JP2009071455A - Communication module, communicating method, communication program, and communication terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To assure mobility of a communication terminal and security of communication data, and to reduce needless security process. <P>SOLUTION: The communication module includes an application part for generating communication data, an encryption condition deciding part which decides whether a condition for transmitting communication data agrees with a predetermined condition or not, an encryption part which does not encrypt communication data that does not agree with the predetermined condition but encrypts communication data that agrees with the predetermined condition, and a data transmitting/receiving part which transmits the communication data encrypted by the encryption part. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a communication module, a communication method, a communication program, and a communication terminal. The present invention particularly relates to a communication module, a communication method, a communication program, and a communication terminal that transmit and receive communication data.

Patent Document 1 discloses a communication device that selectively encrypts a part of moving image data based on the frame type of moving image or header information of moving image data. Specifically, when a moving image is encoded by MPEG, only a packet including an I frame is selected and encrypted. Patent Document 2 discloses a communication device that selectively encrypts a part of input data according to the type of input data or the transmission characteristics of a communication network. Specifically, the encryption range of the input data is determined according to the input data application or the transmission rate of the communication network.
JP-A-2005-295468 JP 2002-319936 A

  However, even if the data to be encrypted is already encrypted, or is encrypted again before being sent to the communication network, it is disclosed in Patent Document 1 and Patent Document 2. The encryption process is executed. Even when data is transmitted to a communication network that has high security and does not require data encryption, the encryption process is executed. Therefore, data processing for transmission / reception and communication traffic load become unnecessarily large.

  In order to solve the above-described problem, in the first embodiment of the present invention, a communication module of a communication terminal that transmits and receives communication data, and an application unit that generates communication data and a condition for transmitting communication data are preliminarily set. An encryption condition determination unit that determines whether or not a predetermined condition is met, and communication data that does not meet a predetermined condition is not encrypted, and communication data that meets a predetermined condition is encrypted An encryption unit; and a data transmission / reception unit that transmits communication data encrypted by the encryption unit. An encryption condition storage unit that stores a predetermined condition, and the encryption condition determination unit determines whether or not the condition for transmitting the communication data matches the condition stored in the encryption condition storage unit May be judged.

  The encryption condition storage unit stores the application type as a predetermined condition, and the encryption condition determination unit stores the type of application that generated the communication data in the encryption condition storage unit. It may be determined whether or not it matches the type of application. The encryption condition storage unit stores a protocol applied to the communication data as a predetermined condition, and the encryption condition determination unit stores the protocol applied to the communication data in the encryption condition storage unit. It may be determined whether or not the protocol is matched.

  The data transmission / reception unit transmits communication data via any of a plurality of communication units with different communication methods, and the encryption condition storage unit stores the type of communication method as a predetermined condition, The encryption condition determination unit may determine whether or not the communication method type of the communication unit to which communication data is transmitted matches the communication method type stored in the encryption condition storage unit.

  An address acquisition unit that acquires a real address dynamically assigned to a communication terminal by a communication relay device that relays communication between the communication terminal and a communication partner terminal, a virtual interface unit to which a virtual address is assigned, and an address acquisition unit Is used to establish a first session between the communication control apparatus that manages the session between the communication terminal and the communication partner terminal, and after establishing the first session, the virtual interface unit has a virtual address. And a signaling control unit that establishes a second session with the communication control device and a signaling message generated by the signaling control unit via the first session before the second session is established. To the communication control device via the second session after the second session is established And signaling transceiver that may further comprise a.

  You may further provide the signaling control part which produces | generates a signaling message, and the signaling transmission / reception part which transmits the signaling message which the signaling control part produced | generated to the communication control apparatus which manages the session of a communication terminal and a communicating party terminal. When the communication module is activated, the signaling control unit establishes a first signaling session based on the first security protocol with the communication control device, and when the first signaling session is established, A second signaling session based on the two security protocols is established with the communication control apparatus, and the signaling transceiver transmits the signaling message generated by the signaling control section to the communication control apparatus via the second signaling session May be.

  It should be noted that the above summary of the invention does not enumerate all the necessary features of the present invention. In addition, a sub-combination of these feature groups can also be an invention.

  Hereinafter, the present invention will be described through embodiments of the invention, but the following embodiments do not limit the invention according to the claims. In addition, not all the combinations of features described in the embodiments are essential for the solving means of the invention.

  FIG. 1 shows a network connection configuration of a communication system according to an embodiment of the present invention. The communication system according to the present embodiment includes a communication terminal 10, a communication terminal 12, a proxy server 20, a SIP (Session Initiation Protocol) server 22, a location server 24, a public server 26, a base station 30, an access point 31, an access point 32, A cellular network 40, a core network 42, the Internet 44, and a wireless LAN network 46 are provided.

  The purpose of the communication terminal 10 according to the present embodiment is to ensure the mobility of the communication terminal 10 that can communicate via both the cellular network 40 and the wireless LAN network 46. Moreover, while ensuring the confidentiality of the signaling message transmitted / received between the communication terminal 10 and the SIP server 22, ensuring the confidentiality of the communication data transmitted / received between the communication terminal 10 and the communication terminal 12. Objective. Furthermore, it aims at reducing the processing load and communication traffic in the case of transmitting / receiving communication data by reducing unnecessary security processing.

  Note that SIP is signaling in starting and disconnecting communication between a plurality of communication terminals so that the plurality of communication terminals can transmit and receive various media such as voice, text, and video via the network. Is the protocol used for The signaling here includes all signaling such as SIP Register, SIP Invite, SIP Bye, and 200 OK, in addition to the location registration of the communication terminal 10 to the SIP server 22.

  The SIP server 22 is an example of a communication control device. The communication control device may be a signaling control server that controls the signaling of the communication terminal 10 and is not limited to the SIP server 22. The base station 30, the wireless access point 31, and the wireless access point 32 are an example of a communication relay device that relays communication between the communication terminal 10 and the communication terminal 12. The communication relay device may be a gateway that assigns a real IP address to the communication terminal 10 and relays communication of the communication terminal 10, and is not limited to the base station 30, the wireless access point 31, and the wireless access point 32.

  The communication terminal 10 has a function of communicating with each of a plurality of different communication methods, for example, a communication method such as a 3G method, a GSM method, or a PHS method. Furthermore, the communication terminal 10 has a function of communicating using a wireless LAN. The communication terminal 10 is, for example, a notebook computer having a telephone communication function and a wireless LAN communication function. Further, the communication terminal 10 may be a mobile communication terminal such as a mobile phone terminal having a wireless LAN function, a PDA having a telephone communication function and a wireless LAN communication function, and a digital camera having a telephone communication function and a wireless LAN communication function. Good.

  When the communication terminal 10 communicates with the communication terminal 12 that is the communication partner terminal, the communication terminal 10 first signals to the SIP server 22 using a communication method that can be used at the position where the communication terminal 10 exists. For example, when the communication terminal 10 can use the wireless LAN communication system via the access point 32, the communication terminal 10 signals the SIP server 22 using the wireless LAN communication system. That is, the communication terminal 10 signals to the SIP server 22 via the access point 32, the wireless LAN network 46, and the core network 42. On the other hand, when the communication terminal 10 can use the telephone communication function, the communication terminal 10 performs signaling to the SIP server 22 using a telephone communication method. That is, the communication terminal 10 performs signaling to the SIP server 22 via the base station 30, the cellular network 40, and the core network 42.

  The SIP server 22 causes the location server 24 to accumulate position information that is information related to the position of the communication terminal 10 on the network. The location server 24 is controlled by the SIP server 22 and stores location information of the communication terminal 10. Further, the SIP server 22 stores the location information of the communication terminal 12 in the location server 24 even when the communication terminal 12 performs signaling.

  In the first example of this embodiment, the communication terminal 10 performs a first TLS (Transport Layer Security) session for signaling with the SIP server 22 using the real IP address assigned by the base station 30 or the access point 32. Establish in between. Then, after establishing the first TLS session, the communication terminal 10 establishes a second TLS session for signaling with the SIP server 22 using the virtual IP address assigned to the communication terminal 10 by the SIP server 22. . At this time, the communication terminal 10 encapsulates the signaling message added with the virtual IP address as the transmission source address by adding the real IP address as the transmission source address, and then transmits it to the SIP server 22.

  In this case, the communication terminal 10 encrypts the signaling message using the TLS protocol, and then transmits the encrypted message to the SIP server 22 via the second TLS session. Thereby, signaling between the communication terminal 10 and the SIP server 22 is securely realized by the TLS protocol.

  In the second example of the present embodiment, the communication terminal 10 establishes a TLS session for signaling with the SIP server 22 via the base station 30 or the access point 32. Subsequently, after establishing the TLS session, the communication terminal 10 exchanges a signaling message with the SIP server 22 using the TLS session, thereby performing SRTP (Secure Real- for signaling) with the SIP server 22. Establish a Time Transport Protocol) session. Here, the communication terminal 10 obtains authentication with the SIP server 22 when establishing the SRTP session by using the result of authentication with the SIP server 22 obtained when the TLS session is established. Establish an SRTP session. In another example, the communication terminal 10 does not use the result of authentication with the SIP server 22 obtained when the TLS session is established, but exchanges authentication information with the SIP server 22 for authentication. May establish an SRTP session.

  In this case, the communication terminal 10 encrypts the signaling message using the SRTP protocol, and transmits the encrypted message to the SIP server 22 via the SRTP session using UDP (User Datagram Protocol) which is a connectionless protocol. Thereby, signaling between the communication terminal 10 and the SIP server 22 is realized securely by the SRTP protocol.

  FIG. 2 shows an outline of communication security according to the present embodiment. A signaling message exchanged between the communication terminal 10 and the SIP server 22 is encrypted by TLS or SRTP. Communication data exchanged between the communication terminal 10 and the communication terminal 12 or the proxy server 20 is encrypted by SRTP. Therefore, the security of signaling messages and communication data in an open network such as the cellular network 40, the wireless LAN network 46, and the Internet 44 can be ensured.

  In the first example of the present embodiment, the communication terminal 10 establishes a TLS session with the SIP server 22 to transmit and receive signaling messages. The communication terminal 10 establishes the first TLS session using the real IP address, and then establishes the second TLS session using the virtual IP address. Then, the communication terminal 10 encapsulates the signaling message encrypted by TLS from a signaling message having the virtual IP address as the transmission source address into a signaling message having the real IP address as the transmission source address. Then, the communication terminal 10 transmits the encapsulated signaling message to the SIP server 22 by UDP via the second TLS session. Accordingly, the communication terminal 10 can continuously and rapidly exchange signaling messages with the SIP server 22 in the TLS session.

  Further, the communication terminal 10 transmits / receives communication data encrypted with SRTP between the communication terminal 12 and the proxy server 20. The communication terminal 10 encapsulates communication data to be transmitted to the communication terminal 12 and the proxy server 20 from communication data having a virtual IP address as a transmission source address to communication data having a real IP address as a transmission source address. Then, the communication terminal 10 encrypts the encapsulated communication data using SRTP, and transmits it to the communication terminal 12 and the proxy server 20 using UDP. The communication terminal 10 can always operate the signaling through the second TLS session effectively.

  In the second example of the present embodiment, when the communication terminal 10 is activated, it first establishes a TLS session with the SIP server 22. Subsequently, the communication terminal 10 establishes an SRTP session with the SIP server 22 by transmitting and receiving a signaling message via the established TLS session. Thereafter, the communication terminal 10 transmits and receives signaling through the established SRTP session. Therefore, the communication terminal 10 can continuously and quickly exchange signaling messages with the SIP server 22 in the SRTP session.

