Secure relay device and data transmission / reception system

Abstract

In order to decide a TLS tunnel to be set as a transmission destination of data received from a LAN side, a secure relay device (18) determines whether or not an IP address of the transmission destination of the data is the same network address as an IP address on the LAN side. When the data is addressed to a different network address, the secure relay device (18) selects a TLS tunnel formed with a TLS end point corresponding to the different network address. When the data is addressed to the same network address, the secure relay device (18) selects a TLS tunnel formed with a TLS end point corresponding to the MAC address of the transmission destination of the data.

Description

[Technical Field]

[0001] The present disclosure relates to a secure relay device and a data transmission and reception system.

[0002] This application is based on and claims the benefit of priority from Patent Application No. 2022-058317, filed March 31, 2022, the entire contents of which are incorporated herein by reference. [Background technology]

[0003] BACKGROUND ART Conventionally, VPNs (Virtual Private Networks) have been used for transmitting and receiving data over networks such as the Internet, and VPNs use encryption technologies such as TLS (Transport Layer Security).

[0004] For example, Patent Document 1 describes a tunnel connection device in which an SSL-VPN terminal having a network application program such as a web browser or email client is equipped with a TCP client function unit. This TCP client function unit establishes a tunnel with a TLS tunnel termination function unit of an SSL-VPN gateway to which an application server is connected, and performs tunnel communication (encapsulation communication). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2016-5196 Summary of the Invention

[0006] VPNs are generally implemented as software on personal computers, requiring significant CPU power and consuming a lot of power. This can lead to unstable VPN connections in devices with insufficient CPU power. Furthermore, VPNs' high power consumption makes them difficult to apply to embedded devices, such as IoT devices.

[0007] Furthermore, to connect networks, there are L2 (Layer 2) switches and L3 (Layer 3) switches, and it is necessary to select or configure the appropriate switch depending on the device and network that sends and receives data. This makes it impossible to mix different network configurations, and sometimes limits the setting of network addresses.

[0008] In view of the above background, the present disclosure aims to provide a secure relay device and a data transmission / reception system that enables stable VPN connections regardless of the CPU power of terminal devices and increases the flexibility of network address settings.

[0009] The present disclosure employs the following technical solutions to solve the above problems. The symbols in parentheses in this section are examples showing the correspondence with specific solutions described in the embodiments below as one aspect, and do not limit the technical scope of the present disclosure.

[0010] A secure relay device according to one embodiment of the present disclosure is a secure relay device connected to a terminal device in a VPN network using a TLS tunnel to form an end point of the TLS tunnel, and in order to determine the TLS tunnel to which data received from the LAN side is to be sent, the secure relay device determines whether the destination IP address of the data is the same network address as the IP address of the LAN side, and if the data is destined for a different network address, performs a first process of selecting the TLS tunnel formed with the end point corresponding to the different network address, and if the data is destined for the same network address, performs a second process of selecting the TLS tunnel formed with the end point corresponding to the destination MAC address of the data.

[0011] A secure relay device according to one aspect of the present invention comprises: When the second process is performed, The TLS tunnel to which the data is to be transmitted may be determined by searching a table having an entry for the identifier of the termination point associated with the destination MAC address.

[0012] The secure relay device according to one aspect of the present invention Former The contents of the entries included in the table may be updated based on the MAC address of data transmitted from the termination point.

[0013] A secure relay device according to one embodiment of the present disclosure may select, as the destination of the data, the TLS tunnel of the termination point having the same network address as the IP address on the LAN side, when transmitting the data to a destination for which there is no entry in the table, or when the destination MAC address is a broadcast address.

[0014] The secure relay device according to one aspect of the present disclosure may be configured as hardware.

[0015] In a data transmission / reception system (10) according to one aspect of the present invention, the above-described secure relay device is connected to terminal devices, and in order to transmit and receive data between the terminal devices, the secure relay device vessel forms a TLS tunnel with another of the secure relay devices. [Effects of the Invention]

[0016] According to the present disclosure, a stable VPN connection can be established regardless of the CPU power of the terminal device, and the degree of freedom in setting network addresses can be increased. [Brief explanation of the drawings]

[0017] [Figure 1] 1 is a schematic configuration diagram of a data transmission and reception system according to an embodiment; [Figure 2] FIG. 2 is a conceptual diagram of an L3 configuration according to an embodiment. [Figure 3] FIG. 2 is a conceptual diagram of an L2 configuration according to an embodiment. [Figure 4] FIG. 10 is a schematic diagram showing the flow of an L3 operation according to an embodiment. [Figure 5] FIG. 2 is a schematic diagram illustrating a flow of an L2 operation according to an embodiment. [Figure 6] FIG. 2 is a block diagram showing a hardware configuration of a secure relay device according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0018] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. Note that the embodiments described below are examples of how the present disclosure may be implemented, and the present disclosure is not limited to the specific configurations described below. When implementing the present disclosure, specific configurations according to the embodiments may be appropriately adopted.

[0019] 1 is a schematic diagram of a data transmission and reception system 10 of this embodiment. In the data transmission and reception system 10 of this embodiment, as an example, a plurality of terminal devices 12 and one or more management devices 14 transmit and receive data via the Internet 16. In the following explanation, the transmitted and received data will be described as packets.

[0020] The terminal device 12 is, for example, an IoT (Internet of Things) device, and is a device with a low CPU power. The terminal device 12 is connected to a secure relay device 18, which is hardware, and the secure relay device 18 is connected to a router 20, thereby enabling the terminal device 12 to connect to the Internet 16. As an example, the terminal device 12 transmits and receives packets via the secure relay device 18 using a communication application.

