JP4788264B2 - Encrypted communication method and communication apparatus - Google Patents

Description

The present invention relates to encrypted communication between predetermined devices such as computers, and more particularly to an encrypted communication method and a communication device for notifying a running application of a communication state of encrypted communication.

  With the spread of the Internet, in-house networks, and the like, such networks are open, so it is important to protect the information flowing through them. As protection of this information, encrypted communication that allows information to be exchanged only between specific devices is used (see, for example, Patent Document 1).

JP-A-9-270786

  FIG. 6 is a block diagram showing an example of a conventional encrypted communication method and communication apparatus. FIG. 6 illustrates a portion related to encrypted communication in the apparatus.

  In FIG. 6, the application execution means 1 is formed by an application program (hereinafter referred to as an application), a processing circuit comprising a CPU (arithmetic unit), a memory, and the like. The application execution means 1 executes an application and realizes predetermined functions such as data creation and transmission / reception based on the operation of the application. The application is stored in the storage unit 53.

  The communication control means 52 is a communication module that controls communication according to TCP / IP (Transmission Control Protocol / Internet Protocol), and based on the operation of the installed software, the transmission data received from the application execution means 1 is TCP In accordance with / IP, a transmission packet in which transmission data is divided and protocol header information is added is generated and transmitted to another apparatus via the network 5, and a packet received from another apparatus is received data. To the application execution means 1. The communication control data 6 is generated for each series of communication of the application, and is various data necessary for communication such as connection status information, own port used, port used by the connection partner, and the like. Stored in

  When performing encrypted communication, the security policy database 8 performs discard (packet discard), Bypass (does not perform any encryption or decryption processing), Apply (encryption / decryption processing) for any packet. This is a database that stores a security policy that is a rule that determines whether to perform an action such as (apply). This database is also stored in the storage means 53.

  The encryption information database 9 is a database in which encryption information necessary for establishing a secure communication path in encrypted communication is stored. This encrypted information must be shared with the communication partner before starting encrypted communication. This sharing is set up manually or automatically. This database is also stored in the storage means 53.

  The encryption information setting means 10 is a module for automatically sharing encryption information with a communication partner, and upon receiving an encryption information creation request from the communication control means 52 based on the operation of the installed software. In addition, negotiation with a communication partner is performed via the network 5.

  The operation by such a configuration is as follows. A description will be given according to the signal flow (processing procedure).

(S 1) The application execution unit 1 creates transmission data and passes it to the communication control unit 52.

(S2) The communication control means 52 searches the security policy database 8 to check whether encrypted communication should be applied to the transmission data.

(S3) When encrypted communication is required, the communication control means 52 searches the encrypted information database 9 to check whether the corresponding encrypted information exists. If there is no encryption information corresponding to the packet to be transmitted, the encryption information setting unit 10 is requested to create the corresponding encryption information. In parallel, the transmission packet is retransmitted a preset number of times at a preset interval, and the packet is discarded when the transmission count reaches the preset number. Alternatively, the transmission packet is discarded without being retransmitted.

(S4) The communication control means 52 informs the application execution means 1 that packet transmission has failed.

(S5) The encrypted information setting means 10 that has received a request for creating encrypted information from the communication control means 52 negotiates with the communication partner.

(S6) When the encryption information setting means 10 succeeds in negotiation, the created encryption information is stored in the encryption information database 9.

  Such encrypted communication is communication in which a secure communication path is established by applying encryption technology to a packet generated according to TCP / IP, and is realized by a TCP / IP communication module. There is no need to be aware that encrypted communication is taking place.

In such a conventional encrypted communication method and communication device, the reason why an application that performs encrypted communication fails in communication with the communication partner is that there is no encrypted information or encryption information creation means by the encrypted information setting means. Failure, communication path abnormality, etc. are possible, but the application cannot know that there was no encryption information.

In general, the time required for negotiation of encrypted information is much longer than normal communication, so if there is no mechanism for notifying the failure or status of encrypted communication in the application, especially applications that expect the response of the communication partner, There is a problem that the TCP / IP communication module cannot move to the next step, and the TCP / IP communication module repeatedly wastes data retransmission and waits for a timeout, which increases the load on the CPU of the transmission source and affects other processes. there were.

