JP3803725B2 - Packet processing method, packet processing program, recording medium, packet switch, and information processing apparatus - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to packet communication, and more particularly to packet communication that uses unique resources for each user when processing a packet.
[0002]
[Prior art]
For the purpose of improving the flexibility of network functions, an active network system has been proposed in which various processes of the network are programmable.
[0003]
For example, as a method using a capsule in which a program is stored in a packet and the processing method of the packet itself is determined by processing the program, PLAN (Michael Hicks, Pankaj Kakkar, Jonathan T. Moore, Carl A., etc.) is used. Gunter and Scott Nettles,. "PLAN: A Packet Language for Active Networks", in Proceedings ofthe International Conference on Functional Programming (ICFP) '98) and StreamCode (Takashi Egawa, Koji Hino, Yohei Hasegawa, "Fast and Secure Pa ket Processing Environment for Per-PacketQoS Customization ", in Proceedings IWAN 2001.) have been proposed.
[0004]
Further, assuming that it is a waste of bandwidth to put the program in all packets, the packet stores only the identifier, and the program corresponding to the identifier is downloaded from another place in the network and executed when necessary. (David J. Wetherall, John Guttag, and David L. Tennenhouse, “ANTS: A Talking D e er. Choi, J. DeHart, T. Wolf, B. Plattner, “A Scalable, High Perform Ances Active Network Node ", In IEEE Network, January / February 1999.) have also been proposed.
[0005]
In these methods, the packet processing method is specified at the time of packet arrival. Therefore, it is necessary to prevent intentional or negligent designation from adversely affecting the network. For this reason, a mechanism for limiting resources used for each node by one packet, a mechanism for limiting resources used as a whole while being transferred through the network, and the like are required.
[0006]
As described above, as a mechanism for limiting resources used as a whole, a mechanism called resource bound is adopted in ANTS and PLAN. This is an extension of the concept of TTL in IPv4 packets. A certain amount is given when a packet is generated, and it is forcibly reduced when processing at each node is performed. In particular, when generating a child packet group, there is a restriction that the total resource bound of the child packet group must not exceed the resource bound of the parent packet.
[0007]
Such resource limitation is an excellent method in terms of processing safety, but it impairs processing flexibility. In particular, it is difficult to realize multicast. In order to generate a large number of child packets, it is necessary to have a large amount of resource bound as an initial value, but if this is allowed, this resource bound will be used when a packet processing program that realizes a unicast packet runs away intentionally or accidentally. It will take time until the restriction by is functioning.
[0008]
One method for improving this problem is to authenticate individual packets and grant privileges according to the packets. For example, in the above case, child packet generation may be performed according to privileges.
[0009]
Various techniques have been proposed as techniques for authenticating individual packets. However, these methods are intended to more accurately perform billing and load monitoring within one provider. For example, JP-A-2001-44992 can be mentioned. In this method, data necessary for authentication is received from the authentication data source existing in the network when necessary in near real time, and the network address in the packet is compared with the received authentication data. The customer is authenticated at a monitoring node arranged at a necessary place in the network.
[0010]
[Problems to be solved by the invention]
The first issue to be solved is safety. In the active network method of the capsule method, the damage caused when the packet processing program runs away or the safety mechanism is broken is much worse than when the billing process and the load monitoring process run away in the conventional IP network. Big. In the worst case, the entire network is forced to stop functioning, the packet processing program malfunctions, the packet is misdelivered, and customer-specific information is leaked. Therefore, it is necessary to provide stronger safety.
[0011]
The second problem to be solved is high speed. If the processing speed can be reduced by using a stronger encryption method, it is generally not difficult to ensure safety. However, the capsule type active network assumed by the present invention may be applied to the main signal packet. In such a case, it is extremely important to ensure safety while maintaining high speed.
[0012]
The third problem to be solved is the versatility of processing. An encapsulated active network is not necessarily a process closed to a single carrier. Therefore, it is necessary to operate appropriately even when it extends over a plurality of carriers.
[0013]
An object of the present invention is to enable a privileged instruction corresponding to a packet to be used by authenticating each packet in an active network using a capsule method, and to provide a packet processing program while maintaining the security of the entire network. The purpose is to improve processing flexibility.
[0014]
[Means for Solving the Problems]
In order to solve the above-described problems, the present invention provides the following packet processing technology.