  Further, the communication terminal 10 transmits / receives communication data encrypted with SRTP between the communication terminal 12 and the proxy server 20. The communication terminal 10 transmits the communication data to be transmitted to the communication terminal 12 and the proxy server 20 from the communication data whose source address is the virtual IP address assigned by the SIP server 22 when the TLS session is established. Is encapsulated in communication data with a source address. Then, the communication terminal 10 encrypts the encapsulated communication data using SRTP, and transmits it to the communication terminal 12 and the proxy server 20 using UDP. Therefore, the communication terminal 10 can always realize communication by SRTP.

  FIG. 3 shows an example of a functional configuration of the communication module 14 of the communication terminal 10 according to the first example of the present embodiment. The communication module 14 includes a general application unit 100, a real-time application unit 105, a virtual interface unit 110, a communication unit 120, a communication control unit 130, and a session mobility control unit 160. Note that the proxy server 20 and the SIP server 22 may include some or all of the functions and configurations of the communication module 14.

  The communication unit 120 has a plurality of communication units including a first communication unit 122, a second communication unit 124, and an nth communication unit 126. In addition, the communication control unit 130 includes a communication IF selection unit 140 and an address acquisition unit 150. In addition, the session mobility control unit 160 includes a data format conversion unit 1600, a signaling control unit 1605, a (de) encapsulation unit 1610, a first encryption unit 1615, a second encryption unit 1620, a signaling transmission / reception unit 1625, and a conversion table storage. Unit 1640, data transmission / reception unit 1645, encryption condition storage unit 1650, and encryption condition determination unit 1655.

  In FIG. 3, the first encryption unit 1615 is described as two blocks, but it may be functionally and physically configured as one. Also, the first encryption unit 1615 and the second encryption unit 1620 may be physically separate configurations or may be physically one configuration. Further, the signaling transmission / reception unit 1625 and the data transmission / reception unit 1645 may have a physically separate configuration or a physically single configuration.

  The communication unit 120 has a plurality of different communication units for each of a plurality of communication methods with which the communication module 14 can communicate. For example, the communication unit 120 includes a first communication unit 122 that communicates with a first communication method (for example, a wireless LAN communication method), a second communication unit 124 that communicates with a second communication method (for example, a telephone communication method), And an nth communication unit 126 that communicates with the nth communication method (for example, other communication methods excluding a wireless LAN and a telephone communication method). Note that the communication unit 120 may include a communication unit that can communicate with a plurality of communication methods. For example, the communication unit 120 includes a communication unit that can communicate with either the first communication method or the second communication method, that is, a communication unit that has the functions of the first communication unit and the second communication unit described above. You may have. Thereby, it can contribute to the simplification of the structure of the communication module 14, and size reduction.

  Each of the plurality of communication units receives the signaling message generated by the signaling transmission / reception unit 1625 via each of a plurality of communication relay apparatuses corresponding to each of a plurality of communication networks such as the cellular network 40 and the wireless LAN network 46. , And transmitted to the SIP server 22. Each of the plurality of communication units included in the communication unit 120 transmits communication data generated by the general application unit 100 or the real-time application unit 105 to or from the communication terminal 12 or the proxy server 20.

  Each of the plurality of communication units supplies the signaling message received from the SIP server 22 to the signaling control unit 1605 via the communication control unit 130. Each of the plurality of communication units supplies communication data received from the communication terminal 12 or the proxy server 20 to the general application unit 100 or the real-time application unit 105 via the communication control unit 130.

  Each of the plurality of communication units included in the communication unit 120 transmits, to the communication control unit 130, information used by the communication IF selection unit 140 to determine whether or not communication can be performed using the communication method assigned to each of the communication units. Supply. Furthermore, when a plurality of communication units are assigned dynamic real IP addresses from communication relay apparatuses that can communicate with each other, the plurality of communication units supply the assigned real addresses to the communication control unit 130.

  The communication IF selection unit 140 selects a communicable communication unit among the plurality of communication units based on information supplied from the plurality of communication units. For example, the communication IF selection unit 140 receives information indicating the radio wave intensity including information for identifying a communication method issued by the communication relay device from a plurality of communication units, and enables communication based on the magnitude of the charge intensity. Judge the part. In another example, the communication IF selection unit 140 may select one communication unit from the plurality of communication units based on a policy such as a usage priority order set in advance for the plurality of communication units. Then, the communication IF selection unit 140 supplies information for identifying the selected communication unit to the conversion table storage unit 1640.

  The address acquisition unit 150 acquires a real address that is dynamically assigned to the communication terminal 10 by the communication relay device. That is, the address acquisition unit 150 acquires a real address assigned to the communication unit selected by the communication IF selection unit 140. The real address is, for example, a private IP address or a global IP address managed by the communication relay device, and is hereinafter referred to as a real IP address. Then, the address acquisition unit 150 supplies the acquired real IP address to the conversion table storage unit 1640.

  The conversion table storage unit 1640 stores information for identifying the communication unit selected by the communication IF selection unit 140 and the real IP address acquired by the address acquisition unit 150. Then, the conversion table storage unit 1640 notifies the stored real IP address to the data format conversion unit 1600 and the (de) encapsulation unit 1610.

  The general application unit 100 executes processing for a predetermined purpose. Specifically, the general application unit 100 causes an application program that executes data processing to execute predetermined target data processing. The application program may be, for example, a Web browser program, an e-mail transmission / reception program, and a multimedia data transmission / reception program. The general application unit 100 supplies the virtual interface unit 110 with data processed by the application program and to be transmitted to the communication terminal 12 or the proxy server 20.

  In such a case, the general application unit 100 adds an identification number that uniquely identifies the virtual interface unit 110 to the communication data and supplies the communication data to the virtual interface unit 110. The identification number is a virtual address assigned to the virtual interface unit 110, for example. The virtual address is dynamically or statically assigned by the SIP server 22 at the activation stage of the signaling control unit 1605. The virtual address has an IP address configuration, for example, and is hereinafter referred to as a virtual IP address. The virtual IP address may be fixedly set for the general application unit 100.

  The real-time application unit 105 executes a predetermined target process. Specifically, the real-time application unit 105 causes a SIP application program that executes data processing to execute predetermined data processing. For example, the SIP application program may be an application program such as an IP phone that provides real-time multimedia communication.

  The virtual interface unit 110 is assigned a virtual IP address, and receives communication data to be transmitted to the communication terminal 12 or the proxy server 20 from the general application unit 100. The virtual interface unit 110 supplies the received communication data to the data format conversion unit 1600. In addition, the virtual interface unit 110 receives the signaling message generated by the signaling control unit 1605 via the first encryption unit 1615. The virtual interface unit 110 supplies the received signaling message to the (de) encapsulation unit 1610.

  The signaling control unit 1605 controls signaling of the communication terminal 10. The signaling control unit 1605 controls signaling by SIP, for example. Specifically, the signaling control unit 1605 establishes a session with the SIP server 22 using the real IP address acquired by the address acquisition unit 150 or the virtual IP address of the virtual interface unit 110. More specifically, the signaling control unit 1605 uses the real IP address acquired by the address acquisition unit 150 to establish a first session with the SIP server 22, and after establishing the first session, the virtual interface A second session is established with the SIP server 22 using the virtual IP address of the unit 110.

  The signaling control unit 1605 establishes the first session with the SIP server 22 and during the period from the establishment of the first session to the establishment of the second session via the first encryption unit 1615. The signaling message is supplied to the signaling transmission / reception unit 1625 and exchanged with the SIP server 22 via the first session. On the other hand, after the second session is established, the signaling control unit 1605 sends a signaling message to the signaling transmission / reception unit 1625 via the first encryption unit 1615, the virtual interface unit 110, and the (de) encapsulation unit 1610. And interacts with the SIP server 22 via the second session. The signaling control unit 1605 performs various operations such as turning on the power to the communication terminal 10, starting or restarting the communication module 14, HO (Handover) of the communication terminal 10, changing the codec during a call, and periodically updating the SIP registration. In response to the operation, a signaling message is generated and signaling such as location registration is performed.

  The first encryption unit 1615 encrypts the signaling message generated by the signaling control unit 1605 for signaling to the SIP server 22 using a first security protocol that ensures communication security. Specifically, the first encryption unit 1615 performs encryption using a first security protocol that can be used together with a connection-type communication protocol. More specifically, the first encryption unit 1615 performs encryption using the first security protocol that can be used together with the connection-type communication protocol used in the transport layer (layer 4) in the OSI reference model. The first security protocol may be a protocol that prevents tapping and tampering of communication data using at least one of security techniques such as public key encryption or private key encryption, digital certificate, and hash function. For example, the first encryption unit 1615 encrypts the signaling message using the TLS protocol as the first security protocol.

  Before the second session is established, the first encryption unit 1615 supplies the encrypted signaling message directly to the signaling transmission / reception unit 1625. On the other hand, after the second session is established, the first encryption unit 1615 supplies the encrypted signaling message to the signaling transmission / reception unit 1625 via the virtual interface unit 110 and the (de) encapsulation unit 1610. .

  The first encryption unit 1615 decrypts the signaling message transmitted from the SIP server 22 and supplies the decrypted signaling message to the signaling control unit 1605. Also in this case, the first encryption unit 1615 receives the signaling message directly from the signaling transmission / reception unit 1625 before the second session is established, while the signaling message is received after the second session is established. Is received via the (de) encapsulation unit 1610 and the virtual interface unit 110.

  The data format conversion unit 1600 converts communication data to be transmitted to the communication terminal 12 or the proxy server 20 into a data format that can be encrypted using SRTP. The data format conversion unit 1600 converts the data structure of the communication data and the header format into a data format that can be encrypted using SRTP. For example, the data format conversion unit 1600 virtually converts predetermined additional information to convert communication data that can be transmitted by TCP (Transmission Control Protocol) received from the virtual interface unit 110 into communication data that can be transmitted by UDP. It is added to the communication data received from the interface unit 110. However, the data format conversion unit 1600 does not perform data format conversion when the communication data is an RTP (Real-Time Transport Protocol) packet, and when the communication data is a packet other than RTP, By adding the RTP header, the data format is converted into an RTP packet. Then, the data format conversion unit 1600 supplies the communication data after the data format conversion to the second encryption unit 1620.

  Further, the data format conversion unit 1600 reversely converts the data format of communication data transmitted from the communication terminal 12 or the proxy server 20. For example, the data format conversion unit 1600 removes the RTP header from the communication data and converts the communication data into a TCP / UDP packet. Then, the data format conversion unit 1600 supplies the communication data after the reverse conversion of the data format to the virtual interface unit 110.

  The (de) encapsulation unit 1610 encapsulates the signaling message received from the virtual interface unit 110 or the communication data received from the second encryption unit 1620 by adding predetermined additional information. Specifically, the (de) encapsulation unit 1610 is supplied from the virtual interface unit 110, a signaling message with a virtual IP address added as a source address, or communication data supplied from the second encryption unit 1620. In addition, the real IP address acquired by the address acquisition unit 150 and stored in the conversion table storage unit 1640 is added as a source address for encapsulation. Then, the (de) encapsulation unit 1610 supplies the encapsulated signaling message to the signaling transmission / reception unit 1625. The (de) encapsulation unit 1610 supplies the encapsulated communication data to the data transmission / reception unit 1645.

  Further, when receiving the encapsulated signaling message transmitted from the SIP server 22, the (de) encapsulation unit 1610 decapsulates the received signaling message and supplies it to the virtual interface unit 110. Further, when receiving the encapsulated communication data transmitted from the communication terminal 12 or the proxy server 20, the (de) encapsulation unit 1610 decapsulates the received communication data and supplies it to the second encryption unit 1620. To do. For example, the (de) encapsulation unit 1610 removes the UDP header from the UDP-encapsulated communication data, and converts the communication data into an RTP packet. Then, the (de) encapsulation unit 1610 supplies the communication data after the decapsulation to the second encryption unit 1620.

