JP4682020B2 - Equipment with data communication function - Google Patents

Description

  The present invention relates to a device having a data communication function such as IPsec (Internet Protocol security).

  There is a protocol called IPsec as a security technique that can be generally used in a TCP / IP (Transmission Control Protocol / Internet Protocol) environment. This is a secure communication protocol implemented by Layer 3 and supports two types of functions: an encryption function that prevents the contents of communications from third parties from being watched and an authentication function that avoids session hijacking by third parties.

  IPsec basically secures communication between two points, and in order to realize this, it is necessary that both two points performing communication correspond to IPsec. Communication is not possible when only one side is compatible with IPsec.

  In IPsec, hosts that are IPsec targets and communication details thereof are stored in storage areas called SAD (Security Association Database) and SPD (Security Policy Database). If IPsec is set for SAD and SPD, communication is immediately secured.

On the other hand, Patent Document 1 discloses a technique for setting a security policy in a device using IPsec.
JP 2005-130096 A

  By the way, when trying to perform IPsec communication between two devices that are not set for IPsec, if one device is set to perform IPsec communication, the set device suddenly needs IPsec communication. become. At this point, since the other device has not yet been set for IPsec, communication between both devices suddenly becomes impossible.

  In particular, when performing IPsec setting of the other device by remote operation from one device, the IPsec setting is made at the other device almost simultaneously with the transmission of a packet requesting IPsec setting, and an IPsec response is returned. Therefore, the requester cannot receive the response. Therefore, it cannot be distinguished from the case where a response is not returned due to some failure, and the IPsec setting request cannot be terminated normally.

  On the other hand, if the requesting device is set for IPsec first, it cannot communicate with the other device in the first place, and a packet requesting IPsec setting cannot be transmitted.

  The present invention has been proposed in view of the above-mentioned conventional problems, and the object of the present invention is to eliminate the sudden communication inability when setting security communication such as IPsec, and to properly set the security communication. An object of the present invention is to provide a device having a data communication function that can be performed.

In order to solve the above problems, according to the present invention, as described in claim 1, a device having a security communication function, a holding unit for holding a setting of security communication, and a security communication from the outside Receiving means for accepting the setting request, and setting means for enabling the setting of the security communication related to the setting request to be immediately activated at a predetermined timing without immediately enabling the setting to the holding means, and the setting means Temporarily holds the security communication settings related to the above setting request, sets a part or all of the modified settings in the holding means, and at the subsequent predetermined timing, the correct contents of the modified setting part The gist of the apparatus has a data communication function that reflects the above in the holding means .

According to a second aspect of the present invention, in the device having the data communication function according to the first aspect, after the setting means receives the setting request, the setting means performs security communication related to the setting request after a predetermined time. The setting can be reflected in the holding means.

According to a third aspect of the present invention, in the device having the data communication function according to the first aspect, the setting means accepts the setting request when a specific time is reached after receiving the setting request. Such security communication settings can be reflected in the holding means.

According to a fourth aspect of the present invention, in the device having the data communication function according to the first aspect, after the setting means receives the setting request, the setting means externally passes a communication path that is not a security communication target. When the validation request is received, the security communication setting related to the setting request can be reflected in the holding means.

In addition, as described in claim 5 , in the device having the data communication function according to any one of claims 1 to 4 , the accepting unit sets security communication from a device that is a partner of security communication. Requests can be accepted.

Further, as described in claim 6 , in the device having the data communication function according to any one of claims 1 to 4 , the accepting unit is configured to perform security from a device other than the device that is a partner of the security communication. It is possible to receive a communication setting request.

According to a seventh aspect of the present invention, there is provided a method for controlling a device having a security communication function, the step of accepting a security communication setting request from the outside, and the security communication setting related to the setting request immediately security. Without enabling the holding means for holding the communication setting, and enabling it at a predetermined timing after the fact . The enabling step temporarily sets the security communication setting related to the setting request. Control of a device having a data communication function that retains, sets a part or all of the settings in the retaining unit, and reflects the regular contents of the modified setting part on the retaining unit at a predetermined timing afterwards It can be configured as a method.

  In the device having the data communication function of the present invention, it is possible to eliminate the sudden communication disabled state when setting security communication such as IPsec, and to normally set security communication.