[0021] Secure relay device 18 is connected to terminal device 12 to form a termination point of a TLS tunnel (hereinafter referred to as a "TLS termination point") in a VPN network using a TLS tunnel. That is, secure relay device 18 forms a TLS tunnel with another secure relay device 18 connected to another terminal device 12, and makes it possible to treat an address space outside the TLS termination point as a VPN address space.

[0022] In the data transmission / reception system 10 of this embodiment, one or more terminal devices 12 are connected to one secure relay device 18. One or more secure relay devices 18 are connected to one router 20. In the following description, a set of the terminal device 12, the secure relay device 18, and the router 20 is also referred to as a base.

[0023] The management device 14 is, for example, a server or the like, which is equipped with a function for forming a TLS tunnel, and is connectable to the Internet 16 via a router 20 .

[0024] 1 are schematic representations of TLS tunnels formed between point 1 and points 2 and 3 and management device 14. Note that TLS tunnels are also formed between point 2 and point 3, between point 2 and management device 14, and between point 3 and management device 14.

[0025] As will be described in detail later, the secure relay device 18 of this embodiment enables packets to be transmitted and received between bases even when the L2 configuration and the L3 configuration are mixed.

[0026] 2 is a conceptual diagram of an L3 configuration, in which different VPN addresses (different IP addresses or subnet addresses) are set for bases 1 to 3 and management device 14. In the L3 configuration, L3 operation, which is the operation of transmitting a packet, selects a destination TLS tunnel by routing based on the packet's destination IP address.

[0027] 3 is a conceptual diagram of an L2 configuration, in which the same VPN address is set for points 1 to 3 and management device 14. In an L2 configuration, an L2 operation, which is a packet transmission operation, selects a destination TLS tunnel based on the destination MAC address of the packet. To perform an L2 operation, secure relay device 18 stores a table having entries each corresponding to the MAC address of terminal device 12 and containing an identifier of the TLS tunnel termination point (hereinafter referred to as a "TLS identifier").

[0028] 4 is a schematic diagram showing an example of the flow of operation of the data transmission and reception system 10 in an L3 configuration (hereinafter referred to as "L3 operation"). Note that the local station side in FIG. 4 is the source of a packet, and the remote station side is the destination of the packet.

[0029] In the L3 configuration, as described above, a different VPN address (a different subnet address in the example of FIG. 4) is assigned to each base in the VPN address space. Also, the secure relay device 18 serves as a default route from the terminal device 12. In addition, in the L3 operation, the secure relay device 18 determines the TLS tunnel to which the packet is to be sent by a routing operation.

[0030] In step S1, the secure relay device 18 on the local station side (hereinafter referred to as the "local station side relay device") is started up.

[0031] In step S2, the local relay device establishes a TLS tunnel between the remote secure relay device 18 (hereinafter referred to as the remote relay device) and management device 14 based on the settings.

[0032] In step S3, the terminal device 12 on the local station side (hereinafter referred to as "local station side terminal") is started up.

[0033] In step S4, the local terminal creates a packet to be transmitted to the remote terminal device 12 (hereinafter referred to as the "local terminal"). Since the address of the remote terminal device 12 is outside the subnetwork of the local terminal, the local terminal sets the local relay device as the Next Hop IP. Then, the local terminal transmits an ARP (Address Resolution Protocol) request to the local relay device.

[0034] In step S5, when the local relay device receives the ARP request, it creates and transmits an ARP response to the ARP request.

[0035] In step S6, the local terminal receives the ARP response and transmits the packet created by the local terminal to the local relay device.

[0036] In step S7, the local relay device receives the packet, selects a destination TLS tunnel by performing routing processing based on the destination IP address (Dest IP) of the packet, and transmits the packet to the selected TLS tunnel.

[0037] In step S8, the relay device on the other side receives the packet from the TLS tunnel and transmits the packet to the terminal on the other side based on the Dest IP.

[0038] In step S9, the remote terminal receives the packet from the remote relay device.

[0039] FIG. 5 is a schematic diagram showing an example of the flow of operations (hereinafter referred to as "L2 operations") of the data transmission and reception system 10 in the L2 configuration.

[0040] In the L2 configuration, as described above, all bases in the VPN address space are assigned the same VPN address (subnet address in the example of FIG. 5). Furthermore, the secure relay device 18 is not recognized by the terminal device 12. Furthermore, in the L2 operation, the secure relay device 18 determines the TLS tunnel to which a packet is to be sent based on the MAC address of the destination.

[0041] In step S1, the local station side relay device is started up.

[0042] In step S2, the local relay device establishes a TLS tunnel with the remote relay device and management device 14 based on the settings.

[0043] In step S3, the local terminal starts up.

[0044] In step S4, the local terminal creates a packet to be sent to the remote terminal. Also, since the remote terminal's address is within the local terminal's subnetwork, the local terminal sets the remote terminal as the Next Hop IP. Then, the local terminal broadcasts an ARP request to the remote terminal.

[0045] In step S5, the local relay device receives the ARP request from the local terminal, and then, since the local relay device is a broadcast device, transmits a packet indicating the ARP request (hereinafter referred to as an "ARP request packet") to all TLS tunnels.

[0046] In step S6, the relay device on the other side receives the ARP request packet by broadcast from the TLS tunnel, associates the MAC address of the ARP request packet with the TLS tunnel, and then broadcasts the ARP request packet to the terminal on the other side.

[0047] In step S7, the remote terminal receives the ARP request packet, creates an ARP response, and sends it.

[0048] In step S8, the remote relay device receives the ARP response, selects a destination TLS tunnel based on the destination MAC address of the ARP response, and transmits the ARP response packet to the selected TLS tunnel.

