Patent Application
20090164617
This application claims the benefit of priority based on Taiwan Patent Application No. 096149912 filed on Dec. 25, 2007, of which the contents are incorporated herein by reference in its entirety.
Not applicable.
1. Field of the Invention
The present invention relates to a network apparatus having a database, a management method and a tangible machine-readable medium for managing internet protocol (IP) connection rules of the database; more specifically, relates to a network apparatus, a management method, and a tangible machine-readable medium for avoiding conflicts between IP connection rules.
2. Descriptions of the Related Art
In recent years, with widespread use of the Internet, network security has come up as an increasingly important issue, and accordingly, pertinent solutions have become a hot topic of great concern. Internet protocol security (IPSec) is just among one of the security specifications proposed for IP.
The IPsec mainly serves dual functions: an authentication function and an encryption function. The authentication function means that when a connection is made to the Internet, identities of both parties involved in a communication session are authenticated to protect the transmission data from damage or tampering by a third party The encryption function means that data transmission between both parties is encrypted to prevent a third party from intercepting the data and having a direct access to content thereof. A core component of the IPsec is an encryption algorithm. Once a user establishes a network connection with a server, both parties will initially have to determine an IP connection rule for encryption and decryption, for example, to adopt an advanced encryption standard (AES) algorithm or a data encryption standard (DES) algorithm for encryption of data. The IP connection rule agreed by both parties is stored into a database of the user and a database of the server individually; in other words, the agreed encryption algorithm is stored in a security association database (SADB) and a security policy database (SPDB). Then, when data transmission between the user and the server is desired, the transmitter may use the agreed IP connection rule to encrypt data to be transmitted, while the receiver may use corresponding IP connection rule for decryption to obtain the data.
In conventional methods, there exists only one management program in a single system for managing the IPsec, e.g., a management program known as the Internet Key Exchange (IKE), so the management program has direct access to the database. However, recently, a new management program for managing the IPsec, which is known as the Internet Key Exchange version 2 (IKEv2), has also been proposed. Under this circumstance, if two different management programs both have a direct access to the database coexist in the single system, it will effect on access to IP connection rules.
Specifically, as shown in
Accordingly, it is becoming increasingly important to avoid corruption or loss of data as management programs of different IPsecs write different IP connection rules on the same network connection. In view of this, efforts still have to be made in the network communication industry to provide a solution to manage IP connection rules effectively.
One objective of this invention is to provide a management method for managing IP connection rules of a database, wherein the database is used to store at least one first IP connection rule. The management method comprises the steps of: writing a second IP connection rule through one of a plurality of management programs; determining that a conflict is occurred between the at least one first IP connection rule and the second IP connection rule; and eliminating the conflict according to a first weight value of the at lest one first IP connection rule and a second weight value of the second IP connection rule. The at least one first IP connection rule and the second IP connection rule are used in the same network connection.
Another objective of this invention is to provide a network apparatus having a database, wherein the database is used to store at least one first IP connection rule. The network apparatus comprises a plurality of management units, a conflict determining unit, and a conflict eliminating unit. The conflict determining unit is used to determine that a conflict is occurred between the at least one first IP connection rule and a second IP connection rule when one of the management units writes the second IP connection rule. The conflict eliminating unit is used to eliminate the conflict according to a first weight value of the at least one first IP connection rule and a second weight value of the second IP connection rule. The at least one first IP connection rule and the second connection rule are used in the same network connection.
Yet a further objective of this invention is to provide a tangible machine-readable medium having executable code to cause a network apparatus to perform a management method for managing IP connection rules of a database, wherein the database is used to store at least one first IP connection rule. The management method comprises the steps of: writing a second IP connection rule through one of a plurality of management programs; determining that a conflict is occurred between the at least one first IP connection rule and the second IP connection rule; and eliminating the conflict according to a first weight value of the at lest one first IP connection rule and a second weight value of the second IP connection rule. The at least one first IP connection rule and the second IP connection rule are used in the same network connection.
In summary, the present invention determines whether a conflict occurs due to application of different IP connection rules to a same network connection, and selectively eliminates one of the IP connection rules causing the conflict according to weight values thereof. As a result, potential conflicts between different IP connection rules incurred by more than one IPsec management programs in a single system can be avoided, thereby to maintain quality of the network connection and speed of data transmission.
The detailed technology and preferred embodiments implemented for the subject invention are described in the following paragraphs accompanying the appended drawings for people skilled in this field to well appreciate the features of the claimed invention.
As shown in
Hereinafter, description will be made on how the network apparatus 2 manages IP connection rules of the SADB 211 and the SPDB 213. Initially, it is assumed that the first management unit 201 is ready to write a first IP connection rule (e.g., adopting an AES encryption algorithm for a network connection that is connected with the site 140.92.61.197 and port 23) to the SADB 211 and the SPDB 213. Then the conflict determining unit 205 retrieves all IP connection rules recorded in the ASADB 215 and the ASPDB 217, and detects a conflict by determining whether the first IP connection rule and the recorded IP connection rules are applied to the same network connection but adopt different encryption algorithm. If there exists no conflict between the first IP connection rule and the recorded IP connection rules, the conflict determining unit 205 writes the first IP connection rule into the SADB 211 and the SPDB 213 through the PFkey module 209, and at the same time writes the first IP connection rule into the ASADB 215 and the ASPDB 217.
