Image processing apparatus, communication system, control method thereof, and storage medium

An apparatus connected to a network via a network interface device and capable of executing encrypted communication with an external device on the network requests that a first algorithm to be used in the encrypted communication with the external device is changed to a second algorithm included in the network interface device when the apparatus detects that a condition for shifting to a power saving mode, in which power consumption is smaller than that in a normal power mode, is satisfied while the apparatus is operated in the normal power mode.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to an information processing apparatus, which is connected to a network and can execute encrypted communication with an external device on the network.

2. Description of the Related Art

An information processing system with a power saving mode for suppressing power consumption, when the information processing system in a standby state, has been known. As one example of such the information processing system, there is a communication configured by an information processing apparatus on the main body side including a main central processing unit (CPU) and a network interface card (NIC) apparatus including a sub CPU.

In such the communication system, generally, the information processing apparatus on the main body side is shifted to a power saving mode, and each module on the NIC apparatus side, which is small in electric power consumption, stands by with normal electric power being supplied.

Further, in Japanese Patent Application Laid-Open No. 2006-259906, it is discussed that when the information processing apparatus is shifted to the power saving mode and electric power supply to the main CPU is stopped, the main CPU informs the sub CPU of the address of a multicast packet to be responded thereto.

This allows the sub CPU to respond instead of the main CPU when the multicast packet is received while the electric power supply to the main CPU stopped. Thus, it is not necessary to start the main CPU. In other words, this allows the electric power stop to the main CPU to be continued for a longer period of time. Thus, an electric power saving effect is enhanced.

Recently, in order to protect confidential information, as a technique for communicating with a network path encrypted, internet protocol security (IPSec), secure socket layer (SSL) or the like has been known. If these techniques are used, the confidential information can be transmitted and received via a network with data encrypted. Thus, leakage of information can be protected.

As described above, when the information processing apparatus on the main body side is shifted to the power saving mode, information about a packet to be responded thereto is registered with the NIC apparatus. Thus, the NIC apparatus can execute a response for a received packet instead of the information processing apparatus on the main body side. However, when the NIC apparatus responds as proxy of the information processing apparatus on the main body, if the packet to be transmitted via a network is encrypted, a response by the NIC apparatus may not successfully be executed in some cases.

More specifically, when the NIC apparatus responds instead of the information processing apparatus on the main body, a pattern of a packet to which the NIC apparatus is to respond and a packet to be transmitted as a response to a packet that matches the pattern are registered. Then, the NIC apparatus having received a packet that matches the registered pattern will transmit a packet corresponding to the pattern.

At this time, if a packet received by the NIC apparatus is encrypted, although the content of its packet matches the registered pattern, when a packer that remains encrypted and the registered pattern are compared, it is determined that these are not matched.

In this case, the information processing apparatus is to be returned on the main body from the power saving mode and transfer the packet received by the NIC apparatus to the information processing apparatus on the main body. Accordingly, the number of times in which the information processing apparatus on the main body is returned to the normal power mode is increased and an electric power saving effect is reduced.

Further, it is also considered that the NIC apparatus is provided with a configuration for executing encryption/decryption processing similar to the information processing apparatus on the main body. However, the hardware configuration of the NIC apparatus (processing capability of CPU and memory capacity) is usually more insufficient than that of the information processing apparatus on the main body. Thus, for example, when a plurality of algorithms for executing encrypted communication are present, it may be difficult to also provide the NIC apparatus with all of the plurality of algorithms to be included in the information processing apparatus on the main body.

Accordingly, when a session for encrypted communication using a specific algorithm between the information processing apparatus on the main body and an external device on a network is established, if the information processing apparatus on the main body is shifted to the power saving mode, a similar situation may arise. In other words, if the NIC apparatus does not include the above-described specific algorithm, a packet received by the NIC apparatus cannot be decrypted. Thus, pattern matching in the NIC apparatus is not successfully executed.

SUMMARY OF THE INVENTION

According to an aspect of the present invention, an apparatus includes a detection unit configured to detect that a condition for shifting to a power saving mode, in which power consumption is smaller than that in a normal power mode, is satisfied while the apparatus is operated in the normal power mode, and a request unit configured to request that a first algorithm to be used in an encrypted communication with an external device is changed to a second algorithm included in a network interface device when the condition is satisfied.

