JP2007258986A - Communication apparatus, communication method, and communication program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication apparatus for improving the security in transmission/reception of a message. <P>SOLUTION: The communication apparatus includes: a message receiving section 10 for receiving a first message including first authentication information from a client 200; a detection information calculation section 13 that extracts the first authentication information from the first message received by the message receiving section 10 and calculates second authentication information output resulting from inputting the extracted first authentication information to a predetermined function; a response generating section 12 for generating a second message including the second authentication information calculated by the detection information calculation section 13; and a message transmission section 15 for transmitting the second message generated by the response generating section 12 to the client 200. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a communication apparatus, a communication method, and a communication program for transmitting a message including retransmission attack detection information for preventing a retransmission attack.

  One of the features of IPv6 (Internet Protocol Version 6), which is attracting attention as the next-generation Internet technology, is an automatic setting function that enables end hosts (clients) to connect to a network without complicated setting work. Can be mentioned. Among the automatic setting functions, a function called a neighbor search function is used for setting the host IP address and default router.

  On the other hand, DHCPv6 (Dynamic Host Configuration Protocol version 6) is defined as a protocol for distributing application level setting information such as DNS (Domain Name System) server addresses to clients (Non-Patent Document 1).

  Although DHCPv6 also includes a function for address setting, in order to more easily distribute application level setting information as described above to clients that perform address setting using the neighbor search function. Stateless DHCPv6, which is a partial protocol of DHCPv6, is defined (Non-patent Document 2).

  Stateless DHCPv6 uses two messages, an information request (Information-request) and a response (Reply). The DHCPv6 client requests necessary setting information by sending an information request message to the DHCPv6 server. The DHCPv6 server responds to the information request message with a response message. The response message includes setting information that does not depend on each client, such as a DNS server address. That is, the server side does not need to manage the state of information distributed to the client, and the server implementation can be simplified correspondingly.

  By the way, as the Internet use layer expands, security awareness is increasing. Correspondingly, in DHCPv6 and the like, the security function is defined as a part of the protocol. The security function of DHCPv6 is an authentication function using an electronic signature using a secret key shared between the client and the server. That is, the client and the server add a digital signature to the exchanged DHCPv6 message by using a secret key, and the receiving side verifies the digital signature by using the secret key. Confirm that the packet was received without being tampered with. Information for authentication including the electronic signature portion is included in an authenticate option which is one of DHCPv6 options.

  On the protocol specification, this function can also be applied to stateless DHCPv6. That is, the security function of stateless DHCPv6 can be realized by inserting an authentication option into the information request message or response message.

  However, by realizing this authentication function, the advantages of stateless DHCPv6 may be impaired. First, it is necessary to manage a key for authentication for each individual client. Furthermore, in order to implement the replay attack defense function incorporated in the authentication function described above, for each individual client, replay detection information (replaydetection information) of the message received from that client last time required for authentication. ) Value and retransmission attack detection information of a message transmitted to the client need to be stored.

  In order to solve these problems, Non-Patent Document 3 uses a client-independent secret information managed only by a server and an identifier (DUID, DHCP Unique Identifier) unique to the client to make it dynamic and deterministic. A method is described in which a client-specific secret key is generated, and each client holds only its own secret key. This method eliminates the need for the server to manage a unique key for the client. In Non-Patent Document 1, a method of using the current time of the system as a value of retransmission attack detection information is given as an example. If retransmission attack detection information is generated using a value that always increases monotonically within a single system, such as the time, the value of the retransmission attack detection information value of the transmitted message increases monotonically without recording the past history. I can guarantee that.

  On the other hand, as another technique for preventing such a replay attack, a so-called challenge-response method is known (for example, Patent Document 1). In the challenge-response method, for example, a value including a random value that is difficult to predict is inserted into a transmission message from the client, and the server copies the value to the response message and returns it with an electronic signature. The client compares the value inserted in the message sent by itself with the value included in the response from the server, and determines that the message can be trusted if they match and the digital signature is successfully verified. . Here, if the message inserted by the client does not appear repeatedly within a short period of time, it is established as a defense against a replay attack on the response message from the server.