  The second encryption unit 1620 transmits the communication data supplied from the second encryption unit 1620 after the SIP server 22 signals the communication terminal 10 in response to the signaling message transmitted from the signaling transmission / reception unit 1625 to the SIP server 22. Is encrypted using a second security protocol different from the first security protocol. Specifically, the second encryption unit 1620 performs encryption using a second security protocol that can be used together with a connectionless communication protocol. For example, the second encryption unit 1620 encrypts the communication data using SRTP as the second security protocol.

  Then, the second encryption unit 1620 supplies the encrypted communication data to the (de) encapsulation unit 1610. The second encryption unit 1620 decrypts the communication data transmitted from the communication terminal 12 or the proxy server 20 and supplies the decrypted communication data to the data format conversion unit 1600. For example, the second encryption unit 1620 decrypts the communication data converted into the RTP packet by the (de) encapsulation unit 1610 using the key information of the SRTP session.

  The signaling transmission / reception unit 1625 generates a signaling message generated by the signaling control unit 1605 and encrypted by the first encryption unit 1615 after the first session is established until the second session is established. To the SIP server 22 via At this time, the signaling transmission / reception unit 1625 transmits a signaling message using a connection-type communication protocol. Specifically, the signaling transmission / reception unit 1625 supplies the signaling message supplied from the first encryption unit 1615 to the communication unit selected by the communication IF selection unit 140 via the communication control unit 130, and uses TCP. Send it.

  Further, after the second session is established, the signaling transmission / reception unit 1625 generates a signaling message generated by the signaling control unit 1605, encrypted by the first encryption unit 1615, and encapsulated by the (de) encapsulation unit 1610. It transmits to the SIP server 22 via the second session. At this time, the signaling transmission / reception unit 1625 transmits a signaling message using a connectionless communication protocol. Specifically, the signaling transmission / reception unit 1625 supplies the signaling message supplied from the (de) encapsulation unit 1610 to the communication unit selected by the communication IF selection unit 140 via the communication control unit 130, and uses UDP. To send.

  Further, the signaling transmission / reception unit 1625 supplies the signaling message transmitted from the SIP server 22 to the signaling control unit 1605. Also in this case, the signaling transceiver 1625 supplies the signaling message to the first encryption unit 1615 before the second session is established, while the signaling message is sent to the first encryption unit 1615 after the second session is established. (De) Supply to the encapsulation unit 1610.

  The data transmission / reception unit 1645 supplies communication data to be transmitted to the communication terminal 12 or the proxy server 20 to the communication unit selected by the communication IF selection unit 140 via the communication control unit 130, and transmits the communication data to the communication terminal 12 or the proxy server 20. Send. Specifically, the data transmission / reception unit 1645 transmits the communication data encrypted by the second encryption unit 1620 using a connectionless communication protocol. For example, the data transmission / reception unit 1645 transmits the communication data encrypted by the second encryption unit 1620 using SPTP using UDP. Further, the data transmission / reception unit 1645 receives data received from the communication terminal 12 or the proxy server 20 from the communication unit selected by the communication IF selection unit 140 via the communication control unit 130 and supplies the received data to the (de) encapsulation unit 1610. To do.

  The encryption condition storage unit 1650 stores a predetermined condition for determining whether or not the second encryption unit 1620 is to perform encryption. The encryption condition storage unit 1650 may store conditions individually set by the user.

  The encryption condition determination unit 1655 determines whether or not the condition for transmitting the communication data received by the second encryption unit 1620 matches a predetermined condition stored in the encryption condition storage unit 1650. To do.

  The data format conversion unit 1600 does not convert the data format of the communication data determined by the encryption condition determination unit 1655 as not meeting the predetermined condition. Then, the second encryption unit 1620 does not encrypt the communication data. On the other hand, the data format conversion unit 1600 converts the communication data determined by the encryption condition determination unit 1655 to meet a predetermined condition into a data format that can be encrypted using SRTP. Then, the second encryption unit 1620 encrypts the communication data.

  The encryption condition storage unit 1650 stores the type of application as a predetermined condition. The encryption condition determination unit 1655 analyzes the communication data received by the second encryption unit 1620 to determine the type of application that generated the communication data. Then, the encryption condition determination unit 1655 determines whether or not the type of application that generated the communication data matches the type of application stored in the encryption condition storage unit 1650.

  If the type of application that generated the communication data is not stored in the encryption condition storage unit 1650, the data format conversion unit 1600 does not convert the data format of the communication data. Then, the second encryption unit 1620 supplies the communication data to the data transmission / reception unit 1645 without encrypting the communication data. On the other hand, when the type of application that generated the communication data is stored in the encryption condition storage unit 1650, the data format conversion unit 1600 converts the data format of the communication data. Then, the second encryption unit 1620 encrypts the communication data.

  The encryption condition storage unit 1650 stores application types such as HTTPS (Hypertext Transfer Protocol Security) and SSH (Secure Shell). This can prevent further encryption of communication data that has already been encrypted in the upper layer.

  Further, the encryption condition storage unit 1650 may store a protocol applied to communication data as a predetermined condition. The encryption condition determination unit 1655 determines the protocol applied to the communication data by analyzing the communication data received by the second encryption unit 1620 or examining the protocol applied by the data transmission / reception unit 1645. . Then, the encryption condition determination unit 1655 determines whether or not the protocol applied to the communication data matches the protocol stored in the encryption condition storage unit 1650.

  When the protocol applied to the communication data is not stored in the encryption condition storage unit 1650, the data format conversion unit 1600 does not convert the data format of the communication data. Then, the second encryption unit 1620 supplies the communication data to the data transmission / reception unit 1645 without encrypting the communication data. On the other hand, when the protocol applied to the communication data is stored in the encryption condition storage unit 1650, the data format conversion unit 1600 converts the data format of the communication data. Then, the second encryption unit 1620 encrypts the communication data.

  The encryption condition storage unit 1650 stores protocols such as UDP and IGMP (Internet Group Management Protocol). Thereby, when a specific protocol is applied in order to improve the transfer efficiency of communication data, it is possible to prevent the transfer efficiency from being reduced by the encryption process.

  The encryption condition storage unit 1650 may store the type of communication method as a predetermined condition. The encryption condition determination unit 1655 determines the type of communication method when the communication data is transmitted from the type of communication method of the communication unit selected by the communication IF selection unit 140. Then, the encryption condition determination unit 1655 determines whether or not the type of communication method when the communication data is transmitted matches the type of communication method stored in the encryption condition storage unit 1650.

  If the type of communication method when the communication data is transmitted is not stored in the encryption condition storage unit 1650, the data format conversion unit 1600 does not convert the data format of the communication data. Then, the second encryption unit 1620 supplies the communication data to the data transmission / reception unit 1645 without encrypting the communication data. On the other hand, when the type of communication method when the communication data is transmitted is stored in the encryption condition storage unit 1650, the second encryption unit 1620 encrypts the communication data.

  The encryption condition storage unit 1650 stores a communication method such as a WiFi method, for example. As a result, when communication data is transmitted using the WiFi method, which often has a relatively low security level, encryption processing is executed, and the communication data is transmitted using the cellular method, which often has a relatively high security level. In this case, the encryption process can not be executed. Therefore, excessive encryption can be prevented for communication data transmitted by a communication method with a high security level.

  According to the communication terminal 10 according to the present embodiment, when signaling with the SIP server 22 is performed, the security of the signaling message transmitted to the SIP server 22 can be secured using TLS. Moreover, when a communication terminal performs data communication, the security of the communication data transmitted to the communication terminal 12 or the proxy server 20 can be ensured using SRTP. Thereby, the communication terminal 10 can not only continue the communication without disconnecting the communication connection with the communication terminal 12, the proxy server 20, and the SIP server 22, but also ensures the security of the signaling message and the communication data. it can. Furthermore, the amount of encryption processing and the communication traffic can be reduced by applying the encryption processing by the second encryption unit 1620 only when necessary.

  FIG. 4 shows an example of a module configuration of the communication terminal 10 according to the first example of the present embodiment. The general client application module 200 is an application such as a Web browser, for example, and is an example of the general application unit 100 in the above description of FIG. The Mobile SIP APs module 205 is an example of the real-time application unit 105 in the above description of FIG. 3, and is, for example, a VoIP application. The Virtual IF module 210 is an example of the virtual interface unit 110 in the above description of FIG. The communication interface unit 220 having a plurality of communication IF modules and the plurality of NICs are examples of the communication unit 120 in the above description of FIG.

  The signaling control module 2605 is an example of the signaling control unit 1605 in the above description of FIG. The IAC module 2610 is an example of the communication IF selection unit 140 and the address acquisition unit 150 in the above description of FIG. The (de) encapsulation module 2600 is an example of the (de) encapsulation unit 1610 and the conversion table storage unit 1640 in the above description of FIG.

  The RTP module 2615 and the RTP module 2620 are an example of the data format conversion unit 1600 in the above description of FIG. 3, and the RTP module 2615 and the RTP module 2620 may be physically one module. The policy control module 2625 is an example of the encryption condition storage unit 1650 and the encryption condition determination unit 1655 in the above description of FIG.

  The TLS module 252 and the TLS module 258 are examples of the first encryption unit 1615 in the above description of FIG. 3, and the TLS module 252 and the TLS module 258 may be physically one module. The SRTP module 256 is an example of the second encryption unit 1620 in the above description of FIG. The UDP module 240 is an example of the signaling transmission / reception unit 1625 and the data transmission / reception unit 1645 in the above description of FIG. The TCP module 242 is an example of the signaling transmission / reception unit 1625 in the above description of FIG.

  The plurality of network interface cards (NICs) communicate with the communication terminal 12, the proxy server 20, and the SIP server 22 using a communication method corresponding to each of them. The plurality of NICs are controlled by the corresponding communication IF modules to transmit and receive communication data. The plurality of communication IF modules transmit and receive communication data via the corresponding NICs.

  For example, the communication IF module a222 transmits / receives communication data via the NICa232. Similarly, the communication IF module b224 transmits / receives communication data via the NICb234, and the communication IF module n226 transmits / receives communication data via the NICn236. Specifically, the NICa 232 may be a wireless LAN interface card, and the NICb 234 may be a mobile phone communication system interface card. The NICn 236 may be an interface card of another communication method excluding the wireless LAN communication method and the mobile phone communication method.

  The IAC module 2610 determines and selects which of a plurality of communication IF modules (for example, the communication IF module a222, the communication IF module b224, the communication IF module n226, etc.) included in the communication interface unit 220 can be used. . That is, the IAC module 2610 determines which communication IF module can communicate with the communication relay device, and selects a communication IF module capable of communication. The method by which the IAC module 2610 determines which communication IF module can communicate is substantially the same as the communication IF selection unit 140 in the above description of FIG.

  The IAC module 2610 acquires an IP address dynamically assigned to the communication terminal 10 by the communication relay device via a communication IF module capable of communication. The IAC module 2610 then transmits information for identifying a communication IF module capable of communication and the acquired IP address to the signaling control module 2605, the (de) encapsulation module 2600, the RTP module 2615, the RTP module 2620, and the Mobile SIP APs module. 205 is notified.

  First, the signaling control module 2605 signals to the SIP server 22 using TLS when the communication terminal 10 is activated, for example. That is, the signaling control module 2605 causes the TLS module 258 to encrypt the signaling message for executing the signaling process using TLS. Then, the signaling control module 2605 converts the encrypted signaling message into a format that can be transmitted by TCP in the TCP module 242 and transmits it to the SIP server 22. Specifically, the signaling control module 2605 outputs a signaling message encrypted by TLS to the SIP server via the communication IF module that can communicate with the communication relay device among the plurality of communication IF modules of the communication interface unit 220. 22 to send.