The present invention intends to solve the problem of such an encrypted communication method and communication apparatus. The presence or absence of encrypted information is detected, and if there is no encrypted information, data retransmission is performed. It is an object of the present invention to provide an encrypted communication method and a communication apparatus that reduce the load on the CPU by leaving an interval for a time required for negotiation of encrypted information.

  The present invention is an encrypted communication method and communication apparatus configured as follows.

(1) An encrypted communication method for encrypting created transmission data and transmitting it to another device by an application execution means for creating transmission data by executing an application program stored in a storage means,
Determining whether the transmission data needs to be encrypted based on a security policy that defines rules for applying encryption processing in encrypted communication of the transmission data;
Encryption of encryption processing applied from a database in which encryption information for establishing encrypted communication is stored when encryption is required in the step of determining whether transmission data needs to be encrypted Searching for information;
In the step of searching for encryption information of the encryption processing to be applied from the database storing the encryption information, if the corresponding encryption information does not exist as a result of searching the encryption information, the encryption information is not valid. Creating information indicating presence and transmitting this information to the application execution means;
Negotiating encrypted communication with another device that is the transmission destination of the transmission data, and creating the corresponding encryption information;
And a step of waiting for a re-transmission of transmission data for a time required for negotiation of the encrypted communication based on information indicating the absence of the encrypted information .

(2) The encrypted communication method according to (1), wherein the information indicating the absence of the encrypted information is flag information.

(3) In a communication device that encrypts transmission data and transmits it to another device,
Application execution means for generating the transmission data based on the operation of an application program;
A communication control means for encrypting the transmission data and transmitting it to another device;
Storage means for storing encryption information for establishing encrypted communication;
Encrypted information setting means for negotiating encrypted communication with other devices;
Have
The communication control means detects the presence / absence of encryption information corresponding to the transmission data, transmits the detection result to the application execution means, and requests for negotiation of encrypted communication to the encryption information setting means. And at least one of the application execution unit and the communication control unit waits for retransmission of data based on the detection result for a time required for negotiation of the encryption information setting unit. apparatus.

(4) The communication apparatus according to (3) , wherein the detection result is stored in the storage unit as flag information.

(6) The communication apparatus according to (4) or (5), wherein the waiting time for retransmission of the transmission data is a time required for negotiation of the encrypted communication means.

The present invention has the following effects.

According to the first to fourth aspects of the present invention, the presence or absence of encrypted information is detected, and if there is no encrypted information, the interval between data retransmissions is increased by the time required for negotiation of the encrypted information. An encryption communication method and a communication device that reduce the load on the CPU can be realized.

  Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing an example of an encrypted communication method and communication apparatus according to the present invention. FIG. 1 illustrates a portion related to encrypted communication in the apparatus. In FIG. 1, the same reference numerals are given to the same components as those in the previous drawings, and the description thereof is omitted.

  In FIG. 1, an application execution unit 1 is formed by a processing circuit including an application, a CPU (arithmetic unit), a memory, and the like. The application execution means 1 executes an application, and realizes predetermined functions and control including transmission data creation and transmission / reception based on the operation of the application. The application is stored in the storage unit 11.

The communication control unit 2 is a communication module that controls communication control according to TCP / IP. The transmission data received from the application execution unit 1 is divided into transmission data and addition of protocol header information according to TCP / IP. The generated transmission packet is generated and transmitted to the other device via the network 5, and the packet received from the other device is sent to the application execution means 1 as received data.

As described above, the communication control data 6 is generated for each series of communication of the application, and is various data necessary for communication, and is stored in the storage unit 11 such as a memory or a hard disk.

The communication control data 6 has an area for setting an encryption information flag 7 indicating the presence / absence of encryption information, and the communication control means 2 has no corresponding encryption information when the application execution means 1 transmits data. In this case, the encryption information flag 7 of the communication control data 6 is set (for example, the data is 0 to 1), and the application execution means that the packet transmission has failed, together with the status of the encryption information flag 7 of the communication control data 6 Tell 1 Based on the information transmitted from the communication control unit 2, the application execution unit 1 waits for a preset time for data transmission to the communication control unit 2, or performs other processing.