DESCRIPTION OF THE EMBODIMENTS

Various exemplary embodiments, features, and aspects of the invention will be described in detail below with reference to the drawings. The present invention is not limited to the following exemplary embodiments. Further, all combinations of characteristics illustrated in exemplary embodiments are not necessarily essential for the present invention.

FIG. 1is a block diagram illustrating a hardware configuration of a communication system according to a first exemplary embodiment of the present invention. The communication system100includes an information processing apparatus110and an NIC120. The information processing apparatus110is connected to a local area network (LAN)160via the NIC120.

A central processing unit (CPU)111executes a software program for the information processing apparatus110to control the entire apparatus. A random access memory (RAM)112is used for temporary storage of data or the like when the CPU111controls the apparatus. A read only memory (ROM)113stores a boot program for the apparatus, a fixed parameter, and the like.

A hard disk drive (HDD)114is used for storing various types of data. A timer115executes management of elapsed time. A nonvolatile random access memory (NVRAM)116is a nonvolatile memory and is used to store various setting values for the information processing apparatus110. An operation unit interface (I/F)117controls an operation unit130, displays various types of operation screens on a liquid crystal panel provided on the operation unit130, and also transmits instructions from a user input via an operation screen to the CPU111.

A device I/F118controls a scanner140and a printer150. The scanner140reads an image on a document to generate image data. The printer150prints an image based on image data on a recording medium. An expansion I/F119is connected with an expansion I/F124on the NIC120side to control data communication with an external device on the LAN160.

A CPU121executes a software program for the NIC120to control the entire apparatus. A RAM122is a random access memory and is used for temporary storing data or the like when the CPU121controls the apparatus. A ROM123is a read only memory and stores a boot program of the apparatus, a fixed parameter, and the like.

The expansion I/F124is connected with the expansion I/F119on the information processing apparatus110side to control data communication between the information processing apparatus110and the NIC120. A network I/F125is connected to the LAN160to control data communication between the NIC120(information processing apparatus110, communication system100) and an external device on the LAN160.

The information processing apparatus110can switch between a normal power mode and a power saving mode in which the electric power consumption is smaller than that in the normal power mode. When the information processing apparatus110is shifted from the normal power mode to the power saving mode, electric power supply to the CPU111, the HDD114, the NVRAM116, and the like are stopped.

On the other hand, the NIC120side is made of an application specific integrated circuit (ASIC) different from the information processing apparatus110. Thus, even when the information processing apparatus110is shifted to the power saving mode, electric power supply is continued to the NIC120to realize a proxy response function, which will be described later.

FIG. 2illustrates a software configuration of the communication system100. The software configuration is also configured to be separated into the information processing apparatus110side and the NIC120side.

A network I/F unit220controls transmission and reception of a network packet via the LAN160. A packet processing unit216executes processing of a packet that is transmitted and received via the LAN160. An input/output I/F unit213executes transmission and reception of a packet and a command with the information processing apparatus110.

An NIC control unit215manages a start and an operation state of the NIC120. A proxy response pattern database (DB)214registers proxy response information (e.g., packet pattern) used to realize the proxy response function. An encryption processing unit217encrypts/decrypts a transmitted and received packet. The encryption processing unit217includes an encryption module unit218for storing encryption algorithm and authentication algorithm used to execute encryption/decryption processing. A security information DB219stores key information or the like used to execute encryption/decryption processing.

An input/output I/F unit212executes transmission and reception of a packet and a command with the NIC120. A protocol stack208controls transmission and reception of a network packet. Above a protocol stack, various types of network protocols and applications are present. In the present exemplary embodiment, an example, which includes a simple network management protocol (SNMP) module206and a hyper text transfer protocol (HTTP) module207, will be described.

An encryption processing unit209is a processing unit configured to hook into the protocol stack208to encrypt/decrypt a packet to be transmitted and received, and to store various types of encryption algorithm and authentication algorithm in an encryption module210. An encryption key information DB211is a DB for storing security information to be dynamically generated. For example, the encryption key information DB211stores information to be dramatically changed such as shared key information and a period of validity determined in negotiations with an external device, encryption algorithm, and authentication algorithm.

On the other hand, a security policy DB202stores static setting information (security policy information) concerning how to communicate with which external device and how to communicate by which encryption algorithm. The security policy information can be changed to an arbitrary setting by a user via a user I/F unit201.