  For example, the signaling control module 2605 establishes a first TLS session between the communication terminal 10 and the SIP server 22 by exchanging a signaling message with the SIP server 22 when the communication terminal 10 is activated. Then, the signaling control module 2605 transmits a REGISTER request message as a signaling message to the SIP server 22. The REGISTER request message includes the SIP URI of the SIP server 22 that performs signaling processing, the SIP URI of the communication terminal 10 that requests registration, information indicating the registration expiration date, and the like. Then, the SIP server 22 that has received the REGISTER request message executes the signaling process of the communication terminal 10. When the signaling process is completed, the SIP server 22 notifies the signaling control module 2605 of the communication terminal 10 that the signaling is completed, for example, by returning a 200 OK message.

  Next, a case where the communication IF module capable of communicating with the communication relay device is changed, that is, a case where the handover control is required due to the movement of the communication terminal 10 will be described. In such a case, the signaling control module 2605 executes signaling of the communication terminal 10 as shown below so that the communication with the communication terminal 12 and the SIP server 22 is not disconnected when viewed from the communication terminal 10.

  First, the signaling control module 2605 establishes a first TLS session between the communication terminal 10 and the SIP server 22, and then encrypts the REGISTER request message using the TLS in the TLS module 252. Then, the signaling control module 2605 converts the REGISTER request message encrypted by TLS into a format that can be transmitted by TCP in the TCP / UDP module 254. Subsequently, the signaling control module 2605 supplies a REGISTER request message that has been encrypted with TLS and converted into a format that can be transmitted with TCP to the Virtual IF module 210 that is a virtual interface module.

  Subsequently, the Virtual IF module 210 supplies a REGISTER request message in a format that can be transmitted by TCP to the (de) encapsulation module 2600. The (de) encapsulation module 2600 encapsulates the REGISTER request message encrypted in TLS and converted into a format that can be transmitted in TCP into a format that can be transmitted in UDP. For example, the (de) encapsulation module 2600 uses a REGISTER request to add predetermined additional information to a REGISTER request message encrypted in TLS and converted into a format that can be transmitted in TCP into a format that can be transmitted in UDP. Encapsulate by appending to the message. Then, the (de) encapsulation module 2600 transmits the encapsulated REGISTER request message from the UDP module 240 to the SIP server 22 via the communication IF module.

  Thereafter, the SIP server 22 that has received the encapsulated REGISTER request message executes the signaling process of the communication terminal 10. When the signaling process is completed, the SIP server 22 notifies the signaling control module 2605 of the communication terminal 10 that the signaling is completed, for example, by returning a 200 OK message. Thereby, the signaling of the communication terminal 10 is completed, and the second TLS session is established between the communication terminal 10 and the SIP server 22. As described above, since the communication terminal 10 can establish the second TLS session based on the virtual IP address, even when the real IP address dynamically allocated to the communication terminal 10 changes, the communication terminal 10 can perform signaling with the SIP server 22. It is possible to continuously perform signaling with the SIP server 22 without disconnecting the session.

  Next, a case where the general client application module 200 executes transmission / reception of predetermined communication data with the communication terminal 12 will be described. The general client application module 200 converts the communication data to be transmitted to the communication terminal 12 into a format that can be transmitted by TCP in the TCP / UDP module 254 and supplies the data to the Virtual IF module.

  In such a case, the general client application module 200 adds the virtual IP address assigned to the Virtual IF module 210 to the communication data. Then, the general client application module 200 supplies the communication address with the virtual IP address added to the Virtual IF module 210. Thereby, even when the real IP address assigned to the communication terminal 10 is changed, the general client application module 200 can continue the TCP session with the communication terminal 12 without being affected by the change of the real IP address.

  The virtual IF module 210 supplies the communication data received from the general client application module 200 to the (de) encapsulation module 2600. The (de) encapsulation module 2600 encapsulates the communication data received from the virtual IF module 210. The (de) encapsulation module 2600 controls the RTP module 2620, the SRTP module 256, and the UDP module 240 to encapsulate and encrypt the received communication data.

  The RTP module 2620 converts the data into a data format that can be encrypted using SRTP by adding an RTP header to the communication data. The policy control module 2625 determines whether or not the communication data output from the RTP module 2620 needs to be encrypted by SRTP based on a predetermined condition.

  When the policy control module 2625 determines that SRTP encryption is necessary, the SRTP module 256 encrypts the communication data converted into the RTP packet by the RTP module 2620 using SRTP. The UDP module 240 encapsulates the communication data encrypted by the SRTP module 256 by adding a UDP header, and transmits it to the communication terminal 12 via the communication IF module.

  On the other hand, if it is determined by the policy control module 2625 that encryption by SRTP is not necessary, the RTP module 2620 does not add an RTP header to the communication data. The SRTP module 256 transmits the communication data output from the RTP module 2620 from the UDP module 240 to the communication terminal 12 via the communication IF module without encryption.

  On the other hand, the communication data transmitted from the communication terminal 12 to the communication terminal 10 is received via the NIC and the communication IF module corresponding to the NIC. The communication data transmitted by the communication terminal 12 is encrypted with SRTP after encapsulating communication data communicable with TCP into a format communicable with UDP. The UDP module 240 supplies the received communication data to the SRTP module 256. The SRTP module 256 decrypts communication data encrypted with SRTP. The RTP module 2620 then inversely converts the format of the decrypted communication data and supplies it to the (de) encapsulation module 2600.

  The (de) encapsulation module 2600 decapsulates the communication data decrypted by the SRTP module 256. That is, the (de) encapsulation module 2600 decapsulates communication data encapsulated in a format that can be transmitted by UDP. The (de) encapsulation module 2600 supplies the decapsulated communication data to the virtual IF module 210.

  The virtual IF module 210 supplies communication data received via the TCP / UDP module 254 to the general client application module 200. The general client application module 200 processes the communication data received from the virtual IF module 210 by passing it to a predetermined application.

  Thereby, even when the real IP address assigned to the communication terminal 10 is changed, the general client application module 200 can continue the TCP session with the communication terminal 12 without being affected by the change of the real IP address. Further, the general client application module 200 does not convert communication data that can be communicated by TCP into communication data that can be communicated by UDP, and encryption / decryption of communication data transmitted to and received from the communication terminal 12 is eliminated. That is, according to the communication terminal 10 according to the present embodiment, E2E security can be provided even if the general client application module 200 does not have a special function.

  Next, a case where the Mobile SIP APs module 205 transmits communication data will be described. The Mobile SIP APs module 205 transmits communication data to be transmitted to the communication terminal 12 via the available communication IF module notified from the IAC module 2610.

  Specifically, the Mobile SIP APs module 205 transmits communication data to be transmitted to the communication terminal 12 to the RTP module 2615. The RTP module 2615 converts the communication data received from the Mobile SIP APs module 205 into a format that can be transmitted by RTP.

  Then, the RTP module 2615 supplies the communication data converted into a format that can be transmitted by RTP to the SRTP module 256. The SRTP module 256 encrypts the communication data received from the RTP module 2615 using SRTP. Then, the SRTP module 256 transmits the encrypted communication data to the communication terminal 12 via the communication module. In addition, the SIP AP communication data received by the communication IF module from the communication terminal 12 is decrypted by the SRTP module 256. Then, the SRTP module 256 supplies the decrypted communication data to the Mobile SIP APs module 205 via the RTP module 2615.

  Note that the communication data transmitted to the communication terminal 12 in the above description may be transmitted to another server such as the public server 26 or the communication terminal via the proxy server 20. In such a case, the proxy server 20 executes decapsulation and decryption of the communication data transmitted by the communication terminal 10 and encapsulation and encryption of the communication data transmitted by the public server 26 and the like.

  Thereby, the communication terminal 10 can ensure the security of the communication data transmitted / received with the communication terminal 12 using SRTP. Furthermore, since IPsec is not used, communication data is not transmitted / received via the IPsec Security Gateway. Thereby, it can avoid that communication traffic concentrates on one point.

  FIG. 5 shows an example of the flow of signaling processing by the communication terminal 10 according to the first example of the present embodiment. First, the IAC module 2610 selects a communication IF module capable of communication from a plurality of communication IF modules (S500). Then, the IAC module 2610 acquires a real IP address assigned to the selected communication IF module (S505). Then, the signaling control module 2605 establishes the first session of the first protocol based on the real IP address (S510). The first session is, for example, a session using TLS and TCP. Thereafter, the signaling control module 2605 transmits and receives signaling securely using the first session (S515). Next, the Virtual IF module 210 is set to be valid (S520).

  Here, when the mobility of the signaling security of the communication terminal 10 is not necessary (S525: NO), the communication terminal 10 shifts to a standby state (S545). In this case, in the standby state, the signaling control module 2605 performs signaling through the first session as necessary. On the other hand, when the mobility of the signaling security of the communication terminal 10 is necessary (S525: YES), the communication terminal 10 makes a second session of an arbitrary protocol based on the virtual IP address set in the Virtual IF module 210. Establish (S530). The arbitrary protocol may be the same as the first protocol described above, or may be another protocol. The second session is, for example, a session based on SRTP and UDP, which is a session based on TLS and TCP.

  Thereafter, the signaling control module 2605 uses the second session to securely transmit and receive signaling (S535). Then, the signaling control module 2605 determines whether or not the signaling process is completed (S540). If the signaling process is not completed, the process returns to S540, and the signaling control module 2605 continues to transmit and receive signaling securely using the second session (S535). On the other hand, when the signaling process is completed, the communication terminal 10 shifts to a standby state (S545). In this case, in the standby state, the signaling control module 2605 performs signaling through the second session.

  Thereafter, when the session mobility controller module 260 is not stopped (S545: NO), the communication terminal 10 is maintained in a standby state. On the other hand, when the session mobility controller module 260 is stopped (S545: YES), the signaling process ends.

  FIG. 6 shows an example of the flow of communication data transmission processing in the standby state (S545). First, the general client application module 200 designates the communication data to be transmitted to the communication terminal 12 by designating the virtual IP address assigned to the virtual IF module 210, and the (de) encapsulation module 2600 through the virtual IF module 210. (S600). Since the virtual IP address is fixedly assigned to the virtual IF module 210, the general client application module 200 is always virtual regardless of the IP address dynamically assigned to the communication terminal 10 by the communication relay device. An IP address is designated and communication data is transmitted. The general client application module 200 transmits communication data to the virtual IF module 210 in a format that can be transmitted using TCP.

  The policy control module 2625 determines whether or not the condition for transmitting the communication data supplied from the general client application module 200 matches a predetermined condition (S610). If it is determined that the predetermined condition is met (S610: YES), the RTP module 2620 performs packet processing on the communication data supplied from the Virtual IF module 210 (S620). That is, the RTP module 2620 adds the RTP header to the communication data and encapsulates it.

  Next, the SRTP module 256 encrypts the communication data encapsulated by the RTP module with SRTP, which is the second security protocol (S630). Then, the UDP module 240 adds a UDP header to the communication data encrypted by the SRTP module 256 and encapsulates it (S640). Then, the UDP module 240 transmits the communication data encrypted by the SRTP module 256 from the communication IF module to the communication terminal 12 using UDP (S650).

  If it is determined in S610 that the predetermined condition is not met (S610: NO), the RTP module 2620 does not encapsulate the communication data, and the SRTP module 256 does not encrypt the communication data. The UDP module 240 adds a UDP header to the communication data not encrypted with SRTP and encapsulates it (S660). Then, the UDP module 240 transmits communication data not encrypted with SRTP from the communication IF module to the communication terminal 12 using UDP (S670).

