JP3472098B2 - Mobile computer device, relay device, and data transfer method - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a mobile computer capable of moving and communicating between networks, and a relay for receiving a packet transferred on the network, judging whether or not the packet can be passed, and transferring or returning the packet. The present invention relates to a device and a data transfer method.

[0002]

2. Description of the Related Art The use of computer systems has rapidly and widely spread to various fields as computer systems have become smaller and less expensive, and network environments have been enhanced. Also, the shift from centralized systems to distributed systems Is progressing. Especially in recent years, not only sharing resources such as files and printers in the office but also communication outside the office and outside the organization (email , E-news, file transfer, etc.) have become possible and these have begun to be widely used. In recent years, in particular, the use of the world's largest computer network “Internet” has become widespread, and it has become popular with external users who connect to the Internet and use publicly available information and services, and vice versa. On the other hand, by providing information and services, new computer business is being cultivated. In addition, new technologies are being developed and deployed regarding the use of the Internet.

With the spread of such networks, technical development for mobile communication is being carried out. In mobile communication, a user having a portable terminal or a computer moves on a network for communication. In some cases, the position on the network may be changed while performing communication, and a method for managing the network of the mobile computer that changes in such communication so that the communication contents can be correctly reached is required.

In general, when mobile communication is performed, a router (home agent) for managing destination data of the mobile computer is placed in the network to which the mobile computer belongs, and when the mobile computer moves, the current home agent for the home computer is set. Send a registration message indicating the location. When the registration message is received, the mobile computer sends data to the mobile computer by encapsulating the IP packet addressed to the original address of the mobile computer into the packet addressed to the current position address of the mobile computer via the home agent. Data is routed to the. For example, in FIG. 1, the mobile computer 2 that originally belonged to the home network 1a
Moves to another network 1b, and the network 1c
Home computer (HA) for the mobile computer 2 when communicating with another computer (CH) 3 in the
5 plays the role described above. This method is called Mobile IP, which is being standardized by the mobile-IP working group of IETF, which is an Internet standardization organization (reference: RFC2002, IP mo).
biliity support (C. Perkin
s)).

By the way, in the mobile IP system, when the mobile computer is moved to a new destination, the handling of the message issued by the mobile computer changes depending on the network to which the mobile computer has moved.

[0006] For example, if the gateway (firewall) located at the exit of the mobile computer moves to a network close to the home network of the mobile computer and the data packet is freely transmitted to the outside, the mobile I
It is possible to operate with the definition of P as it is.

On the other hand, in a general network that treats a mobile computer as staying (or invading) inside from the outside, it is dangerous to freely send the registration message issued by the mobile computer to the outside due to security considerations. It is determined that In this case, the mobile computer recognizes that it is currently in the network that treats itself as an intruder, performs the negotiation message exchange process corresponding to the identification to the gateway, and obtains the passage permission. It is necessary to send data packets. Further, in data transmission thereafter, it is necessary to add a negotiation message to the gateway for communication.

Generally, when a mobile computer moves to an external network that exchanges security information with a home network to which it belongs, a mobile computer sends a negotiation message to a packet relay device that relays a packet at the exit of the external network. If it is attached, thereafter, data can be safely transferred to the home network according to the security information exchanged in advance.

On the other hand, when the mobile computer moves to an external network that does not exchange security information with the home network to which it belongs, the mobile computer first negotiates with the packet relay device registered in itself. A packet with a message is transmitted (when the packet arrives at the relay device, the packet is thereafter safely transferred according to preset security information). However, also in this case, there may be a packet relay device that rejects the relay of the packet issued by the mobile computer in the middle of the route. If there is such a packet relay device, the relay device sends back a packet relay rejection message to the mobile computer. On the mobile computer side, the packet relay device that refuses to relay the packet cannot be located at any position on the network. If it is not determined whether it exists in the relay device, the negotiation message cannot be correctly added to the relay device.

However, the conventional mobile IP system alone does not define the routing of packets originating from the mobile computer based on such dynamic negotiation, and the mobile computer side also correctly attaches the negotiation message on the side of the packet relay device. I didn't want to send a rejection message with enough information for it.

[0011]

Conventionally, when a mobile computer communicates while maintaining security, and when moving to a network where security information is exchanged with a home network and performing communication, a predetermined method is used. According to it, I was able to communicate correctly. However, when the mobile computer moves to a network that does not exchange security information with the home network, the mobile computer sends data to the packet relay device that exchanges security information correctly with the home network registered in itself. After reaching the relay device, the process may be performed based on the registered security information. In this case as well, if the packet relay device existing in the middle of the route may refuse to relay the data packet, in that case,
Based on the rejection message from the packet relay device that rejected the data, the mobile computer determines whether or not the packet relay device exchanges security information with its own homenet, and based on that, a negotiation message for packet relay. Will be required. However, in the conventional mobile IP method, the mobile computer cannot negotiate with the packet relay device that refuses to relay the packet,
The packet could not reach the home network.