[0015]
That is, the present invention provides a packet processing method including the following steps 1 to 5 in a method of processing a packet by a network that determines a processing method of the packet itself by processing a program stored in the packet. . First, other node B acquires specific information predetermined for the node A of the network (step 1). Next, the node A generates a key for each packet based on the unique information, and assigns the generated key to each packet (step 2). Next, the node A transmits the packet with the key to the node B (step 3). Next, the node B determines whether the key given to the packet received in the step 3 is correct based on the unique information acquired in the step 1 (step 4). Next, whether or not the resource under the management of the node B can be used when executing the program is determined by the node B according to the determination result of the step 4 (step 5). Here, the node refers to a user terminal, a packet switch or the like.
[0016]
According to this method, whether or not the resource of the node B can be used when executing the program stored in the packet is determined for each packet based on the correctness of the key generated based on the unique information of the node A. Can be determined.
[0017]
In this packet processing method, prior to Step 5, Node B obtains a privilege request that requests permission to use some or all of the resources, and in Step 5, Node B enters the scope of the privilege request. The use of the corresponding resource may be permitted. In this case, Node B can authenticate each packet and allow the use of resources according to the range of privilege requests required by Node A. By doing so, even if the program stored in the packet runs away intentionally or accidentally, only resources within the range defined by the privilege request can be used, so that the influence of the runaway can be suppressed.
[0018]
In this way, the key is preferably a disposable key.
[0019]
In the child method, the packet may store an identifier specifying the program instead of the program.
[0020]
Stage 1 may be performed by signaling from Node A to Node B. Further, stage 1 may be performed by signaling from the gateway connecting the network to another network to the node B. Alternatively, stage 1 may be performed by transmitting the unique information to the node B from the authentication server in which the unique information is registered in advance.
[0021]
The unique information may be determined for a customer including a plurality of users.
[0022]
Further, the present invention is a network that determines a processing method of a packet itself by processing a program stored in the packet, and performs the following processing in a program that causes a device operating as a packet switch to process a packet. A packet processing program that is executed by the apparatus is provided. First, specific information predetermined for each user terminal of the network is acquired (processing 1). Next, a packet including a key generated for each packet based on the unique information is received from the user terminal (processing 2). Next, based on the unique information acquired in the process 1, it is determined whether the key given to the packet received in the process 2 is correct (process 3). Next, whether to use the resource under the management of the apparatus when executing the program stored in the packet is determined according to the determination result of the process 3 (process 4).
[0023]
Prior to the process 4, the user terminal may acquire a privilege request that requests permission to use some or all of the resources, and in the process 4, it may be determined a resource that can be used according to the scope of the privilege request.
[0024]
The key is preferably a disposable key.
[0025]
The packet may store an identifier specifying the program instead of the program stored in the packet.
[0026]
Process 1 may be performed by receiving signaling from the user terminal. In addition, the process 1 may be performed by receiving signaling to the apparatus from a gateway that connects the network to another network. Alternatively, the process 1 may be performed by receiving unique information from an authentication server in which unique information is registered in advance.
[0027]
The unique information may be determined for a customer including a plurality of users.
[0028]
Furthermore, the present invention also provides a recording medium on which the packet processing program is recorded, and a packet switch that stores the recording medium and operates according to the packet processing program. In particular, in the packet switch, at least one of the processes 1 to 4 may be provided as hardware.
[0029]
Further, the present invention is a network that determines a processing method of a packet itself by processing the program stored in the packet, and performs the following processing in a program that causes a device operating as a user terminal to process a packet. A packet processing program is provided that causes a device to execute. First, a key is generated for each packet based on unique information given in advance (Process 1). Next, the generated key is assigned to each packet (processing 2). Next, the packet to which the key is attached is transmitted to the packet switch in the network (processing 3).
[0030]
In the process 3, it is preferable that a privilege request for requesting permission to use part or all of the resources managed by the packet switch is transmitted to the packet switch.
[0031]
At least one of the packet to which the key transmitted in the process 3 is assigned and the privilege request may be transmitted to the packet switch via the authentication server.
[0032]
Furthermore, the present invention also provides a recording medium that records this packet processing program, and an information processing apparatus that stores this recording medium and operates as a user terminal in accordance with the packet processing program. In this information processing apparatus, at least one of the processes 1 to 3 may be provided as hardware.
[0033]
In the present invention, each end router and each router on the communication path share customer specific information. This unique information is managed by an MMU (memory management device) which is a mechanism for managing privileges.
[0034]
Since the key for each packet added to each packet is generated from the customer's unique information and is discarded for each packet, the security when used in the network is high. In addition, a one-way function such as MD5 often used in the disposable key method can be implemented as hardware. These authentication-related functions are incorporated into the MMU, and hardware processing integrated with resource management makes it possible to achieve both safety and high speed.