  Preferred embodiments of the present invention will be described below with reference to the drawings.

<First Embodiment>
FIG. 1 is a diagram showing a configuration example according to a first embodiment of a device having a data communication function of the present invention.

  In FIG. 1, a device (A) 1 and a device (B) 2 are connected via a network 3.

  The device (A) 1 includes an input / output unit 11 that inputs / outputs data using a normal IP address, and an IPsec that performs IPsec setting at a predetermined timing when receiving an IPsec setting command from the outside via the input / output unit 11 By the setting unit 12, the IPsec target IP address holding unit 13 that holds the IPsec target IP address in the instructed IPsec setting, the IPsec setting holding unit 14 such as SAD / SPD that holds the IPsec setting, and the IPsec setting unit 12 And a timer unit 15 that measures a certain time from the reception of the IPsec setting command or detects that a specific time has been reached.

  The device (B) 2 has an input / output unit 21 for inputting / outputting data using a normal IP address, an IPsec setting command transmitting unit 22 for transmitting an IPsec setting command to an external device, and an IPsec setting of its own device. An IPsec setting unit 23 for performing the setting and an IPsec setting holding unit 24 such as SAD / SPD for holding the IPsec setting are provided.

  Initially, the IPsec target IP address holding unit 13 of the device (A) 1 is blank, and the IPsec setting holding unit 14 is not set. Further, it is assumed that the IPsec setting holding unit 24 of the device (B) 2 is in an unset state.

  Now, the device (A) 1 and the device (B) 2 are in a state in which IPsec is not set, and when trying to perform IPsec conversion by the conventional technology, details of the IPsec communication of the device (A) 1 are described in the device (B) 2. As soon as communication is performed from the device (1), the device (A) 1 performs IPsec communication. If the device (A) 1 is set as IPsec mandatory, the device (A) 1 will only allow IPsec communication as soon as it is set, and the device (B) 2 has not yet been set up for IPsec. As soon as the IPsec setting is performed, the device (A) 1 and the device (B) 2 become incapable of communication, and the response to the IPsec setting request cannot be received, so that the IPsec setting process cannot be terminated normally. The present invention solves this problem.

  FIG. 2 is a diagram illustrating an example of IPsec setting processing according to the first embodiment.

  In FIG. 2, first, the IPsec setting command transmission unit 22 of the device (B) 2 transmits an IPsec setting command to the device (A) 1 via the input / output unit 21 (step S101). In this IPsec setting command, the setting of the IP address of the device (B) 2 or the address block including the device (B) 2 is described as “the communication with the device B (own device) is changed to IPsec”. Has been.

  The IPsec setting unit 12 of the device (A) 1 receives this IPsec setting command via the input / output unit 11 (step S102).

  Next, the IPsec setting unit 12 of the device (A) 1 performs IPsec setting in accordance with the IPsec setting command in the IPsec setting holding unit 14, but sets (temporary setting) an invalid IP address for the IPsec target IP address, The IPsec target IP address (the IP address of the device B or an address block including the device B) is held in the IPsec target IP address holding unit 13 (step S103). At this time, the device (A) 1 does not require IPsec for communication with the device (B) 2. For this reason, IPsec is not required for the communication of the IPsec setting command performed from the device (B) 2 to the device (A) 1, and the communication is normally performed and the communication is terminated.

  In addition, the IPsec setting unit 12 of the device (A) 1 activates the timer unit 15 and waits for the elapse of a predetermined time or the arrival of a specific time (step S104). FIG. 3 is a diagram showing a state in which an IPsec setting request is made from the device (B) 2 to the device (A) 1, and the IPsec setting of the device (A) 1 has been performed, but there is no IPsec target IP address ( Disabled). In addition, the IPsec setting of the device (B) 2 is not performed.

  Next, returning to FIG. 2, when the timer unit 15 of the device (A) 1 detects the elapse of a predetermined time or the arrival of a specific time, the IPsec setting unit 12 has the normal IP address held in the IPsec target IP address holding unit 13. An IPsec target IP address (IP address of device B or an address block including device B) is acquired and set in the IPsec setting holding unit 14 (step S105). As a result, the device (A) 1 needs to be IPsec for communication with the device (B) 2.