  FIG. 7 shows an example of the flow of communication data reception processing in the standby state (S545). First, the UDP module 240 receives the communication data transmitted from the communication terminal 12 to the communication terminal 10 via the communication IF module (S700). Communication data transmitted from the communication terminal 12 to the communication terminal 10 is encrypted using SRTP, which is the second security protocol, after encapsulating communication data communicable with TCP into a format communicable with UDP. ing.

  The UDP module 240 decapsulates the communication data by removing the UDP header from the received communication data in accordance with the control of the (de) encapsulation module 2600 (S710). The SRTP module 256 decrypts the decapsulated communication data encrypted using SRTP (S720). The (de) encapsulation module 2600 supplies the communication data decoded after being decapsulated to the virtual IF module 210. The virtual IF module 210 performs packet processing on the communication data received from the (de) encapsulation module 2600 (S730) and transfers it to the general client application module 200 (S740).

  FIG. 8 shows an example of a functional configuration of the communication module 14 of the communication terminal 10 according to the second example of the present embodiment. The communication module 14 includes a general application unit 800, a real-time application unit 805, a virtual interface unit 810, a communication unit 820, a communication control unit 830, and a session mobility control unit 860. Note that the proxy server 20 and the SIP server 22 may include some or all of the functions and configurations of the communication module 14.

  The communication unit 820 includes a plurality of communication units including a first communication unit 822, a second communication unit 824, and an nth communication unit 826. In addition, the communication control unit 830 includes a communication IF selection unit 840 and an address acquisition unit 850. The session mobility control unit 860 includes a data format conversion unit 8600, a signaling control unit 8605, a (de) encapsulation unit 8610, a first encryption unit 8615, a second encryption unit 8620, a signaling transmission / reception unit 8625, and a conversion table storage. Unit 8640, data transmission / reception unit 8645, encryption condition storage unit 8650, and encryption condition determination unit 8655.

  The communication unit 820 includes a plurality of communication units that differ for each of a plurality of communication methods with which the communication module 14 can communicate. For example, the communication unit 820 includes a first communication unit 822 that communicates with a first communication method (for example, a wireless LAN communication method), a second communication unit 824 that communicates with a second communication method (for example, a telephone communication method), And an nth communication unit 826 that communicates with the nth communication method (for example, other communication methods excluding a wireless LAN and a telephone communication method). Note that the communication unit 820 may include a communication unit that can communicate with a plurality of communication methods. For example, the communication unit 820 includes a communication unit that can communicate with either the first communication method or the second communication method, that is, a communication unit that has the functions of the first communication unit and the second communication unit described above. You may have. Thereby, it can contribute to the simplification of the structure of the communication module 14, and size reduction.

  In addition, each of the plurality of communication units receives a signaling message generated by the signaling transmission / reception unit 8625 via each of a plurality of communication relay apparatuses corresponding to each of a plurality of communication networks such as the cellular network 40 and the wireless LAN network 46. , And transmitted to the SIP server 22. Each of the plurality of communication units included in the communication unit 820 transmits communication data generated by the general application unit 800 or the real-time application unit 805 to or from the communication terminal 12 or the proxy server 20.

  Each of the plurality of communication units supplies the signaling message received from the SIP server 22 to the signaling control unit 8605 via the communication control unit 830. Each of the plurality of communication units supplies communication data received from the communication terminal 12 or the proxy server 20 to the general application unit 800 or the real-time application unit 805 via the communication control unit 830.

  Each of the plurality of communication units included in the communication unit 820 sends information used for the communication IF selection unit 840 to determine whether or not communication can be performed using the communication method assigned to each of the communication units to the communication control unit 830. Supply. Further, when a dynamic real IP address is assigned from a communication relay device that can communicate with each other, the plurality of communication units supplies the assigned real address to the communication control unit 830.

  The communication IF selection unit 840 selects a communicable communication unit among the plurality of communication units based on information supplied from the plurality of communication units. For example, the communication IF selection unit 840 receives information indicating the radio wave intensity including information for identifying a communication method issued by the communication relay device from a plurality of communication units, and enables communication based on the magnitude of the charge intensity. Judge the part. In another example, the communication IF selection unit 840 may select one communication unit from the plurality of communication units based on a policy such as a usage priority set in advance for the plurality of communication units. Then, the communication IF selection unit 840 supplies information for identifying the selected communication unit to the conversion table storage unit 8640.

  The address acquisition unit 850 acquires a real address that is dynamically assigned to the communication terminal 10 by the communication relay device. That is, the address acquisition unit 850 acquires the real address assigned to the communication unit selected by the communication IF selection unit 840. The real address is, for example, a private IP address or a global IP address managed by the communication relay device, and is hereinafter referred to as a real IP address. Then, the address acquisition unit 850 supplies the acquired real IP address to the conversion table storage unit 8640.

  The conversion table storage unit 8640 stores information for identifying the communication unit selected by the communication IF selection unit 840 and the real IP address acquired by the address acquisition unit 850. Then, the conversion table storage unit 8640 notifies the stored real IP address to the data format conversion unit 8600 and the (de) encapsulation unit 8610.

  The general application unit 800 executes processing for a predetermined purpose. Specifically, the general application unit 800 causes an application program that executes data processing to execute predetermined data processing. The application program may be, for example, a Web browser program, an e-mail transmission / reception program, and a multimedia data transmission / reception program. The general application unit 800 supplies the virtual interface unit 810 with data processed by the application program and to be transmitted to the communication terminal 12 or the proxy server 20.

  In such a case, the general application unit 800 adds an identification number uniquely identifying the virtual interface unit 810 to the communication data and supplies the communication data to the virtual interface unit 810. The identification number is a virtual address assigned to the virtual interface unit 810, for example. The virtual address is dynamically or statically assigned by the SIP server 22 at the activation stage of the signaling control unit 8605. The virtual address has an IP address configuration, for example, and is hereinafter referred to as a virtual IP address. The virtual IP address may be fixedly set for the general application unit 800.

  The real-time application unit 805 executes a predetermined target process. Specifically, the real-time application unit 805 causes a SIP application program that executes data processing to execute predetermined data processing. For example, the SIP application program may be an application program such as an IP phone that provides real-time multimedia communication.

  The virtual interface unit 810 is assigned a virtual IP address and receives communication data to be transmitted to the communication terminal 12 or the proxy server 20 from the general application unit 800. The virtual interface unit 810 supplies the received communication data to the data format conversion unit 8600.

  The signaling control unit 8605 generates a signaling message and controls signaling of the communication terminal 10. The signaling control unit 8605 controls signaling by SIP, for example. Specifically, the signaling control unit 8605 establishes a session with the SIP server 22 using the real IP address acquired by the address acquisition unit 850. More specifically, the signaling control unit 8605 establishes a first signaling session based on the first security protocol with the SIP server 22. Then, after establishing the first signaling session, a second signaling session based on the second security protocol is established with the SIP server 22.

  The signaling control unit 8605 first supplies a signaling message to the signaling transmission / reception unit 8625 via the first encryption unit 8615. Accordingly, the signaling control unit 8605 establishes a first signaling session based on the first security protocol with the SIP server 22. At this time, the signaling control unit 8605 establishes a first signaling session by obtaining mutual authentication between the communication terminal 10 and the SIP server 22 using the first security protocol.

  When the first signaling session is established, the signaling control unit 8605 supplies a signaling message to the signaling transmission / reception unit 8625 via the first encryption unit 8615 and exchanges with the SIP server 22 via the first signaling session. . Accordingly, the signaling control unit 8605 establishes a second signaling session based on the second security protocol with the SIP server 22. At this time, the signaling control unit 8605 establishes the second signaling session using the authentication result obtained by using the first security protocol when establishing the first signaling session.

  After the second signaling session is established, the signaling control unit 8605 supplies the signaling message to the signaling transmission / reception unit 8625 via the data format conversion unit 8600 and the second encryption unit 8620, and the second signaling session Exchanges with the SIP server 22 via the session. The signaling control unit 8605 performs various operations such as turning on the power to the communication terminal 10, starting or restarting the communication module 14, HO (Handover) of the communication terminal 10, changing the codec during a call, and periodically updating the SIP registration. In response to the operation, a signaling message is generated to process signaling such as location registration.

  The first encryption unit 8615 encrypts the signaling message generated by the signaling control unit 8605 for signaling to the SIP server 22 using a first security protocol that ensures communication security. Specifically, the first encryption unit 8615 performs encryption using a first security protocol that can be used together with a connection-type communication protocol. More specifically, the first encryption unit 8615 performs encryption using the first security protocol that can be used together with the connection-type communication protocol used in the transport layer (layer 4) in the OSI reference model. The first security protocol may be a protocol that prevents tapping and tampering of communication data using at least one of security techniques such as public key encryption or private key encryption, digital certificate, and hash function. For example, the first encryption unit 8615 encrypts the signaling message using the TLS protocol as the first security protocol.

  The first encryption unit 8615 decrypts the signaling message transmitted from the SIP server 22 and supplies the decrypted signaling message to the signaling control unit 8605. In this case, the first encryption unit 8615 receives the signaling message directly from the signaling transmission / reception unit 8625.

  The data format conversion unit 8600 converts the signaling message generated by the signaling control unit 8605 into a data format that can be encrypted based on the second security protocol. Specifically, the data format conversion unit 8600 converts the signaling message generated by the signaling control unit 8605 into an RTP data format that can be encrypted based on SRTP by adding an RTP header. Then, the data format conversion unit 8600 supplies the second encryption unit 8620 with the signaling message whose data format has been converted.

  The data format conversion unit 8600 converts communication data transmitted to the communication terminal 12 or the proxy server 20 into a data format that can be encrypted using SRTP. The data format conversion unit 8600 converts the data configuration of the communication data and the format of the header into a data format that can be encrypted using SRTP. The data format conversion unit 8600 does not perform data format conversion when the communication data is an RTP packet, and adds an RTP header when the communication data is a packet other than RTP, thereby adding an RTP header. Perform data format conversion to packet. Then, the data format conversion unit 8600 supplies the communication data after the data format conversion to the second encryption unit 8620.

  The data format conversion unit 8600 reversely converts the data format of communication data transmitted from the communication terminal 12 or the proxy server 20. For example, the data format conversion unit 8600 removes the RTP header from the communication data and converts the communication data into a TCP / UDP packet. Then, the data format conversion unit 8600 supplies the communication data after the reverse conversion of the data format to the virtual interface unit 810.

  The (de) encapsulation unit 8610 encapsulates the communication data received from the second encryption unit 8620 by adding predetermined additional information. Specifically, the (de) encapsulation unit 8610 acquires the communication data supplied from the virtual interface unit 810 with the virtual IP address added as the transmission source address, and the address acquisition unit 850 acquires the conversion table storage unit. The real IP address stored in 8640 is added as a source address and encapsulated. The (de) encapsulation unit 8610 supplies the encapsulated communication data to the data transmission / reception unit 8645.

  The (de) encapsulation unit 8610 receives the encapsulated communication data transmitted from the communication terminal 12 or the proxy server 20. Then, the (de) encapsulation unit 8610 decapsulates the received communication data and supplies it to the second encryption unit 8620. For example, the (de) encapsulation unit 8610 removes the UDP header from the UDP-encapsulated communication data and converts it into an RTP packet. Then, the (de) encapsulation unit 8610 supplies the communication data after the decapsulation to the second encryption unit 8620.

  The second encryption unit 8620 encrypts the signaling message or communication data whose data format has been converted by the data format conversion unit 8600 based on a second security protocol different from the first security protocol. Specifically, the second encryption unit 8620 performs encryption using a second security protocol that can be used together with a connectionless communication protocol. For example, the second encryption unit 8620 encrypts the signaling message or communication data using SRTP as the second security protocol.

