JPH1141280A - Communication system, vpn repeater and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication system in which different kinds of virtual private networks(VPN) are compatible. SOLUTION: A communication system 1 is constituted by providing plural VPN devices 22A and 22B and a VPN managing server 10 equipped with correspondent VPN devices 15X, 15Y... for constructing the VPN on a communication network in cooperation with the respective VPN devices 22A and 22B. The VPN managing server 10 receives an enciphered telegraphic message by constructing the 1st VPN with the VPN device 22A of a telegraphic message transmission source and specifies the VPN device 22B of the transmission destination by deciphering the transmission destination information included in the received enciphered telegraphic message and at the same time, the 2nd VPN is constructed with the VPN device 22B of the transmission source. After the received enciphered telegraphic message is deciphered by a cryptographic key for the 1st VPN, this is enciphered by a cryptographic key for the 2nd VPN and transmitted through the 2nd VPN to the VPN device 22B.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a VPN on a communication network.
(Virtual Private Network: Virtual Private Network)
The present invention relates to a technology for absorbing a standard difference of a VPN device for constructing a VPN.

[0002]

2. Description of the Related Art For example, in a communication system using a wide area network environment, there is a demand for a highly reliable system construction and operation management in consideration of security of an intruder. Here, the wide area network environment refers to an environment in which data communication between communication devices is performed via a router that controls a destination path on a wide area communication network (network) such as the Internet. The router is a device that optimally selects a route to a destination based on a destination and a source address added to the head of a transmission target message. Such router-based networks include networks within organizations such as corporations and networks that provide a network connection environment to an unspecified number of persons such as Internet providers. I have. Also, e-mail has been established as a new low-cost communication means replacing telephone and facsimile. Thus, in the future, the demand for the construction of a system in which a conventional line such as a telephone is replaced by a network environment tends to increase sharply.

However, in data communication in a wide area network environment, there is a problem in terms of security since data can be easily intercepted or falsified by a third party. Therefore, when transmitting highly confidential data using a communication medium such as an electronic currency used in the field of electric commerce, it is necessary to separately lay a dedicated line. Therefore, recently, a technology for applying a data encryption technology, an authentication technology, an encapsulation technology for concealing target data, and establishing a VPN on a wide area network to perform data communication has been proposed.

FIG. 5 shows a public network L which is a wide area network.
FIG. 1 is a conceptual diagram showing an example of a conventional communication system that performs data communication by constructing a VPN thereon. This communication system 2
Is a computer device 4 having a data transmission / reception function
0, 50, VPN devices 41, 51, firewalls (FW) 42, 52, and routers 43, 53. The FWs 42 and 52 are a kind of barrier that realizes protection against unauthorized external access by special software, and are essential in an environment using a wide area network such as the public network L.

[0005] In the communication system 4, a procedure for transmitting a message from the computer device 40 to another computer device 50 located at a remote place is as follows. First, mutual authentication processing is performed between the source and destination routers 43 and 53, and further, mutual exchange of encryption keys is performed between the source and destination VPN devices 41 and 51. Then, in the source VPN device 41, the destination VPN device 4
The message is encrypted using the first encryption key and transmitted. on the other hand,
The destination VPN device 51 receives the encrypted message, decrypts the message with the encryption key of the source VPN device 51, and transfers the message to the computer device 50.

Note that the VPN devices 41 and 51 have other V
Some have a function as a router in addition to an authentication function for mutually confirming PN devices, an encryption key exchange function for encryption, an encryption / decryption function for electronic messages. These functions are realized by a manufacturer's original method or a standardized method. Also, some VPN devices do not have an encryption key exchange function, and currently do not always conform to a unified standard.

[0007]

The standardization of the authentication functions, encryption key exchange functions, encryption / decryption and other functions provided in the VPN devices 41 and 51 has been advanced. As mentioned above, at present, each function is realized and commercialized with its own standard,
A VPN cannot be constructed between products of different manufacturers. For this reason, for example, when a plurality of companies of different types of businesses that have already introduced a VPN device intend to construct a joint VPN network environment (hereinafter, referred to as a VPN environment), the VPN environment can be constructed without any problem by using the same manufacturer's products. Although it is possible, it is impossible to construct a VPN environment between products of different manufacturers as it is.

