IPsec communication method, communication control apparatus, and network camera

• US 20060031922A1
• Filed: 03/09/2005
• Published: 02/09/2006
• Est. Priority Date: 08/04/2004
• Status: Active Grant

• Current Assignee: Panasonic Corporation (Panasonic Holdings Corporation)
• Original Assignee: Matsushita Electric Industrial Company Limited (Panasonic Holdings Corporation)
• Inventors: Sakai, Junichi
• Granted Patent: US 7,526,641 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

When a packet arrives from a communication terminal apparatus, i.e., a communicating terminal with which the IPsec communication is performed, a source IP address is recognized from an IP header of the packet and a security policy is registered in an SPD. At the same time, an encoding parameter for the encoded communication with the communicating terminal is registered in an SAD. When an SA entry is deleted from the SAD, the security policy for the communicating terminal is deleted from the SPD, as long as there is no other entry that is referring to the security policy corresponding to the deleted SA entry.

Claims

1. A communication control apparatus comprising:

a security policy database that stores a security policy for each communicating terminal with which an encoded communication is performed;

a security association database that stores an entry including an encoding parameter for each communicating terminal;

a storage unit that stores a security policy in said security policy database using a source IP address of a reception packet; and

a policy deletion unit that determines, when an entry for a communicating terminal is deleted from said security association database, whether a security policy for the communicating terminal is effective and deletes the security policy when the security policy is determined not to be effective.

2. The communication control apparatus according to claim 1, wherein, when an entry is deleted from said security association database, said policy deletion unit deletes, from said security policy database, a security policy corresponding to the entry as long as there is no other entry referring to the security policy.

3. The communication control apparatus according to claim 1, wherein, when an entry is deleted from said security association database, said policy deletion unit sets a time limit in a lifetime included in a security policy, the security policy corresponding to the entry, decreases the time limit as time passes as long as there is no other entry referring to the security policy, and deletes a security policy from said security policy database when the lifetime becomes 0.

4. The communication control apparatus according to claim 3, wherein, when an entry is deleted from said security association database and another entry is referring to a security policy corresponding to the deleted entry, said policy deletion unit sets the lifetime to infinity.

8. A network camera comprising:

an image capturer that inputs an image;

a transmitter that converts the image into an IP packet and transmits the packet to a network; and

the communication control apparatus according to claim 1,

wherein, the image is transmitted to a communicating terminal as encoded communication performed by said communication control apparatus.

5. An IPsec communication method that performs IPsec communication using a security policy database and a security association database, the security policy database storing a security policy for each communicating terminal with which an encoded communication is performed, the security association database storing an entry including an encoding parameter for each communicating terminal, the method comprising:

storing a security policy in the security policy database using a source IP address of a reception packet;

determining, when an entry for a communicating terminal is deleted from the security association database, whether a security policy for the communicating terminal is effective; and

;

deleting the security policy when the security policy is determined not to be effective.

6. The IPsec communication method according to claim 5 further comprising:

deleting, when an entry is deleted from the security association database, a security policy corresponding to the entry from the security policy database as long as there is no other entry referring to the security policy.

7. The IPsec communication method according to claim 5, further comprising:

setting, when an entry is deleted from said security association database, a time limit in a lifetime included in a security policy, the security policy corresponding to the entry;

decreasing the time limit as time passes as long as there is no other entry referring to the security policy; and

deleting the security policy from said security policy database when the lifetime becomes 0.