[0049] In step S9, the local relay device receives the ARP response packet from the TLS tunnel, associates the MAC address of the ARP response packet with the TLS tunnel, and then transmits the ARP response packet to the remote terminal.

[0050] In step S10, the local terminal receives the ARP response packet and transmits the packet created by the local terminal to the local relay device.

[0051] In step S11, the local relay device receives the packet, selects a destination TLS tunnel based on the destination MAC address of the received packet, and transmits the packet to the selected TLS tunnel.

[0052] In step S12, the relay device on the other side receives the packet from the TLS tunnel and transmits the packet to the terminal on the other side.

[0053] In step 13, the other terminal device receives the packet from the other relay device.

[0054] 6 is a block diagram showing the hardware configuration of the secure relay device 18 of this embodiment. The processing performed by the secure relay device 18 will be described below with reference to FIG.

[0055] The secure relay device 18 includes a network interface processing unit 30A, a receive queue 31A, a receive FIFO 32A, a receive processing unit 33A, a TLS tunnel selection unit 34, a receive TLS queue 35A, a receive TLS buffer 36A, a TLS encryption unit 37, a transmit TLS queue 39A, a transmit TLS buffer 40A, a transmit processing unit 41A, a transmit queue 42A, and a transmit FIFO 43A.

[0056] The secure relay device 18 also includes a network interface processing unit 30B, a receive queue 31B, a receive FIFO 32B, a receive processing unit 33B, a receive TLS queue 35B, a receive TLS buffer 36B, a TLS decryption unit 38, a transmit TLS queue 39B, a transmit TLS buffer 40B, a transmit processing unit 41B, a transmit queue 42B, and a transmit FIFO 43B.

[0057] The network interface processing unit 30A is connected to the LAN side interface of the secure relay device 18, and has the function of transmitting and receiving packets to and from other devices connected to the LAN. For this reason, the network interface processing unit 30A has the so-called Ethernet-PHY and Ethernet-MAC functions.

[0058] When the network interface processor 30A receives a packet from a directly connected terminal device 12 to be transmitted to another terminal device 12, it writes the received packet to the receive FIFO 32A and enqueues information about the received packet in the receive queue 31A. To this end, the network interface processor 30A outputs a receive queue setting signal S101 to the receive queue 31A and outputs a receive packet data signal S102 to the receive FIFO 32A.

[0059] The receive queue setting signal S101 is a signal for enqueuing the packet length of the receive packet in the receive queue 31A. The receive queue setting signal S101 is output to the receive queue 31A when the transfer of the receive packet data to the receive FIFO 32A is completed.

[0060] The received packet data signal S102 is a signal for transferring received packet data to the receive FIFO 32A.

[0061] The receive queue 31A holds information about the received packets stored in the receive FIFO 32A. The information held includes the packet length of the received packets. The first entry in the receive queue 31A is output to the receive processor 33A, and the received packet is processed by the receive processor 33A. Faith When the packet has been received, the receiving queue 31A is read out, and the contents of the next entry are output to the receiving processor 33A. Therefore, the receiving queue 31A outputs a receiving queue output signal S103 to the receiving processor 33A.

[0062] The receive queue output signal S103 is a signal indicating the first entry enqueued in the receive queue 31A, and indicates the packet length of a receive packet to be processed by the receive processing unit 33A when the receive packet is stored in the receive FIFO 32A. When the receive processing unit 33A reads the receive queue output signal S103, the receive queue 31A outputs the contents of the next enqueued queue as the next receive queue output signal S103.

[0063] The reception FIFO 32A is a packet storage FIFO for transferring received packets to the reception processing unit 33A. The reception FIFO 32A has received packet data written therein by the network interface processing unit 30A, and the received packet data is read out by the reception processing unit 33A.

[0064] Therefore, the receive FIFO 32A outputs a receive packet data signal S104 to the receive processing unit 33A. The receive packet data signal S104 is a signal that is read by the receive processing unit 33A in accordance with the information indicated in the receive queue output signal S103, and indicates the contents of the receive packet data stored in the receive FIFO 32A.

[0065] The reception processing unit 33A receives a reception packet by reading the reception FIFO 32A based on the reception queue output signal S103, and performs the following reception process on the reception packet.

[0066] Before performing the following process, the receiving processing unit 33A determines whether the destination IP address of the received packet received from the LAN side is the same network address as the LAN-side IP address of the secure relay device 18 in order to determine the TLS tunnel to which the received packet is to be sent.

[0067] (Reception process 1) Reception process 1 is a process performed when the destination MAC address included in the MAC header of the received packet is the same as the MAC address set in the LAN-side interface of the secure relay device 18, and the destination IP address included in the IP header of the received packet is different from the IP address set in the LAN-side interface of the secure relay device 18.

[0068] In this case, the reception processing unit 33A uses the destination IP address included in the IP header of the received packet to search a management table provided in the reception processing unit 33A and obtains the TLS identifier to be used for transmission associated with the network address.

[0069] In this way, when the subnet address of the destination IP address indicated in the IP header of the received packet differs from the subnet address of the network to which the secure relay device 18 is directly connected, the secure relay device 18 selects the destination TLS tunnel based on the subnet address of the destination IP address. Note that the reception process 1 is a process for performing the above-mentioned L3 operation.

[0070] (Reception process 2) Reception process 2 is a process performed when the destination MAC address included in the MAC header of the received packet is different from the MAC address set in the LAN-side interface of the secure relay device 18, and the destination IP address included in the IP header of the received packet is the same as the IP address set in the LAN-side interface of the secure relay device 18.

[0071] In this case, the reception processing unit 33A outputs TLS selection key information S105 indicating a search instruction using the destination MAC address of the received packet as a search key to the TLS tunnel selection unit 34. Then, the reception processing unit 33A obtains the TLS identifier searched by the TLS tunnel selection unit 34 as the destination of the received packet.

