Communication device and communication method

Abstract

A communication device 1 comprises: a communication unit 12 which is disposed in a first virtual environment and can communicate with a communication unit 22 in a second virtual environment; a key acquisition unit 11 which is disposed in the first virtual environment and performs processing for acquiring a key; an integrated management unit 13 which is disposed in the first virtual environment and manages a first key that has been set for current communication and a second key to be used next; and an encryption switching unit 14 which is disposed in the first virtual environment and performs switching on the basis of an instruction from the integrated management unit 13 so as to perform communication of either encrypted communication or non-encrypted communication. When requesting a key update, the key acquisition unit reports a key ID of the second key and a plane number indicating a storage area of the second key. When the key update is requested, the key acquisition unit acquires a key corresponding to the reported key ID, and stores the key in an area corresponding to the reported plane number. The first communication unit adds information on a plane number corresponding to the first key to data to be transmitted when data communication is performed by the encrypted communication.

Description

Communication device and communication method

[0001] The present disclosure relates to a technique for concealing communications.

[0002] Containers are a mechanism for protecting internal functions, but they cannot protect communication between containers.

[0003] Encryption methods for communication networks include, for example, IPsec (Security Architecture for Internet Protocol) and MACsec (MAC Security). IPsec uses the Internet Key Exchange Protocol (IKE) for key exchange, while MACsec uses standards (technologies) such as MKA (IEEE802.1AF) and IEEE802.1x as methods for synchronously managing and updating keys (see, for example, Non-Patent Documents 1 to 5).

[0004] MACsec IEEE 802.1AE, [searched on July 5, 2021], Internet <URL: https: / / 1.ieee802.org / security / 802-1ae / > MAC Key Security (MACsec Key Agreement: MKA) 802.1AF, [Searched on July 5, 2020], Internet <URL: https: / / www.ieee802.org / 1 / pages / 802.1af.html> Port-Based Network Access Control 802.1X, [Searched on July 5, 2020], Internet <URL: https: / / 1.ieee802.org / security / 802-1x / > Security Architecture for Internet Protocol IPSec (IETF RFC 6071), [Retrieved July 5, 2020], Internet <URL: https: / / www.rfc-editor.org / rfc / pdfrfc / rfc6071.txt.pdf> The Internet Key Exchange (IKE) (IETF RFC 2409), [Retrieved July 5, 2020], Internet <URL: https: / / www.rfc-editor.org / rfc / pdfrfc / rfc2409.txt.pdf>

[0005] Authentication and key updates for host-to-host cryptographic communication devices are subject to network constraints, and linkage and compatibility with key exchange functions are not always achieved. In the case of host-to-host connections, settings must be adjusted manually, but there is no standardized procedure, so the operational costs of verifying the appropriateness of the settings and configuration information are high.

[0006] The present disclosure aims to provide a technology that enables secure and dynamic synchronization and updating of cryptographic keys of a cryptographic communication device, and switching between encryption and non-encryption by the cryptographic communication device, without depending on the network configuration.

[0007] A communication device according to one aspect of the present disclosure includes: a first communication unit disposed in a first virtual environment and capable of communicating with a second communication unit disposed in a second virtual environment different from the first virtual environment; a key acquisition unit disposed in the first virtual environment and performing a process of acquiring a key periodically or at random timing; a general management unit disposed in the first virtual environment and managing a first key set by the first communication unit for current communication and a second key to be used by the first communication unit after the first key; and an encryption switching unit disposed in the first virtual environment and switching the type of communication based on an instruction from the general management unit to perform either encrypted communication using the first key or the second key or unencrypted communication without a key. When requesting a key update from a communication partner, the key acquisition unit notifies the communication partner of a key ID of the second key and a plane number indicating a storage area for the second key, and when the communication partner requests a key update, the key acquisition unit acquires a key corresponding to the notified key ID and stores the acquired key in an area corresponding to the notified plane number. When performing data communication by encrypted communication, the first communication unit adds information about the plane number corresponding to the first key to the data to be transmitted and performs the data communication.