The present invention has been made in consideration of the above circumstances, and provides a mobile computer device, a relay device, and a data transfer method capable of performing secure communication regardless of where they move on a network. With the goal.

[0013]

The present invention (Claim 1) includes:
A mobile computer device capable of moving and communicating between mutually connected networks, and communication capable of maintaining a security maintaining relationship from a network (home network) to which the device itself belongs before moving. From the storage means that holds the address range information indicating the range of the other party's address, and the destination network in the network to which the device belongs from the destination network where the device itself is currently located, the entrance of the network to which the device belongs Means for transmitting data to which the negotiation information is added to the first relay device (packet relay device; packet encryption gateway) installed in the first relay device, and the second relay device (packet relay device; packet) on the way to the destination computer. From the encryption gateway), a passage refusal message (error message) for the transmission data is sent. When received, means for collating the address information of the second relay device with the address range information held in the storage means, and as a result of this collation, the address information of the second relay device is If it is not included in the address range information, the negotiation information for the second relay device is added before the negotiation information added to the transmission data that is denied passage, and the address of the second relay device is added. When the information is included in the address range information, the negotiation information for the second relay device is added after the negotiation information added to the transmission data that is denied passage, and the data is retransmitted. And means.

[0014] Preferably, when the passage refusal message is returned from the second relay device on the route to the data transmitted by the own device, key information for generating a mobile computer identifier in the relay device. It may further be provided with a unit for transmitting a message requesting the request, and a unit for generating the negotiation information based on the key information when the key information is returned from the relay device.

Preferably, when the negotiation information is added to the second relay device and retransmitted, and it is recognized that the data has been passed by the second relay device, the data is also transferred in the subsequent data communication. The negotiation information may be added to the data and transmitted.

[0016] Preferably, the negotiation information may be a mobile computer identifier obtained by using a predetermined function (for example, a hash function) based on the content of a predetermined portion of transfer data and the key information. .

Preferably, the passage refusal message may include information indicating passage refusal and address information of the second relay device. Preferably,
As the address range information stored in the storage means,
You may make it use what was obtained from the said 1st relay apparatus.

The present invention (claim 7) is a relay apparatus (packet relay apparatus; packet encryption gateway) installed at an arbitrary point on a mutually connected network, and permits passage of transfer data. The storage means for holding a passage permission list including information indicating the address range of the transmission source computer and the received data are exchanged between the transmission source address corresponding to the one included in the passage permission list and the own device. If it contains legitimate negotiation information,
A means for removing this negotiation information and transferring the data to the next-stage relay device or destination address on the network, and the received data corresponding to the source address or its own device that is included in the passage permission list. If it does not include at least one of the legitimate negotiation information exchanged between the two, a passage refusal message (error message) including the address information of the own device and the information indicating the passage refusal,
Means for returning the data to the transmission source computer.

[0019] Preferably, when a message for requesting key information for generating the negotiation information is received, a condition that a sender computer of the message must meet in order to accept the message and return the key information. When a message for requesting key information is received from the same computer after returning the passage refusal message and a storage unit that retains the indicated information, the requested key information is determined when the computer determines that the condition is satisfied. May be further provided.

Preferably, the negotiation information may be a mobile computer identifier obtained by using a predetermined function (for example, a hash function) based on the content of a predetermined portion of transfer data and the key information. .

The present invention (Claim 10) is a data transfer method in a mobile computer device capable of moving and communicating between mutually connected networks, wherein a destination network in which the device itself is currently located. Sends data with negotiation information to the first relay device installed at the entrance of the network to which the own device belongs to the destination computer in the network to which the own device belongs, and on the way to the destination computer When a passage refusal message for the transmission data is returned from the second relay device of
The address information of the relay device and the address range information indicating the range of the address of the communication partner with which the device can communicate in a security maintaining relationship from the network to which the device belongs before the movement are collated, and as a result of this collation, If the address information of the second relay device is not included in the address range information, the negotiation information for the second relay device is added before the negotiation information added to the transmission data that has been denied passage. However, when the address information of the second relay device is included in the address range information, the negotiation information for the second relay device is added after the negotiation information added to the transmission data rejected to pass. And add
The feature is that the data is transmitted again.

The present invention (Claim 11) is a data transfer method in a relay device installed at an arbitrary point on a mutually connected network, wherein when data to be transferred is received, the source of the data is transmitted. Whether or not the address is included in the passage permission list including the information indicating the range of the address of the transmission source computer which is permitted to pass the transfer data,
Also, it is checked whether or not the data includes the legitimate negotiation information exchanged between the data transmission source computer and its own device, and the received data corresponds to the source address and the self-addressed data included in the passage permission list. If it contains valid negotiation information to exchange with the device, remove this negotiation information and transfer the data to the next stage relay device or destination address on the network, and the received data is the passage permission. If the address does not include at least one of the source address corresponding to the one included in the list and the legitimate negotiation information exchanged with the own device, the pass including the address information of the own device and the information indicating the passage refusal. It is characterized in that a rejection message is returned to the transmission source computer of the data.