A security policy registration unit203is a control unit configured to read setting information from the security policy DB202to reflect a setting on the encryption processing unit209. A reflection of the setting may be executed only once when starting, or a reflection of the setting may also be executed whenever instructions for a change of the setting are received via the user I/F unit201.

A proxy response registration unit204notifies the NIC120of a received packet pattern for specifying a packet to which the NIC120is to respond instead of the information processing apparatus110(as proxy of information processing apparatus110), and the content of a transmission packet to be responded. Then the NIC120registers them. The notification may be executed only once when starting, or whenever instructions for a change of the setting are received via the user I/F unit201.

A sleep control unit205controls the shift of the information processing apparatus110to the power saving mode and the return thereof to the normal power mode. Further, the sleep control unit205notifies the NIC120and the encryption processing unit209of the shift to the power saving mode in advance directly before the information processing apparatus110is shifted to the power saving mode.

FIG. 3illustrates a general view of a network including the communication system100. In the present exemplary embodiment, as one example of encrypted communication, a case in which each device on the network can execute data communication using the IPsec will be described below. However, an encryption method is not limited to the IPsec but another method may be adopted.

The communication system100is communicably connected to a PCa301, a PCb302, a PCc303, and a router304via the LAN160. InFIG. 3, only devices present in the same link under the router304are illustrated. However, in a case in which the communication system100communicates with an external device connected to the communication system100via the router304, the present invention can also similarly be applied thereto.

The communication system100including the information processing apparatus110and the NIC120is set with 192.168.0.100 as a common internet protocol (IP) address. This IP address may be given based on the internet protocol version 4 (IPv4) or internet protocol version 6 (IPv6). Encryption algorithms to be supported by the information processing apparatus110are triple data encryption standard-CBC (3 DES-CBC), advanced encryption standard-CBC (AES-CBC), advanced encryption standard-GCM (AES-GCM), and advanced encryption standard-CTR (AES-CTR). Further, authentication algorithms to be supported by the information processing apparatus110are message digest algorithm 5 (MD 5), secure hash algorithm 1 (SHA 1), secure hash algorithm 256 (SHA 256), and secure hash algorithm 512 (SHA 512).

On the other hand, encryption algorithms to be supported by the NIC120are 3 DES-CBC and AES-CBC. Further, authentication algorithms to be supported by the NIC120are MD 5 and SHA 1.

The PCa301is set with 192.168.0.1 as an IP address. Encryption algorithms to be supported by the PCa301is 3 DES-CBC and AES-CBC. Authentication algorithms are MD 5 and SHA 1. The PCb302is set with 192.168.0.2 as an IP address. Encryption algorithms to be supported by the PCb302are AES-GCM and AES-CBC. Authentication algorithms are SHA 256, SHA 512, and SHA 1.

The PCc303is set with 192.168.0.5 as an IP address. Encryption algorithms to be supported by the PCc303are AES-CBC and AES-CTR. Authentication algorithms are SHA 256, SHA 1, and MD 5.

FIGS. 4 to 6are flowcharts illustrating processing for changing algorithm to be used in encrypted communication with an external device when the information processing apparatus100is shifted to the power saving mode while a session for executing encrypted communication with the external device is established.

Each operation (step) illustrated in flowcharts inFIGS. 4 and 5is realized by the CPU111on the information processing apparatus110by executing a control program. Further, each operation (step) illustrated in a flowchart inFIG. 6is realized by the CPU121on the NIC120by executing a control program.

A flowchart illustrated inFIG. 4is started when the information processing apparatus110is started. In step S401, the encryption processing unit209inquires of the encryption processing unit217on the NIC120information concerning encryption algorithm and authentication algorithm to be supported by the NIC120, and acquires these information from the NIC120. The acquired information is stored in a memory (e.g., RAM112) in the information processing apparatus110.

In an example illustrated inFIG. 3, the NIC120replies with 3 DES-CBC and AES-CBC as supporting encryption algorithm. Further, the NIC120replies with MD 5 and SHA 1 as supporting authentication algorithm.

In step S402, it is determined whether the sleep control unit205detects that a condition for shifting the information processing apparatus110from the normal power mode to the power saving mode is satisfied. The condition for shifting the information processing apparatus110to the power saving mode includes, for example, cases in which a packet addressed to the information processing apparatus110itself has not been received from an external device for a predetermined period of time, a user operation has not been performed for a fixed period of time, or a button for shifting the information processing apparatus110to the power saving mode is pressed.