  When the application execution unit 1 transmits data again, the communication control unit 2 checks the encryption information flag 7 of the corresponding communication control data 6, and whether the corresponding encryption information does not exist in the previous data transmission. Check. If the encryption information flag 7 is set, the communication control means 2 transmits to the application execution means 1 that the encryption information does not exist in the previous data transmission and does not retransmit the packet. To wait.

  Specifically, since the exchange of encryption information between devices generally takes longer than data transmission, by detecting the set of the encryption information flag and adjusting the interval at which data is retransmitted It is possible to reduce the load on the CPU of the transmission source. The waiting time for retransmitting data is a time required for negotiation of encrypted communication performed by the encryption information setting means, and this time is obtained empirically and set as a waiting time in advance.

In addition, by transmitting to the application execution means 1 that the encrypted information does not exist in the data transmission, the operation of the application can be performed without being restricted by the result of the success or failure of the encrypted communication. .

  The operation (processing process) of the present invention will be described below with reference to FIG.

(S101) The application execution means 1 creates transmission data and passes it to the communication control means 2.

(S102) The communication control unit 2 searches the security policy database 8 to check whether or not to apply encrypted communication to the transmission packet.

(S103) When encrypted communication is necessary, the communication control means 2 searches the encrypted information database 9 to check whether the corresponding encrypted information exists, and if it exists, encrypts the transmission packet and transmits the packet. Do.

(S104) If the corresponding encryption information does not exist, if the encryption information flag 7 is not already set, the communication control means 2 sets the encryption information flag 7 of the communication control data 6, and The failure of transmission is notified to the application execution means 1 together with the status of the encryption information flag 7 of the communication control data 6. Further, the communication control unit 2 determines that the packet is not retransmitted if the encryption information flag 7 is set.
In parallel, the communication control unit 2 requests the encryption information setting unit 10 to create corresponding encryption information.
Based on the information transmitted from the communication control unit 2, the application execution unit 1 waits for a preset time for data transmission to the communication control unit 2, or performs other processing.

(S105) The encryption information setting means 10 creates encryption information that is information on the encryption algorithm and encryption key, and negotiates with the communication partner by exchanging the encryption key via the network 5.

(S106) If the negotiation is successful, the encryption information setting unit 10 stores the created encryption information in the encryption information database 9.

(S107) The communication control unit 2 resets the encryption information flag 7 when the corresponding encryption information is created by the encryption information setting unit 10 and the encrypted communication is successful.
At this time, the communication control unit 2 may notify the application execution unit 1 that the encrypted information has been created. Since the application side can grasp the change of the encryption information flag 7, processing such as data transmission can be performed at an appropriate timing.

FIG. 2 is a flowchart showing processing steps of the encrypted communication method in the communication apparatus according to the present invention.
A description will be given below according to each processing step with reference to FIG.

(ST1) A header is added to the application data to create a packet.

(ST2) The security policy database is searched to check whether there is a corresponding policy.

(ST3) It is determined whether or not “encryption is required” is written in the found policy.

(ST4) If “encryption is required”, the encrypted information database is searched, and the encrypted information corresponding to the packet to be transmitted is searched.

(ST5) It is determined whether there is encryption information. If there is no encryption information, the process of ST6 is performed, and if there is the encryption information, the process of ST13 is performed.

(ST6) If the encryption information flag is not set, the encryption information flag is set.

(ST7) If the application process block (the state where the application is waiting for a predetermined return value) is not required, the process of ST11 is performed.
If an application process block is necessary, the block is started and the processes of ST8 and ST10 are performed. The application is blocked until it reaches the specified number of retransmissions or communication is successful.

(ST8) Negotiate with the communication partner to create encryption information.

(ST9) The encryption information is stored in the encryption information database.

(ST10) If there is no reception response from the communication partner, it is determined that the packet is retransmitted, and the process returns to ST1.

(ST11) If it is determined not to retransmit, or if an application processing block is not necessary, the transmission packet is discarded.

(ST12) The application is notified that the communication has failed because there is no corresponding encryption information, and the process is terminated.