  In parallel with this, the IPsec setting unit 23 of the device (B) 2 performs its own IPsec setting to the IPsec setting holding unit 24 (step S106). FIG. 4 is a diagram illustrating a state in which IPsec setting is performed after a predetermined time has elapsed since the temporary setting of IPsec. The IPsec setting of the device (A) 1 has been performed, and the IPsec target IP address is the device B. The IPsec setting of the device (B) 2 has been performed, and the IPsec target IP address is the device A.

  With the above procedure, the device (A) 1 and the device (B) 2 are ready to communicate by IPsec.

  Then, returning to FIG. 2, IPsec communication is performed between the device (A) 1 and the device (B) 2 (steps S107 and S108). FIG. 5 is a diagram illustrating a state in which IPsec communication can be performed between the device (A) 1 and the device (B) 2.

<Second Embodiment>
FIG. 6 is a diagram showing a configuration example according to the second embodiment of a device having a data communication function of the present invention. In the second embodiment, the device (A) 1 and the device (B) 2 have a function of controlling validity / invalidity of IPsec communication from the outside, and the IPsec communication is invalid in the initial state. To do.

  In FIG. 6, the device (A) 1 and the device (B) 2 are connected via a network 3.

  When the device (A) 1 receives an IPsec setting command from the outside via the input / output unit 11 and the input / output unit 11 that inputs and outputs data using two IP addresses, a normal IP address and a link local address An IPsec setting unit 12 that performs IPsec setting at a predetermined timing, an IPsec setting temporary storage unit 16 that temporarily stores the instructed IPsec setting, an IPsec setting storage unit 14 such as SAD / SPD that stores the IPsec setting, An IPsec validation command receiving unit 17 that receives an IPsec validation command from the outside via the input / output unit 11 and notifies the IPsec setting unit 12 to that effect is provided.

  The device (B) 2 includes an input / output unit 21 that inputs and outputs data using two IP addresses, a normal IP address and a link local address, and an IPsec setting command transmission unit that transmits an IPsec setting command to an external device. 22, an IPsec setting unit 23 that performs IPsec setting of the own device, an IPsec setting holding unit 24 such as SAD / SPD that holds the IPsec setting, and an IPsec validation command that transmits an IPsec validation command to an external device And a transmission unit 25.

  Initially, the IPsec setting temporary holding unit 16 of the device (A) 1 is blank, and the IPsec setting holding unit 14 sets IPsec as the target for the link local address. Further, it is assumed that the IPsec setting holding unit 24 is in an unset state.

  FIG. 7 is a diagram illustrating an example of IPsec setting processing according to the second embodiment.

  In FIG. 7, first, the IPsec setting command transmission unit 22 of the device (B) 2 transmits an IPsec setting command to the device (A) 1 through the input / output unit 21 using a normal IP address (step S201). In this IPsec setting command, the setting of the IP address of the device (B) 2 or the address block including the device (B) 2 is described as “the communication with the device B (own device) is changed to IPsec”. Has been.

  The IPsec setting unit 12 of the device (A) 1 receives this IPsec setting command with a normal IP address via the input / output unit 11 (step S202).

  Next, the IPsec setting unit 12 of the device (A) 1 holds the entire IPsec setting according to the IPsec setting command in the IPsec setting temporary holding unit 16, and the IPsec setting itself of the device (A) 1 is invalid (unset). As it is, an IPsec validation command addressed to the link local address (not subject to IPsec) is awaited (step S203). At this time, the device (A) 1 does not require IPsec for communication with the device (B) 2. For this reason, IPsec is not required for the communication of the IPsec setting command performed from the device (B) 2 to the device (A) 1, and the communication is normally performed and the communication is terminated. FIG. 8 is a diagram showing a state in which an IPsec setting request is made from the device (B) 2 to the device (A) 1, and the IPsec setting of the device (A) 1 has been performed, but the IPsec communication becomes invalid. ing. In addition, the IPsec setting of the device (B) 2 is not performed.

  Next, returning to FIG. 7, the IPsec setting unit 23 of the device (B) 2 performs its own IPsec setting in the IPsec setting holding unit 24 (step S204). FIG. 9 is a diagram illustrating a state where IPsec setting is performed in the device (B) 2.