It should be noted that the present invention relating to the apparatus also holds as the invention relating to the method, and the present invention relating to the method also holds as the invention relating to the apparatus. Further, the above invention is also realized as a machine-readable medium in which a program for causing a computer to execute a corresponding procedure or means is recorded.

According to the present invention, when a message indicating that the data packet sent from the destination by the mobile computer from the destination is passed by the relay device on the route is returned, the passage is rejected from the reply message. By obtaining the position of the relay device on the network and adding an appropriate negotiation message code accordingly, it is possible to carry out secure communication no matter where the mobile computer moves on the network.

[0025]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 shows an example of the basic configuration of the communication system according to this embodiment. The communication system of FIG. 1 is assumed to support communication of mobile computers by mobile IP (reference: IETF RFC2002). In the mobile IP protocol, it is assumed that there is a router called a foreign agent that carries out packet delivery in the destination network, and when the mobile computer itself also serves as a foreign agent.
Although it may be called -of address mode, in the present embodiment, the latter assumption is assumed and there is no foreign agent.

In FIG. 1, the home network 1a, the first
The other department network 1b and the second other department network 1c are connected to each other via the Internet 6, and the mobile computer (MN) 2 and the communication partner host (CH) 3 of the mobile computer are provided in these networks. Alternatively, it is connected to the Internet 6 as an external node.

In this embodiment, a mobile computer (M) having a home position inside the network 1a of FIG.
N) 2 and its correspondent computer (CH) 3 will be mainly described in the packet communication. Therefore, in FIG. 1, the network 1a is referred to as a home network, the network 1b,
1c is shown as a home network of another department.

The home network 1a, the first other department network 1b, and the second other department network 1c include
Home agents (HA) 5a, 5b, and 5c for supporting the mobile IP protocol are installed respectively (however, in the present embodiment, it is assumed that the mobile computer 2 originally existed in the home network, and therefore the other department networks). Home agents 5b and 5c of 1b and 1c
Is not involved in the explanatory communication).

Further, it is assumed that the networks 1a, 1b, 1c are respectively provided with packet relay devices 4a, 4b, 4c for subjecting input packets to predetermined packet processing and transferring them. In this embodiment, the packet relay device 4
It is assumed that a, 4b, and 4c have a packet encryption authentication processing function. The mobile computer 2 has a packet encryption authentication processing function at least during movement (in the figure, the mobile computer 2 which performs the packet encryption authentication processing by itself is represented by MN ⁺ ). Note that GW and GWi (i is a number or symbol) indicate a packet relay device (packet encryption gateway; hereinafter abbreviated as gateway).

The encryption / decryption of communication data in the packet encryption authentication process is described in, for example, the document (IETF).
It can be realized by the method shown in RFC1825, 1827). In addition, in the packet encryption authentication process, the addition / check of the negotiation code with the end and the negotiation code with the next stage (the hash function value generated from the contents of the transfer packet and the generation key) is performed by, for example, a specification called IP security. It is possible to define it by an authenticator and packet encryption using (Reference: IETF RFC1825-282).
9).

Further, the gateway in this embodiment holds a passage permission list including a source address which permits passage of a packet. The gateway is
Packets from sources that are not included in this passage permission list will be denied passage.

Further, when the gateway in this embodiment receives a message for requesting the key information from the mobile computer 2, the sender computer of the message should satisfy the message in order to accept the message and return the key information. Information that indicates the conditions shall be retained.

The condition of whether or not the gateway 4b passes the public key information to the key request message depends on the security policy managed by the gateway. For example: Check the user identification information (user affiliation information) added to the key request message in a predetermined format, and if it is an in-house user, return the key information. -If the user is an outside user, the key information is passed if the user is within a predetermined organization. -In other cases, if the user is a pre-registered user, the key information is passed. Such a rule is registered in the gateway.

FIG. 2 shows a packet format processed by each gateway. (A) is a normal IP packet format. (B) is an encryption / terminal authentication format, which is a format for encrypting and authenticating packets between terminal gateways (terminals) or between an end gateway and a mobile computer.

(C) is an encryption / inter-route authentication format, which is used when authentication is required between gateways on the way, and between gateways on the way-mobile computer.

(D) is a mobile IP format, which is a packet format in which the home agent performs route control to the mobile computer. In (b) and (c) above, the key information header is header information including information used by the receiving side to obtain a key used for authentication processing and a key used for decryption processing. For example, when the above-mentioned key is generated from the packet processing key, the packet processing key encrypted with the master key shared between the nodes performing authentication is written. In addition, if necessary, information for designating an authentication algorithm, a data encryption algorithm, and a key encryption algorithm is written.