(ST13) The transmission packet is encrypted.

(ST14) If the encryption information flag is set, the encryption information flag is reset.

(ST15) The transmission packet is encrypted.

(ST16) The success or failure of the transmission is determined. If the transmission is unsuccessful, the processing of ST17 is performed. If the transmission is successful, the processing is terminated.

(ST17) The application is notified that the communication has failed, and the process ends.

As described above, an application that transmits a packet that requires encrypted communication can know the presence or absence of the corresponding encrypted information, so that appropriate processing can be performed.

In particular, when an application performs data retransmission when transmission fails, if the application knows that there is no encryption information, it will be possible to leave a retransmission interval for the time required for negotiation of the encryption information. The load on the CPU of the transmission source can be reduced.

Further, as in the conventional example, even when the communication control unit manages the retransmission of data, if it can be known that there is no encryption information, it is possible to omit a wasteful retransmission process and reduce the load on the CPU.

  The present invention is not limited to the above-described embodiments, and includes many changes and modifications without departing from the essence thereof.

  FIG. 3 is an explanatory diagram showing the operation of the second embodiment of the encrypted communication method and communication apparatus according to the present invention. FIG. 3 illustrates a portion related to encrypted communication in the apparatus.

In FIG. 3, the same reference numerals are given to the same components as those in the previous drawings, and the description thereof is omitted. The connection relationship is indicated by a solid line and the signal path is indicated by a broken line. Furthermore, for convenience of explanation, communication control data, transmission data, and transmission packets are illustrated in communication control means (TCP / IP communication module).

  In FIG. 3, an API (Application Program Interface) of the TCP socket unit 21 is a set of rules defining a set of functions for functioning as an interface and a program procedure for using them. Specifically, an application that performs communication based on a network address, a connection function, a packet transmission function, and the like possessed by a device that performs communication using TCP / IP via a processing circuit (not shown) through the operation of installed software. The execution unit 1 functions as an interface for handling TCP / IP.

  As a result, the application execution means 1 can send and receive data without worrying about the details of the communication procedure simply by specifying a socket which is a set of an address and a port and opening a line.

The TCP module 23 in the TCP / IP communication module 22 is a network described later in accordance with a standard protocol (Transmission Control Protocol) corresponding to the transport layer via a processing circuit (not shown) based on the operation of installed software. It performs a bridge between the layer IP module and the protocol above the session layer. Here, since the transport layer, the network layer, and the session layer are well known, description thereof will be omitted.

Further, the IP module 24 performs addressing of devices participating in the network 5 and communication in a plurality of interconnected networks via a processing circuit (not shown) based on the operation of the installed software. Route the route.

The IPsec policy database 25 is a database that stores a security policy according to IPsec (Security Architecture for Internet Protocol), which is a standard for performing cryptographic communication on the Internet. Since IP packets are encrypted and transmitted / received, application software that uses a higher-level protocol such as TCP or UDP described later does not need to be aware that IPsec is used.

The operation (processing step) in the case of performing connection by encrypted communication using the API of the TCP socket unit 21 will be described below with reference to FIG.

(S201) When the application execution means 1 calls the API connection function of the TCP socket unit 21, the API of the TCP socket unit 21 calls the connection function of the TCP module 23.

(S202) The connection function of the TCP module 23 generates a TCP connection packet and calls the packet transmission function of the IP module 24.

(S203) The IP module 24 refers to the IPsec policy database 25 to check whether IPsec is required for the corresponding policy, and searches for the corresponding encryption information from the encryption information database 9 if necessary.

(S204) If the corresponding encryption information does not exist, the IP module 24 sets the encryption information flag 7 in the corresponding TCP communication control data 6, and sets the encryption information to the encryption information setting means 10. Request. The encryption information setting means 10 negotiates with the packet transmission destination by the encryption information setting protocol, creates corresponding encryption information, and stores it in the encryption information database 9.

(S205) When the corresponding encryption information exists, the IP module 24 encrypts the transmission packet 4 using the encryption information and transmits the transmission packet 4 to the communication partner, and the corresponding TCP communication control data 6 The encryption information flag 7 set in the above is reset.