[0035]
Customer-specific information can be distributed end-to-end of the entire network by signaling from the customer or from the gateway of the ISP network by signaling from the gateway of the ISP network. If signaling is used and broadcasting is not performed in this way, it can be applied even to a large-scale network, and it is possible to cross the boundaries of organizations such as ISPs.
[0036]
DETAILED DESCRIPTION OF THE INVENTION
Next, the packet switching network 1 according to the first embodiment of the present invention will be described in detail with reference to FIG.
[0037]
The packet switching network 1 transmits a packet storing a program. The packet switching network 1 includes active packet switches 101 and 101b and user terminals 111 and 111b. The active packet switches 101 and 101b have the same configuration, and are distinguished by adding b to the reference numerals of the corresponding components. The same applies to the user terminals 111 and 111b. Actually, there may be other active packet switches and user terminals in the packet switching network 1, but they are omitted here because they are unnecessary for the description of the present invention. The user terminal 111 and the active packet switch 101 are connected by a communication path 121. The active exchanges 101 and 101b are connected by a communication path 121b.
[0038]
The active packet switch 101 includes a node user authentication daemon 102, an in-packet program execution mechanism 103, a privilege table 104, a shared memory 105, an MMU with authentication mechanism 106, and a disposable key generation mechanism 107. The node user authentication daemon 102 performs signaling with a node user authentication daemon of another active packet switch or a terminal user authentication daemon of a user terminal. The in-packet program execution mechanism 103 is a mechanism for executing a program (intra-packet program) stored in a packet. Both the privilege table 104 and the shared memory 105 are privileged resources. A privileged resource is a resource used when executing an in-packet program, but its use is restricted from a program stored in an unauthenticated packet. The authentication mechanism-equipped MMU 106 authenticates the packet with a key attached to each packet. The disposable key generation mechanism 107 generates a key to be attached to the packet to be transmitted. The generated key is a disposable key, and a different key is generated for each packet.
[0039]
The user terminal 111 includes a terminal user authentication daemon 112, a packet generation mechanism 113, and a disposable key generation mechanism 114. Similarly to the node user authentication daemon 102, the terminal user authentication daemon 112 performs signaling with the node user authentication daemon for other active packet switches and the terminal user authentication daemon for user terminals. The packet generation mechanism 113 generates a packet including the in-packet program and the key generated by the disposable key generation mechanism 114. The disposable key generation mechanism 114 generates a key to be attached to the packet to be transmitted. A key generated in the same manner as the disposable key generation mechanism 107 is a disposable key, and a different key is generated for each packet.
[0040]
Next, a packet processing operation when performing communication using privileged resources on a node, for example, the privilege table 104 or the shared memory 105, using the packet switching network 1 will be described with reference to FIG. First, customer specific information is distributed and resources are secured (step S11). Second, actual data communication is performed (step S12). Third, resource release is performed (step S13).
[0041]
The process of step S11 is performed by signaling from a customer, for example. A customer refers to a group of a plurality of users. The operation in this example will be described with reference to FIG. 3. In the signaling process, the terminal user authentication daemon 112 is connected to the terminal user authentication daemon 112 b of the other user terminal 111 b that is the communication partner of the user terminal 111, and The session keys and customer specific information are exchanged between the active packet switches 101 and 101b on the communication channels 121 and 121b and other active packet switches on the communication channels 121 and 121b and other user authentication daemons 102 and 102b for the other active packet switches (steps). S21). The terminal user authentication daemon 112 sets the customer-specific information acquired here in the disposable key generation mechanism 114 (step S22). Further, according to the needs of the customer, resources for the customer are secured in the privilege table 104 and the shared memory 105 (S23).
[0042]
Referring to FIG. 4, in the data communication process in step S12, the disposable key generation mechanism 114 generates a disposable key for each packet based on the set customer specific information. Hereinafter, this key is also referred to as a packet key. The packet generation mechanism 113 generates a packet in which the generated packet key is added to the in-packet program (or the identifier of the in-packet program) (step S31). At this time, in order to increase resistance to a replay attack, a time stamp with a secure hash for preventing falsification may be added.
[0043]
The generated packet is sent to the active packet switch 101 through the communication path 121 (step S32). The in-packet program (or the program specified by the identifier) is executed by the packet processing program execution mechanism 103 (step S33). The packet processing program execution mechanism 103 executes the in-packet program itself if it is stored in the packet, and if an identifier instructing the processing method such as ANTS is stored, the corresponding program Is downloaded from another location in the network or a cached item in the node is called to secure and execute the corresponding program.