[0008] According to the present disclosure, it is possible to synchronize and update the encryption key of an encryption communication device, and to switch between encryption and non-encryption by the encryption communication device securely and dynamically, without depending on the network configuration.

[0009] FIG. 1 is a diagram showing an example of the functional configuration of a communication device. FIG. 2 is a diagram showing an example of a processing procedure of a communication method. FIG. 3 is a diagram showing an example of a processing procedure of a key update / synchronization method. FIG. 4 is a diagram showing an example of a processing procedure of a key update / synchronization method. FIG. 5 is a diagram showing an example of a processing procedure accompanying startup of a communication device. FIG. 6 is a diagram for explaining an example of key setting. FIG. 7 is a diagram showing an example of the physical configuration of a communication device. FIG. 8 is a diagram showing another example of the functional configuration of a communication device. FIG. 9 is a diagram showing an example of the functional configuration of a computer.

[0010] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, components having the same functions are designated by the same reference numerals, and duplicated descriptions will be omitted.

[0011] 1 , the communication device 1 includes at least a key acquisition unit 11, a communication unit 12, a supervising management unit 13, and an encryption switching unit 14. The key acquisition unit 11, the communication unit 12, the supervising management unit 13, and the encryption switching unit 14 are arranged in a first virtual environment 10 constructed within the communication device 1.

[0012] In this example, a communication device that performs encrypted or unencrypted communication with communication device 1 is defined as communication device 2. Communication device 2 includes at least a key acquisition unit 21, a communication unit 22, an overall management unit 23, and an encryption switching unit 24. The key acquisition unit 21, the communication unit 22, the overall management unit 23, and the encryption switching unit 24 are arranged in a second virtual environment 20 constructed within communication device 2. The functions of the key acquisition unit 21, the communication unit 22, the overall management unit 23, and the encryption switching unit 24 are similar to the functions of the key acquisition unit 11, the communication unit 12, the overall management unit 13, and the encryption switching unit 14.

[0013] In this disclosure, since the components of communication device 1 and communication device 2 have the same names, the former may be referred to as "first" and the latter as "second" in order to distinguish between them. For example, the communication unit 12 in the first virtual environment 10 may be referred to as the "first communication unit," and the communication unit 22 in the second virtual environment 20 may be referred to as the "second communication unit."

[0014] Examples of the first virtual environment 10 and the second virtual environment 20 are virtual environments constructed on a computer, such as a container, a pod, a virtual machine (VM), a network namespace, or a trusted execution environment (TEE). The same applies to examples of a third virtual environment 30 and a fourth virtual environment 40, which will be described later. Each virtual environment may be an isolated environment in which information within the virtual environment cannot be accessed from outside without permission from the virtual environment.

[0015] The main functions of the key acquisition unit 11, the communication unit 12, the overall management unit 13, the encryption switching unit 14, and the key server 31 will be described below.

[0016] [Key Acquisition Unit 11] The key acquisition unit 11 is arranged in the first virtual environment 10 and performs a process of acquiring a key periodically or at random timing.

[0017] In other words, the key acquisition unit 11 performs the process of acquiring a key at a timing different from the timing of communication under the management of the overall management unit 13. The timing different from the timing of communication is, for example, a timing that is not immediately before encrypted communication or unencrypted communication.

[0018] "Periodic" means, for example, at predetermined time intervals or at predetermined timing. The key acquisition unit 11 may have a timer that determines the timing for performing these processes. In this case, these processes may be performed at the timing determined by the timer. Another example of the predetermined timing is the timing before keys are exhausted. For this purpose, the key acquisition unit 11 may monitor the state of key exhaustion.

[0019] In addition, the key acquisition unit 11 may further perform a process of authentication with a key acquisition unit 21 located in a second virtual environment 20 different from the first virtual environment 10, and after authentication is completed, a process of confirming the validity of information used for communication between the communication unit 12 located in the first virtual environment 10 and the communication unit 22 located in the second virtual environment 20.

[0020] For example, the key acquisition unit 11 includes an acquisition unit 111, an authentication unit 112, and a validity confirmation unit 113. Typical processing contents of each of these units are as follows.