  Then, the second encryption unit 8620 supplies the encrypted signaling message to the signaling transmission / reception unit 8625. The second encryption unit 8620 supplies the encrypted communication data to the (de) encapsulation unit 8610. The second encryption unit 8620 decrypts the signaling message transmitted from the SIP server 22 and supplies the decrypted signaling message to the data format conversion unit 8600. The second encryption unit 8620 decrypts the communication data transmitted from the communication terminal 12 or the proxy server 20 and decapsulated by the (de) encapsulation unit 8610, and supplies the decrypted communication data to the data format conversion unit 8600. For example, the second encryption unit 8620 decrypts the communication data converted into the RTP packet by the (de) encapsulation unit 8610 using the key information of the SRTP session.

  When establishing the first signaling session, the signaling transmission / reception unit 8625 transmits the signaling message generated by the signaling control unit 8605 and encrypted by the first encryption unit 8615 to the SIP server 22. Further, when establishing the second signaling session, the signaling transmission / reception unit 8625 generates a signaling message generated by the signaling control unit 8605 and encrypted by the first encryption unit 8615 via the first signaling session. 22 to send. At this time, the signaling transmission / reception unit 8625 transmits a signaling message using a connection-type communication protocol. Specifically, the signaling transmission / reception unit 8625 supplies the signaling message supplied from the first encryption unit 8615 to the communication unit selected by the communication IF selection unit 840 via the communication control unit 830 and uses TCP. Send it.

  After the second signaling session is established, the signaling transmission / reception unit 8625 transmits the signaling message encrypted by the second encryption unit 8620 to the SIP server 22 via the second signaling session. At this time, the signaling transmission / reception unit 8625 transmits a signaling message using a connectionless communication protocol. Specifically, the signaling transmission / reception unit 8625 supplies the signaling message supplied from the second encryption unit 8620 to the communication unit selected by the communication IF selection unit 840 via the communication control unit 830 and uses UDP. Send it.

  When the communication terminal 10 moves from the first area where the first communication unit 822 can communicate to the second area where the second communication unit 824 can communicate, the signaling transmission / reception unit 8625 uses the second communication method in the second area. The communication message for establishing the SRTP session, which is the third signaling session established in step S1, is transmitted to the first communication method via the second signaling session established in the first communication method in the first area. It transmits to the SIP server 22 via the device. That is, when a real IP address is assigned to the second communication unit 824 from the communication relay device, an SRTP session by the second communication method is established in advance before the communication IF selection unit 840 selects the second communication unit 824. As a result, when the communication IF selection unit 840 switches from the first communication unit 822 to the second communication unit 824, signaling by the second communication method is immediately possible, and there is no delay in the signaling.

  Similarly, when the communication terminal 10 moves from the first area in which the first communication unit 822 can communicate to the second area in which the second communication unit 824 can communicate, the signaling transmission / reception unit 8625 has the second area in the second area. A communication message for establishing a second communication data session established by the second communication method via the second signaling session established by the first communication method in the first area. It transmits to the SIP server 22 via the device. That is, when a real IP address is assigned to the second communication unit 824 from the communication relay device, an SRTP session by the second communication method is established in advance before the communication IF selection unit 840 selects the second communication unit 824. As a result, when the communication IF selection unit 840 switches from the first communication unit 822 to the second communication unit 824, data communication by the second communication method can be immediately performed, causing a delay in data communication. Absent.

  Further, the signaling transmission / reception unit 8625 supplies the signaling message transmitted from the SIP server 22 to the signaling control unit 8605. Also in this case, the signaling transmission / reception unit 8625 supplies a signaling message to the first encryption unit 8615 when establishing the first signaling session and the second signaling session. On the other hand, the signaling transmission / reception unit 8625 supplies the signaling message to the signaling control unit 8605 via the second encryption unit 8620 and the data format conversion unit 8600 after the second signaling session is established.

  Further, the signaling transmission / reception unit 8625 transmits a signaling message for establishing a communication data session used for transmitting the communication data generated by the general application unit 800 and the real-time application unit 805 to the communication terminal 10, as a second signaling session. To the SIP server 22 via

  The data transmission / reception unit 8645 supplies communication data to be transmitted to the communication terminal 12 or the proxy server 20 to the communication unit selected by the communication IF selection unit 840 via the communication control unit 830, and transmits the communication data to the communication terminal 12 or the proxy server 20. Send. Specifically, the data transmission / reception unit 8645 transmits the communication data encrypted by the second encryption unit 8620 using a connectionless communication protocol. For example, the data transmission / reception unit 8645 transmits the communication data encrypted by the second encryption unit 8620 using SPTP using UDP. Further, the data transmission / reception unit 8645 receives data received from the communication terminal 12 or the proxy server 20 from the communication unit selected by the communication IF selection unit 840 via the communication control unit 830 and supplies the received data to the (de) encapsulation unit 8610. To do.

  The encryption condition storage unit 8650 stores a predetermined condition for determining whether or not the second encryption unit 8620 performs encryption. The encryption condition storage unit 8650 may store conditions individually set by the user.

  The encryption condition determination unit 8655 determines whether or not the condition for transmitting the communication data received by the second encryption unit 8620 matches a predetermined condition stored in the encryption condition storage unit 8650. To do.

  The data format conversion unit 8600 does not convert the data format of the communication data determined by the encryption condition determination unit 8655 not to meet the predetermined condition. Then, the second encryption unit 8620 does not encrypt the communication data. On the other hand, the data format conversion unit 8600 converts the communication data determined by the encryption condition determination unit 8655 to meet a predetermined condition into a data format that can be encrypted using SRTP. Then, the second encryption unit 8620 encrypts the communication data.

  The encryption condition storage unit 8650 stores the type of application as a predetermined condition. The encryption condition determination unit 8655 analyzes the communication data received by the second encryption unit 8620 to determine the type of application that generated the communication data. Then, the encryption condition determination unit 8655 determines whether or not the type of application that generated the communication data matches the type of application stored in the encryption condition storage unit 8650.

  If the type of application that generated the communication data is not stored in the encryption condition storage unit 8650, the data format conversion unit 8600 does not convert the data format of the communication data. Then, the second encryption unit 8620 supplies the communication data to the data transmission / reception unit 8645 without encryption. On the other hand, when the type of application that generated the communication data is stored in the encryption condition storage unit 8650, the data format conversion unit 8600 converts the data format of the communication data. Then, the second encryption unit 8620 encrypts the communication data and supplies it to the data transmission / reception unit 8645.

  The encryption condition storage unit 8650 stores application types such as HTTPS and SSH, for example. This can prevent further encryption of communication data that has already been encrypted in the upper layer.

  Further, the encryption condition storage unit 8650 may store a protocol applied to communication data as a predetermined condition. The encryption condition determination unit 8655 determines the protocol applied to the communication data by analyzing the communication data received by the second encryption unit 8620 or examining the protocol applied by the data transmission / reception unit 8645. . Then, the encryption condition determination unit 8655 determines whether or not the protocol applied to the communication data matches the protocol stored in the encryption condition storage unit 8650.

  When the protocol applied to the communication data is not stored in the encryption condition storage unit 8650, the data format conversion unit 8600 does not convert the data format of the communication data. Then, the second encryption unit 8620 supplies the communication data to the data transmission / reception unit 8645 without encryption. On the other hand, when the protocol applied to the communication data is stored in the encryption condition storage unit 8650, the data format conversion unit 8600 converts the data format of the communication data. Then, the second encryption unit 8620 encrypts the communication data and supplies it to the data transmission / reception unit 8645.

  The encryption condition storage unit 8650 stores protocols such as UDP and IGMP, for example. Thereby, when a specific protocol is applied in order to improve the transfer efficiency of communication data, it is possible to prevent the transfer efficiency from being reduced by the encryption process.

  The encryption condition storage unit 8650 may store the type of communication method as a predetermined condition. The encryption condition determination unit 8655 determines the type of communication method when the communication data is transmitted from the type of communication method of the communication unit selected by the communication IF selection unit 840. Then, the encryption condition determining unit 8655 determines whether or not the type of communication method when the communication data is transmitted matches the type of communication method stored in the encryption condition storage unit 8650.

  If the type of communication method for transmitting the communication data is not stored in the encryption condition storage unit 8650, the data format conversion unit 8600 does not convert the data format of the communication data. Then, the second encryption unit 8620 supplies the communication data to the data transmission / reception unit 8645 without encryption. On the other hand, when the type of the communication method when the communication data is transmitted is stored in the encryption condition storage unit 8650, the second encryption unit 8620 encrypts the communication data and transmits the data transmission / reception unit. 8645.

  The encryption condition storage unit 8650 stores a communication method such as a WiFi method, for example. As a result, when communication data is transmitted using the WiFi method, which often has a relatively low security level, encryption processing is executed, and the communication data is transmitted using the cellular method, which often has a relatively high security level. In this case, the encryption process can not be executed. Therefore, excessive encryption can be prevented for communication data transmitted by a communication method with a high security level.

  According to the communication terminal 10 according to the present embodiment, when signaling with the SIP server 22 is executed, the security of the signaling message transmitted to the SIP server 22 can be secured using SRTP. Moreover, when a communication terminal performs data communication, the security of the communication data transmitted to the communication terminal 12 or the proxy server 20 can be ensured using SRTP. Thereby, the communication terminal 10 can not only continue the communication without disconnecting the communication connection with the communication terminal 12, the proxy server 20, and the SIP server 22, but also can ensure the security of the signaling message and the communication data. . Furthermore, the amount of encryption processing and the communication traffic can be reduced by applying the encryption processing by the second encryption unit 1620 only when necessary.

  FIG. 9 shows an example of a module configuration of the communication terminal 10 according to the second example of the present embodiment. The general client application module 900 is an application such as a Web browser, for example, and is an example of the general application unit 800 in the above description of FIG. The Mobile SIP APs module 905 is an example of the real-time application unit 805 in the above description of FIG. 8, and is, for example, a VoIP application. The Virtual IF module 910 is an example of the virtual interface unit 810 in the above description of FIG. The communication interface unit 920 having a plurality of communication IF modules and the plurality of NICs are examples of the communication unit 820 in the above description of FIG.

  The signaling control module 9605 is an example of the signaling control unit 8605 in the above description of FIG. The IAC module 9610 is an example of the communication IF selection unit 840 and the address acquisition unit 850 in the above description of FIG. The (de) encapsulation module 9600 is an example of the (de) encapsulation unit 8610 and the conversion table storage unit 8640 in the above description of FIG.

  The RTP module 9615 and the RTP module 9620 are an example of the data format conversion unit 8600 in the above description of FIG. 8, and the RTP module 9615 and the RTP module 9620 may be physically one module. The policy control module 9625 is an example of the encryption condition storage unit 8650 and the encryption condition determination unit 8655 in the above description of FIG.

  The TLS module 958 is an example of the first encryption unit 8615 in the above description of FIG. The SRTP module 956 is an example of the second encryption unit 8620 in the above description of FIG. The UDP module 940 is an example of the signaling transmission / reception unit 8625 and the data transmission / reception unit 8645 in the above description of FIG. The TCP module 942 is an example of the signaling transmission / reception unit 8625 in the above description of FIG.

  The plurality of network interface cards (NICs) communicate with the communication terminal 12, the proxy server 20, and the SIP server 22 using a communication method corresponding to each of them. The plurality of NICs are controlled by the corresponding communication IF modules to transmit and receive communication data. The plurality of communication IF modules transmit and receive communication data via the corresponding NICs.