If subsequently the second management unit 203 attempts to write a second IP connection rule (e.g., adopting a DES encryption algorithm for a network connection that is connected with the site 140.92.61.197 and port 23) into the SADB 211 and the SPDB 213, then as previously described, the conflict determining unit 205 retrieves all IP connection rules recorded in the ASADB 215 and the ASPDB 217. At this point, the ASADB 215 and the ASPDB 217 have 25 already stored the first IP connection rule therein. Then, the conflict determining unit 205 detects a conflict by determining whether the second IP connection rule and the recorded IP connection rules are applied to the same network connection but adopt different encryption algorithm.
In this embodiment, the second IP connection rule (adopting a DES encryption algorithm for a network connection that is connected with the site 140.92.61.197 and port 23) and the previously recorded first IP connection rule (adopting an AES encryption algorithm for the network connection that is connected with the site 140.92.61.197 and port 23) are both applied to the same network connection (connected with the site 140.92.61.197 and port 23), but adopt different encryption algorithms (the DES and the AES encryption algorithms respectively). Therefore, if the second IP connection rule is also written into the SADB 211 and the SPDB 213 through the PFkey module 209, a conflict will occur between the first IP connection rule and the second connection rule.
Once the conflict determining unit 205 determines that a conflict would occur between the first IP connection rule and the second connection rule, the conflict eliminating unit 207 will assign weight values to the first IP connection rule and the second IP connection rule respectively according to a using time and a status thereof, for example, whether it is in use at present. The way to assign weight values will readily occur to those skilled in the art can understand the current IP connection rule architecture, and thus no necessary detail is given.
If the weight value of the first IP connection rule is assigned to be higher than that of the second IP connection rule, which means that the second IP connection rule is less important than the first IP connection rule, the conflict eliminating unit 207 will simply refuse to write the second IP connection rule into the SADB 211 and the SPDB 213, or write the second IP connection rule into the SADB 211 and the SPDB 213 through the PFkey module 209 but cease it.
On the other hand, if the weight value of the first IP connection rule is assigned to be lower than that of the second IP connection rule, which means that the first IP connection rule is less important than the second IP connection rule, the conflict eliminating unit 207 will delete the first IP connection rule stored in the SADB 211 and the SPDB 213 through the PFkey module 209, or cease the first IP connection rule stored in the SADB 211 and the SPDB 213 through the PFkey module 209. Likewise, the conflict eliminating unit 207 will delete or cease the first IP connection rule stored in the ASADB 211 and the ASPDB 213.
The above description on how to avoid or eliminate a conflict between IP connection rules are intended only to illustrate rather than to limit the present invention. The way to delete or cease an IP connection rule will readily occur to those skilled in the art can understand the current IP connection rule architecture, and thus no necessary detail is given.
A second embodiment of the present invention is a management method for managing IP connection rules of a database, which is a method applied to the network apparatus 2 described in the first embodiment. More specifically, the method of the second embodiment which is illustrated in
The following steps will be described to explain the management method for managing IP connection rules of the database. The database includes an SADB and an SPDB, and has already stored at least one first IP connection rule therein. Initially in step 301, a second IP connection rule is written through one of a plurality of management programs. Then in step 303, a conflict determining unit determines whether a conflict occurs between the at least one first IP connection rule and the second IP connection rule. If yes, step 305 is executed, in which a conflict eliminating unit assigns a weight value to the at least one first IP connection rule according to a using time thereof. Next in step 307, a conflict eliminating unit assigns a weight value to the second IP connection rule according to a using time thereof. And in step 309, the conflict is eliminated according to the weight values of the at least one first IP connection rule and the second IP connection rule.
On the other hand, if there is no conflict occurs between the at least one first IP connection rule and the second IP connection rule in step 303, the second IP connection rule is written into the database in step 311.
In addition to the steps revealed in
It follows from the above description that, this invention determines whether a conflict occurs due to application of different IP connection rules to the same network connection, and selectively eliminates one of the IP connection rules causing the conflict according to weight values thereof. This may keep compatibility among contents of the database and enable the network connection to operate properly. As a result, potential conflicts between different IP connection rules incurred by more than one IPsec management programs in a single system can be avoided, thereby to maintain quality of the network connection and speed of data transmission.
The above disclosure is related to the detailed technical contents and inventive features thereof. People skilled in this field may proceed with a variety of modifications and replacements based on the disclosures and suggestions of the invention as described without departing from the characteristics thereof. Nevertheless, although such modifications and replacements are not fully disclosed in the above descriptions, they have substantially been covered in the following claims as appended.
| Number | Date | Country | Kind |
|---|---|---|---|
| 096149912 | Dec 2007 | TW | national |