[0021] [[Acquisition Unit 111]] The acquisition unit 111 acquires a key. The acquisition unit 111 acquires and updates a key from a key server 31 located, for example, in a third virtual environment 30 that is different from the first virtual environment 10 and the second virtual environment 20. Here, updating includes the initial acquisition of a key. An example of a key is a common key. By placing the key server 31 outside the first virtual environment 10, the key server 31 and the key acquisition unit 11 can be operated separately.

[0022] [[Authentication Unit 112]] The authentication unit 112 performs authentication with an authentication unit 212 located in a second virtual environment 20 different from the first virtual environment 10. Communication between the authentication unit 112 and the authentication unit 212 is performed via a network to be encrypted or via a different network, and mutual authentication is performed. For example, TLS (Transport Layer Security) for IP (Internet Protocol) communication is used, and mTLS is used for mutual authentication. Communication methods and authentication methods that can achieve equivalent security functions may also be used.

[0023] [[Validity Verification Unit 113]] After authentication is complete, the validity verification unit 113 verifies the validity of information used for encrypted communication between the communication unit 12 located in the first virtual environment 10 and the communication unit 22 located in the second virtual environment 20. Communication between the validity verification unit 113 and the validity verification unit 213 is performed via the network to be encrypted or via a different network.

[0024] The validity confirmation unit 113 obtains information on the IPsec device or MACsec device to be encrypted, the IP address of the communication device 2 in the case of an IPsec device, or the MAC address of the network interface of the communication device 2 in the case of a MACsec device, from information set by the administrator or from the management server that manages the container. The validity confirmation unit 113 holds information for identifying this setting information and confirms the consistency of the setting information between the overall management unit 23.

[0025] For example, the validity confirmation unit 113 obtains the corresponding IP address or MAC address that has been specified in advance based on the setting information, and information on the target IPsec device or MACsec device that is currently running from the corresponding overall management unit 23, and verifies whether the administrator's settings are correct.

[0026] [Supervisory Management Unit 13] The supervisory management unit 13 manages the states of the key acquisition unit 11, the communication unit 12, and the encryption switching unit 14, as well as the information held by them, in addition to its own processing, which will be described later. The supervisory management unit 13 controls at least some of the processing performed by the key acquisition unit 11, the communication unit 12, and the encryption switching unit 14.

[0027] The overall management unit 13 is located in the first virtual environment 10 and manages at least the key (first key) set by the communication unit 12 for current communication and the key (second key) to be used by the communication unit 12 after the first key. The overall management unit 13 may also manage the key (third key) to be used after the second key and the key (fourth key) to be used after the third key. Communication between the overall management unit 13 and the overall management unit 23 is performed via the network to be encrypted or via a different network.

[0028] The overall management unit 13 transmits and receives key update information and key switching information to and from the overall management unit 23, and updates the encryption key settings of the communication unit 12 in the communication device 1. The overall management unit 13 also holds and manages the key synchronization status and key update status.

[0029] The overall management unit 13 manages encryption and decryption in addition to key management. The overall management unit 13 instructs the encryption switching unit 14 to switch the type of communication so that the communication unit 12 performs either encrypted communication or unencrypted communication.

[0030] The overall management unit 13 receives instructions from a management function of a higher network layer that performs socket communication using, for example, an IPsec device, or a management function of a higher network layer that performs IP communication using a MACsec device, checks consistency with the key update status, and causes the encryption switching unit 14 to perform encryption / decryption switching processing.

[0031] After the key acquisition unit 11 acquires the key, the overall management unit 13 performs appropriate processing such as updating the key, synchronizing the key, and other processing when the communication device 1 is started or stopped, as well as when the communication device 1 is stopped during key synchronization or subsequently restarted.

[0032] When device information is updated or added, the central management unit 13 notifies the central management unit 23, and the respective units update their own device information.

[0033] [Encryption switching unit 14] The encryption switching unit 14 is placed in the first virtual environment 10 and switches the type of communication based on instructions from the overall management unit 13 so as to perform either encrypted communication using, for example, a first key or a second key managed by the overall management unit 13, or unencrypted communication without using a key.