[0072] The TLS tunnel selection unit 34 includes a table having entries for TLS identifiers associated with the MAC addresses of the terminal devices 12 (hereinafter referred to as the "TLS identifier table").

[0073] The TLS tunnel selection unit 34 then uses the MAC address indicated by the TLS selection key information S105 as a search key, searches through all entries in the TLS identifier table for an entry that matches the MAC address, and selects the TLS identifier of the matching entry. The value set in the selected TLS identifier is output to the reception processing unit 33A as a TLS selection search result output signal S106.

[0074] In this way, in the secure relay device 18, when the subnet address of the destination IP address of the received packet is the same as the subnet address of the network to which the secure relay device 18 is directly connected, the TLS tunnel selection unit 34 searches the TLS identifier table to determine the TLS tunnel. Note that this reception process 2 is a process for performing the above-mentioned L2 operation.

[0075] Furthermore, if there is no TLS identifier corresponding to the destination MAC address in the TLS identifier table provided in the TLS tunnel selection unit 34, the reception processing unit 33A searches the management table provided in the reception processing unit 33A using the IP address set in the LAN-side interface of the secure relay device 18, and obtains at least one TLS identifier to be used for transmission that is associated with the network address (reception processing 2A). In this case, multiple TLS identifiers may be used for transmission.

[0076] (Reception process 3) If the destination MAC address included in the MAC header of the received packet is a broadcast address and is not addressed to the secure relay device 18, the management table provided in the reception processing unit 33A is searched using the IP address set in the LAN side interface of the secure relay device 18, and at least one TLS identifier to be used for transmission associated with the network address is obtained. In this case, multiple TLS identifiers may be used for transmission.

[0077] (Reception process 4) If the destination MAC address included in the MAC header of the received packet is a broadcast address and is addressed to the secure relay device 18, or if the destination MAC address included in the MAC header of the received packet is the same as the MAC address set in the LAN side interface of the secure relay device 18 and the destination IP address included in the IP header is the same as the IP address set in the LAN side interface of the secure relay device 18, the packet is determined to be addressed to the secure relay device 18, and appropriate termination processing and response processing are performed.

[0078] After performing any one of the above reception processes 1 to 4, the reception processing unit 33A transfers the received packet to the reception TLS buffer 36A and enqueues the packet length of the packet, a pointer to the reception TLS buffer 36A, and the TLS identifier of the output destination in the reception TLS queue 35A. To this end, the reception processing unit 33A outputs a reception TLS queue setting signal S107 to the reception TLS queue 35A and outputs a reception TLS buffer write signal S108 to the reception TLS buffer 36A.

[0079] The receive TLS queue setting signal S107 is a signal for enqueuing information about the received packet in the receive TLS queue 35A so that the reception processing unit 33A can hand over the packet for which reception processing has completed to the TLS encryption unit 37. The information about the received packet includes the packet length of the received packet, a pointer to the receive TLS buffer 36A, and the TLS identifier of the output destination. The receive TLS queue setting signal S107 is output when writing of the received packet for which reception processing has completed into the receive TLS buffer 36A is completed.

[0080] The receive TLS buffer write signal S108 is a signal for writing packet data for which the receive processing unit 33A has completed the receive processing into the receive TLS buffer 36A.

[0081] The receive TLS queue 35A holds information about receive packets that have been processed by the receive processing unit 33A and transferred to the receive TLS buffer 36A. The first entry in the receive TLS queue 35A is output to the TLS encryption unit 37, and the contents of the next entry are output by reading the receive TLS queue 35A when the TLS encryption unit 37 has finished receiving the packet. Therefore, the receive TLS queue 35A outputs a receive TLS queue output signal S109 to the TLS encryption unit 37.

[0082] The receive TLS queue output signal S109 is a signal indicating the first entry enqueued in the receive TLS queue 35A. When a receive packet to be processed by the TLS encryption unit 37 is stored in the receive TLS buffer 36A, the packet length of the receive packet and the TLS identifier of the pointer output destination to the receive TLS buffer 36A are output as the receive TLS queue output signal S109. When the TLS encryption unit 37 reads the receive TLS queue output signal S109, the receive TLS queue 35A outputs the contents of the next enqueued queue.

[0083] The reception TLS buffer 36A is a packet storage buffer for passing received packets processed by the reception processing unit 33A to the TLS encryption unit 37, and received packet data is written to the reception TLS buffer 36A by the reception processing unit 33A and read out by the TLS encryption unit 37. For this reason, the reception TLS buffer 36A outputs a reception TLS buffer read signal S110 to the TLS encryption unit 37.

[0084] The receive TLS buffer read signal S110 is a signal indicating the contents of the received packet data stored in the receive TLS buffer 36A, and is output when the TLS encryption unit 37 reads the data in accordance with the information indicated in the receive TLS queue output signal S113.

[0085] The TLS encryption unit 37 reads out the received packet data stored in the receive TLS buffer 36A using the information indicated by the receive TLS queue output signal S109. Then, the TLS encryption unit 37 performs TLS encryption processing using the TLS identifier of the output destination indicated by the receive TLS queue output signal S109.

[0086] The TLS encryption unit 37 then selects a TCP session identifier based on the TLS identifier and transfers the received packet that has been TLS encrypted to the transmit TLS buffer 40A. The TLS encryption unit 37 also enqueues the packet length of the received packet, a pointer to the transmit TLS buffer 40A, and the identifier of the TCP session used for transmission in the transmit TLS queue 39A. To this end, the TLS encryption unit 37 transmits a transmit TLS queue setting signal S111 to the transmit TLS queue 39A and transmits a transmit TLS buffer write signal S112 to the transmit TLS buffer 40A.