It is an object of the present invention to provide an improved communication system that can construct a VPN environment even if different types of VPN devices are used. Another subject of the present invention is:
In a communication system using different types of VPN devices, V
An object of the present invention is to provide a VPN relay device that can easily construct a PN environment, and a recording medium for realizing the VPN relay device with a general-purpose computer device.

[0009]

A communication system according to the present invention, which solves the above-mentioned problems, comprises a plurality of VPNs each of which constructs a VPN on a communication network in cooperation with a corresponding VPN device of the same standard.
A VPN device comprising a PN device and a VPN relay device including all of the corresponding VPN devices corresponding to the plurality of VPN devices, wherein the VPN relay device establishes a first VPN between the VPN device of the message transmission source and encrypts the first VPN. Means for receiving a message, means for decrypting the destination information contained in the received encrypted message to identify the destination VPN device, and means for establishing a second VPN with the source VPN device; The received encrypted message is converted into an encrypted message for the second VPN and the second VPN
, And relaying the message transmission between the VPN devices.

[0010] It should be noted that a firewall is interposed in the input / output interface of the encrypted message in the VPN relay apparatus.

According to another aspect of the present invention, there is provided a VPN relay apparatus which cooperates with a VPN apparatus of the same standard to construct a VPN on a communication network, and a second VPN apparatus serving as a message transmission source. 1st VP between 1VPN device
N, the second VP between the second VPN device as the message transmission destination
N is constructed using the corresponding corresponding VPN device, and the encrypted message received from the first VPN device through the first VPN is converted into the encrypted message for the second VPN, and the converted encrypted message is converted into the second VPN through the second VPN.
Routing control means for transmitting to the device. In the conversion of the encrypted message, for example, the encrypted message received through the first VPN is decrypted with the encryption key of the first VPN device, and the decrypted message obtained by the decryption is converted to the second VPN.
This is performed by encrypting with the encryption key of the device.

[0012] The plurality of corresponding VPN devices construct a VPN with the VPN device based on different authentication methods, encryption key exchange methods, and encryption methods. , A corresponding device is selected from the corresponding VPN devices prepared in advance, and the first V
Build a PN and a second VPN.

[0013] The recording medium of the present invention for solving the above-mentioned other problems is readable by a computer device communicably connected to a VPN device that constructs a VPN on a communication network in cooperation with a corresponding VPN device. A recording medium on which a program is recorded, wherein the program causes the computer device to execute the following processing. (1) The first voltage between the first VPN device serving as a message transmission source and the first VPN device
A process of constructing a PN to receive an encrypted message, (2) decoding destination information included in the received encrypted message to identify a communication device of the destination, and a second VPN serving as the destination
(3) a process of constructing a second VPN with the device, and (3) a process of converting the received encrypted message into a second VPN encrypted message and sending it to the second VPN.

[0014]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments in which the present invention is applied to a communication system using a wide area network will be described below in detail with reference to the drawings. FIG. 1 is a functional block diagram of the communication system of the present embodiment. The communication system 1 includes a plurality of clients 20A that transmit and receive a message.
20B and a VPN management server 10, which is a VPN relay device of the present invention, are connected via a public network L so as to be capable of two-way communication. Each client 20A, 20B has F
It is a communication device including W21A, 21B and VPN devices 22A, 22B.

The VPN management server 10 includes a plurality of compatible VPs manufactured by different manufacturers according to their own standards.
N devices 15A, 15B,... 15X, 15Y (hereinafter, referred to as
Unless it refers to a specific corresponding VPN device, a suffix-removed code 15 is used) and the general-purpose computer device connected to the above-described FW11 and the VPN determination unit when read and executed by the computer device. 1
2, a computer program for realizing the functions of the VPN selector 13 and the VPN manager 14. This computer program is usually stored in an internal storage device or an external storage device of the computer device, and is read and executed as needed. However, a recording medium separable from the computer device, for example, a CD-ROM or FD
Or the like, and may be installed in the internal storage device or the external storage device at the time of use and provided for execution at any time.

In the present embodiment, it is assumed that the VPN management server 10 and each client 20 each have communication control means corresponding to an existing router.
Further, in the present embodiment, each corresponding VPN device 15
A plurality of different kinds of VPN software (programs) are stored in the VPN management server 10 or in an external storage device, and exist independently as product packages and exhibit a VPN construction function according to their own standards. The present invention may be applied to a case where the VPN software is displayed and executed at any time to perform the VPN construction function.