[0034] [Communication Unit 12] The communication unit 12 is arranged in the first virtual environment 10 and is capable of communicating with a communication unit 22 arranged in a second virtual environment 20 different from the first virtual environment 10. The communication unit 12 performs encrypted or unencrypted communication with the communication unit 22 arranged in the second virtual environment 20 according to the settings made by the overall management unit 13 and the encryption switching unit 14. In the case of encrypted communication, the communication unit 12 performs encrypted communication using a key designated by the overall management unit 13. When performing data communication through encrypted communication, the communication unit 12 performs data communication by adding information about a plane number (described below) corresponding to the first key to the data to be transmitted. The encrypted communication is performed, for example, at the data link layer. The encrypted communication may also be performed at at least one layer other than the data link layer.

[0035] [Key Server 31] The key server 31 has a function of transmitting (issuing) keys to corresponding clients. The key server 31 in the example of FIG.

[0036] 1 has the same functions as the key server 31. In communication between the key servers 31 and 41, keys are shared over a secure communication channel that allows authentication between the key servers. Key sharing between the key servers may be a key sharing method using public key cryptography, a key sharing method using quantum key distribution (QKD), or a combination of these methods.

[0037] In order to identify the shared key, the key servers 31 and 41 hold an ID that identifies the actual key and the key, and in response to a key request from each client, communication device 1 or communication device 2, return the key ID and key to the client that shared the key.

[0038] Here, the sharing source client is, for example, communication device 1 in relation to key server 31. Communication device 1, which is the client, notifies a counterpart client (opposing host) such as communication device 2 of a key ID. Communication device 2, which is the counterpart client, uses the received key ID to make a key request to its counterpart key server, such as key server 41, and obtains the corresponding key, thereby obtaining the same key as the key held by the source client, such as communication device 1.

[0039] <Communication Method> The communication method of the communication device 1 is realized, for example, by each component of the communication device 1 performing the processes of steps S1 to S2 shown in Fig. 2. That is, the communication device 1 performs key acquisition, authentication, validity confirmation, key synchronization, encryption / decryption switching, and other processes using the key acquisition unit 11, the overall management unit 13, and the encryption switching unit 14 (step S1), and the communication unit 12 communicates using the contents set in the communication unit 12 by the overall management unit 13 and the encryption switching unit 14 (step S2).

[0040] 3 and 4 are diagrams showing an example of a processing procedure for a key update and synchronization method. The overall management unit 13 controls key updates within the communication device 1, as well as key synchronization with the key server 31 and the communication device 2. For example, if the communication device 1 is the data sender and the communication device 2 is the data receiver, each component performs the following processing under a key update instruction from the overall management unit 13.

[0041] The key acquisition unit 11 performs the processes of steps S101 to S112, which will be described later.

[0042] In step S101, the acquisition unit 111 requests the key server 31 to update the key.

[0043] In step S102, the key server 31 that has received the request for key update shares the key with the key server 41 located in the fourth virtual environment 40, which is different from the first virtual environment 10, the second virtual environment 20, and the third virtual environment 30. As a result, the key and the key ID are shared.

[0044] In step S103, the key server 31 transmits the key shared with the key server 41 and its key ID to the key acquisition unit 11. The key ID is identification information for identifying the key. For example, in this manner, the key acquisition unit 11 acquires the key from the key server 31.

[0045] It is assumed that the key server 31 exchanges keys with the key server 41 using, for example, a Key Encapsulation Mechanism (KEM), and that there is a correspondence between the common key and the key ID.

[0046] In step S104, the authentication unit 112 performs authentication with an authentication unit disposed in a second virtual environment 20 different from the first virtual environment 10. In this example, the authentication unit disposed in the second virtual environment 20 different from the first virtual environment 10 is the authentication unit 212 of the key acquisition unit 21 of the communication device 2. The authentication unit 112 performs mutual authentication using, for example, TLS.

[0047] In addition, if there is no change in network information (hereinafter also referred to as "NW information") after authentication has been performed once, the authentication unit 112 may simply pass the session information shared the previous time authentication was performed to the authentication unit 212.