JP 2004-274134 A R. Droms et al., "RFC 3315, Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", [online], July 2003, retrieved from the Internet: <URL: http://www.ietf.org/rfc/rfc3315 .txt> R. Droms., "RFC 3736, Stateless Dynamic Host Configuration Protocol (DHCP) Service for IPv6", [online], April 2004, retrieved from the Internet: <URL: http://www.ietf.org/rfc/rfc3736 .txt> R. Droms et al., "RFC 3118, Authentication for DHCP Messages", [online], June 2001, retrieved from the Internet: <URL: http://www.ietf.org/rfc/rfc3118.txt>

  However, in the method of Non-Patent Document 1, it is not necessary to store client-specific information on the server side. However, in an environment where a message transmitted by the client can be reused by a third party as described later, the client There is a problem that a replay attack on the network cannot be prevented.

  For example, it is assumed that a valid client sends a message to the server and the server responds to it, and the value of the retransmission attack detection information in the response message from the server to the client is 100. Here, if a malicious third party reuses a message from the client to the server and sends it to the server, the server returns a response to it, but the value at that time is greater than 100.

  Therefore, if the third party stores the message, it can be used as a material for a resending attack against a legitimate client in the future. This is because the value of the retransmission attack detection information recorded on the client side is 100, and this third party holds a response message having a larger value.

  The method of Patent Document 1 can avoid a retransmission attack by a challenge / response method, but has a problem that an extension of a standard protocol is required. That is, in order to realize the challenge-response method with a protocol that has already introduced a retransmission attack avoidance method using monotonically increasing retransmission attack detection information such as DHCPv6, the protocol is extended and the standardization process of the extension is performed. It is because it cannot be used without passing. In this case, it is necessary to change the implementation on both the server side and the client side.

  The present invention has been made in view of the above, and improves security at the time of message transmission / reception without storing client-specific information on the server side and without changing protocol specifications or client implementation. An object is to provide a communication device, a communication method, and a communication program.

  In order to solve the above-described problems and achieve the object, the present invention is a communication device that transmits a message including authentication information used for message authentication to a terminal device connected via a network, Receiving means for receiving a first message including first authentication information from the terminal device; and extracting the first authentication information from the first message received by the receiving means and extracting the first authentication information. Calculating means for calculating second authentication information output as a result of inputting the authentication information to a predetermined function; and a second message including the second authentication information calculated by the authentication information calculating means. And generating means for generating, and transmitting means for transmitting the second message generated by the generating means to the terminal device.

  The present invention also provides a communication method and a communication program that can execute the above-described apparatus.

  According to the present invention, it is possible to calculate authentication information that is a monotonically increasing value using authentication information of a message extracted from a received message, and return a message including the calculated authentication information. Therefore, there is no need to store client-specific information on the server side, and it is possible to improve the security at the time of message transmission / reception without changing the existing protocol and client implementation.

  Exemplary embodiments of a communication apparatus, a communication method, and a communication program according to the present invention will be explained below in detail with reference to the accompanying drawings.

  The communication device according to the present embodiment extracts authentication information from a message received from a client, sets a value obtained by inputting the extracted authentication information into a monotonically increasing function as authentication information of a message to be returned, It is sent to the client. Here, the authentication information refers to information used for message authentication and includes retransmission attack detection information for detecting a retransmission attack.

  FIG. 1 is an explanatory diagram showing the overall configuration of a communication system including a server 100 that is a communication apparatus according to the present embodiment. As shown in the figure, the communication system includes clients 200a and 200b (hereinafter simply referred to as the client 200) that transmit a DHCPv6 information request message, and a server 100 that returns a DHCPv6 response message to the information request message. It is configured to be connected via a LAN (Local Area Network) 300.

  In the following description, the LAN 300 is a network configured according to IPv6, and the server 100 is a DHCPv6 server that provides DNS server address information and the like according to stateless DHCPv6. However, the network protocol is limited to these. Instead, the method according to the present embodiment can be applied to any protocol as long as messages including information for detecting a retransmission attack are transmitted and received using a monotonically increasing identifier.