  For example, the communication IF module a922 transmits / receives communication data via the NICa932. Similarly, the communication IF module b924 transmits / receives communication data via the NICb934, and the communication IF module n926 transmits / receives communication data via the NICn936. Specifically, the NICa 932 may be a wireless LAN interface card, and the NICb 934 may be a mobile phone communication system interface card. The NICn 936 may be an interface card of another communication method excluding the wireless LAN communication method and the mobile phone communication method.

  The IAC module 9610 determines and selects which of the plurality of communication IF modules (for example, the communication IF module a922, the communication IF module b924, the communication IF module n926, and the like) included in the communication interface unit 920 can be used. . That is, the IAC module 9610 determines which communication IF module can communicate with the communication relay device, and selects a communication IF module capable of communication. The method by which the IAC module 9610 determines which communication IF module is communicable is substantially the same as the communication IF selection unit 840 in the above description of FIG.

  The IAC module 9610 acquires an IP address dynamically assigned to the communication terminal 10 by the communication relay device via a communication IF module capable of communication. The IAC module 9610 then transmits information for identifying a communication IF module capable of communication and the acquired IP address to the signaling control module 9605, the (de) encapsulation module 9600, the RTP module 9615, the RTP module 9620, and the Mobile SIP APs module. 905 is notified.

  First, the signaling control module 9605 performs signaling to the SIP server 22 using TLS when the communication terminal 10 is activated, for example. That is, the signaling control module 9605 causes the TLS module 958 to encrypt the signaling message for executing the signaling process using TLS. Then, the signaling control module 9605 causes the encrypted signaling message to be sent to the SIP server 22 in a format that can be sent by the TCP module 942 using TCP. Specifically, the signaling control module 9605 sends a TLS-encrypted signaling message to the SIP server via the communication IF module that can communicate with the communication relay device among the plurality of communication IF modules of the communication interface unit 920. 22 to send.

  For example, the signaling control module 9605 establishes a TLS session, which is a first signaling session, with the SIP server 22 when the communication terminal 10 is activated. Thereafter, the signaling control module 9605 transmits a REGISTER request message as a signaling message to the SIP server 22. The REGISTER request message includes the SIP URI of the SIP server 22 that performs signaling processing, the SIP URI of the communication terminal 10 that requests registration, information indicating the registration expiration date, and the like. Then, the SIP server 22 that has received the REGISTER request message executes the signaling process of the communication terminal 10. When the signaling process is completed, the SIP server 22 notifies the signaling control module 9605 of the communication terminal 10 that the signaling is completed, for example, by returning a 200 OK message.

  Next, the signaling control module 9605 transmits a signaling message for establishing an SRTP session, which is the second signaling session, to the SIP server 22 via the TLS session. At this time, when the TLS session is established, the signaling control module 9605 exchanges the authentication result authenticated with the SIP server 22 with the SIP server 22, thereby authenticating with the SIP server 22 again. An SRTP session is established without executing processing.

  Next, a case where the communication IF module capable of communicating with the communication relay device is changed, that is, a case where handover control is required due to movement of the communication terminal 10 will be described. In such a case, the signaling control module 9605 executes the signaling of the communication terminal 10 as shown below so that the communication with the communication terminal 12 and the SIP server 22 is not disconnected when viewed from the communication terminal 10.

  The IAC module 9610 acquires the IP address assigned to the communication IF module by the communication relay device when a communication IF module that is newly communicable is detected. Then, the IAC module 9610 notifies the signaling control module 9605 of information for identifying a communicable communication IF module and the acquired IP address.

  When the signaling control module 9605 is notified of information for identifying a communication IF module that is newly communicable, the signaling control module 9605 should establish an SRTP session, which is a third signaling session, between the communication terminal 10 and the SIP server 22. Generate a signaling message. The signaling control module 9605 supplies the signaling message to the RTP module 9615, converts it into the RTP data format, and causes the SRTP module 956 to encrypt it using SRTP. Then, the signaling control module 9605 establishes a new SRTP session with the SIP server 22 by transmitting a signaling message to the SIP server 22 via the already established SRTP session.

  As described above, the communication terminal 10 uses the SRTP session for signaling established through the currently selected communication IF module to perform the SRTP session for signaling from the next selected communication IF module. Establish. Thereby, before the communication terminal 10 hands over between networks, the SRTP session which can be utilized in a network of a movement destination can be prepared beforehand, Therefore Mobility can be ensured.

  Next, a case where the general client application module 900 executes transmission / reception of predetermined communication data with the communication terminal 12 will be described. The general client application module 900 converts the communication data to be transmitted to the communication terminal 12 into a format that can be transmitted by TCP in the TCP / UDP module 954 and supplies it to the Virtual IF module.

  In such a case, the general client application module 900 adds the virtual IP address assigned to the virtual IF module 910 to the communication data when the TLS session is established. Then, the general client application module 900 supplies the communication address with the virtual IP address added to the Virtual IF module 910. Thereby, even when the real IP address assigned to the communication terminal 10 is changed, the general client application module 900 can continue the TCP session with the communication terminal 12 without being affected by the change of the real IP address.

  The virtual IF module 910 supplies the communication data received from the general client application module 900 to the (de) encapsulation module 9600. The (de) encapsulation module 9600 encapsulates the communication data received from the virtual IF module 910. Specifically, the (de) encapsulation module 9600 controls the RTP module 9620, the SRTP module 956, and the UDP module 940 to encapsulate and encrypt the received communication data.

  The RTP module 9620 converts the data into a data format that can be encrypted using SRTP by adding an RTP header to the communication data. The policy control module 9625 determines whether the communication data output from the RTP module 9620 needs to be encrypted by SRTP based on a predetermined condition.

  If the policy control module 9625 determines that SRTP encryption is necessary, the SRTP module 956 encrypts the communication data converted into RTP packets by the RTP module 9620 using SRTP. The UDP module 940 encapsulates the communication data encrypted by the SRTP module 956 by adding a UDP header, and transmits it to the communication terminal 12 via the communication IF module.

  On the other hand, when the policy control module 9625 determines that SRTP encryption is not necessary, the RTP module 9620 does not add the RTP header to the communication data. The SRTP module 956 transmits the communication data output from the RTP module 9620 from the UDP module 940 to the communication terminal 12 via the communication IF module without encrypting the communication data.

  On the other hand, the communication data transmitted from the communication terminal 12 to the communication terminal 10 is received via the NIC and the communication IF module corresponding to the NIC. The communication data transmitted by the communication terminal 12 is encrypted with SRTP after encapsulating communication data communicable with TCP into a format communicable with UDP. The UDP module 940 supplies the received communication data to the SRTP module 956. The SRTP module 956 decrypts communication data encrypted with SRTP. Then, the RTP module 9620 inversely converts the format of the decrypted communication data and supplies it to the (de) encapsulation module 9600.

  The (de) encapsulation module 9600 decapsulates the communication data decrypted by the SRTP module 956. That is, the (de) encapsulation module 9600 decapsulates communication data encapsulated in a format that can be transmitted by UDP. The (de) encapsulation module 9600 supplies the decapsulated communication data to the virtual IF module 910.

  The virtual IF module 910 supplies the communication data received via the TCP / UDP module 954 to the general client application module 900. The general client application module 900 processes the communication data received from the virtual IF module 910 by passing it to a predetermined application.

  Thereby, even when the real IP address assigned to the communication terminal 10 is changed, the general client application module 900 can continue the TCP session with the communication terminal 12 without being affected by the change of the real IP address. Further, the general client application module 900 does not convert communication data communicable with TCP into communication data communicable with UDP, and encrypt / decrypt communication data transmitted / received to / from the communication terminal 12. That is, according to the communication terminal 10 according to the present embodiment, E2E security can be provided even if the general client application module 900 does not have a special function.

  Next, a case where the Mobile SIP APs module 905 transmits communication data will be described. The Mobile SIP APs module 905 transmits communication data to be transmitted to the communication terminal 12 via the available communication IF module notified from the IAC module 9610.

  Specifically, the Mobile SIP APs module 905 transmits communication data to be transmitted to the communication terminal 12 to the RTP module 9615. The RTP module 9615 converts the communication data received from the Mobile SIP APs module 905 into a format that can be transmitted by RTP.

  Then, the RTP module 9615 supplies the communication data converted into a format that can be transmitted by RTP to the SRTP module 956. The SRTP module 956 encrypts the communication data received from the RTP module 9615 using SRTP. Then, the SRTP module 956 transmits the encrypted communication data to the communication terminal 12 via the communication module. Also, the SRTP module 956 decrypts the SIP AP communication data received by the communication IF module from the communication terminal 12. Then, the SRTP module 956 supplies the decrypted communication data to the Mobile SIP APs module 905 via the RTP module 9615.

  Note that the communication data transmitted to the communication terminal 12 in the above description may be transmitted to another server such as the public server 26 or the communication terminal via the proxy server 20. In such a case, the proxy server 20 executes decapsulation and decryption of the communication data transmitted by the communication terminal 10 and encapsulation and encryption of the communication data transmitted by the public server 26 and the like.

  Thereby, the communication terminal 10 can ensure the security of the communication data transmitted / received with the communication terminal 12 using SRTP. Furthermore, since IPsec is not used, communication data is not transmitted / received via the IPsec Security Gateway. Thereby, it can avoid that communication traffic concentrates on one point.

  FIG. 10 shows an example of the flow of activation processing of the communication terminal 10 according to the second example of the present embodiment. When the session mobility controller module 960 is activated (S1000), the signaling control module 9605 establishes a TLS session with the SIP server 22 (S1010). When the TLS session is established, the SIP server 22 performs SIP registration of the communication terminal 10 (S1020).

  Next, the signaling control module 9605 obtains and sets information necessary for enabling the Virtual IF module 910 (S1030). Specifically, information about the core network 42 such as a virtual IP address, a proxy server IP address, a default gateway IP address, and a DNS server IP address is acquired.

  Next, the signaling control module 9605 establishes an SRTP session with the SIP server 22 (S1040). At this time, the signaling control module 9605 exchanges a signaling message for establishing an SRTP session with the SIP server 22 using a TLS session. In such a case, the signaling control module 9605 establishes the SRTP session using mutual authentication information with the SIP server 22 obtained when the TLS session is established. Thereafter, the signaling control module 9605 exchanges a signaling message for establishing voice data communication using the SRTP session without using the TLS session (S1050).

  FIG. 11 shows an example of the flow of the handover process of the communication terminal 10 according to the second embodiment. In a state where the communication terminal 10 is communicating with the first communication method using the first communication IF module (S1100), the IAC module 9610 communicates with the second communication method different from the first communication method. It is detected whether the module has acquired a real IP address (S1110). In this case, the IAC module 9610 uses the first policy based on the strength of the radio waves received by the plurality of communication IF modules from the communication relay device, the usage priority order set in advance for the plurality of communication IF modules, and the like. It is determined which of the communication IF module and the second communication IF module is selected. Then, when selecting the second communication IF module, the IAC module 9610 acquires an actual IP address in the second communication method. If the second communication IF module has not acquired a real IP address (S1110: NO), the communication terminal 10 continues to communicate using the first communication method (S1100).

  When the second communication IF module has acquired the real IP address (S1110: YES), the signaling control module 9605 uses the SRTP session established in the first communication method to perform signaling used in the second communication method. An SRTP session is established (S1120). Further, the signaling control module 9605 establishes an SRTP session for communication data used in the second communication method via the SRTP session established in the first communication method (S1130). In this case, the signaling control module 9605 uses the mutual authentication information with the SIP server 22 obtained when the SRTP session of the first communication method is established to establish the SRTP session of the second communication method.

  Thereafter, the communication terminal 10 communicates with the second communication method using the second communication IF module (S1140). Then, the communication terminal 10 exchanges a signaling message with the SIP server 22 via the SRTP session established in S1120. Further, the communication terminal 10 exchanges communication data with the communication terminal 12 through the SRTP session established in S1130.