[0048] In step S105, after the authentication is confirmed by the validity confirmation unit 113, the overall management unit 13 sends a key update request to the overall management unit 23, along with the key ID corresponding to the set key, the network information, and the face number of the key to be updated (described later).

[0049] In step S106, the validity verification unit 113 verifies the validity of the information for encrypted communication between the communication unit 12 located in the first virtual environment 10 and the communication unit 22 located in the second virtual environment 20 based on the received information.

[0050] If a predetermined time has not elapsed since the previous validity confirmation, the validity confirmation unit 113 may not perform the process of step S105, but may simply treat the NW information received from the validity confirmation unit 213 at the time of the previous validity confirmation as session information and pass the session information and the key ID to the validity confirmation unit 213. In other words, only if a predetermined time has elapsed since the previous validity confirmation, the validity confirmation unit 113 may perform the NW information sharing process again together with the notification of the key ID in the process of step S105.

[0051] An example of information for encrypted communication between the communication unit 12 arranged in the first virtual environment 10 and the communication unit 22 arranged in the second virtual environment 20 is network information. The network information is information for identifying the communication unit 12 and the communication unit 22. An example of the network information is the MAC (Media Access Control) address or IP address of the communication unit 12 and the communication unit 22.

[0052] The validity confirmation unit 213 confirms the validity by determining whether the NW information it possesses is identical to the NW information received from the validity confirmation unit 113 (step S106). If the NW information it possesses is identical to the NW information received from the validity confirmation unit 113, the NW information is deemed to be valid.

[0053] In step S107, after the authenticity is confirmed, the acquisition unit 211 transmits the key ID and requests the key from the key server 41.

[0054] In step S108, the key server 41 transmits the key corresponding to the received key ID to the key acquisition unit 21.

[0055] In step S109, the key acquisition unit 21 stores the received key in its own storage area or in an area that can be managed by the central management unit 23, according to the face number of the key received in step S105. The storage method will be described later.

[0056] In step S110, the validity confirmation unit 213 transmits a receipt notification of the key ID and its own NW information to the validity confirmation unit 113.

[0057] In step S111, the validity confirmation unit 113 confirms validity by determining whether the NW information it possesses is identical to the NW information received from the validity confirmation unit 213. If the NW information it possesses and the NW information received from the validity confirmation unit 213 are identical, the NW information is deemed to be valid.

[0058] In step S112, after the authenticity is confirmed in step S111, the key acquisition unit 11 stores the received key in its own memory area or in an area that can be managed by the overall management unit 13, according to the face number of the key notified in step S105.

[0059] The key acquisition unit 11 holds at least two planes of keys for key update, for example, and rotates them. That is, in this case, the key acquisition unit 11 of the communication device 1, which is the sending device, stores (sets) a key based on the key and key ID acquired from the key server 31 in an area (different plane) different from the area (plane) that holds the key currently used for encryption. That is, the second key is stored in a plane different from the first key.

[0060] As described above, when the key acquisition unit 11 requests a key update from the communication device 2, which is the communication partner, the key acquisition unit 11 notifies the communication device 2 of the key ID of the second key and the plane number indicating the storage area for the second key. When a key update is requested from the communication partner (communication device 2), the key acquisition unit 11 acquires the key corresponding to the notified key ID and stores the acquired key in the area corresponding to the notified plane number.

[0061] FIG. 6 is a diagram illustrating an example of key configuration. Here, MACsec is used as an example. Using the key currently being used for encryption as a reference, the key (encodingSA) to be used next for encryption is AN (Association Number) = 1, and "keyValue1" is set as the SAK (Security Association Key) for AN=1. AN=1 is notified from communication device 1 to communication device 2 as the SA (Secure Association). The AN is set in the SecTAG (MAC Security tag) format, which is added before the Secure Data (user data) in the encrypted frame format shown in FIG. 6. AN=1 is set in this AN. In other words, encrypted communication data propagates information identifying the number of the key storage plane. While MACsec corresponds to the AN, in the case of IPsec, information equivalent to the SPI is included in the encrypted communication data. While the information identifying the correspondence with the key storage plane corresponds to the AN in MACsec, in the case of IPsec, it corresponds to the SPI (Security Parameter Index). By including this information in the encrypted communication data, it is possible to ensure that the same key is used on the sending and receiving sides.