(S206) When there is no reception response from the communication partner, the processing of S202 to S205 is performed by the packet retransmission processing of the TCP module 23. During this time, the processing of the application execution means 1 is performed until a communication error such as the end of connection or the number of retransmissions of the packet 4 has reached a specified number by the API of the TCP socket unit 21 when the connection function of the TCP socket API 21 is called May be blocked.

(S207) When the encrypted information with the communication partner is not created by the encrypted information setting means 10 during the packet retransmission process, the TCP module 23 informs the application execution means 1 as a function return value or an error number.

In the following, an operation (processing step) in the case of transmitting data by encrypted communication using the API of the TCP socket unit 21 will be described.

FIG. 4 is an explanatory view for explaining the operation (processing step) of data transmission by encrypted communication in FIG.
The components in FIG. 4 are the same as the components in FIG.

(S301) The application execution unit 1 calls the API packet transmission function of the TCP socket unit 21. The API of the TCP socket unit 21 calls the packet transmission function of the TCP module 23.

(S302) The packet transmission function checks the corresponding communication control data 6, and if the encryption information flag 7 is set, informs the application execution means 1 of that as a return value or an error number of the function.
The packet transmission function transmits error information at this time to the application execution means 1 through the API transmission function of the TCP socket unit 21, and the subsequent transmission processing is performed only within the TCP module 23.

(S303) The connection function of the TCP module 23 generates the transmission packet 4 and calls the packet transmission function of the IP module 24.

(S304) The IP module 24 refers to the IPsec policy database 25 to check whether IPsec is required for the corresponding policy, and searches for the corresponding encryption information from the encryption information database 9 if necessary.

(S305) If the corresponding encryption information does not exist, the IP module 24 sets the encryption information flag 7 corresponding to the corresponding communication control data 6, and sets the encryption information to the encryption information setting means 10. The encryption information setting unit 10 makes a request, negotiates with the packet transmission destination by the encryption information setting protocol, creates corresponding encryption information, and stores it in the encryption information database 9.

(S306) When the corresponding encryption information exists, the IP module 24 encrypts the transmission packet 4 using the encryption information, transmits the transmission packet 4 to the communication partner, and sets it in the corresponding communication control data 6. The encryption information flag 7 is reset.

(S307) When there is no reception response from the communication partner, the processing of S303 to S305 is performed by the packet retransmission processing of the TCP module 23.

(S308) If the encryption information with the communication partner is not created by the encryption information setting means during the packet retransmission process of the TCP module 23, the encryption information flag set in the corresponding communication control data is left as it is.

As described above, an application that performs a connection that requires encryption with a communication partner using the TCP socket API knows whether or not the corresponding encryption information exists, so that appropriate processing can be performed in a state where there is no encryption information at the time of connection. Will be able to do.

In addition, an application that transmits a packet that needs to be encrypted to a communication partner using the TCP socket API knows the creation status of the encryption information when the previous packet was transmitted, so that the corresponding encryption information at the time of packet transmission can be obtained. Appropriate processing can be performed in the absence.

  Further, encrypted communication by a TCP / IP communication module using a UDP (User Datagram Protocol) and ICMP (Internet Control Message Protocol) module instead of the TCP module in the TCP / IP communication module will be described. Here, TCP / IP is used as a general term for communication protocols for connecting to the Internet.

FIG. 5 is an explanatory diagram for explaining the operation of the third embodiment of the encrypted communication method and communication apparatus according to the present invention.
In FIG. 5, the UDP / ICPM module 26 in the TCP / IP communication module 28 follows a standard protocol (UDP) corresponding to the transport layer via a processing circuit (not shown) based on the operation of the installed software. The network layer IP module, which will be described later, and the session layer or higher protocol are bridged.

It also has a function for checking the status of IP error messages and control messages between computers and network devices.

  The UDP and RAW socket unit 29 is an application that performs communication based on a network address, a connection function, a packet transmission function, and the like possessed by a device that performs communication via a processing circuit (not shown) by the operation of installed software. It functions as an interface.

The operation (processing process) when data is transmitted by encrypted communication using the UDP / RAW socket unit 29 will be described below.