The authentication header is header information containing authentication data generated using a predetermined key (for example, the authentication key generated from the packet generation key). The encrypted header is
Header information including information that specifies an algorithm for decrypting internal data (in this case, the internal IP header and its data part) encrypted using a predetermined key (for example, the encryption key generated from the packet generation key) is there.

The internal IP protocol is an encapsulated packet, and is composed of an internal IP header including a source address and a destination address of a computer for communication and its data portion. For example, TCP or UDP format or IP format.

As the authentication data used by the gateway and the mobile computer, for example, a one-way hash function value (for example, Ke
yed MD5 method) or the like can be used.

The master key shared between the two gateways or between the gateway and the mobile computer is
For example, it can be generated by exchanging the secret key or by deriving the public key and the secret key (for example, the Diffie-Hellman method).

Several examples of packet transfer will be described. As described above, the gateway refers to the passage permission list to determine whether to permit or deny the passage of the packet, and also inspects the authentication code to determine whether to permit or deny the passage of the packet. (It is a passing condition that both of the above are satisfied). However, in the following, the condition regarding the passing permission list is satisfied, and the description regarding the passing permission list is omitted.

First, when the mobile computer 2 moves to a network protected by the gateway GW, the flow of processing when transmitting a packet to the communication partner 3 in the home network 1a will be described with reference to FIG. Here, in FIG. 3A, GW (N) is a gateway 4a of the home network 1a, GW1 is a gateway of a destination network (not shown), and GW2 to GW (N-.
1) indicates a gateway (not shown) in the middle of the route. Here, it is assumed that the gateways GW on the route are exchanging authentication key information for negotiation with each other. It is also assumed that each gateway GW knows the address range of the partner node with which it can communicate with security.

At the time of reconnection to the destination net, the mobile computer 2 has no knowledge of the surrounding network environment. First, as shown in FIG. 3B, a plaintext packet ( 2 (a) format) is transmitted.
Receiving this, the gateway GW1 returns an error message to the mobile computer 2 because the negotiation code necessary for passing through the gateway GW1 is not added to the packet.

Next, the mobile computer 2 and the gateway GW1
Necessary key information is exchanged between the two, and the negotiation code between the routes is calculated. The negotiation code between the routes is indicated by N (M, 1). In the negotiation code, M represents a mobile computer, and the values 1 to N represent the values next to the GW).

Next, as shown in FIG. 3C, the mobile computer 2
When the packet (the format of FIG. 2B) in which the internal packet is encrypted and the negotiation code N (M, 1) is added is transmitted to the gateway GW1, it can pass through the gateway GW1 this time. After that, the packets are transferred from the gateway GW2 to the gateway GW (N-1) based on the preset information. That is, the gateway GW1
End-to-end negotiation code E (M, N) with gateway GW (N), which is the end in packet encryption authentication.
Is added to the packet, the negotiation code N (1, 2) between the routes to the next-stage gateway GW2 is added, and this packet (the format of FIG. 2C) is transferred. The gateway GW2 inspects the negotiation code N (1,2) with the preceding-stage gateway GW1 and removes it, and instead, negotiates the negotiation code N between the paths with the next-stage gateway GW3.
Since (2, 3) is added and the negotiation code between the ends is already added, the packet is transferred to the next-stage gateway GW3 without performing any processing regarding the negotiation code between the ends. Thereafter, in the same manner, packets are transferred between the gateways one after another, and finally, the gateway GW (N) receives the negotiation code N (N-1, N) between the routes and the negotiation code E (M, N) between the ends. The added packet arrives.

When the packet reaches the gateway GW (N), the gateway GW (N) inspects the negotiation message with the gateway GW (N-1) in the preceding stage, and then extracts the packet inside. Next, when the negotiation code between the ends is checked, the negotiation code between the ends of the mobile computer 2 and the gateway GW (N) is not added, so an error occurs again here. And the gateway GW (N)
Returns an error message containing information necessary for the negotiation code between the terminals, as shown in FIG.

Mobile computer 2 that received the error message
Then, this time, the negotiation code E (M, N) between the terminals with the gateway GW (N) can be calculated from the information necessary for the negotiation code between the terminals.

Thus, the mobile computer 2, as shown in FIG. 3D, is a route between the negotiation code E (M, N) between the end points with the gateway GW (N) and the next-stage gateway GW2. If the packet (the format of FIG. 2 (c)) with the negotiation code N (1,2) added is retransmitted, the gateway G
Negotiation codes between the routes are exchanged at W2 to GW (N-1), packets are transferred one after another, and the packet can now correctly reach the gateway GW (N).

In the gateway GW (N), the negotiation code E (M, N) between the end points and the preceding-stage gateway G
W (N-1) and negotiation code N (N-1,
N) is inspected and then these are removed, and the internal packet (the format of FIG. 2A) is decoded and the destination computer (CH) 3
Transfer to.

Next, referring to FIG. 4, the mobile computer 2
A description will be given of the flow of processing when a packet is transmitted to the communication partner 3 (in the network 1e in FIG. 4) when the packet has moved to a position that does not belong to the organization protected by the specific gateway GW.