The VPN judging section 12 judges whether or not the corresponding VPN device 15 on the server side corresponding to each of the VPN devices 22A and 22B of the transmission source or the transmission destination is provided. The VPN selector 13 is a VPN management server 1
In this case, a device corresponding to the source or destination VPN device 22A, 22B is selected from the plurality of corresponding VPN devices 15 included in the device 0. The VPN management unit 14 performs overall control of each corresponding VPN device 15, authentication processing, and other data management.

Next, in the communication system 1 of the present embodiment, a processing procedure for transmitting and receiving an encrypted message between the clients 20A and 20B will be described with reference to FIG. In this example, in the client 20A, the VPN device X (22A)
And the client 20B uses a VPN device Y (22B) having a different standard from that of the VPN device X. The address information given to the message to be transmitted includes the destination and source VPN devices X and Y (15
X, 22A, 22B, 15Y), and the original address information and data added to the message are encrypted on the VPN.

Now, from the client 20A, FIG.
Is transmitted to the VPN management server 10 ((1) in FIG. 1). The VPN management server 10 sends the message received via the FW 11 to the VPN determination unit 12 (Step S101). VPN determination unit 1
2 is based on the address information given to the message, whether or not a corresponding VPN device for constructing a VPN in cooperation with the VPN device 22A of the client 20A is provided in the server, that is, the VPN device X Corresponding VPN to be paired
It is determined whether the device X exists (step S10).
2).

When the corresponding VPN device X to be paired is provided in the VPN management server 10, the VPN selection unit 12
Then, a corresponding one is selected from the plurality of VPNs 15. As a selection method in this case, specifically, information on a plurality of VPN devices 15 provided in the VPN management server 10 is stored in the VPN selection unit 12 in advance, and the information and the address given to the message are stored. Compare with the information and select the one that matches. In this example, the VPN device X
Since there is a corresponding VPN device X (15X) paired with (22A), this is selected. This selection information
It is input to the PN management unit 14.

The VPN management unit 14 stores the selected corresponding VPN.
Activate the device 15X and connect the VP to the VPN device 22A.
N is constructed (step S102: Yes, S103).
Then, the encrypted part of the received message is transmitted to the VPN device 15.
Decryption is performed with the X encryption key (the encryption key exchanged with the VPN device 22A) (step S104), and a decrypted message in a format as shown in FIG. 3B is obtained. The original transmission destination client 20B is specified from the decrypted message, and the VPN determination unit 12 determines whether or not the VPN management server 10 has a corresponding VPN device Y to be paired with the VPN device Y (22B) of the client. Is determined (step S105). When the corresponding VPN device Y to be paired is provided in the VPN management server 10, the VPN selection unit 12
Then, the corresponding one is selected, and the VPN management unit 14 activates the corresponding VPN device Y (15Y) (step S10).
5: Yes, S106). Then, the corresponding VPN device 15Y
To the corresponding VPN ((2) in FIG. 1).
The encrypted message is encrypted with the encryption key of the device (the encryption key exchanged with the VPN device 22B), and the destination information and the address information of the transmission source are added to the encrypted message and transmitted to the client 20B via the FW 11 (step S107). ). The message format at this time is as shown in FIG.
As a result, the client 20B
The message from A can be obtained. If the corresponding VPN devices X and Y are not provided in the VPN management server 10 in steps S102 and S105, an error notification is sent to the client 20A of the transmission source (step S108). The above processing is repeated for all messages (step S109).

FIG. 4 is a conceptual diagram of the communication system 1 of the present embodiment. Normally, a VPN is directly established between clients performing communication. In the present embodiment, as shown in FIG.
VPNs are respectively constructed with the PN management server 10,
Communication between clients is always performed via the VPN via the VPN management server 10. VP
N management server 10 is a client-side VPN at each point.
A plurality of corresponding VPN devices corresponding to the device,
The standard difference between the VPN devices on each client side is
Since the transmission is absorbed by the N management server 10, the transmission source client can transmit the message without being conscious of the standard of the VPN device on the transmission destination client side.