  Next, returning to FIG. 7, the IPsec validation command transmission unit 25 of the device (B) 2 sends an IPsec validation command to the device (A) 1 from the link local address that is not subject to IPsec via the input / output unit 21. Transmit (step S205). When the IPsec validation command receiving unit 17 of the device (A) 1 receives this IPsec validation command using the link local address via the input / output unit 11, the IPsec setting command is transmitted to the IPsec setting unit 12. The setting content held in the temporary setting holding unit 16 is reflected in the IPsec setting holding unit 14 (step S206). As a result, the device (A) 1 needs to be IPsec for communication with the device (B) 2 using a normal IP address. FIG. 10 is a diagram showing a state in which an IPsec validation request is made from the device (B) 2 to the device (A) 1.

  With the above procedure, the device (A) 1 and the device (B) 2 are ready to communicate by IPsec.

  Returning to FIG. 7, IPsec communication is performed between the device (A) 1 and the device (B) 2 (steps S207 and S208). FIG. 11 is a diagram illustrating a state in which IPsec communication can be performed between the device (A) 1 and the device (B) 2.

<Third Embodiment>
FIG. 12 is a diagram showing a configuration example according to the third embodiment of a device having a data communication function of the present invention. In the third embodiment, these IPsec settings are performed by remote control from the third device (C) 4, which is not the device (A) 1 and the device (B) 2.

  In FIG. 12, the device (A) 1, the device (B) 2, and the device (C) 4 are connected via the network 3. The device (C) 4 may be connected from another data link via a router.

  The device (A) 1 and the device (B) 2 have the same configuration, and input / output is performed using two IP addresses, a normal IP address and a multicast IP address (or anycast IP address). Sections 11 and 21, IPsec setting sections 12 and 23 for performing IPsec setting at a predetermined timing when an IPsec setting command is received from the outside via input / output sections 11 and 21, and IPsec target among the designated IPsec settings IPsec target IP address holding units 13 and 25 for holding an IP address, IPsec setting holding units 14 and 24 such as SAD / SPD for holding an IPsec setting, and an IPsec validation command from the outside via the input / output units 11 and 21 , And an IPsec enabling command receiving unit 17 for notifying the IPsec setting units 12 and 23 of the fact, And a 6.

  The device (C) 4 includes an input / output unit 41 that inputs / outputs data using a normal IP address, an IPsec setting command transmission unit 42 that transmits an IPsec setting command to an external device, and an external device. And an IPsec validation command transmission unit 43 that transmits an IPsec validation command.

  Initially, the IPsec target IP address holding units 13 and 25 of the device (A) 1 and the device (B) 2 are blank, and the IPsec setting holding units 14 and 24 set IPsec to be out of target for the multicast IP address. Has been.

  FIG. 13 is a diagram illustrating an example of IPsec setting processing according to the third embodiment.

  In FIG. 13, first, the IPsec setting command transmission unit 42 of the device (C) 4 transmits an IPsec setting command to the devices (A) 1 and (B) 2 via the input / output unit 41 (step S301). . In this IPsec setting command, “the communication between the device A and the device B is changed to IPsec”, the device (A) 1 includes the IP address of the device (B) 2 or the device (B) 2. As for the setting of the address block, for the device (B) 2, the IP address of the device (A) 1 or the setting of the address block including the device (A) 1 is described.

  The IPsec setting units 12 and 23 of the device (A) 1 and the device (B) 2 receive this IPsec setting command via the input / output units 11 and 21 (steps S302 and S303).

  Next, the IPsec setting units 12 and 23 of the device (A) 1 and the device (B) 2 perform the IPsec setting in accordance with the IPsec setting command to the IPsec setting holding units 14 and 24, but the invalid IP address for the IPsec target IP address. An address is set (temporary setting), and a regular IPsec target IP address (in the device (A) 1, the IP address of the device B or an address block including the device B, in the device (B) 2, the IP address or the device of the device A) The address block including A) is held in the IPsec target IP address holding units 13 and 25 (steps S304 and S305). At this time, the device (A) 1 and the device (B) 2 do not require IPsec for communication with the device (C) 4. For this reason, IPsec is not necessary for communication of the IPsec setting command performed from the device (C) 4 to the device (A) 1 and the device (B) 2, and the communication is normally performed and the communication is completed. To do. FIG. 14 is a diagram illustrating a state in which an IPsec setting request is made from the device (C) 4 to the device (A) 1 and the device (B) 2, and the IPsec setting of the device (A) 1 and the device (B) 2 is performed. However, the IPsec target IP address is none (invalid).