[0087] The transmit TLS queue setting signal S111 is a signal for enqueuing information about a TLS transmit packet (hereinafter referred to as a "TLS transmit packet") in the transmit TLS queue 39A so that the TLS encryption unit 37 can pass the packet on which TLS encryption processing has been completed to the transmit processing unit 41A. The information about the TLS transmit packet includes the packet length of the TLS transmit packet, a pointer to the transmit TLS buffer 40A, and an identifier of the TCP session used for transmission. The transmit TLS queue setting signal S111 is output to the transmit TLS queue 39A when writing of a received packet that has undergone TLS encryption processing to the transmit TLS buffer 40A is completed.

[0088] The transmission TLS buffer write signal S112 is a signal for writing TLS transmission packet data that has been TLS encrypted by the TLS encryption unit 37 into the transmission TLS buffer 40A, and indicates the contents of the packet data that has been TLS encrypted.

[0089] The transmit TLS queue 39A holds information about TLS transmit packets transferred to the transmit TLS buffer 40A. The first entry in the transmit TLS queue 39A is output to the transmit processing unit 41A, and when the transmit processing unit 41A has finished receiving the packet, the transmit TLS queue 39A is read out and the contents of the next entry are output. Therefore, the transmit TLS queue 39A outputs a transmit TLS queue output signal S113 to the transmit processing unit 41A.

[0090] The transmit TLS queue output signal S113 indicates the first entry enqueued in the transmit TLS queue 39A. When a TLS transmit packet to be processed by the transmit processing unit 41A is stored in the transmit TLS buffer 40A, the packet length of the TLS transmit packet, a pointer to the transmit TLS buffer 40A, and an identifier of the TCP session used for transmission are output as the transmit TLS queue output signal S113. When the transmit processing unit 41A reads the transmit TLS queue output signal S113, the transmit TLS queue 39A outputs the contents of the next enqueued queue.

[0091] The transmit TLS buffer 40A is a packet storage buffer for passing TLS transmit packets to the transmit processing unit 41 A. TLS transmit packet data is written to the transmit TLS buffer 40A by the TLS encryption unit 37 and is read out by the transmit processing unit 41 A. For this reason, the transmit TLS buffer 40A outputs a transmit TLS buffer read signal S114 to the transmit processing unit 41 A.

[0092] The transmit TLS buffer read signal S114 is a signal indicating the contents of the TLS transmit packet data stored in the transmit TLS buffer 40A by the transmit processing unit 41A, and is read out in accordance with the information indicated in the transmit TLS queue output signal S113.

[0093] The transmission processing unit 41A reads the TLS transmission packet stored in the transmission TLS buffer 40A using the information indicated by the transmission TLS queue output signal S113, and creates a TCP / IP packet with the TLS transmission packet as its payload using the identifier of the TCP session to be used for transmission indicated by the transmission TLS queue output signal S113.

[0094] Specifically, the transmission processing unit 41A performs routing processing to select a next hop IP and perform MAC address resolution on the created TCP / IP packet to generate an Ethernet frame. The transmission processing unit 41A then transfers the generated Ethernet frame to the transmission FIFO 43A, transmits the frame length of the Ethernet frame to the transmission queue 42A, and enqueues it in the transmission queue 42A. To this end, the transmission processing unit 41A outputs a transmission queue setting signal S115 to the transmission queue 42A and outputs a transmission FIFO write signal S116 to the transmission FIFO 43A.

[0095] The transmission queue setting signal S115 is a signal for enqueuing information for a transmission Ethernet frame in the transmission queue 42A so that the transmission processing unit 41A can hand over the transmission Ethernet frame, which has completed TCP / IP packetization processing, to the network interface processing unit 30B. The transmission queue setting signal S115 is output when the transmission Ethernet frame, which has completed TCP / IP packetization processing and Ethernet framing processing, has been written to the transmission FIFO 43A. The information for the Ethernet frame includes the frame length of the transmission frame.

[0096] The transmission FIFO write signal S116 is a signal for the transmission processing unit 41A to write the transmission Ethernet frame that has been packetized and converted into an Ethernet frame into the transmission FIFO 43A, and indicates the transmission Ethernet frame.

[0097] The transmit queue 42A holds information about the Ethernet frame transferred to the transmit FIFO 43A. The information about the Ethernet frame includes the frame length of the Ethernet frame. The first entry in the transmit queue 42A is output to the network interface processor 30B, and when the network interface processor 30B has completed receiving the Ethernet frame, the transmit queue 42A is read out, and the contents of the next entry are output. Therefore, the transmit queue 42A outputs a transmit queue output signal S117 to the network interface processor 30B.

[0098] The transmission queue output signal S117 indicates the first entry enqueued in the transmission queue 42A, and includes the frame length of an Ethernet frame that is to be transmitted by the network interface processor 30B and is stored in the transmission FIFO 43A. When the network interface processor 30B reads the transmission queue output signal S117, the transmission queue 42A outputs the contents of the next enqueued queue.

[0099] The transmission FIFO 43A is a packet storage FIFO for passing the Ethernet frame generated by the transmission processing unit 41A to the network interface processing unit 30B. The Ethernet frame is written to the transmission FIFO 43A by the transmission processing unit 41A and read out by the network interface processing unit 30B. For this reason, the transmission FIFO 43A outputs a transmission FIFO read signal S118 to the network interface processing unit 30B.

[0100] The transmission FIFO read signal S118 is a signal output by the network interface processor 30B when reading out an Ethernet frame stored in the transmission FIFO 43A in accordance with the information indicated in the transmission queue output signal S117, and outputs the contents of the Ethernet frame data.