When the sleep control unit205has detected that the condition for shifting the information processing apparatus110to the power saving mode is satisfied (YES in step S402), the sleep control unit205notifies the encryption processing unit209, the proxy response registration unit204, and the NIC control unit215of the fact that the information processing apparatus110will be shifted to the power saving mode.

In step S403, the proxy response registration unit204, which is notified of the shift to the power saving mode, generates a reception packet pattern for specifying a packet to which the NIC120is to respond instead of the information processing apparatus110and a transmission packet to be transmitted as a response. The proxy response registration unit204registers the generated reception packet pattern and the transmission packet with the proxy response pattern DB214.

FIG. 7illustrates a pattern for specifying an SNMP request as one example of a reception packet pattern to be registered with the proxy response pattern DB214. The packet processing unit216on the NIC120specifies a packet (SNMP request) used to execute a proxy response among packets received from the LAN160based on this reception packet pattern.

FIG. 8illustrates an SNMP reply packet as one example of a transmission packet to be registered with the proxy response pattern DB214. The packet processing unit216on the NIC120executes a proxy response by transmitting a packet of the content illustrated inFIG. 8when it is determined that the SNMP request is received based on the reception packet pattern illustrated inFIG. 7.

Referring toFIG. 4again, in step S404, the encryption processing unit209that is notified of shift to the power saving mode determines whether a session for executing encrypted communication with an external device is established. This determination is executed based on whether security association (SA) information is registered with the encryption key information DB211.

The communication system100is set with security policy information as illustrated inFIG. 9, and this information is stored in the security policy DB202. The security policy information denotes a security policy defined for the communication system100.

In the communication system100, the encryption processing unit209negotiates with an external device on the LAN160. If the session for executing encrypted communication is established, the SA information illustrated inFIG. 10Ais registered with the encryption key information DB211. Then, as time elapses or whenever encrypted communication is executed, the SA information is dynamically updated.FIG. 10Aillustrates an example of a state in which the communication system100establishes a session for executing encrypted communication with the PCa301and the PCb302, which are external devices.

As a result of determination in step S404, if it is determined that the session for executing encrypted communication with an external device is established (YES in step S404), the processing proceeds to step S405. Otherwise (NO in step S404), the processing proceeds to step S410.

In step S405, the encryption processing unit209determines whether the NIC120supports algorithms to be used in encrypted communication based on the session that is currently established. This determination is executed by comparing information managed in a table illustrated inFIG. 10Aand information acquired from the NIC120in step S401.

In other words, in an example illustrated inFIG. 10A, encryption algorithm/authentication algorithm to be used in the session established with the PCa301is 3 DES-CBC/SHA 1 respectively. All of these algorithms are supported by the NIC120. On the other hand, encryption algorithm/authentication algorithm to be used in the session established with the PCb302is AES-GCM/SHA 256 respectively. All of these algorithms are not supported by the NIC120.

Accordingly, in this case, the encryption processing unit209determines that the NIC120does not support algorithms to be used in the session that is established with the PCb302.

As a result of determination in step S405, if it is determined that the NIC120does not support algorithms to be used in the session that is currently established (NO in step S405), the processing proceeds to step S406. If it is determined that the NIC120supports the algorithms (YES in step S405), the processing proceeds to step S409.

In step S406, the encryption processing unit209executes processing for changing algorithms to be used in encrypted communication based on the session that has already been established. The detail of the processing in step S406is illustrated inFIG. 5.

In step S501, the encryption processing unit209acquires authentication algorithm set to the session that is determined, in step S405, that the NIC120does not support among the SA information stored in the encryption key information DB211. In an example illustrated inFIG. 10A, the encryption processing unit209acquires SHA 256, which is authentication algorithm to be used in the session that is established with the PCb302.

In step S502, the encryption processing unit209determines whether the acquired SHA 256 is an algorithm supported by the NIC120. In an example illustrated inFIG. 10A, as described above, neither of the encryption algorithm nor the authentication algorithm of the session established with the PCb302is not supported by the NIC120.

However, when the NIC120does not support either of encryption algorithm and authentication algorithm, in step S405, negative determination is provided. The processing proceeds to step S406(step S501). Thus, in step S502, it is determined again whether the NIC120supports the acquired authentication algorithm.