(S 401) The application execution means 1 calls the packet transmission function of the lower module (UDP, ICMP, IP module) 26 using the UDP / RAW socket unit 29.

(S402) The connection function of the lower module generates a transmission packet and calls the packet transmission function of the IP module 27.

(S403) The IP module 27 refers to the IPsec policy database 25 to check whether IPsec is necessary for the corresponding policy, and retrieves the corresponding encryption information from the encryption information database 9 if necessary.

(S404) When the corresponding encryption information does not exist, the IP module 27 requests the encryption information setting means 10 to set the encryption information, and the encryption information setting means 10 transmits the packet by the encryption information setting protocol. Negotiations with the other party are made, corresponding encryption information is created, and stored in the encryption information database 9. The IP module 27 informs the upper module (UDP, ICMP module 26) that the corresponding encryption information does not exist. The upper module 26 informs that there is no encryption information corresponding to the application execution means 1 via the UDP / RAW socket unit 29.

(S405) If the corresponding encryption information exists, the IP module 27 encrypts the transmission packet 4 using the encryption information and transmits the transmission packet 4 to the communication partner. The IP module 27 notifies the upper module (UDP, ICMP module 26) that the transmission was successful.

As described above, when an application that transmits a packet that needs to be encrypted to a communication partner using a UDP or RAW socket knows whether there is corresponding encryption information, there is no corresponding encryption information at the time of packet transmission. Appropriate processing can be performed.

In particular, in UDP and RAW socket communications, if packet transmission fails, the application must retransmit the packet itself if necessary. If the application can know that there is no encryption information, the retransmission interval can be increased by the time required for setting the encryption information, and the CPU load of the transmission source can be reduced.

It is a block diagram which shows one Example of the encryption communication method and communication apparatus which concern on this invention. It is a flowchart which shows the process of the encryption communication method in the communication apparatus which concerns on this invention. It is explanatory drawing which shows the 2nd Example of the encryption communication method and communication apparatus which concern on this invention. It is explanatory drawing which shows the operation | movement (processing process) of the data transmission by the encryption communication in FIG. It is explanatory drawing which shows the 3rd Example of the encryption communication method and communication apparatus which concern on this invention. It is the block diagram which showed an example of the conventional encryption communication method and communication apparatus.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Application execution means 2 Communication control means 5 Network 6 Communication control data 7 Encrypted information flag 8 Security policy database 9 Encrypted information database 10 Encrypted information setting means

Claims (4)

An encryption communication method for encrypting the created transmission data and transmitting it to another device by the application execution means for creating the transmission data by executing the application program stored in the storage means,
Determining whether the transmission data needs to be encrypted based on a security policy that defines rules for applying encryption processing in encrypted communication of the transmission data;
Encryption of encryption processing applied from a database in which encryption information for establishing encrypted communication is stored when encryption is required in the step of determining whether transmission data needs to be encrypted Searching for information;
In the step of searching for encryption information of the encryption processing to be applied from the database storing the encryption information, if the corresponding encryption information does not exist as a result of searching the encryption information, the encryption information is not valid. Creating information indicating presence and transmitting this information to the application execution means;
Negotiating encrypted communication with another device that is the transmission destination of the transmission data, and creating the corresponding encryption information;
And a step of waiting for a re-transmission of transmission data for a time required for negotiation of the encrypted communication based on information indicating the absence of the encrypted information . The encrypted communication method according to claim 1, wherein the information indicating the absence of the encrypted information is flag information.   In a communication device that encrypts transmission data and transmits it to another device,
  Application execution means for generating the transmission data based on the operation of an application program;
  A communication control means for encrypting the transmission data and transmitting it to another device;
  Storage means for storing encryption information for establishing encrypted communication;
Encrypted information setting means for negotiating encrypted communication with other devices;
Have
The communication control means detects the presence / absence of encryption information corresponding to the transmission data, transmits the detection result to the application execution means, and requests for negotiation of encrypted communication to the encryption information setting means. And at least one of the application execution unit and the communication control unit waits for retransmission of data based on the detection result for a time required for negotiation of the encryption information setting unit. apparatus. The communication apparatus according to claim 3, wherein the detection result is stored in the storage unit as flag information.

Images