[0062] In the example shown in Figure 6, multiple SAs (Secure Associations) / SAKs within an SC (Secure Channel) are set in advance on the transmitting and receiving sides. Each time a frame is transmitted, the next PN is counted up, and when the upper limit is exceeded, the AN is switched. By setting the AN / SCI used in the SecTAG on the transmitting side, the receiving side can know the SAK used on the transmitting side even if the AN is switched.

[0063] As mentioned above, in the case of MACsec as an example, it is associated with the SA number, but in the case of IPSec, for example, it may be associated with the SPI (Security Parameter Index). The sending and receiving sides store multiple pieces of key identification information that correspond to the SPI and SA, and associate them with the key face numbers.

[0064] In step S113, the supervisory management unit 13 transmits a key switching synchronization notification to the supervisory management unit 23.

[0065] In step S114, after transmitting the key switching notification, the integrated management unit 13 sets the information and key corresponding to the communication unit 22 in the NW information in the communication unit 12. If the NW information is the MAC addresses of the communication unit 12 and the communication unit 22, the information corresponding to the communication unit 22 in the NW information is the MAC address of the communication unit 22.

[0066] In step S115, after transmitting the key switching notification, the integrated management unit 23 sets the information and key corresponding to the communication unit 12 in the NW information in the communication unit 22. If the NW information includes MAC addresses of the communication unit 12 and the communication unit 22, the information corresponding to the communication unit 12 in the NW information is the MAC address of the communication unit 12. Note that the processing of steps S114 and S115 does not matter in which order, and may be performed in parallel, for example.

[0067] In step S116, the encryption switching unit 24 enables the communication unit 22. The communication unit 22 is set to enable encrypted communication. This enables encrypted communication using the communication unit 22.

[0068] In step S117, the central management unit 23 transmits a validation notification to the central management unit 13 to notify the central management unit 13 that validation has been performed.

[0069] In step S118, the encryption switching unit 14 enables the communication unit 12. The communication unit 12 is set to enable encrypted communication. This enables encrypted communication using the communication unit 12.

[0070] In this way, to ensure that encrypted communication can be carried out reliably, the setting from disabled to enabled is carried out first on the receiving side that receives the encrypted communication. After the receiving side has been enabled, encryption on the sending side is set to enabled.

[0071] If an event requiring the suspension of the encryption function (V1 in FIG. 4) occurs between communication device 1 and communication device 2, the encryption function is disabled first on the transmitting side. That is, as shown in step S119 in FIG. 4, when the V1 event occurs, the overall management unit 13 of communication device 1, which is the transmitting side, causes the encryption switching unit 14 to switch from enabled to disabled.

[0072] In step S120, the central management unit 13 transmits an invalidation notification to the central management unit 23.

[0073] In step S121, when the overall management unit 23 receives the disablement notification, it causes the encryption switching unit 24 to switch from enabled to disabled, and the encryption switching unit 24 is set to switch from encrypted communication to unencrypted communication.

[0074] In this way, the deactivation is performed on the sending side of the encrypted communication first, so that the encrypted communication that has been going on up until that point can be received reliably to the end. After the deactivation on the sending side is completed, encryption on the receiving side is set to be disabled.

[0075] <Initial Settings> Fig. 5 is a diagram showing an example of a processing procedure associated with startup. When the communication device 1 starts up (V2), as shown in step S201, the communication device 1 performs initial settings. The initial settings are set in the communication unit 12 based on information held by the overall management unit 13. The same is true for the communication device 2. That is, when the communication device 2 starts up (V3), as shown in step S202, the communication device 2 performs initial settings. The initial settings are set in the communication unit 22 based on information held by the overall management unit 23.