In the communication system100, authentication algorithms supported by the NIC120are MD 5 and SHA 1. Thus, the NIC120does not support SHA 256 (NO in step S502). Accordingly, in this case, the processing proceeds to step S504. The encryption processing unit209determines that authentication algorithms to be proposed to the PCb302are MD 5 and SHA 1, which are supported by the NIC120.

If the NIC120supports SHA 256 (YES in step S502), the processing proceeds to step S503. Then, the encryption processing unit209determines that authentication algorithm to be proposed to the PCb302is SHA 256 that is set in the SA information.

In steps S505to S508, processing similar to that executed in steps S502to S504is executed to encryption algorithm. In step S505, the encryption processing unit209acquires encryption algorithm that is set to the session that is determined, in step S405, that the NIC120does not support from among the SA information to be stored in the encryption key information DB211. In an example illustrated inFIG. 10A, the encryption processing unit209acquires AES-GCM, which is the encryption algorithm to be used in the session that is established with the PCb302.

In step S506, the encryption processing unit209determines whether the acquired AES-GCM is an algorithm supported by the NIC120. In the communication system100, encryption algorithms supported by the NIC120are 3 DES-CBC and AES-CBC. Thus, the NIC120does not support AES-GCM (NO in step S506). Thus, in this case, the processing proceeds to step S508. The encryption processing unit209determines that encryption algorithms to be proposed to the PCb302are 3 DES-CBC and AES-CBC, which are supported by the NIC120.

If the NIC120supports AES-GCM (YES in step S506), the processing proceeds to step S507. The encryption processing unit209determines that encryption algorithm to be proposed to the PCb302is AES-GCM that is set to the SA information.

After algorithm to be proposed to an external device (PCb302) is determined, in step S509, the encryption processing unit209transmits an algorithm change request packet illustrated inFIG. 11to an external device. All combinations of authentication algorithm and encryption algorithm supported by the NIC120are proposed.

A key length of AES-CBC is fixed by 128 bits. However, the key length of 192 bits or 256 bits may be adopted as an option. Further, as illustrated inFIG. 11, in the order of priority of combinations a pair of AES-CBC and SHA 1 is provided at the highest rank. However, a system may exchange the order of priority in arbitrary order. Further, it may be provided so as to allow a user to select the order of priority. In this example, a high priority is assigned in order of high security strength.

The external device (PCb302) can select arbitrary combinations among the proposed combinations. However, in the present exemplary embodiment, a combination of AES-CBC and SHA 1 is selected. As a result, a new session is established by the changed algorithm and, as illustrated inFIG. 10B, the SA information is updated.

Further, if the encryption processing unit209has established a session for executing the encrypted communication with the external device (PCb302) using AES-CBC and SHA 256, the encryption processing unit209transmits an algorithm change packet illustrated inFIG. 12. In other words, encryption algorithm AES-CBC, which is set to the SA information, is not to be changed since the NIC120supports the encryption algorithm AES-CBC, and only the authentication algorithm is requested to be changed.

Also, when the NIC120does not support either of encryption algorithm and authentication algorithm, as illustrated inFIG. 11, all combinations of algorithms supported by the NIC120may be proposed.

In step S407, the encryption processing unit209determines whether an algorithm change request to the external device (PCb302) is successful. If the algorithm change request is rejected by the external device (PCb302), the processing may proceed intact without changing algorithm or a request to cancel the session for executing the encrypted communication may be transmitted to execute plain text communication.

In step S408, the encryption processing unit209holds the SA information (FIG. 10A) before change in the RAM112or the NVRAM116. The SA information before change is used to execute a change request to restore to algorithm before change after the information processing apparatus110is returned from the power saving mode to the normal power mode. In step S409, the encryption processing unit209acquires the SA information on the encryption key information DB211at that time to transmit it to the security information DB219.

The encryption processing unit209and the proxy response registration unit204having completed the shift preparation processing (above-described algorithm change processing) notify the sleep control unit205of completion of a series of shift preparation processing. Then, in step S410, the sleep control unit205not only notifies the NIC control unit215of the shift to the sleep but also issues a command to stop supplying electric power current to the CPU111, the HDD114, the NVRAM116, and the like to cause the information processing apparatus110to be shifted to the power saving mode.