In this case, the mobile computer 2 must be preset to enable secure communication from the destination to at least one of the gateways GW with which the mobile computer 2 can communicate safely. That is, FIG.
Then, it is assumed that the network 1a is the home network of the mobile computer and the networks 1d and 1e are networks capable of communicating with the home while maintaining security. In this case, the mobile computer 2 is loaded with the information necessary for secure communication with at least one of the gateway 4a, the gateway 4d, and the gateway 4e.

The mobile computer 2 uses this gateway GW.
A packet is transmitted in the encrypted / end-point authentication format shown in FIG. 2B to (for example, the gateway 4d). The gateway 4d interprets this and, until the final destination, see FIG.
Packets including inter-route authentication are transferred in the same manner as the procedure of (the gateway 4d corresponds to the GW 1 of FIG. 3A,
The gateway 4e corresponds to GW (N) in FIG.

Up to now, all gateways G
It has been described on the assumption that W are exchanging the necessary security information with each other. However, in general, there may be a gateway GW that does not exchange security information.

FIG. 5 shows an example where the mobile computer 2 moves to such a security isolated network. In FIG. 5A, the other department net is the network 1b of FIG. 1, the destination net is the home network 1a, the GW (N) is the gateway 4a of the home network 1a, and the GW1 is the gateway 4b of the network 1b.
Shall be indicated. Here, it is assumed that the gateway GW1 of the network 1b to which the mobile computer 2 has moved has not exchanged security information with the home network 1a to which the mobile computer originally belonged. In addition, the mobile computer 2 has information on an address range in which the mobile computer 2 can maintain communication with security.

First, as in the case of FIG. 4, the mobile computer 2 encrypts the internal packet to the gateway GW (N) at the entrance of the home network 1a as shown in FIG. 5 (b) and negotiates the negotiation code E ( A packet (M, N) added (format shown in FIG. 2B) is transmitted. When this packet reaches the destination gateway GW1, the gateway GW1
In No. 1, since the negotiation code necessary for passing through the gateway GW1 is not added to the packet, an error message is returned.

Here, the error message includes the address information of the gateway GW1, and the mobile computer 2
From this address and the address range information that can be communicated while maintaining its own security, it can be seen that this error message is from a gateway that has not exchanged security information in advance. Therefore, it is necessary to add the negotiation code for the gateway GW1 to the packet and transmit the packet.

Then, the mobile computer 2 uses the gateway G
Necessary key information is exchanged with W1 to calculate a negotiation code between routes, and as shown in FIG. 5 (c) (FIG. 7 (a)),
The negotiation code N (M, 1) is further added to the outside of the packet for the gateway GW (N), and the packet (FIG. 2) is added.
(Format of (c)) is transmitted.

Gateway GW1 which received this packet
Examines the negotiation code N (M, 1) and removes it,
Internal gateway GW (N) addressed packet (Fig. 2 (b))
Format).

It should be noted that here, for the mobile computer which does not exchange security information, the gateway GW supports the transfer of the packet to the outside according to the exchange of the key information when the mobile computer satisfies a certain condition. However, the encryption / authentication by the negotiation code between the routes thereafter is not supported.

Gateway GW receiving this packet
(N) inspects the negotiation code E (M, N) between the ends and then removes it, and an internal packet (format of FIG. 2A).
Is decrypted and transferred to the destination computer (CH) 3.

Next, in FIG. 5, between the mobile computer 2 and the gateway GW1 and / or the gateway GW1.
A case where another gateway GW exists between the gateways GW (N) and / or between the gateway GW (N) and the communication partner 3 will be described. Here, as shown in FIG. 6A, the gateway GW (P) is located between the mobile computer 2 and the gateway GW1, the gateway GW (Q) is located downstream of the gateway GW1, and the gateway GW is located downstream of the gateway GW (N). The case where (S) is present will be described.

(I) First, as in the case of FIG. 5, the mobile computer 2 encrypts the internal packet and sets the negotiation code E (M, N) to the gateway GW (N) at the entrance of the home network 1a. The added packet (format of FIG. 2B) is transmitted.

When this packet reaches the gateway GW (P), the gateway GW (P) does not add the negotiation code necessary for passing through the gateway GW (P), and returns an error message. (FIG.6 (b)).

Here, the error message includes the address information of the gateway GW (P), and the mobile computer 2 uses this address and the address range information that it can carry out communication while maintaining its own security. It can be seen that this error message comes from a gateway that has not previously exchanged security information. Therefore,
It is necessary to add a negotiation code for the gateway GW (P) to the packet and transmit the packet.

(Ii) The mobile computer 2 is the gateway GW
Necessary key information is exchanged with (P) to calculate a negotiation code between routes, and the negotiation code N (M, P) is further added to the outside of the packet for the gateway GW (N). (The format of FIG. 2C) is transmitted.