[0076] <Processing Associated with Shutdown and Restart of Communication Devices During Key Synchronization Period> Assume that key synchronization is updated between communication device 1 and communication device 2 after steps S201 and S202 in Fig. 5 (V4). Assume that communication device 2 shuts down during this key synchronization period, and then restarts (V5). When this event V5 occurs, communication device 1 performs, for example, the following process.

[0077] In step S301, the central management unit 23 requests the central management unit 13 for network information and synchronization status information.

[0078] In step S302, the central management unit 13 transmits its own NW information and synchronization status information to the central management unit 23.

[0079] In step S303, the central management unit 23 sets the information and key corresponding to the communication unit 12 of the NW information in the communication unit 22, similarly to step S115.

[0080] By the processing of steps S301 to S303, the synchronous update of the key is resumed (V6).

[0081] According to the above embodiment, synchronization and key update of encryption keys of encryption communication devices, and switching between encryption and non-encryption by the encryption communication devices can be performed securely and dynamically, without depending on the network configuration.

[0082] The communication device 1 of the embodiment has means for performing authentication between the overall management units 13 and 23, verifying the setting information of the encryption communication device (communication unit 12) to be encrypted with the device actually in operation, confirming (authenticating) the connection with the key server 31, and transmitting the key ID used by both the communication devices 1 and 2, as well as verifying and confirming the cooperation state between the overall management units 13 and 23. Therefore, an encryption communication path can be formed using an appropriate encryption communication device.

[0083] The overall management unit 13 links the key update status management and update function with the encryption / decryption switching function of the encryption communication device (communication unit 12), and the interface that operates this linking function can be controlled from higher-level communication network functions such as the IP layer and socket communication function that use the encryption communication device. This makes it possible to control encryption / decryption without disconnecting sessions in higher layers.

[0084] The key server 31 is configured to be located outside the communication device 1, and is equipped with a function for authenticating connection with the key acquisition unit 11 that acquires keys, and communication between the key servers 31 and 41 is configured to pass through an external network or a network device to be encrypted. This allows for more flexible functional placement than conventional methods that have functional placement restrictions.

[0085] By linking the setting information of the general management unit 13 with the host management function and the container management function, flexible control of the cryptographic communication network becomes possible.

[0086] This method is not limited to IPsec and MACsec, and can also be applied to encrypted communications and data encryption methods using common key cryptography between two parties or between multiple parties.

[0087] As an example of implementing the functional configuration of FIG. 1 , for example, the physical configuration shown in FIG. 7 is considered. FIG. 7 is a diagram showing an example of the physical configuration of a communication device. In FIG. 7 , host A corresponds to communication device 1, host B corresponds to communication device 2, container A corresponds to the first virtual environment 10, container B corresponds to the second virtual environment 20, key server host A corresponds to key server 31, and key server host B corresponds to key server 41. Host A, host B, key server host A, and key server host B are connected to an L2 switch via their respective network interface cards (NICs). Here, the L2 switch may be, for example, a virtual local area network (VLAN) or a virtual eXtensible local area network (VXLAN), or may be an overlay or L2 tunneling switch.

[0088] [Modifications] The specific configurations of the embodiments of the present disclosure are not limited to those described above. The specific configurations of the embodiments of the present disclosure can be appropriately modified in design, etc., without departing from the spirit of the embodiments of the present disclosure.

[0089] 8, the key server 31 may be located in the first virtual environment 10. Similarly, the key server 41 may be located in the second virtual environment 20. Note that the key servers 31 and 41 each have a function of authenticating the key acquisition function of the requestor when a key acquisition request is received.

[0090] Furthermore, the central management unit 13 may have the function of the key server 31. Similarly, the central management unit 23 may have the function of the key server 41.

[0091] That is, instead of using a key server, the central management units may directly use a key sharing method using public key cryptography, a combination of these key sharing methods, or a key obtained from an external key sharing method using QKD, or may be provided with a function to combine multiple key sharing methods. The key servers 31 and 41 may be configured as an integrated unit and may be provided with a function to generate a common key using a random number generation function or, in addition, a key derivation function, to present the common key and a key ID corresponding to the common key to the key acquisition unit 11 of the first virtual environment 10, and to present the key corresponding to the key ID when a key acquisition request specifying the key ID is received from the key acquisition unit 21 of the second virtual environment 20.