In step S411, the sleep control unit205determines whether the information processing apparatus110has satisfied a condition for returning from the power saving mode. This return condition includes, for example, cases in which a wake on LAN (WOL) packet is received via a network and a sleep return button of the operation unit130is pressed.

When the information processing apparatus110has satisfied a condition for returning from the power saving mode (YES in step S411), in step S412, the sleep control unit205causes the information processing apparatus110to be returned to the normal power mode. In other words, the sleep control unit205restarts electric power supply to the CPU111, the HDD114, the NVRAM116, and the like.

In step S413, the encryption processing unit209determines whether a session for executing the encrypted communication with an external device is established before the information processing apparatus110is shifted to the power saving mode. This determination is executed based on the SA information on the encryption key information DB211.

At this time, the registered content of SA information is as illustrated inFIG. 10B. Thus, the encryption processing unit209determines that the session has been established. As a result of determination in step S413, if it is determined that the session is established (YES in step S413), the processing proceeds to step S414. Otherwise (NO in step S413), the processing ends.

In step S414, the encryption processing unit209acquires the SA information from the security information DB219on the NIC120. The SA information acquired at this time is the registered content as illustrated inFIG. 10C. If time period of having shifted to the power saving mode is an hour and SNMP communication by the IPsec is generated several times during that time, elapsed time, life-duration bytes, sequence numbers, and the like are updated.

The encryption processing unit209updates the SA information illustrated inFIG. 10Bthat is stored in the encryption key information DB211into the acquired SA information illustrated inFIG. 10C. In step S415, the encryption processing unit209compares the SA information before shifting to the power saving mode held in step S408(before change of algorithm) and the updated SA information inFIG. 10C. Then, the encryption processing unit209determines whether the algorithm is changed when being shifted to the power saving mode. If the algorithm is changed (YES in step S415), the processing proceeds to step S416. If the algorithm is been changed (NO in step S415), the processing ends.

In step S416, the encryption processing unit209transmits a change request packet of algorithm to be used to the external device (PCb302) based on the SA information before shifting to the power saving mode (before change of algorithm) held in step S408.

Encryption algorithm to be proposed at this time is AES-GCM, and authentication algorithm to be proposed is SHA 256. The external device (PCb302) supports the proposed algorithm. Thus, the change of algorithm is successful and the SA information is updated as illustrated inFIG. 10D.

Next, an operation on the NIC120side will be described referring to a flowchart illustrated inFIG. 6. In step S601, it is determined whether the NIC control unit215receives proxy response information from the proxy response registration unit204on the information processing apparatus110. If the proxy response information is received (YES in step S601), the processing proceeds to step S602and stores the received proxy response information in the proxy response pattern DB214.

In step S603, the NIC control unit215determines whether the SA information is transmitted from the encryption processing unit209on the information processing apparatus110. If the SA information is transmitted (YES in step S603), in step S604, the received SA information is stored in the security information DB219. If the information processing apparatus110does not establish a session for executing the encrypted communication with an external device (NO in step S603), the SA information is not transmitted. Thus, processing in step S604is omitted. Then, the processing proceeds to step S605.

In step S605, the NIC control unit215determines whether the shift to the power saving mode is notified from the sleep control unit205. If the notification is received (YES in step S605), the processing proceeds to step S606and makes a proxy response function of the NIC120effective (ON).

In a case of a state in which the proxy response function is made ineffective (OFF), the packet processing unit216on the NIC120transfers all of packets received from the LAN160to the information processing apparatus110. On the other hand, in a case of a state in which the proxy response function is made effective (ON), the packet processing unit216executes pattern matching to the received packet, and determines whether the packet uses proxy response and whether the packet uses encryption and decryption.

In step S607, the packet processing unit216determines whether a packet is received from the LAN160. If a packet is received (YES in step S607), the processing proceeds to step S608. Otherwise (NO in step S607) the processing stands by until a packet is received.

In step S608, the packet processing unit216determines whether the received packet is encrypted. For example, in the IPsec, whether the packet is encrypted can be determined by a protocol field value on an IP header. In an encapsulating security payload (ESP) packet, identification data (ID) on a protocol number 50 (0x32) is stored in this field. In an authentication header (AH) packet, ID on a protocol number (0x33) is stored therein.

If the packet processing unit216has determined that the received data is encrypted (YES in step S608), the packet processing unit216transfers the received packet to the encryption processing unit217. Then, the processing proceeds to step S609.