  Next, returning to FIG. 13, the IPsec validation command transmission unit 43 of the device (C) 4 uses its own IP address as a source via the input / output unit 41, and sets the destination as a multicast IP address not subject to IPsec. Then, an IPsec enabling command is transmitted to the device (A) 1 and the device (B) 2 (step S306). When the IPsec validation command receiving units 17 and 26 of the device (A) 1 and the device (B) 2 receive this IPsec validation command using the multicast IP address of the input / output units 11 and 21, the IPsec setting unit 12, 23, the IPsec setting units 12 and 23 acquire the regular IPsec target IP addresses held in the IPsec target IP address holding units 13 and 25, and set them in the IPsec setting holding units 14 and 24 (steps S307 and S308). ). As a result, communication between the device (A) 1 and the device (B) 2 needs to be IPsec. FIG. 15 is a diagram illustrating a state in which an IPsec validation request is made from the device (C) 4 to the device (A) 1 and the device (B) 2, and the IPsec setting of the device (A) 1 has been performed and the IPsec target. The IP address is the device B, the IPsec setting of the device (B) 2 has been performed, and the IPsec target IP address is the device A.

  With the above procedure, the device (A) 1 and the device (B) 2 are ready to communicate by IPsec.

  Returning to FIG. 13, IPsec communication is performed between the device (A) 1 and the device (B) 2 (steps S309 and S310). FIG. 16 is a diagram illustrating a state in which IPsec communication can be performed between the device (A) 1 and the device (B) 2.

  In the above example, when the device (A) 1 and the device (B) 2 receive the IPsec setting command, an invalid value is set in the IPsec target IP addresses of the IPsec setting holding units 14 and 24, and the IPsec enabling command is set. When the IP address is received, the normal IPsec target IP address is set in the IPsec setting holding units 14 and 24. However, when the IPsec setting command is received, the entire IPsec setting is temporarily held and an IPsec enabling command is issued. When received, the entire IPsec setting may be set in the IPsec setting holding units 14 and 24.

<Summary>
As described above, in the present invention, after the IPsec setting is performed, the IPsec setting is not immediately activated, and immediately after the IPsec communication setting of this device is performed, the IPsec setting of the communication partner is set. Since it does not validate its own IPsec function before completion, communication between this device and the communication partner is not suddenly disabled.

  Also, after the IPsec setting is performed, the IPsec setting is not immediately activated, but the IPsec setting is validated after a certain time or when a specific time comes, so that the IPsec communication setting of this device is performed. Immediately after that, there is a time margin for setting the IPsec of the communication partner. As a result, the IPsec function of this device is validated before the communication partner's IPsec setting is completed, and mutual communication is not disabled.

  In addition, after the IPsec setting is performed, the IPsec setting is not immediately enabled, and when the IPsec setting enable command is issued for the link local address or the multicast IP address, the IPsec setting is enabled. Immediately after performing the IPsec communication setting of the device, there is a time margin for performing the IPsec setting of the communication partner. As a result, the IPsec function of this device is validated before the communication partner's IPsec setting is completed, and mutual communication is not disabled.

  Further, by sending a command from a device on the network that is not local, it is possible to realize collective IPsec of IPsec devices in the network.

  The present invention has been described above by the preferred embodiments of the present invention. While the invention has been described with reference to specific embodiments, various modifications and changes may be made to the embodiments without departing from the broad spirit and scope of the invention as defined in the claims. Obviously you can. In other words, the present invention should not be construed as being limited by the details of the specific examples and the accompanying drawings.