[0101] The network interface processing unit 30B has the same functions as the network interface processing unit 30A, is connected to the WAN side interface of the secure relay device 18, and transmits and receives packets to and from other secure relay devices 18 connected via the Internet 16, etc.

[0102] When the network interface processing unit 30B transmits a packet, it reads the TLS transmission packet from the transmission FIFO 43A based on information about the TLS transmission packet enqueued in the transmission queue 42A, and transmits it to the network through the determined TLS tunnel.

[0103] On the other hand, when the network interface processor 30B receives a packet, it writes the received packet into the receive FIFO 32B and enqueues information about the received packet into the receive queue 31B.

[0104] The reception queue setting signal S201 is similar to the reception queue setting signal S101, and is a signal for enqueuing the packet length of the packet received by the network interface processor 30B in the reception queue 31B.

[0105] The received packet data signal S202 is similar to the received packet data signal S102, and is a signal for transferring the data of the packet received by the network interface processor 30B to the receive FIFO 32B.

[0106] The receive queue 31B is similar to the receive queue 31A and holds information about received packets received by the network interface processor 30B and stored in the receive FIFO 32B. The receive queue 31B then outputs a receive queue output signal S203, which is similar to the receive queue output signal S103, to the receive processor 33B.

[0107] The receive FIFO 32B is similar to the receive FIFO 32A and is a packet storage FIFO for transferring receive packets received by the network interface processor 30B to the receive processor 33B. The receive FIFO 32B outputs a receive packet data signal S204, which is similar to the receive packet data signal S104, to the receive processor 33B.

[0108] The reception processing unit 33B reads the received packet stored in the reception FIFO 32B based on the reception queue output signal S203, performs TCP / IP termination processing on the received packet, and extracts the encrypted packet stored in the TCP payload. The reception processing unit 33B transfers the extracted received packet to the reception TLS buffer 36B, and enqueues the packet length of the received packet, a pointer to the reception TLS buffer 36B, and an identifier of the TCP session used for reception in the reception TLS queue 35B. To this end, the reception processing unit 33B outputs a reception TLS queue setting signal S205 to the reception TLS queue 35B, and outputs a reception TLS buffer write signal S206 to the reception TLS buffer 36B.

[0109] The receive TLS queue setting signal S205 is a signal for enqueuing information about the received packet in the receive TLS queue 35B so that the receive processing unit 33B performs receive processing and passes the received packet stored in the payload of the TCP segment to the TLS decryption unit 38. The information about the received packet includes the packet length of the packet, a pointer to the receive TLS buffer 36B, and an identifier of the TCP session used for reception. The receive TLS queue setting signal S205 is output when writing of the received packet extracted as a result of receive processing into the receive TLS buffer 36B is completed.

[0110] The receive TLS buffer write signal S206 is a signal for writing the received packet data that has been processed by the receive processing unit 33B into the receive TLS buffer 36B, and indicates the received packet data that has been processed.

[0111] The receive TLS queue 35B holds information about encrypted receive packets extracted by the receive processing unit 33B and stored in the receive TLS buffer 36B. The first entry in the receive TLS queue 35B is output to the TLS decryption unit 38, and the contents of the next entry are output by reading the receive TLS queue 35B when the TLS decryption unit 38 has finished receiving the packet. Therefore, the receive TLS queue 35B outputs a receive TLS queue output signal S207 to the TLS decryption unit 38.

[0112] The receive TLS buffer 36B is a packet storage buffer for passing the encrypted receive packets extracted by the receive processing unit 33B to the TLS decryption unit 38. The receive TLS buffer 36B is written to by the receive processing unit 33B and read out by the TLS decryption unit 38. For this reason, the receive TLS buffer 36B outputs a receive TLS buffer read signal S208 to the TLS decryption unit 38.

[0113] The receive TLS queue output signal S207 is a signal indicating the first entry enqueued in the receive TLS queue 35B. When receive packet data to be processed by the TLS decryption unit 38 is stored in the receive TLS buffer 36B, the data length of the receive packet data, a pointer to the receive TLS buffer 36B, and a TLS identifier corresponding to the input source TCP session are output as the receive TLS queue output signal S207. When the TLS decryption unit 38 reads the receive TLS queue output signal S207, the receive TLS queue 35B outputs the contents of the next enqueued queue.

[0114] The receive TLS buffer read signal S208 is a signal indicating the receive packet data stored in the receive TLS buffer 36B by the TLS decryption unit 38, and is output when the receive packet data is read in accordance with the information indicated in the receive TLS queue output signal S207.

[0115] The TLS decryption unit 38 receives the encrypted received packet to be processed by reading the receive TLS buffer 36B based on the receive TLS queue output signal S207. The TLS decryption unit 38 selects a TLS identifier based on the identifier of the TCP session used to receive the output information of the receive TLS queue 35B. The TLS decryption unit 38 then performs decryption processing on the encrypted received packet using the selected TLS identifier to restore the packet.

[0116] The TLS decryption unit 38 transfers the restored packet (hereinafter referred to as the "transmission packet") to the transmission TLS buffer 40B, and enqueues the packet length of the transmission packet, a pointer to the transmission TLS buffer 40B, and a TLS identifier corresponding to the input source TCP session in the transmission TLS queue 39B. To this end, the TLS decryption unit 38 transmits a transmission TLS queue setting signal S209 to the transmission TLS queue 39B, and outputs a transmission TLS buffer write signal S210 to the transmission TLS buffer 40B.