  Further, the server 100 and the client 200 are not limited to those existing on the same LAN 300, and may be configured to be connected on different LANs that can be connected on the Internet via a relay device called a relay agent.

  Here, a general method for detecting a retransmission attack will be described. In the stateless DHCPv6 standard, as described above, the authentication function can be realized by the authenticate option, and the retransmission attack detection function is incorporated in this authentication function.

  In order to detect a retransmission attack, a client and a server that transmit a message add retransmission attack detection information, which is information for detecting a retransmission attack, to the message. Specifically, each time a message is transmitted, a monotonically increasing value is added to the message as retransmission attack detection information. The message receiving side stores the value of the previous retransmission attack detection information for each source client or server, and the value increases compared to the value of the newly received message retransmission attack detection information. If so, it is determined that the message was not retransmitted illegally.

  As described above, in order to realize the retransmission attack defense function, it is necessary to manage the value of the retransmission attack detection information of the received message and the retransmission attack detection information of the transmitted message for each device that is a communication partner.

  Of the replay attack detection information, for messages received from clients, there is a correspondence that the possibility of a replay attack is not considered only for use in stateless DHCPv6, that is, the server side does not manage replay attack detection information. sell.

  Information distributed by stateless DHCPv6 is usually information that does not depend on the client, such as the address of the shared DNS server, and it is not necessary to control whether to respond for each client. Even if it is correspondence, the possibility that a problem will occur is low. On the other hand, this case has an advantage that it is not necessary to manage retransmission attack detection information sent in the past from individual clients in the server. In the following description, it is assumed that the server side does not manage the value of the retransmission attack detection information of the message received from the client.

  On the other hand, regarding the retransmission attack detection information of a message transmitted to the client, it is necessary to ensure that the value always increases monotonically so as not to be a target of the retransmission attack. This is because, when the response message to the client can be reused by an unauthorized third party, for example, an attack is established in which a past message that has already been invalidated is sent to the client to be trusted.

  For this reason, conventionally, a method of individually storing retransmission attack detection information of a transmission message to the client and a method of using the current time of the system have been taken, but the memory amount of the server is increased and the implementation is complicated. In some cases, there were cases where resending attacks on clients could not be prevented.

  In the server 100 according to the present embodiment, as described below, a retransmission attack avoidance method using monotonically increasing retransmission attack detection information is used in a protocol based on one-to-one packet exchange between a client and a server. In this case, it is possible to prevent a replay attack due to reuse of a server message without having any state unique to the client 200 on the server 100 side and without changing the existing protocol specifications and the implementation of the client 200.

  Next, details of the configuration of the server 100 will be described. FIG. 2 is a block diagram showing a configuration of the server 100 according to the present embodiment.

  As shown in the figure, the server 100 includes a message reception unit 10, a message verification unit 11, a response generation unit 12, a detection information calculation unit 13, a message signature unit 14, a message transmission unit 15, and a storage unit. 21.

  The message receiving unit 10 receives a message transmitted by the client 200 and passes it to the message verification unit 11.

  The message verification unit 11 verifies the validity of the received message. Specifically, the message verification unit 11 verifies the electronic signature added to the received message, using the private key of the client 200 obtained in advance.

  The response generation unit 12 generates a response message corresponding to the received message. For example, when the client 200 transmits a DHCPv6 information request message for requesting provision of setting information such as a DNS server address, the response generation unit 12 is a response that is a DHCPv6 response (Reply) including setting information corresponding thereto. Generate a message.

  The detection information calculation unit 13 calculates retransmission attack detection information of the response message based on the retransmission attack detection information of the received message. Specifically, the detection information calculation unit 13 extracts retransmission attack detection information in the received message, inputs the value of the extracted retransmission attack detection information into a monotonically increasing function, and obtains a value obtained as an output of the function Is calculated as the retransmission attack detection information of the response message.

  The message signature unit 14 adds an electronic signature to a response message including the generated retransmission attack detection information using the client 200's private key obtained in advance.

  The message transmission unit 15 transmits a response message with an electronic signature added to the client 200.