It is a figure which shows the structural example concerning 1st Embodiment of the apparatus which has a data communication function of this invention. It is a figure which shows the example of a process of the IPsec setting in 1st Embodiment. It is a figure which shows a mode that the IPsec setting request | requirement was performed from the apparatus B to the apparatus A. FIG. It is a figure which shows a mode that the IPsec setting was performed after the fixed time passed since the temporary setting of IPsec. It is a figure which shows a mode that the IPsec communication became possible with the apparatus A and the apparatus B. FIG. It is a figure which shows the structural example concerning 2nd Embodiment of the apparatus which has a data communication function of this invention. It is a figure which shows the example of a process of the IPsec setting in 2nd Embodiment. It is a figure which shows a mode that the IPsec setting request | requirement was performed from the apparatus B to the apparatus A. FIG. 6 is a diagram illustrating a state where IPsec setting is performed in the device B. FIG. It is a figure which shows a mode that the IPsec validation request | requirement was performed from the apparatus B to the apparatus A. FIG. It is a figure which shows a mode that the IPsec communication became possible with the apparatus A and the apparatus B. FIG. It is a figure which shows the structural example concerning 3rd Embodiment of the apparatus which has a data communication function of this invention. It is a figure which shows the example of a process of the IPsec setting in 3rd Embodiment. It is a figure which shows a mode that the IPsec setting request | requirement was performed from the apparatus C to the apparatus A and the apparatus B. FIG. It is a figure which shows a mode that the IPsec validation request | requirement was performed from the apparatus C to the apparatus A and the apparatus B. FIG. It is a figure which shows a mode that the IPsec communication became possible with the apparatus A and the apparatus B. FIG.

Explanation of symbols

1 Device A
DESCRIPTION OF SYMBOLS 11 Input / output part 12 IPsec setting part 13 IPsec object IP address holding part 14 IPsec setting holding part 15 Timer part 16 IPsec setting temporary holding part 17 IPsec validation command receiving part 2 Device B
21 I / O Unit 22 IPsec Setting Command Transmitting Unit 23 IPsec Setting Unit 24 IPsec Setting Holding Unit 25 IPsec Validating Command Transmitting Unit 26 IPsec Validating Command Receiving Unit 3 Network 4 Device C
41 Input / output unit 42 IPsec setting command transmission unit 43 IPsec validation command transmission unit

Claims (7)

A device with a security communication function,
Holding means for holding security communication settings;
Accepting means for accepting security communication setting requests from outside,
A setting unit that does not immediately activate the setting of the security communication related to the setting request to the holding unit, but activates it at a predetermined timing afterwards ,
The setting means temporarily holds the security communication settings related to the setting request, sets a part or all of the modified settings in the holding means, and sets the modified setting part at a predetermined timing after the fact. A device having a data communication function, wherein normal contents are reflected in the holding means . In the apparatus which has a data communication function of Claim 1 ,
An apparatus having a data communication function, wherein after the setting request is received, the setting means reflects a setting of security communication related to the setting request to the holding means after a predetermined time. In the apparatus which has a data communication function of Claim 1 ,
An apparatus having a data communication function, wherein the setting unit reflects the setting of security communication related to the setting request in the holding unit when a specific time is reached after receiving the setting request. In the apparatus which has a data communication function of Claim 1 ,
After receiving the setting request, the setting unit reflects the setting of the security communication related to the setting request in the holding unit when an enabling request is received from outside via a communication path that is not a security communication target. A device having a data communication function. In the apparatus which has a data communication function as described in any one of Claims 1 thru | or 4 ,
A device having a data communication function, wherein the accepting unit accepts a security communication setting request from a device which is a partner of security communication. In the apparatus which has a data communication function as described in any one of Claims 1 thru | or 4 ,
A device having a data communication function, wherein the accepting unit accepts a setting request for security communication from a device other than a device serving as a counterpart of security communication. A method for controlling a device having a security communication function,
Receiving a security communication setting request from the outside;
The security communication setting for the setting request is not immediately activated for the holding means for holding the security communication setting, and is activated at a predetermined timing after the process ,
The step of enabling temporarily holds the security communication settings related to the setting request, sets a part or all of the settings to the holding unit, and sets the modified settings at a predetermined timing afterwards. A control method for a device having a data communication function, wherein the regular content of the portion is reflected in the holding means .

Images