[0117] The transmit TLS queue setting signal S209 is a signal for enqueuing information about the transmit packet in the transmit TLS queue 39B in order to hand over the transmit packet to the transmit processing unit 41B. The information about the transmit packet includes the packet length of the transmit packet, a pointer to the transmit TLS buffer 40B, and a TLS identifier corresponding to the input source TCP session. The transmit TLS queue setting signal S209 is output when the transmit packet that has completed the restoration process has been written to the transmit TLS buffer 40B.

[0118] The transmit TLS buffer write signal S210 is a signal for writing the transmit packet that has been restored into the transmit TLS buffer 40B, and indicates the contents of the transmit packet data.

[0119] The transmit TLS queue 39B holds information about transmit packets transferred to the transmit TLS buffer 40B. The first entry in the transmit TLS queue 39B is output to the transmit processing unit 41B, and when the transmit processing unit 41B has completed receiving the packet, the transmit TLS queue 39B is read and the contents of the next entry are output. Therefore, the transmit TLS queue 39B outputs a transmit TLS queue output signal S211 to the transmit processing unit 41B.

[0120] The transmission TLS queue output signal S211 outputs the first entry enqueued in the transmission TLS queue 39B. When a transmission packet to be processed by the transmission processing unit 41B is stored in the transmission TLS buffer 40B, the packet length of the transmission packet, a pointer to the transmission TLS buffer 40B, and a TLS identifier corresponding to the input source TCP session are output as the transmission TLS queue output signal S211. When the transmission processing unit 41B reads the transmission TLS queue output signal S211, the transmission TLS queue 39B outputs the contents of the next enqueued queue.

[0121] The transmission TLS buffer 40B is a packet storage buffer for handing over transmission packets to the transmission processing unit 41B. Transmission packet data is written to the transmission TLS buffer 40B by the TLS decryption unit 38 and is read out by the transmission processing unit 41B. For this reason, the transmission TLS buffer 40B outputs a transmission TLS buffer read signal S212 to the transmission processing unit 41B.

[0122] The transmit TLS buffer read signal S212 is a signal indicating the contents of the transmit packet data stored in the transmit TLS buffer 40B by the transmit processing unit 41B, and is output when reading according to the information indicated in the transmit TLS queue output signal S211.

[0123] The transmission processing unit 41B receives a transmission packet to be processed by reading the transmission TLS buffer 40B based on the transmission TLS queue output signal S211, and performs the following processing.

[0124] (Send process 1) If the TLS identifier indicated in the transmission TLS queue 39B is a TLS tunnel used in communication with a terminal device 12 whose IP address is different from the IP address set in the LAN-side interface of the secure relay device 18, the transmission processing unit 41B changes the source MAC address included in the MAC header to the MAC address set in the LAN-side interface of the secure relay device 18.

[0125] (Send process 2) If the TLS identifier indicated in the transmission TLS queue 39B is a TLS tunnel used in communication with the terminal device 12 having the same IP address as that set in the LAN-side interface of the secure relay device 18, the source MAC address included in the MAC header of the transmission packet and the TLS identifier are output to the TLS tunnel selection unit 34, and an instruction is given to update the entry in the TLS identifier table that pairs the MAC address and the corresponding TLS identifier provided in the TLS tunnel selection unit 34. In this case, the transmission processing unit 41B outputs a TLS tunnel learning signal S213 to instruct the TLS tunnel selection unit 34 to update the entry.

[0126] If the network address corresponding to the TLS identifier corresponding to the input source TCP session matches the subnet address of the network directly connected to the secure relay device 18, the source MAC address and TLS identifier indicated in the MAC header of the transmitted packet are output as a TLS tunnel learning signal S213.

[0127] When the TLS tunnel selection unit 34 is instructed by the transmission processing unit 41B to update the TLS identifier table using the MAC address and TLS identifier by the TLS tunnel learning signal S213, the TLS tunnel selection unit 34 searches for an entry that matches the specified MAC address and performs the following processing based on the result.

[0128] (Update process 1) If an entry matching the specified MAC address exists, the value of the TLS identifier of that entry is changed to the TLS identifier specified by the transmission processing unit 41B.

[0129] (Update process 2) If an entry matching the specified MAC address does not exist, an entry having the specified MAC address and TLS identifier as values is created and added.

[0130] In this way, the TLS tunnel selection unit 34 Former The contents of the entries contained in the TLS identifier table are updated based on the MAC address of the packet sent from the TLS termination point. Note that "updating" here includes changing and adding entries, as described above. In addition to the above method, the contents of the entries may also be updated by obtaining the contents of the entries through automatic learning, for example.

[0131] After performing transmission process 1 or transmission process 2, the transmission processing unit 41B transfers the transmission Ethernet frame to the transmission FIFO 43B and enqueues the transmission Ethernet frame in the transmission queue 42B. To this end, the transmission processing unit 41B transmits a transmission queue setting signal S214 to the transmission queue 42B and transmits a transmission FIFO write signal S215 to the transmission FIFO 43B.

[0132] The transmission queue setting signal S214 is a signal for enqueuing information about a transmission Ethernet frame in the transmission queue 42B so that the transmission processing unit 41B can hand over the transmission Ethernet frame, for which transmission processing has been completed, to the network interface processing unit 30A. The information about the Ethernet frame includes the packet length of the transmission Ethernet frame. The transmission queue setting signal S214 is output when the transmission processing of the transmission Ethernet frame has been completed and written to the transmission FIFO 43B.

[0133] The transmission FIFO write signal S215 is a signal for writing a transmission Ethernet frame, which has been transmitted by the transmission processing unit 41B, into the transmission FIFO 43B, and indicates the contents of the transmission packet data of the transmission Ethernet frame.