  The storage unit 21 stores information used for message transmission and reception, such as a secret key for each client 200 used by the message verification unit 11 and the message signature unit 14, and includes a hard disk drive (HDD), an optical disk, a memory card, and a RAM. (Random Access Memory) or any other commonly used storage medium can be used.

  Next, communication processing by the server 100 according to this embodiment configured as described above will be described. FIG. 3 is a flowchart showing the overall flow of communication processing in the present embodiment. In the following description, an example of processing in which a DHCPv6 information request message is transmitted from the client 200 and a response message is returned from the server 100 that is the DHCPv6 server that has received the message is described.

  First, the message receiving unit 10 receives the information request message transmitted from the client 200 (step S301). Next, the message verification unit 11 verifies the validity of the received information request message using the secret key of the client 200 (step S302).

  Next, the message verification unit 11 determines whether the verification is successful (step S303). If the verification is successful (step S303: YES), the response generation unit 12 generates a response message for the information request message. (Step S304).

  Next, the detection information calculation unit 13 extracts retransmission attack detection information in the received information request message (step S305). In DHCPv6, since retransmission attack detection information is stored in an RDM (Replay Detection Method) field, the detection information calculation unit 13 can extract retransmission attack detection information from the field.

Next, the detection information calculation unit 13 inputs the extracted retransmission attack detection information into a monotonically increasing function, and calculates retransmission attack detection information obtained as a function output (step S306). Here, the monotone increasing function refers to a function f (x) that satisfies the condition of the following expression (1).
If x1 ≦ x2, then f (x1) ≦ f (x2) (1)

  For example, an identity function (f (x) = x) that outputs a value equal to the input value, a function obtained by adding a positive integer to the identity function (for example, f (x) = x + 1), etc. monotonically increase Corresponds to function. Note that the range of values that can be taken by the input retransmission attack detection information is limited, but when the upper limit is reached, it is common to use a method of returning to 0 and recomparison. Again, such a method is assumed, but for simplicity, it is simply expressed as “monotonically increasing”. In addition, since the range that can be taken is limited, it is desirable not to use a function that increases the possibility that the calculated value greatly exceeds the range, for example, f (x) = 2x.

  Since the message 200 retransmitting attack detection information sent from the client 200 has a value that monotonically increases for each message on the client 200 side, the result obtained by inputting this value into the monotonically increasing function is the same as above. A monotonically increasing value for each message. Therefore, if the value calculated in this way on the server 100 side is set as the retransmission attack detection information of the response message, it can be used for the retransmission attack detection processing in the client 200.

  Thus, since the retransmission attack detection information of the response message can be calculated using the received retransmission attack detection information, it is not necessary to store the past retransmission attack detection information transmitted to the client 200.

  Note that this effect is particularly beneficial when it is desirable that the server 100 does not have information specific to the client 200 and is implemented in a lightweight manner, such as stateless DHCPv6. In general DHCPv6 in which an address is assigned to each client 200 and the state is managed, the server 100 essentially needs to manage information unique to the client, and therefore it records past retransmission attack detection information even in message authentication. This is because a simple method can be used.

  Next, the message signature unit 14 performs an electronic signature for authentication from the response message generated in step S304 and the value of the retransmission attack detection information calculated in step S306, and adds the result to the response message. (Step S307).

  Next, the message transmission unit 15 transmits a response message including a response to the information request, retransmission attack detection information, and an electronic signature to the client 200 (step S308).

  If it is determined in step S303 that the verification was not successful (step S303: NO), the message verification unit 11 discards the received information request message and completes the communication process (step S309).

  Next, a specific example of communication processing by the server 100 according to the present embodiment will be described. First, problems that occur in communication processing according to the prior art will be described.

  FIG. 4 is an explanatory diagram illustrating an example of a message transmitted and received in a communication process according to a conventional technique. This figure shows an example in which a message is transmitted and received by a method using the current time of the server system as the value of retransmission attack detection information, as in Non-Patent Document 1.