  The communication data transmission process according to the second example is the same as the communication data transmission process described with reference to FIG. The communication data reception process according to the second example is the same as the communication data reception process described with reference to FIG.

  FIG. 12 shows an example of a hardware configuration of the communication terminal 10 or the SIP server 22 according to the present embodiment. Note that the proxy server 20 according to the present embodiment may include a part or all of the hardware configuration described below. The communication terminal 10 and the SIP server 22 according to the present embodiment include a CPU peripheral unit having a CPU 1505, a RAM 1520, a graphic controller 1575, and a display device 1580 connected to each other by a host controller 1582, and a host by an input / output controller 1584. An input / output unit having a communication interface 1530, a hard disk drive 1540, and a CD-ROM drive 1560 connected to the controller 1582; a ROM 1510, a flexible disk drive 1550, and an input / output chip 1570 connected to the input / output controller 1584; A legacy input / output unit.

  The host controller 1582 connects the RAM 1520 to the CPU 1505 and the graphic controller 1575 that access the RAM 1520 at a high transfer rate. The CPU 1505 operates based on programs stored in the ROM 1510 and the RAM 1520 to control each unit. The graphic controller 1575 acquires image data generated by the CPU 1505 or the like on a frame buffer provided in the RAM 1520 and displays the image data on the display device 1580. Alternatively, the graphic controller 1575 may include a frame buffer that stores image data generated by the CPU 1505 or the like.

  The input / output controller 1584 connects the host controller 1582 to the communication interface 1530, the hard disk drive 1540, and the CD-ROM drive 1560, which are relatively high-speed input / output devices. The communication interface 1530 communicates with other devices via a network. The hard disk drive 1540 stores programs and data used by the communication terminal 10 or the CPU 1505 in the SIP server 22. The CD-ROM drive 1560 reads a program or data from the CD-ROM 1595 and provides it to the hard disk drive 1540 via the RAM 1520.

  The input / output controller 1584 is connected to the ROM 1510, the flexible disk drive 1550, and the relatively low-speed input / output device of the input / output chip 1570. The ROM 1510 stores a boot program executed when the communication terminal 10 or the SIP server 22 is started, a program depending on the hardware of the communication terminal 10 or the SIP server 22, and the like. The flexible disk drive 1550 reads a program or data from the flexible disk 1590 and provides it to the hard disk drive 1540 via the RAM 1520. The input / output chip 1570 connects various input / output devices via a flexible disk drive 1550 such as a parallel port, a serial port, a keyboard port, and a mouse port.

  A communication program provided to the hard disk drive 1540 via the RAM 1520 is stored in a recording medium such as the flexible disk 1590, the CD-ROM 1595, or an IC card and provided by the user. The communication program is read from the recording medium, installed in the communication terminal 10 or the hard disk drive 1540 in the SIP server 22 via the RAM 1520, and executed by the CPU 1505.

  The communication program installed and executed in the communication terminal 10 according to the first example of the present embodiment works on the CPU 1505 or the like to change the communication terminal 10 to the general application unit 100, real-time application described with reference to FIGS. Unit 105, virtual interface unit 110, multiple communication units, communication IF selection unit 140, address acquisition unit 150, data format conversion unit 1600, signaling control unit 1605, (de) encapsulation unit 1610, second encryption unit 1620, The signaling transmission / reception unit 1625, the conversion table storage unit 1640, the data transmission / reception unit 1645, the encryption condition storage unit 1650, and the encryption condition determination unit 1655 are caused to function.

  In addition, the communication program installed and executed in the communication terminal 10 according to the second example of the present embodiment works on the CPU 1505 and the like to make the communication terminal 10 the general application unit 800 described with reference to FIGS. Real-time application unit 805, virtual interface unit 810, multiple communication units, communication IF selection unit 840, address acquisition unit 850, data format conversion unit 8600, signaling control unit 8605, (de) encapsulation unit 8610, second encryption unit 8620, signaling transmission / reception unit 8625, conversion table storage unit 8640, data transmission / reception unit 8645, encryption condition storage unit 8650, and encryption condition determination unit 8655.

  As mentioned above, although this invention was demonstrated using embodiment, the technical scope of this invention is not limited to the range as described in the said embodiment. It will be apparent to those skilled in the art that various modifications or improvements can be added to the above-described embodiment. It is apparent from the scope of the claims that the embodiments added with such changes or improvements can be included in the technical scope of the present invention.

1 shows a network connection configuration of a communication system. An overview of communication security is shown. The function structure of the communication module 14 of the communication terminal 10 which concerns on a 1st example is shown. The module structure of the communication terminal 10 which concerns on a 1st example is shown. The flow of the signaling process by the communication terminal 10 which concerns on a 1st example is shown. The flow of the transmission process of communication data in a standby state (S545) is shown. The flow of the reception process of communication data in a standby state (S545) is shown. The function structure of the communication module 14 of the communication terminal 10 which concerns on a 2nd example is shown. The module structure of the communication terminal 10 which concerns on a 2nd example is shown. The flow of the starting process of the communication terminal 10 which concerns on a 2nd example is shown. The flow of the hand-over process of the communication terminal 10 which concerns on 2nd is shown. An example of the hardware constitutions of the communication terminal 10 or the SIP server 22 is shown.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Communication terminal 12 Communication terminal 14 Communication module 20 Proxy server 22 SIP server 24 Location server 26 Public server 30 Base station 31 Access point 32 Access point 40 Cellular network 42 Core network 44 Internet 46 Wireless LAN network 100 General application part 105 Real time application part DESCRIPTION OF SYMBOLS 110 Virtual interface part 120 Communication unit 122 1st communication part 124 2nd communication part 126 nth communication part 130 Communication control unit 140 Communication IF selection part 150 Address acquisition part 160 Session mobility control unit 200 General client application module 205 Mobile SIP APs module 210 Virtual IF module 220 Communication interface Interface Unit 222 communication IF module a
224 Communication IF module b
226 Communication IF module n
232 NICa
234 NICb
236 NICn
240 UDP module 242 TCP module 252 TLS module 254 TCP / UDP module 256 SRTP module 258 TLS module 260 Session mobility controller module 800 General application part 805 Real-time application part 810 Virtual interface part 820 Communication unit 822 First communication part 824 Second communication part 826 nth communication unit 830 communication control unit 840 communication IF selection unit 850 address acquisition unit 860 session mobility control unit 900 general client application module 905 Mobile SIP APs module 910 virtual IF module 920 communication interface unit 922 communication IF module a
924 Communication IF module b
926 Communication IF module n
932 NICa
934 NICb
936 NICn
940 UDP module 942 TCP module 952 TLS module 954 TCP / UDP module 956 SRTP module 958 TLS module 960 Session mobility controller module 1505 CPU
1510 ROM
1520 RAM
1530 Communication interface 1540 Hard disk drive 1550 Flexible disk drive 1560 CD-ROM drive 1570 Input / output chip 1575 Graphic controller 1580 Display device 1582 Host controller 1584 Input / output controller 1590 Flexible disk 1595 CD-ROM
1600 Data format conversion unit 1605 Signaling control unit 1610 (De) Encapsulation unit 1615 First encryption unit 1620 Second encryption unit 1625 Signaling transmission / reception unit 1640 Conversion table storage unit 1645 Data transmission / reception unit 1650 Encryption condition storage unit 1655 Encryption Condition determination unit 2600 (de) encapsulation module 2605 signaling control module 2610 IAC module 2615 RTP module 2620 RTP module 2625 policy control module 8600 data format conversion unit 8605 signaling control unit 8610 (de) encapsulation unit 8615 first encryption unit 8620 Second encryption unit 8625 Signaling transmission / reception unit 8640 Conversion table storage unit 8645 Data transmission / reception unit 8650 Encryption condition storage unit 8655 encryption condition determination unit 9600 (de) encapsulation module 9605 signaling control module 9610 IAC module 9615 RTP module 9620 RTP module 9625 policy control module

Claims (10)

A communication module of a communication terminal that transmits and receives communication data,
An application unit for generating the communication data;
An encryption condition determination unit that determines whether or not a condition for transmitting the communication data matches a predetermined condition;
An encryption unit that encrypts the communication data that does not encrypt the communication data that does not match the predetermined condition and that matches the predetermined condition;
A data transmission / reception unit for transmitting the communication data encrypted by the encryption unit;
A communication module comprising: An encryption condition storage unit for storing the predetermined condition;
Further comprising
The communication module according to claim 1, wherein the encryption condition determination unit determines whether a condition for transmitting the communication data matches a condition stored in the encryption condition storage unit. The encryption condition storage unit stores the type of application as the predetermined condition,
The communication module according to claim 2, wherein the encryption condition determination unit determines whether the type of application that generated the communication data matches the type of application stored in the encryption condition storage unit. . The encryption condition storage unit stores a protocol applied to the communication data as the predetermined condition,
The communication module according to claim 2, wherein the encryption condition determining unit determines whether a protocol applied to the communication data matches a protocol stored in the encryption condition storage unit. The data transmission / reception unit transmits the communication data via any of a plurality of communication units having different communication methods,
The encryption condition storage unit stores the type of communication method as the predetermined condition,
The encryption condition determination unit determines whether or not a communication method type of the communication unit to which the communication data is transmitted matches a communication method type stored in the encryption condition storage unit. Item 3. The communication module according to Item 2. An address acquisition unit that acquires a real address dynamically assigned to the communication terminal by a communication relay device that relays communication between the communication terminal and a communication partner terminal;
A virtual interface part to which a virtual address is assigned; and
Using the real address acquired by the address acquisition unit, establishing a first session between the communication control device that manages the session between the communication terminal and the communication partner terminal, after establishing the first session, A signaling control unit that establishes a second session with the communication control device using a virtual address of the virtual interface unit;
The signaling message generated by the signaling control unit is transmitted to the communication control apparatus via the first session before the second session is established, and after the second session is established, the second session is established. A signaling transceiver for transmitting to the communication control device via
The communication module according to claim 1, further comprising: A signaling controller for generating a signaling message;
A signaling transceiver that transmits a signaling message generated by the signaling controller to a communication controller that manages a session between the communication terminal and a communication partner terminal;
Further comprising
The signaling control unit includes:
A first signaling session based on a first security protocol is established with the communication control device when the communication module is activated;
When the first signaling session is established, a second signaling session based on a second security protocol is established with the communication control device;
The communication module according to claim 1, wherein the signaling transmission / reception unit transmits a signaling message generated by the signaling control unit to the communication control device via the second signaling session. A communication method of a communication terminal that transmits and receives communication data,
Generating the communication data;
Determining whether a condition for transmitting the communication data matches a predetermined condition;
Not encrypting the communication data not meeting the predetermined condition, and encrypting the communication data meeting the predetermined condition;
Transmitting the communication data encrypted;
A communication method comprising: A communication program for a communication module of a communication terminal that transmits and receives communication data, the communication module comprising:
An application unit for generating the communication data;
An encryption condition determination unit that determines whether or not a condition for transmitting the communication data matches a predetermined condition;
An encryption unit that encrypts the communication data that matches the predetermined condition without encrypting the communication data that does not match the predetermined condition, and the communication data that is encrypted by the encryption unit Data transmission / reception unit,
Communication program to function as. A communication terminal for transmitting and receiving communication data,
An application unit for generating the communication data;
An encryption condition determination unit that determines whether or not a condition for transmitting the communication data matches a predetermined condition;
An encryption unit that encrypts the communication data that does not encrypt the communication data that does not match the predetermined condition and that matches the predetermined condition;
A data transmission / reception unit for transmitting the communication data encrypted by the encryption unit;
A communication terminal comprising:

Images