[0044]
At the same time as executing the program in this way, the packet key in the packet is passed to the MMU 106 with an authentication mechanism. The MMU with authentication mechanism 106 processes the packet key and customer-specific information in the MMU according to a method agreed in advance with the customer (step S34). If it is found from the processing result that the customer specific information that is the source of the packet key added to the received packet matches the customer specific information exchanged in step S21, that is, if the authentication is successful, Permits the program stored in (or designated by) the packet to access the privileged resources secured in step S23, that is, the portion related to this session on the privilege table 104 or shared memory 105. (Step S36). On the other hand, if authentication fails in step S35, the program is prohibited from accessing privileged resources (step S37).
[0045]
In the resource release in step S13, when the necessity for resource use disappears, the terminal user authentication daemon 112 communicates with the active packet switch 101 and the partner user terminal 111b that communicated in the first session establishment signaling. Signaling is performed, and the previously set session key and the reserved privilege resources, that is, the privilege table 104 and the shared memory 105 are released.
[0046]
A packet switching network 2 according to a second embodiment of the present invention will be described with reference to FIG. Compared to the packet switching network 1 described above, the point that the authentication server 201 exists is greatly different. In the packet switching network 1, distribution of customer specific information (step S21) and resource reservation (step S23) in step S11 are performed on communication paths including the user terminals 111 and 111b and the active packet switches 101 and 101b. This was realized by signaling between packet switches. On the other hand, in the packet switching network 2, the authentication server 201 centrally manages customer-specific information and information about resources required by the customer, and the active packet switching devices such as the active packet switching devices 101 and 101b. The distribution is different.
[0047]
Next, a packet processing operation when communication using privileged resources on the node is performed using the packet switching network 2 will be described with reference to FIG. 2 again.
[0048]
Distribution of customer-specific information and securing of resources in step S11 are performed as follows. The authentication server 201 distributes customer-specific information to each active packet switch 101, 101b, etc., and requests each active packet switch 101, 101b, etc. to secure resources required by the customer.
[0049]
Actual data communication in step S12 is performed in the same manner as in the first embodiment.
[0050]
The resource release in step S13 is performed by communication between the authentication server 201 and the active packet switches 101 and 101b.
[0051]
This embodiment is effective when it is desired to perform resource allocation or the like based on a prior plan in a small-scale centrally managed network.
[0052]
The present invention has been described above based on the embodiments. However, the present invention is not limited to this, and it is needless to say that modifications and improvements can be made within the ordinary knowledge of those skilled in the art. .
[0053]
For example, although various methods are known for generating a disposable key for each packet in step S31, any method may be used. For example, in IETF RFC 1938 'One-Time Password system (OTP)', a bit string is sent from the server to the client every time an authentication request is made, and a disposable key is generated using this and secret information held in the client. ing. This may be used, or if the bit string is sent from the node to the terminal every time to transmit the packet, high speed cannot be obtained. If only the authentication information held from the beginning in the client is used. Thus, a disposable key can be generated.
[0054]
In the first embodiment, the end user terminal starts signaling or adds authentication information. However, a network constructed by this active packet switch is different from an existing network that does not use a capsule method such as IP. If connected, the gateway terminal may do this.
[0055]
When a plurality of users share privileged resources, the second and subsequent users may omit the signaling process performed in steps S11 and S13.
[0056]
In addition, this method can also be applied to management of access to resources that do not necessarily need to be unique to a customer, such as temporary memory.
[0057]
【The invention's effect】
According to the present invention, it is possible to manage the use of resources of a packet switch on a packet basis.
[0058]
Further, according to the present invention, user authentication beyond the framework of an organization such as an ISP can be performed. This is because the session key information is shared by signaling between daemons that control the authentication process, so that it can also be applied between ISPs.
[0059]
Moreover, according to the present invention, the security when authenticating a packet is high. This is because a disposable key is added to each packet.
[0060]
Further, according to the present invention, packet authentication can be executed at high speed. This is because the key processing for each packet can be implemented as hardware as an additional function of the MMU, and the same hardware also controls privileged resources.
[Brief description of the drawings]
FIG. 1 is a functional block diagram of a packet switching network 1 according to a first embodiment of this invention.
FIG. 2 is a flowchart for explaining the operation of the packet switching network 1;
FIG. 3 is a flowchart for explaining the operation of the packet switching network 1;
FIG. 4 is a flowchart for explaining the operation of the packet switching network 1;
FIG. 5 is a functional block diagram of a packet switched network 2 according to a second embodiment of the present invention.