Gateway GW receiving this packet
(P) inspects the negotiation code N (M, P) and then removes it, and the packet addressed to the internal gateway GW (N) (see FIG. 2).
(B) format) is transferred.

When this packet reaches the gateway GW1, since the negotiation code necessary for passing through the gateway GW1 is not added to the packet in the gateway GW1, an error message is returned (FIG. 6).
(B)).

Here, the error message includes the address information of the gateway GW1, and the mobile computer 2
From this address and the address range information that can be communicated while maintaining its own security, it can be seen that this error message is from a gateway that has not exchanged security information in advance. Therefore, it is necessary to add the negotiation code for the gateway GW1 to the packet and transmit the packet.

(Iii) The mobile computer 2 is the gateway GW
Necessary key information is exchanged with 1 to calculate the negotiation code N (M, 1) between the routes, and the negotiation code N (M, P) is negotiated outside the packet to the gateway GW (N). The code N (M, 1) is added and the packet is transmitted.

Gateway GW receiving this packet
(P) inspects the negotiation code N (M, P), removes it, and transfers the packet addressed to the gateway GW (N) to which the negotiation code N (M, 1) is added.

Gateway GW1 which received this packet
Examines the negotiation code N (M, 1) and removes it,
The packet addressed to the internal gateway GW (N) is transferred.
When this packet reaches the gateway GW (Q), the gateway GW (Q) adds the packet to the gateway G.
Since the negotiation code necessary for passing through W (Q) is not added, an error message is returned (Fig. 6).
(B)).

Here, the error message includes the address information of the gateway GW (Q), and the mobile computer 2 uses this address and the address range information that it can carry out communication while holding the security. It can be seen that this error message comes from a gateway that has not previously exchanged security information. Therefore,
It is necessary to add a negotiation code for the gateway GW (Q) to the packet and transmit the packet.

(Iv) The mobile computer 2 is the gateway GW
Necessary key information is exchanged with (Q) to calculate the negotiation code N (M, Q) between routes, and as shown in FIG. 7B, outside the packet for the gateway GW (N). The negotiation code N (M, P), the negotiation code N (M, 1) and the negotiation code N (M, Q) are added to the packet and the packet is transmitted (FIG. 6 (c)).

Gateway GW receiving this packet
For (P), the negotiation code N (M, P) is inspected and then removed, and the negotiation code N (M, 1) and the negotiation code N (M, P).
The packet addressed to the gateway GW (N) to which Q) is added is transferred (FIG. 6 (c)).

Gateway GW1 which received this packet
Examines the negotiation code N (M, 1) and removes it,
Gateway GW with negotiation code N (M, Q) added
(N) Transfer the addressed packet.

Gateway GW that received this packet
(Q) inspects the negotiation code N (M, Q) and then removes it, and transfers the packet addressed to the internal gateway GW (N) (FIG. 6 (c)).

As described above, for the gateway GW (P), the gateway GW1, and the gateway GW (Q), the negotiation message based on the route authentication similar to the case of FIG. 5 and the error message to the mobile computer 2 are returned. (P) → GW1 → GW (Q) are sequentially assigned from the outside (the GW address information given to these GW error messages does not match the security retention address information of the mobile computer 2). Therefore, the packet addressed to the gateway GW (N) can be passed through the gateway GW (Q) by transmitting the data packet as shown in FIG. 6 (c).

Now, when the packet having passed through the gateway GW (Q) reaches the gateway GW (N), the gateway GW (N) negotiates the negotiation code E between the terminals.
(M, N) is inspected and then removed, and the internal packet (the format of FIG. 2A) is decoded and the destination computer (CH) 3
Transfer to.

When the packet reaches the gateway GW (S), the gateway GW (S) does not add the negotiation code between the ends of the mobile computer 2 and the gateway GW (S). . Then, the gateway GW (S), as shown in FIG.
Returns an error message.

The mobile computer 2 can determine that the gateway GW (S) is in the address area where security is held with the home network from the address range information which the mobile computer 2 can hold and communicate with while maintaining security.

When an error message is received from such a gateway GW, the mobile computer 2 returns the error message to the gateway GW (in this case, G
The end-to-end authentication with W (S) is performed, and the packet format is changed to perform inter-route authentication with the gateway GW (in this case, GW (N)) that has performed end authentication until then. To do. This modified packet format is shown in Figure 7.
It shows in (c).

(V) As shown in FIG. 7C, the mobile computer 2 encrypts the internal packet and authenticates the authentication code E (M,
S) is added to the outside of the packet for the gateway GW (S), the negotiation code N (M, P) and the negotiation code N
(M, 1) and negotiation code N (M, Q) and negotiation code N
A packet is transmitted with (M, N) added (see FIG. 6).
(D)).

Gateway GW receiving this packet
For (P), the negotiation code N (M, P) is inspected and then removed, and the negotiation code N (M, 1) and the negotiation code N (M, P).
The packet addressed to the gateway GW (N) to which Q) and the negotiation code N (M, N) are added is transferred.