  First, an information request message including “100” as retransmission attack detection information is transmitted from the client 200 (step S401). In contrast, the conventional server transmits a response message including, for example, “12:00” as the current system time to the client 200 (step S402).

  Here, if an unauthorized client illegally obtains the information request message of the client 200 and resends it to the server (step S403), the server does not detect a replay attack, so the server accepts this message. A response message including, for example, “12:01” as the current time is transmitted to the unauthorized client (step S404).

  In this way, an unauthorized client can obtain a response message including a value larger than the value “12:00” of the retransmission attack detection information of the message returned by the client 200 first. Thereafter, when the client 200 transmits the information request message again (step S405), when the unauthorized client transmits the obtained response message to the client 200 (step S406), the client 200 is larger than the previously received value. Since this is a response message including value retransmission attack detection information, it cannot be detected as an invalid message.

  Next, it will be described that such a problem can be solved by the communication processing according to the present embodiment. FIG. 5 is an explanatory diagram illustrating an example of a message transmitted and received by the communication process performed by the server 100 according to the present embodiment. Here, it is assumed that the server 100 calculates retransmission attack detection information of a response message using an identity function.

  First, an information request message including “100” as retransmission attack detection information is transmitted from the client 200 (step S501). The server 100 transmits a response message including retransmission attack detection information having the same value (100) as the retransmission attack detection information of the received information request message to the client 200 (step S502).

  Here, if an unauthorized client illegally obtains the information request message of the client 200 and resends it to the server 100 (step S503), the server 100 again has the same information as the retransmission attack detection information of the received information request message. A response message including retransmission attack detection information of value (100) is generated and transmitted to an unauthorized client (step S504).

  Thereafter, when the client 200 transmits the information request message again (step S505), even if an unauthorized client returns this response message to the client 200 (step S506), the client 200 receives the value received last time. Since it is a response message including retransmission attack detection information of the same value as, it is possible to detect an illegal message.

  Note that since the client 200 is a device that complies with the DHCPv6 authentication specification, the value of the retransmission attack detection information in the transmitted information request message is set to a value that increases monotonously with the message. Therefore, the value of the retransmission attack detection information included in the response from the server 100 also increases monotonously. That is, a retransmission attack that simply reuses a response from the server 100 is not established.

  Further, since the server 100 can use the value calculated by inputting the information in the message received from the client 200 into a predetermined function as the retransmission attack detection information of the response message, the server 100 has a retransmission attack for each client. There is no need to hold detection information.

  Furthermore, since the operation of the client 200 is assumed only to conform to the existing DHCPv6 authentication protocol, it is not necessary to change the protocol specification and the implementation of the client 200.

  As described above, in the communication apparatus according to the present embodiment, the server side does not have any client-specific state, and the message transmitted from the server without changing the existing DHCPv6 protocol specification or client implementation. It is possible to prevent a replay attack due to reuse.

  FIG. 6 is an explanatory diagram showing a hardware configuration of the communication apparatus according to the present embodiment.

  The communication device according to the present embodiment includes a communication I / F 54 that communicates with a control device such as a CPU (Central Processing Unit) 51 and a storage device such as a ROM (Read Only Memory) 52 and a RAM 53 by connecting to a network. And an external storage device such as an HDD (Hard Disk Drive) and a CD (Compact Disc) drive device, a display device such as a display device, an input device such as a keyboard and a mouse, and a bus 61 for connecting each part. The hardware configuration uses a normal computer.

  A communication program executed by the communication apparatus according to the present embodiment is a file in an installable format or an executable format, and is a CD-ROM (Compact Disk Read Only Memory), a flexible disk (FD), a CD-R (Compact). The program is recorded on a computer-readable recording medium such as a disk recordable (DVD) or a digital versatile disk (DVD).

  The communication program executed by the communication apparatus according to the present embodiment may be provided by being stored on a computer connected to a network such as the Internet and downloaded via the network. Further, the communication program executed by the communication device according to the present embodiment may be provided or distributed via a network such as the Internet.

  Further, the communication program of the present embodiment may be provided by being incorporated in advance in a ROM or the like.