[Explanation of symbols]
101, 101b Active packet switch 102 User authentication daemon for node 103 In-packet program execution mechanism 104 Privilege table 105 Shared memory 106 MMU with authentication mechanism
107 Disposable Key Generation Mechanism 111, 111b User Terminal 112 User Authentication Daemon for Terminal 113 Packet Generation Mechanism 114 Disposable Key Generation Mechanism 121, 121b Communication Channel 201 Authentication Server

Claims (25)

In a method of processing a packet by a network that determines a processing method of the packet itself by processing a program stored in the packet,
Step 1 in which other nodes B acquire specific information predetermined for the node A of the network;
The node A generates a key for each packet based on the unique information, and assigns the generated key to each packet;
Step 3 in which the node A transmits a packet with a key to the node B;
Step 4 in which the node B determines whether the key assigned to the packet received in Step 3 is correct based on the unique information acquired in Step 1;
Step 5 in which the node B determines whether or not the resource under the management of the node B can be used when executing the program according to the determination result in the step 4 Processing method. The packet processing method according to claim 1,
Prior to the step 5, the node B obtains a privilege request that the node A requests permission to use part or all of the resource,
In step 5, the node B permits the use of resources according to the scope of the privilege request. 3. The packet processing method according to claim 1, wherein the key is a disposable key. 4. The packet processing method according to claim 1, wherein the packet stores an identifier designating the program instead of the program. 5. The packet processing method according to claim 1, wherein the stage 1 is performed by signaling from the node A to the node B. 5. The packet processing method according to claim 1, wherein the step 1 is performed by signaling from a gateway connecting the network to another network to the node B. . 5. The packet processing method according to claim 1, wherein the step 1 is performed by transmitting the unique information to the node B from an authentication server in which the unique information is registered in advance. Packet processing method. 8. The packet processing method according to claim 1, wherein the unique information is determined for a customer composed of a plurality of users. In a network that determines the processing method of the packet itself by processing the program stored in the packet, in a program that causes a device that operates as a packet switch to process the packet,
Processing 1 for acquiring unique information predetermined for each user terminal of the network;
A process 2 of receiving a packet including a key generated for each packet based on the unique information from the user terminal;
A process 3 for determining whether the key given to the packet received in the process 2 is correct based on the unique information acquired in the process 1;
Causing the apparatus to execute a process 4 for determining whether to use a resource under the management of the apparatus according to a determination result of the process 3 when executing the program stored in the packet A packet processing program. The packet processing program according to claim 9, wherein
Prior to the process 4, the user terminal obtains a privilege request for requesting permission to use part or all of the resource,
A packet processing program characterized in that, in the process 4, a resource that can be used is determined according to a range of the privilege request. 11. The packet processing program according to claim 9, wherein the key is a disposable key. 12. The packet processing program according to claim 9, wherein the packet stores an identifier designating the program in place of the program stored in the packet. 13. The packet processing program according to claim 9, wherein the processing 1 is performed by receiving signaling from the user terminal. 13. The packet processing program according to claim 9, wherein the processing 1 is performed by receiving signaling to the device from a gateway connecting the network to another network. program. 13. The packet processing program according to claim 9, wherein the process 1 is performed by receiving the unique information from an authentication server in which the unique information is registered in advance. 16. The packet processing program according to claim 9, wherein the unique information is determined for a customer composed of a plurality of users. A recording medium on which the packet processing program according to claim 9 is recorded. A packet switch which stores the recording medium according to claim 17 and operates according to the packet processing program. 19. The packet switch according to claim 18, comprising at least one of the processes 1 to 4 as hardware. In a program that allows a device operating as a user terminal to process a packet in a network that determines the processing method of the packet itself by processing the program stored in the packet,
Processing 1 for generating a key for each packet based on unique information given in advance,
Processing 2 for assigning the generated key to each packet;
A packet processing program that causes the apparatus to execute a process 3 of transmitting a packet to which a key is attached to a packet switch of the network. The packet processing program according to claim 20,
In the processing 3, the packet processing program further transmits to the packet switch a privilege request for requesting permission to use part or all of the resources managed by the packet switch. The packet processing program according to any one of claims 20 and 21, wherein at least one of the packet to which the key is transmitted and the privilege request transmitted in the process 3 is transmitted to the packet switch via an authentication server. Feature packet processing program. A recording medium on which the packet processing program according to any one of claims 20 to 22 is recorded. An information processing apparatus that stores the recording medium according to claim 23 and that operates as the user terminal according to the packet processing program. 25. The information processing apparatus according to claim 24, comprising at least one of the processes 1 to 3 as hardware.

Images