Gateway GW1 receiving this packet
Examines the negotiation code N (M, 1) and removes it,
The packet addressed to the gateway GW (N) to which the negotiation code N (M, Q) and the negotiation code N (M, N) are added is transferred.

Gateway GW receiving this packet
(Q) inspects and removes the negotiation code N (M, Q), and transfers the packet addressed to the gateway GW (N) to which the negotiation code N (M, N) is added.

Gateway GW that received this packet
(N) inspects the negotiation code N (M, N) and then removes it, and transfers the packet addressed to the internal gateway GW (N). Then, the gateway GW (S) inspects and negates the negotiation code E (M, S) between the terminals, decodes the internal packet (the format of FIG. 2A), and sends it to the destination computer (CH) 3. Forward.

By the way, the negotiation code with each gateway GW is a one-way hash function calculated from the key information shared between the mobile computer 2 and the gateway GW and the contents of a predetermined part (all or part) of the internal packet. You can use an authentication code (mobile computer identifier) such as
Also, once a passage refusal message (error message) is returned from the gateway GW in the middle of the route, a message requesting key information for the mobile computer identifier is sent to the gateway GW, the returned key information is used, and The authentication code of the mobile computer can be calculated and added as a negotiation message to the second message and transmitted.

For example, the registration message (registration request) of FIG. 8 is used as the first message.
st) is transmitted. This message is rejected by the gateway GW on the way, and the passage refusal message (f
It is assumed that an email message) has been returned. In this case, a key inquiry message (Key request) is generated as shown in FIG. 10 using the address of the gateway GW included in the passage refusal message.

In response to this request, the key reply message (Key reply) of FIG. 11 returned from the gateway.
When the key shared by the gateway GW and the mobile computer is obtained by, the registration message of FIG. 12 is transmitted as the second message.

Since this message is addressed to the gateway that returned the above passage refusal message and the authentication code AH for this gateway is added to this message, that gateway performs the authentication process, and if this succeeds, the message is Can pass KEY is a header containing key information shared by both parties.

As described above, in the present embodiment, when the mobile computer moves to the destination network that does not have a security relation with the home network to which the mobile computer originally belongs and the route is determined by the negotiation code, the gateway included in the error message. Packets can be shaped by an appropriate negotiation code attachment method based on the address information of the mobile computer, and no matter where the mobile computer moves or how the gateway is arranged on the route, the correct mobile computer is generated. Packet processing is possible.

The present invention can be applied not only to the mobile IP shown in RFC2002, but also to various other mobile communication protocols. Further, methods other than the encryption processing and the authentication processing shown in this embodiment can also be used.

Each of the above functions can be realized as software. It is also possible to implement it as a machine-readable medium in which a program for causing a computer to execute the above-mentioned procedures or means is recorded. The present invention is not limited to the above-described embodiments, but can be implemented with various modifications within the technical scope thereof.

[0094]

According to the present invention, when a message indicating that the data packet sent from the destination by the mobile computer from the destination is rejected by the packet relay device on the route, the message is rejected from the reply message. No matter where the mobile computer moves on the network, by finding the position of the packet relay device on the network and adding an appropriate negotiation message code accordingly.
It becomes possible to perform secure communication.

[Brief description of drawings]

FIG. 1 is a diagram showing an example of a basic configuration of a communication system according to an embodiment of the present invention.

FIG. 2 is a diagram showing an example of a packet format.

FIG. 3 is a diagram for explaining a communication procedure.

FIG. 4 is a diagram for explaining a communication procedure.

FIG. 5 is a diagram for explaining a communication procedure.

FIG. 6 is a diagram for explaining a communication procedure.

FIG. 7 is a diagram showing an example of a packet format.

FIG. 8 is a diagram showing an example of a format of a registration message.

FIG. 9 is a diagram showing an example of a format of a passage refusal message.

FIG. 10 is a diagram showing an example of a format of a key inquiry message.

FIG. 11 is a diagram showing an example of a format of a key response message.

FIG. 12 is a diagram showing an example of a format of a registration message.

[Explanation of symbols]

1a, 1b, 1c, 1d, 1e ... Network 2 ... Mobile calculator 3 ... Communication host 4a, 4b, 4c, 4d, 4e ... Packet relay device 5a, 5b, 5c ... Home agent 6 ... Internet

─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Etsuyuki Tsuda 1 Komukai Toshiba Town, Komukai-ku, Kawasaki City, Kanagawa Prefecture, Research & Development Center, Toshiba Corp. (72) Toshio Okamoto Toshiba, Komukai-shi, Kawasaki City, Kanagawa Machi No. 1 in Toshiba Research and Development Center Co., Ltd. (56) Reference JP-A-4-138740 (JP, A) JP-A-59-62245 (JP, A) JP-A-10-243012 (JP, A) JP 10-136014 (JP, A) JP-A-6-209313 (JP, A) JP-A-9-261265 (JP, A) JP-A-9-293052 (JP, A) (58) Fields investigated (Int .Cl. ⁷ , DB name) H04L 12/00-12/28 H04L 12/44-12/66