[0092] That is, the key server function may be located on the same host as the overall management unit 13, or in a container, or may be located on an external server. When located on an external server, TLS or the like is used between the key acquisition unit 11 and the key server function, and a function capable of encrypting the communication path and mutually authenticating the key server and the key acquisition unit 11 is located.

[0093] Clients corresponding to the MAC addresses or IP addresses of the cryptographic communication devices managed by each key acquisition unit 11 or the general management unit 13 are registered with the key server, and a client certificate, for example, is used to identify and authenticate the client. The client identifier is set in the client certificate. After verifying the client certificate, the key server compares the set identifier and the client identifier specified as the key sharing destination with the registered information, ensuring security by issuing keys only to appropriate clients.

[0094] For example, the key acquisition unit 11 may periodically perform a process of acquiring a key using a method different from the above, and a process of performing authentication with the key acquisition unit 21 located in a second virtual environment 20 different from the first virtual environment 10. For example, the key acquisition unit 11 may periodically perform these processes based on a cryptography (PQC: Post Quantum Cryptography) that cannot be decrypted even by a quantum computer.

[0095] The various processes described in the embodiments of the present disclosure may not only be performed in chronological order according to the order described, but may also be performed in parallel or individually depending on the processing capacity of the device performing the processes or as needed.

[0096] For example, data may be exchanged directly between the components of the communication device, or may be exchanged via a storage unit (not shown).

[0097] [Processor, Program, Recording Medium] The functions performed by the components described herein may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), a CPU (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to perform the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes a program stored in a memory.

[0098] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0099] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0100] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 9, and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0101] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0102] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0103] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the received program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of a server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0104] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. A system including: a first communication unit disposed in a first virtual environment and capable of communicating with a second communication unit disposed in a second virtual environment different from the first virtual environment; a key acquisition unit disposed in the first virtual environment and performing a process of acquiring a key periodically or at random timing; a general management unit disposed in the first virtual environment and managing a first key set by the first communication unit for current communication and a second key to be used by the first communication unit after the first key; and an encryption switching unit disposed in the first virtual environment and switching the type of communication based on an instruction from the general management unit to perform either encrypted communication using the first key or the second key, or unencrypted communication not using a key; wherein the key acquisition unit, when requesting a key update from a communication partner, notifies the communication partner of the key ID of the second key and a plane number indicating a storage area for the second key, and, when a key update is requested by the communication partner, acquires a key corresponding to the notified key ID and stores the acquired key in an area corresponding to the notified plane number; A communication device wherein the first communication unit, when performing data communication using encrypted communication, adds information on a plane number corresponding to the first key to the data to be transmitted and performs the data communication.

2. The communication device according to claim 1, wherein the key acquisition unit acquires the first key and the second key from a key server located in a third virtual environment different from the first virtual environment and the second virtual environment.

3. The communication device according to claim 1, wherein the second key managed by the key acquisition unit is stored in an area different from an area in which the first key is stored.

4. A communication method performed by a communication device, wherein a first communication unit of the communication device located in a first virtual environment is capable of communicating with a second communication unit located in a second virtual environment different from the first virtual environment; a key acquisition unit of the communication device located in the first virtual environment periodically or at random times performs a process of acquiring a key; a supervising management unit of the communication device located in the first virtual environment manages a first key set by the first communication unit for current communication and a second key to be used by the first communication unit after the first key; and an encryption switching unit of the communication device located in the first virtual environment switches the type of communication based on an instruction from the supervising management unit to perform either encrypted communication using the first key or the second key, or unencrypted communication without using a key, a communication method in which, when requesting a key update from a communication partner, the key acquisition unit notifies the communication partner of the key ID of the second key and a plane number indicating a storage area for the second key, and when a key update is requested from the communication partner, the key acquisition unit acquires a key corresponding to the notified key ID and stores the acquired key in an area corresponding to the notified plane number; and when performing data communication by encrypted communication, the first communication unit adds information on the plane number corresponding to the first key to data to be transmitted and performs the data communication.

Images