[0134] The transmit queue 42B holds information about the transmit Ethernet frame generated by the transmit processor 41B and transferred to the transmit FIFO 43B. The information about the Ethernet frame includes the frame length of the Ethernet frame. The first entry in the transmit queue 42B is output to the network interface processor 30A, and when the network interface processor 30A has completed receiving the Ethernet frame, the transmit queue 42B is read out, and the contents of the next entry are output. Therefore, the transmit queue 42B outputs a transmit queue output signal S216 to the network interface processor 30A.

[0135] The transmission queue output signal S216 indicates the first entry enqueued in the transmission queue 42B, and includes the frame length of an Ethernet frame that the network interface processor 30A is to process for transmission stored in the transmission FIFO 43B. When the network interface processor 30A reads the transmission queue output signal S216, the transmission queue 42B outputs the contents of the next enqueued queue.

[0136] The transmission FIFO 43B is a packet storage FIFO for passing the Ethernet frame generated by the transmission processing unit 41B to the network interface processing unit 30A. The Ethernet frame is written to the transmission FIFO 43B by the transmission processing unit 41B and read out by the network interface processing unit 30A. Therefore, the transmission FIFO 43B outputs a transmission FIFO read signal S217 to the network interface processing unit 30A.

[0137] The transmission FIFO read signal S217 is a signal that is output when the network interface processor 30A reads out an Ethernet frame stored in the transmission FIFO 43B in accordance with the information indicated in the transmission queue output signal S216, and outputs the contents of the Ethernet frame data.

[0138] Then, the network interface processor 30A reads the Ethernet frame from the transmission FIFO 43A based on the information about the Ethernet frame enqueued in the transmission queue 42B, and transmits the Ethernet frame to the terminal device 12 as the destination.

[0139] As described above, the secure relay device 18 of this embodiment is connected to the terminal device 12 and forms a TLS tunnel with another secure relay device 18 connected to the other terminal device 12, making it possible to treat an address space outside the TLS termination point as a VPN address space. As described above, the secure relay device 18 of this embodiment operates without being built into the terminal device 12, so that the terminal device 12 can have a stable VPN connection even if the CPU power of the terminal device 12 is low.

[0140] The secure relay device 18 of this embodiment then determines whether the destination IP address of the packet, which is data, is the same network address as the IP address on the LAN side.

[0141] If the packets are destined for different network addresses, the secure relay device 18 selects a TLS tunnel formed with a TLS termination point corresponding to the different network address, and transmits the packets through this TLS tunnel. This packet transmission and reception is a so-called L3 operation. On the other hand, if the packets are destined for the same network address, the secure relay device 18 selects a TLS tunnel formed with a TLS termination point corresponding to the destination MAC address of the packets, and transmits the packets through this TLS tunnel. This packet transmission and reception is a so-called L2 operation.

[0142] In this way, the secure relay device 18 of this embodiment switches between L2 operation and L3 operation by determining whether the destination IP address of the packet is the same network address as the IP address on the LAN side. Therefore, the secure relay device 18 of this embodiment can transmit packets even when L2 configuration and L3 configuration are mixed, and thereby it becomes possible to transmit and receive packets without changing the setting regardless of whether the terminal device 12 is on the same network or a different network.

[0143] Furthermore, as described in the reception process 2A and reception process 3 by the reception processing unit 33A, when a packet is sent to a destination for which no entry exists in the TLS identifier table, or when the destination MAC address is a broadcast address, the secure relay device 18 of this embodiment selects, as the destination of the packet, a TLS tunnel at a TLS termination point having the same network address as the IP address on the LAN side.

[0144] This allows the secure relay device 18 to send a packet even if the packet destination is not included in the TLS identifier table.

[0145] Although the present disclosure has been described using the above-mentioned embodiments, the technical scope of the present disclosure is not limited to the scope described in the above-mentioned embodiments. Various modifications or improvements can be made to the above-mentioned embodiments without departing from the gist of the disclosure, and such modifications or improvements are also included in the technical scope of the present disclosure.

[0146] In the above embodiment, the secure relay device 18 is connected to the terminal device 12 as hardware. However, the present disclosure is not limited to this. For example, the functions of the secure relay device 18 may be implemented as software in the terminal device 12.

Claims

1. In a VPN network using a TLS tunnel, a secure relay device (18) is connected to a terminal device (12) to form a termination point of the TLS tunnel, In order to determine the TLS tunnel to which data received from the LAN side is to be transmitted, it is determined whether the destination IP address of the data is the same network address as the IP address of the LAN side; When the destination MAC address of the data is the same as the MAC address on the LAN side and the destination IP address of the data is different from the IP address on the LAN side, a first process is performed to select the TLS tunnel formed with the termination point corresponding to the different network address, and when the destination MAC address of the data is different from the MAC address on the LAN side and the destination IP address of the data is the same as the IP address on the LAN side, a second process is performed to select the TLS tunnel formed with the termination point corresponding to the destination MAC address of the data. Secure relay equipment.

2. 2. The secure relay device according to claim 1, wherein when the second process is performed, the TLS tunnel to which the data is to be transmitted is determined by searching a table having an entry for an identifier of the termination point associated with the destination MAC address.

3. 3. The secure relay device according to claim 2, wherein the contents of the entries included in said table are updated based on a MAC address of data transmitted from said source termination point.

4. 4. The secure relay device according to claim 2, wherein when the data is sent to a destination for which no entry exists in the table, or when the destination MAC address is a broadcast address, the secure relay device selects the TLS tunnel of the termination point having the same network address as the IP address on the LAN side as the destination of the data.

5. 5. The secure relay device according to claim 1, configured as hardware.

6. The secure relay device according to any one of claims 1 to 5 is connected to a terminal device, In order to transmit and receive data between the terminal devices, the secure relay device forms a TLS tunnel with another secure relay device.

Images