JPH0897860A - Method for exchanging route information of inter-network relay device - Google Patents

Abstract

(57) [Summary] [Purpose] To realize a route information concealment exchange method that can ensure higher security than before. Configuration: The route information transmission processing means S11 to S14 encrypts the route information for a network whose presence is to be concealed / disclosed, which is selected and designated by the user from the route information table, and is directly connected to an adjacent inter-network relay device. To send in broadcast mode. The route information reception / registration / update processing steps S21 to S28 are decrypted with / without encryption of the route information frame received from another inter-network relay device / as it is, and if it is not registered in the route information table. It is registered, and if registered, it is updated according to the distance to the destination. The route information retransmission processing procedure S29, S30, S12, S13, or S14 performs encryption if the network attribute is "hidden" with respect to the relevant route information in the route information table to be searched, and if it is "open", it is immediately adjacent. The transmission of the route information is repeated to the inter-network relay device.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a route information exchange method for security management of an inter-network relay device which interconnects networks and has a routing (communication route selection) function.

[0002]

2. Description of the Related Art For example, a document (ASCII Corporation: UNI)
X MAGAEINE 1993, 08901-
As shown in FIG. 10, the method of exchanging route information of the inter-network relay device of the conventional example shown in 3) is such that the public network 14 and the LANs 15a, 16 and 17a, 18 and 19 which disclose route information to the outside are interconnected. The inter-network relay devices (routers) A11a, B12a, and C13 of FIG. 11 that hold the information table first send route information (network information of the routing protocol) to each other in the broadcast (broadcast communication) mode (procedure of FIG. 10). S13a). Next, if the route information frame received from the adjacent inter-network relay device is not registered, it is registered in the route information table of the router C13, for example. If registered, the distance to the destination is checked and compared with the number of hops in the route information table (the number of routers relaying for communication). If the number of hops is large, the route information frame is discarded, and if it is small, it is adopted and the route information table is updated (the above steps S21 and S24 to S2 in FIG. 10).
8). Further, the transmission of the route information is repeated to the adjacent inter-network relay device (step S13a in FIG. 10).

The conventional route information exchange method for the inter-network relay device employs a system (route information disclosure exchange system) for exchanging the route information of the connected networks without hiding all the route information.

The progress of client-server type network computing due to downsizing of computer systems (transition to small-sized machines) largely depends on internetworking (inter-network interconnection) by multi-protocol routers. The inter-network relay devices 11a, 12a and 13 construct a wide area network as shown in FIG. It has a routing function that mutually sends route information about how to connect each network and through which network the target network can be reached, and selects an optimal communication route. When using the Internet Protocol (IP), the Routing Information Protocol (RIP) is used.
Ion Protocol) and open path length order protocol (OSPF: Open Shortest-Path)
Route information is exchanged according to the routing protocol of First). Also, in order to relay data to the network to which the destination terminal belongs, the "end point network number", "next hop router" (the next relay router), and "hop count" (a distance measure as a routing unit). It holds a route information table for each destination network, which is made up of the respective entries. An example of the router C is shown in FIG.

[0005]

In the conventional route information exchanging method for the inter-network relay device as described above, a method of exchanging all the route information of the networks to be connected without concealing each other is adopted. There are problems that the route information is transmitted even when communication is not required, and the information and existence of the network is transmitted to a malicious user who has unauthorized access.

The problem to be solved by the present invention is to conceal only the information selected and designated by the user out of the route information of the network to be connected in order to secure a higher degree of security in the route information exchange method of the inter-network relay device. It is to provide a method for exchanging with each other (route information concealment exchange method).

[0007]

In order to solve the above-mentioned problems, a method for exchanging route information of an inter-network relay device according to the present invention is to connect a plurality of networks to each other and hold route information tables. The exchange method is characterized in that the following procedure is provided and the route information concealment exchange method is adopted.

In the first procedure, the user selects and specifies the route information of the network whose existence is to be hidden from the route information table.

The second procedure is to first transmit a broadcast frame inquiring to the inter-network relay device adjacent to the inter-network relay device or to the inter-network relay device adjacent to the inter-network relay device, and respond to the inquiry frame. The data unit field of the broadcast or unicast frame formed from the designated route information is encrypted and transmitted to the inter-network relay device that returns the frame. Alternatively, an inquiry / response frame authentication procedure is provided. Or encrypt the inquiry / response frame. Alternatively, not only the corresponding data part field of the broadcast or unicast frame but also the corresponding header part field is encrypted.

The third procedure is to decode and analyze the designated route information of the frame received from another adjacent inter-network relay device, and register and update it in the route information table.

In the fourth procedure, the second procedure is repeated for the designated route information from the registered / updated route information table.