As described above, the communication system 1 of the present embodiment
Then, the VPN management server 10 transmits the received encrypted message to the corresponding VPN device 15 paired with the VPN device 22A of the transmission source.
X and the decrypted message is encrypted by the corresponding VPN device 15Y paired with the destination VPN device 22B and transmitted to the VPN device 22B, so that the authentication function between different types of VPN devices, the encryption key exchange function, Compatibility of encryption / decryption functions and the like becomes possible. Further, since decryption and encryption are performed using different encryption keys depending on the corresponding VPN device, it is possible to prevent a decrease in security protection capability. Therefore, it is possible to use different types of VPNs constructed by VPN devices of different manufacturers between a plurality of points, and the conventional problems are solved.

In this embodiment, an example of a communication system for transmitting an encrypted message using different VPN apparatuses X and Y (22A and 22B) from the client 20A to the client 20B has been described for convenience.
When transmitting an encrypted message from B to the client 20A,
Alternatively, even when the VPN devices of the clients 20A and 20B have the same standard, message transmission can be performed in the same procedure.

[0025]

As is apparent from the above description, according to the present invention, in the VPN management server, the corresponding VPN device constructed by the VPN between the source and destination VPN devices is selected and the message is transmitted. Is carried out, so that there is an effect that a VPN environment can be constructed even when different types of VPN devices are used.

[Brief description of the drawings]

FIG. 1 is a functional block diagram of a communication system according to an embodiment of the present invention.

FIG. 2 is an explanatory diagram of a message relay procedure in the VPN management server.

FIG. 3A is a format of a message transmitted from a transmission source client to a VPN management server, and FIG.
N format of the message decrypted in the management server,
FIG. 4C is a diagram illustrating a format of a message transmitted from the VPN management server to the client that is the original transmission destination.

FIG. 4 is a conceptual explanatory diagram of an operation in the communication system of the embodiment.

FIG. 5 is a functional block diagram of a conventional communication system using a VPN.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Communication system 10 VPN management server 11, 21A, 21B Firewall (FW) 12 VPN judgment part 13 VPN selection part 14 VPN management part 15A, 15B, ... 15X, 15Y VPN apparatus 20A, 20B Client 22A, 22B VPN apparatus

Claims (6)

[Claims] 1. A plurality of VPN devices, each of which constructs a VPN on a communication network in cooperation with a corresponding VPN device of the same standard, and all the corresponding VPNs corresponding to the plurality of VPN devices.
A VPN relay device having a PN device, wherein the VPN relay device establishes a first VPN with the VPN device of the message transmission source to receive the encrypted message, and transmits the encrypted message contained in the received encrypted message. Means for decrypting the destination information to identify the destination VPN device, constructing a second VPN with the source VPN device, and converting the received encrypted message into a second VPN encrypted message. A communication system comprising: means for sending to a second VPN, and configured to relay message transmission in each VPN device. 2. The communication system according to claim 1, wherein a firewall intervenes in an input / output interface portion of the encrypted message of the VPN relay device. 3. A first VPN, which is provided between a plurality of corresponding VPN devices that construct a VPN on a communication network in cooperation with VPN devices of the same standard, and a first VPN device serving as a message transmission source.
The second VPN between the second VPN device as the message transmission destination
Are constructed using the corresponding corresponding VPN devices, respectively.
Routing control means for converting an encrypted message received from the first VPN device through the first VPN into an encrypted message for the second VPN, and transmitting the converted encrypted message to the second VPN device through the second VPN. VPN relay device. 4. The plurality of corresponding VPN devices construct a VPN with the VPN device based on different authentication methods, encryption key exchange methods, and encryption methods, respectively, and the route control means includes: , A corresponding device is selected from the corresponding VPN devices prepared in advance, and the first VPN is selected.
4. The VPN relay device according to claim 3, wherein a second VPN is constructed. 5. The path control means decrypts an encrypted message received through the first VPN with an encryption key of the first VPN device, and converts a decrypted message obtained by the decryption into the second VPN.
5. The VPN relay device according to claim 3, wherein the VPN relay device encrypts the data with the encryption key of the PN device and sends the encrypted data to the second VPN. 6. A recording medium comprising a computer readable program recorded in a computer device communicably connected to a VPN device which constructs a VPN on a communication network in cooperation with a corresponding VPN device. A process of constructing a first VPN with the first VPN device serving as a message transmission source and receiving an encrypted message; decoding the destination information included in the received encrypted message to specify a communication device of the destination; And the second destination
The computer device is configured to execute a process of constructing a second VPN with a VPN device, and a process of converting the received encrypted message to a second VPN encrypted message and sending the encrypted message to the second VPN. Recording medium.