  The communication program executed by the communication apparatus according to the present embodiment includes a module configuration including the above-described units (message receiving unit, message verification unit, response generation unit, detection information calculation unit, message signature unit, message transmission unit) As actual hardware, the CPU 51 (processor) reads the communication program from the storage medium and executes it to load the above-described units onto the main storage device, and the above-described units are generated on the main storage device. It has become so.

  As described above, the communication device, the communication method, and the communication program according to the present invention are suitable for a communication device that transmits a message including retransmission attack detection information for preventing a retransmission attack.

It is explanatory drawing which shows the structure of the whole communication system containing the server which is a communication apparatus concerning this Embodiment. It is a block diagram which shows the structure of the server concerning this Embodiment. It is a flowchart which shows the flow of the whole communication process in this Embodiment. It is explanatory drawing which shows an example of the message transmitted / received by the communication process by a prior art. It is explanatory drawing which shows an example of the message transmitted / received by the communication processing by the server concerning this Embodiment. It is explanatory drawing which shows the hardware constitutions of the communication apparatus concerning this Embodiment.

Explanation of symbols

51 CPU
52 ROM
53 RAM
54 Communication I / F
61 Bus 10 Message receiving unit 11 Message verification unit 12 Response generation unit 13 Detection information calculation unit 14 Message signature unit 15 Message transmission unit 21 Storage unit 100 Server 200a, 200b Client 300 LAN

Claims (9)

A communication device that transmits a message including authentication information used for message authentication to a terminal device connected via a network,
Receiving means for receiving a first message including first authentication information from the terminal device;
Second authentication information output as a result of extracting the first authentication information from the first message received by the receiving means and inputting the extracted first authentication information to a predetermined function; A calculating means for calculating;
Generating means for generating a second message including the second authentication information calculated by the authentication information calculating means;
Transmitting means for transmitting the second message generated by the generating means to the terminal device;
A communication apparatus comprising: The calculating means calculates the second authentication information output as a result of inputting the extracted first authentication information to a monotonically increasing function;
The communication apparatus according to claim 1. The calculating means calculates the second authentication information output as a result of inputting the first authentication information to the monotonically increasing function that outputs a value equal to the input value;
The communication device according to claim 2. The receiving means receives the first message including first detection information for detecting that it is a retransmitted message as the first authentication information;
The calculation means is information output as a result of extracting the first detection information from the first message received by the reception means and inputting the extracted first detection information into a monotonically increasing function. Calculating second detection information for detecting that the message is a retransmitted message as the second authentication information,
The communication apparatus according to claim 1. The receiving means receives the first message for requesting setting information relating to communication on the network;
The generating means generates the second message further including the setting information requested by the first message received by the receiving means;
The communication apparatus according to claim 1. The receiving means receives the first message requesting the setting information which is information independent of the terminal device;
The communication device according to claim 5. The reception means receives the first message which is an information request message of stateless DHCPv6 (Dynamic Host Configuration Protocol version 6),
The generation means further includes the setting information requested by the first message received by the reception means, and generates the second message that is a response message to the information request message of stateless DHCPv6. ,
The communication device according to claim 5. A communication method in a communication device for transmitting a message including authentication information used for message authentication to a terminal device connected via a network,
A receiving step of receiving a first message including first authentication information from the terminal device;
The calculation means extracts the first authentication information from the first message received in the reception step, and calculates second authentication information that is a value that does not decrease with respect to the extracted first authentication information. A calculation step;
Generating a second message including the second authentication information calculated by the authentication information calculating step;
A transmission step of transmitting the second message generated by the generation step to the terminal device;
A communication method comprising: A communication program in a communication device that transmits a message including authentication information used for message authentication to a terminal device connected via a network,
A receiving procedure for receiving a first message including first authentication information from the terminal device;
A calculation procedure for extracting the first authentication information from the first message received by the reception procedure and calculating second authentication information that is a value that does not decrease with respect to the extracted first authentication information;
A generation procedure for generating a second message including the second authentication information calculated by the authentication information calculation procedure;
A transmission procedure for transmitting the second message generated by the generation procedure to the terminal device;
A communication program that causes a computer to execute.

Images