[0012]

According to the method for exchanging the route information of the inter-network relay device of the present invention, the route information of the network in which the user wants to hide the existence is first selected from the route information table and designated.
First, a broadcast (broadcast communication) frame for inquiring whether or not the adjacent inter-network relay device or the adjacent inter-network relay device has a cryptographic decryption procedure is transmitted,
The data section field of the broadcast or unicast (single-shot communication) frame formed from the designated route information is encrypted and transmitted to the inter-network relay device that returns a frame responding to the inquiry frame (above route information transmission processing procedure) . Next, the designated route information of the frame received from another adjacent inter-network relay device is decoded and analyzed, and is registered and updated in the route information table (above route information reception /
Registration / update procedure). Further, the above transmission processing procedure is repeated for the designated route information from the registered / updated route information table (above route information retransmission processing procedure). Alternatively, an authentication procedure is provided for the inquiry / response frame or encryption is performed. Alternatively, not only the corresponding data part field of the broadcast or unicast frame but also the corresponding header part field is encrypted.

[0013]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS As shown in FIGS. 1 and 2, a method for exchanging route information in an inter-network relay device according to an embodiment of the present invention is shown in FIG. 1 and FIG. , 18 and 19 are interconnected and the route information table is held by the inter-network relay devices (routers) A11 and B12 (having a decoding procedure) and C13 (having no decoding procedure). LANs 15 and 17 (network number 128.
1.0.0 and 128.3.0.0) are selected and specified.
The router A11 encrypts the route information of the hidden network and broadcasts it to adjacent routers (broadcast communication).
Send in mode. The LAN 16 (network number 128.2.
The route information of (0.0) is transmitted to the adjacent router as it is (the above is the route information transmission processing steps S11 to S1 of FIG. 1).
4). Next, the route information frame received by the router B12 is directly decrypted if it is not encrypted and decrypted if it is encrypted. If not registered, it is registered in the route information table of the router B12, and if registered, the distance to the destination is checked and compared with the number of hops in the route information table.
If the number of hops is large, the route information frame is discarded,
If it is smaller, it is adopted and the route information table is updated (above, route information reception / registration / update processing steps S21 to S in FIG. 1).
28). Further, the route information table is searched. If the network attribute of the route information is "conceal", it is encrypted, and if it is "public", the route information is repeatedly transmitted to the adjacent router (the route information retransmission processing procedure S29 of FIG. S30, S12, S13 or S
14). Further, with respect to the route information frame received by the router C13, only the unencrypted route information frame is recognized, and the process is performed in the same procedure as in the conventional example shown in FIG. 10 (the above steps S21, S22a, and S24- S28 and S1
3a).

The route information exchanging method of the inter-network relay device of the above embodiment is a method of concealing only the information selected and designated by the user out of the route information of the network to be connected and exchanging with each other (route information concealment exchange method). Take.

As shown in FIG. 3, the encryption procedure S12 of the route information transmission processing procedure is the destination address (DA) and the source address (S) of the medium access control (MAC) header section.
A) Only the data portion of the route information frame format including the type portion indicating the frame type, the internet protocol (IP) header portion, the data portion, and the cyclic redundancy code (CRC) portion is encrypted. It goes without saying that not only the data section but also the header section (MAC header section, type section, IP header section) may be encrypted. Further higher security can be secured.

The inter-network relay devices 11 to 13 are as shown in FIG.
Build a wide area network. Similar to FIG. 11 of the conventional example, route information is mutually transmitted, has a routing function, and exchanges route information according to a routing protocol. It also holds a route information table for each destination network. In the example of the router B, the attribute at the time of registering the route information frame from the adjacent router is set to "conceal" at the time of encrypted transmission and "public" at the time of the transmission as it is. In the example of the router C, the route information of the public LANs 16, 18, and 19 can be obtained,
This indicates that the route information of the hidden LANs 15 and 17 cannot be recognized.

In the above embodiment, as shown in FIGS. 5 and 6, a response frame indicating the presence / absence of the decoding procedure may be returned to the received inquiry frame. In FIG. 5, the route information transmission processing procedures S11, S12, and S14 correspond to those in FIG.
In step S11a, inquiry identification information as to whether or not an adjacent inter-network relay device has an encryption decryption procedure is set in the data section. The inquiry frame of FIG. 7A is transmitted in the broadcast mode. In step S13b, the encrypted route information is transmitted in the unicast (single-shot communication) mode to the inter-network relay device having the inquiry response transmission source address.
The route information reception / registration / update processing procedures S21 to S28 are
It corresponds to FIG. Steps S21a and S21b are the response frame shown in FIG. 8A for setting, in the data section, the response identification information as to whether or not the received inquiry frame has an encryption decryption procedure, as well as the source address and the presence or absence of the decryption procedure. return. Processing procedures S21 to S28 that do not have a decryption procedure in FIG.
And S13a correspond to FIG. Step S21a is shown in FIG.
Corresponding to. In step S21c, the response cannot be returned and the inquiry frame to be received is discarded.

It is needless to say that each field of the header part and the data part may be encrypted and transmitted in the inquiry frame and the response frame of the above embodiment.
Further higher security can be secured.