In step S609, the encryption processing unit217determines whether the received packet, which is encrypted, matches the SA information (FIG. 10B) stored in the security information DB219. More specifically, the encryption processing unit217refers to a transmission source address, a destination address, a transmission source port number, and a destination port number. If the SA information consistent therewith is present, the encryption processing unit217determines that the received packet has matched.

In step S610, the encryption processing unit217decrypts packet data based on key information and algorithm set to the SA information that is consistent therewith. After decryption is completed, the encryption processing unit217transfers decrypted plain text data to the packet processing unit216. Further, sequence numbers, life-duration bytes, and the like of the SA information stored in the security information DB219are updated.

In step S611, the packet processing unit216determines whether the received packet matches a packet pattern that uses a proxy response. In the present exemplary embodiment, if the received pattern matches any one packet pattern registered with the proxy response pattern DB214, the packet processing unit216determines that a proxy response is to be executed. When it is determined that the proxy response is to be executed (YES in step S611), since a packet is to be transmitted by a proxy response is associated and registered therewith, the processing proceeds to step S612. In order to execute transmission preparation of the packet, the packet processing unit216transfers the packet to be transmitted to the encryption processing unit217.

In step S612, the encryption processing unit217determines whether the packet is to be encrypted. More specifically, the encryption processing unit217refers to a transmission source address, a destination address, a transmission source port number, and a destination port number. If the SA information consistent therewith is present, the encryption processing unit217determines that the packet is to be encrypted. If it is determined that the packet is to be encrypted (YES in step S612), the processing proceeds to step S613. The encryption processing unit217executes encryption of the packet based on key information and algorithm of the SA information consistent therewith.

After encryption of the packet is completed, the encryption processing unit217transfers the encrypted packet to the packet processing unit216. When it is not used to encrypt the packet, the processing in step S613is omitted. The encryption processing unit217transfers the packet to the packet processing unit216as a plain text.

In step S614, the packet processing unit216transmits proxy response packet data. Then, the processing returns to step S607to wait for a packet data to be received. On the other hand, if it is determined that a proxy response is not to be executed (NO in step S611), the processing proceeds to step S615. In step S615, the packet processing unit216determines whether the received packet corresponds to the WOL packet.

Whether the received packet corresponds to the WOL packet is determined based on whether the received packet is consistent with a packet pattern that is registered in advance, similar to the proxy response information. If it is determined that the received packet does not correspond to the WOL packet (NO instep S615), after the received packet is cancelled, the processing returns to step S607and waits for a packet data to be received.

If it is determined that the received packet corresponds to the WOL packet (YES in step S615), the packet processing unit216notifies the NIC control unit215of the determination result. In step S616, the NIC control unit215instructs the sleep control unit205on the information processing apparatus110to return to the normal power mode. Further, in step S617, the proxy response function of the NIC120is made ineffective (OFF). In other words, all of packets received from the LAN160thereafter are transferred to the information processing apparatus110. In step S618, the packet processing unit216transfers the received WOL packet to the information processing apparatus110. Then, the processing ends.

Thus, when the information processing apparatus110is shifted to the power saving mode when a session for executing the encrypted communication with an external device is established, the algorithm to be used in the encrypted communication can be changed to the algorithm included in the network interface device.

After the information processing apparatus is shifted to the power saving mode, a packet encrypted using algorithm included in the network interface device is transmitted. Thus, the network interface device can decrypt this packet. Then, by comparing the decrypted packet and a pattern registered as the proxy response information, it is possible to determine whether the network interface device is to respond instead of the information processing apparatus.

In other words, even if the encrypted packet is transmitted from an external device, the network interface device can execute a proxy response. Thus, the number of times, in which the information processing apparatus is returned to the normal power mode, can be reduced.

In the present exemplary embodiment, the IPsec has been described as an example of the encrypted communication. However, the encrypted communication technique can be used without limiting a protocol to secure sockets layer (SSL), and transport layer security (TLS), Institute of Electrical and Electronics Engineers (IEEE) 802.1X, secure shell (SSH), and media access control (MAC) address security. Further, the encrypted communication technique can be applied without limiting to specific encryption algorithms and authentication algorithms.

This application claims priority from Japanese Patent Application No. 2009-060684 filed Mar. 13, 2009, which is hereby incorporated by reference herein in its entirety.