encryption unit A cryptographic communication path information agreement means is provided for agreeing with the first network side device on behalf of the second network side device for encryption channel information necessary for path formation. The proxy secure router device according to claim 1. The said encryption processing necessity determination means is provided with the packet validity determination means which determines the validity of the encryption packet received from the 1st network side. The one of Claim 1 or 2 characterized by the above-mentioned. Proxy cryptographic processing router device. The proxy secure according to any one of claims 1 to 3, further comprising: rule information generation means for collecting information on a device on the second network side and generating the rule information based on the device information. Router device. The proxy secure router device according to any one of claims 1 to 4, wherein the rule information includes at least packet source information, destination information, and protocol information. The proxy secure router device according to any one of claims 1 to 5, wherein an IPsec protocol suite is used as an encryption processing protocol. The proxy secure router device according to claim 6, wherein a transport mode is used as an IPsec encapsulation mode. A program for realizing a proxy secure router device that relays a packet between a first network and a second network and performs encryption processing of the packet on behalf of a device on the second network side,
Computer
Storage means for storing rule information on whether or not to apply encryption processing;
Encryption processing necessity determination means for determining whether or not to apply encryption processing to a packet received from the first network or the second network based on the rule information stored in the storage means;
When the encrypted packet addressed to the second network side device relayed from the first network side to the second network side is determined by the encryption processing necessity determination means to apply the encryption processing, Decoding means for decoding the encrypted packet on behalf of the destination device;
When a non-encrypted packet relayed from the second network side to the first network side is determined to apply the encryption process by the encryption process necessity determination unit, the non-encrypted packet is proxyed to the source device A proxy secure router program that functions as an encryption means for encryption.

Images