Further, in the above embodiment, as shown in FIG. 9, the password included in the data part of the received inquiry frame and the response frame is compared with the password of the sender address which is held in advance, and if they match, it is correct for the inquiry and the response. You may recognize. Further higher security can be secured. In FIG. 9, the route information transmission processing steps S11 and S11a
And S12, S13b, and S14 correspond to FIG. In steps S11b and S11c, as shown in FIG. 8B, the password included in the data part of the received response frame is compared with the password of the transmission source address held in advance, and if they match, the response is recognized as correct. If they do not match, the response is regarded as invalid and the response frame is discarded. Route information reception / registration /
The update processing procedures S21a, S21b, and S21 to S28 are
It corresponds to FIG. Steps S21d and S21e are shown in FIG.
As shown in (b), the password included in the data part of the received inquiry frame is compared with the password of the transmission source address held in advance, and if they match, the inquiry is recognized as correct. If they do not match, the inquiry is regarded as invalid and the inquiry frame is discarded.

In the above embodiment, the industry standard multi-vendor
The case of the protocol IP has been described, but the same applies to the international standard protocol OSI and the like.

[0021]

As described above, the method of exchanging route information for the inter-network relay device of the present invention employs a method of concealing only the information selected and designated by the user out of the route information of the network to be exchanged with each other. As compared with the conventional route information disclosure exchange method, it is possible to prevent unnecessary disclosure of route information and unauthorized access by the user, and it is possible to ensure higher security.

[Brief description of drawings]

FIG. 1 is a flow chart of a route information exchange method of an inter-network relay device (when a decoding procedure is provided) according to an embodiment of the present invention.

FIG. 2 is a flow chart of a route information exchanging method of an inter-network relay device (when there is no decoding procedure) of an embodiment showing the present invention.

FIG. 3 is a diagram illustrating a route information frame format.

FIG. 4 is a diagram illustrating an internetwork system configuration diagram and a route information table of an inter-network relay device according to an embodiment.

FIG. 5 is a flowchart of another embodiment (when a decoding procedure is provided) showing the present invention.

FIG. 6 is a flowchart of another embodiment (when there is no decoding procedure) showing the present invention.

FIG. 7 is a diagram illustrating an inquiry frame format.

FIG. 8 is a diagram illustrating a response frame format.

FIG. 9 is a flowchart of another embodiment (when a decoding procedure is provided) showing the present invention.

FIG. 10 is a flowchart of a route information exchange method of an inter-network relay device of a conventional example.

FIG. 11 is a diagram illustrating a conventional internetwork system configuration diagram and a route information table of an inter-network relay device.

[Explanation of symbols]

11, 12, 13 Inter-network relay device, 14 Public network, 1
5,16,17,18,19 LAN. In the drawings, the same reference numerals indicate the same or corresponding parts.

─────────────────────────────────────────────────── ─── Continuation of the front page (51) Int.Cl. ⁶ Identification code Internal reference number FI Technical indication location H04L 9/00 9/10 9/12 12/46 12/28 H04L 11/00 310 C (72) Inventor Naonobu Okazaki 5-1-1, Ofuna, Kamakura-shi, Communication Systems Research Laboratory, Mitsubishi Electric Corporation (72) Inventor, Yasuhisa Tokiba 5-1-1, Ofuna, Kamakura-shi, Communication Systems Research Institute (72) Inventor Akira Watanabe 5-1-1 Ofuna, Kamakura-shi Mitsubishi Electric Corp. Communication Systems Research Laboratories

Claims (7)

[Claims] 1. A method for exchanging route information of an inter-network relay device, which interconnects a plurality of networks and holds a route information table, wherein route information of a network in which a user wants to hide its presence is selected and designated from the route information table. 1
And a second procedure of encrypting and transmitting the data part field of the broadcast frame formed from the designated route information to the adjacent inter-network relay device,
A third procedure of decoding and analyzing the designated route information of a frame received from another adjacent inter-network relay device, registering and updating in the route information table, and the designated route information from the registered / updated route information table. And a fourth procedure for repeating the second procedure. 2. The inter-network relay device, which first transmits a broadcast frame for inquiring whether or not the adjacent inter-network relay device has a cryptographic decryption procedure in the second procedure, and returns a frame responding to the inquiry frame. On the other hand, the route information exchange method of the inter-network relay device according to claim 1, wherein the data part field of the unicast frame formed from the designated route information is encrypted and transmitted. 3. The route information exchange procedure of the inter-network relay device according to claim 2, wherein an inquiry frame authentication procedure is provided in the second procedure. 4. The method of exchanging route information for an inter-network relay device according to claim 2, wherein a response frame authentication procedure is provided in the second procedure. 5. The route information exchanging method for an inter-network relay device according to claim 2, 3 or 4, wherein the inquiry frame is encrypted in the second procedure. 6. The method for exchanging route information of an inter-network relay device according to claim 2, 3, 4 or 5, wherein the response frame is encrypted in the second procedure. 7. The method according to claim 1, wherein not only the data part field of the broadcast or unicast frame formed from the designated route information in the second procedure but also the header part field is encrypted. , 4,
5. A method of exchanging route information of an inter-network relay device according to 5 or 6.