Claims (11)

(57) [Claims] 1. A mobile computer device capable of moving and communicating between mutually connected networks, the communication partner being capable of communicating in a security relationship from a network to which the own device belongs before moving. Address range information indicating the address range of the device, and from the network where the device is currently located, to the destination computer in the network to which the device belongs, installed at the entrance of the network to which the device belongs. And transmits the transmission data with the first negotiation information added to the first relay device .
When a communication refusal message for the transmission data is returned from the first transmitting means and the second relay device installed on the way to the destination computer, the address information of the second relay device and the Means for collating with the address range information held in the storage means, and the address information by the collation is the address information range.
If it is not included in the range, the first negotiation information is added before the first negotiation information.
The second negotiation information for the second relay device is added, and
Before if the dress information is included in the address information range
The second negotiation information is added after the first negotiation information.
A second transmitting means for retransmitting the transmission data . 2. The communication refusal message from the second relay device.
Means for transmitting a request message requesting key information to the second relay device when a sage is returned , and the returned key when the key information is returned from the second relay device The second negotiation information based on the information
The mobile computer device according to claim 1, further comprising: a unit that generates and passes the number to the second transmitting unit . 3. When the second transmission data is recognized to have been passed by the second relay device, the second negotiation information is added to the transmission data and the data is transmitted in the subsequent data communication. The mobile computer device according to claim 1 or 2, characterized in that. 4. The method of claim 2 wherein the second negotiation information is characterized in that it is a mobile computer identifier was determined using predetermined functions based on the contents and the key information of a predetermined portion of the transfer data The mobile computer device described in. 5. The mobile computer device according to claim 1, wherein the passage refusal message includes information indicating passage refusal and address information of the second relay device. 6. The mobile computer device according to claim 1, wherein the address range information stored in the storage means is obtained from the first relay device. . 7. A relay device installed at an arbitrary point on a mutually connected network, which holds a passage permission list including information indicating an address range of a transmission source computer which permits passage of transfer data. And the received data includes the source address corresponding to the one included in the passage permission list and the legitimate negotiation information exchanged with the own device, the negotiation information is removed. , A means for transferring data to the next-stage relay device or destination address on the network, and the source data corresponding to those included in the passage permission list or the legitimate device for exchanging the received data. If it does not include at least one of the negotiation information, a passage refusal message including the address information of the own device and the information indicating the passage refusal is displayed as the deny message. Relay apparatus characterized by comprising a means for returning to the source computer for data. 8. When the message for requesting the key information for generating the negotiation information is received, it indicates the condition that the sender computer of the message must meet to accept the message and return the key information. When a message for requesting key information is received from the same computer after returning the passage refusal message, a storage unit that retains information, and when the computer determines that the condition is satisfied, the requested key information is returned. The relay device according to claim 7, further comprising a returning unit. 9. The negotiation information according to claim 8, wherein the negotiation information is a mobile computer identifier obtained by using a predetermined function based on the content of a predetermined portion of transfer data and the key information. Relay device. 10. A data transfer method in a mobile computer device capable of moving and communicating between mutually connected networks, wherein the device belongs to a network to which the device is currently located. To the destination computer in the network, the data including the negotiation information for the first relay device installed at the entrance of the network to which the device belongs is transmitted, and the second relay device on the way to the destination computer transmits the data. , When the passage refusal message for the transmission data is returned, the address information of the second relay device and the address of the communication partner with which the device to which the device belongs before moving can be maintained in a security maintaining relationship. The address range information indicating the range is collated, and as a result of this collation, the address information of the second relay device is compared with the address range information. If this is not intended to be included,
The negotiation information for the second relay device is added before the negotiation information added to the transmission data whose passage is rejected,
When the address information of the second relay device is included in the address range information, the negotiation information for the second relay device is added after the negotiation information added to the transmission data that has been denied passage. Then, the data transfer method is characterized by transmitting the data again. 11. A data transfer method in a relay device installed at an arbitrary point on a mutually connected network, wherein when data to be transferred is received, the source address of the data is the transfer data passage. Whether or not it is included in the passage permission list including the information indicating the range of addresses of the transmission source computer that permits the data, and the legitimate negotiation information exchanged between the data transmission source computer and the own device. If the received data includes the source address corresponding to the one included in the passage permission list and the legitimate negotiation information exchanged with the own device, the negotiation information is removed. Then, the data is transferred to the next-stage relay device or destination address on the network, and the received data corresponds to the one included in the passage permission list. When the data does not include at least one of the sender address and the legitimate negotiation information exchanged with the own device, a passage refusal message including the address information of the own device and the information indicating the passage refusal is transmitted as the data. A data transfer method characterized by sending a reply to the original computer.