Source: https://patents.google.com/patent/US20060184789A1/en
Timestamp: 2019-01-17 01:52:38
Document Index: 574181517

Matched Legal Cases: ['art 13', 'art 20', 'art 16', 'art 17', 'art 18', 'art 19', 'arts 21', 'art.\n3', 'art.\n9', 'art.\n13', 'art.\n18']

US20060184789A1 - Packet encryption substituting device, method thereof, and program recording medium - Google Patents
US20060184789A1
US20060184789A1 US10550216 US55021605A US2006184789A1 US 20060184789 A1 US20060184789 A1 US 20060184789A1 US 10550216 US10550216 US 10550216 US 55021605 A US55021605 A US 55021605A US 2006184789 A1 US2006184789 A1 US 2006184789A1
US7539858B2 (en )
In order to execute a key exchange protocol in IPSec, communication is performed multiple times between apparatuses which mutually agree on SA information. Furthermore, a lot of computation processing amount is required by the communication, which imposes a considerable load on the apparatuses. If, to cope with this, an SA information agreement function is provided for a small-sized terminal in a home, such as electronic equipment provided with a cryptographic-processed communication function, the scale of hardware and software is increased, and the size and the price are also increased. From this point of view, it is proposed, for example, in Japanese Patent Application Laid Open No. 2003-179592 (hereinafter referred to as Patent Literature 2) that, though a terminal is provided with a cryptographic processing function, processing of agreeing on SA information is substituted by a key support proxy apparatus on behalf of the terminal. According to the key exchange substitution technique shown in this Patent Literature 2, when a terminal which is connected to a network and which is provided with a cryptographic processing function but is not provided with a key exchange function, performs packet cryptographic communication with a communication counterpart terminal which is connected to the network and provided with a key exchange function, the terminal 32 first requests exchange of common keys to be used for a cryptographic communication signal with the communication counterpart terminal, from a key exchange proxy server connected to the network, and the key exchange proxy server performs key exchange processing with the communication counterpart terminal on behalf of the terminal based on the request and sets an agreed common key for the terminal. After that, the terminal uses the agreed common key to perform packet cryptographic communication with the communication counterpart terminal.
As described above, according to the packet cryptographic processing apparatus of this invention, since it is connected between a network and a terminal, a counterpart apparatus connected to the Internet, for example, can perform cryptographic processing, for example, decryption of a packet for which cryptographic processing has been performed, only by setting the IP address or the like of a terminal which is not provided with a cryptographic processing function. That is, the counterpart apparatus can employ a transport mode, and the user of the counterpart apparatus is not required to make settings such as the IP address of the terminal and the IP address of the packet cryptographic processing proxy apparatus and does not have to make such troublesome settings. It is also not necessary to do troublesome works of obtaining the IP address or the like of the cryptographic processing proxy server via communication with the terminal, and, after that, setting the IP address of the server to send a packet for which cryptographic processing has been performed to the cryptographic processing proxy server.
FIG. 4 is a flowchart of a process to be performed for a packet received by the packet cryptographic processing proxy apparatus 10 from a terminal 5. Similarly to the case of FIG. 3, when a packet is received at step S11, it is determined whether or not the packet requests agreement on cryptographic communication channel information (SA information) (for example, exchange of cryptographic keys (step S12). If the packets requests it, the cryptographic communication channel information is agreed with the counterpart apparatus 3 at step S3, and the agreed cryptographic communication channel information is written in the cryptographic communication channel information storage 12 in association with a terminal IP address. The process then returns to step S11 and receives the next packet.
FIG. 7 is a flowchart showing a process for agreeing on cryptographic communication channel information to be performed for a packet received from a terminal 5, by the packet cryptographic processing proxy apparatus. Steps S12-1 to S12-4 in FIG. 7 show details of step S12 in FIG. 3, and steps S13-1 to S13-4 in FIG. 7 show details of step S13 in FIG. 3. The process of FIG. 7 is almost the same as that of FIG. 6.
As for each component of the packet cryptographic processing proxy apparatus 10 described above according to the first embodiment and the second embodiment, a program written to cause the above described operation to be performed may be executed by a processor. That is, the decryption part 13, the terminal information collection part 20, the decryption determination part 16, the received packet determination part 17, the encryption part 18 and the encryption determination part 19, additionally including the packet determination parts 21 and 23 in the case of the second embodiment, may be configured by a computer which executes the programs described above. In this case, the packet cryptographic processing substitution program can be installed in the computer from a recording medium such as a CD-ROM, a magnetic disk and a semiconductor storage device or downloaded to the computer via communication line into the computer, and executed by the computer.
1. A packet cryptographic processing proxy apparatus connected between the Internet and a terminal, comprising:
a cryptographic communication channel information storage part which stores cryptographic communication channel information used for establishing a cryptographic communication channel at least for packet communication on the Internet, in packet communication between a counterpart apparatus connected to the Internet and the terminal; and
cryptographic processing means for performing cryptographic processing for a received packet based on the cryptographic communication channel information stored in said cryptographic communication channel information storage part.
3. The packet cryptographic processing proxy apparatus according to claim 1, further comprising a received packet determination part which determines whether or not a packet received from the counterpart apparatus is valid.
7. The packet cryptographic processing proxy apparatus according to any of claims 1 to 5, being implemented on a device which is connected between the Internet and the terminal and which does not have an IP address.
8. The packet cryptographic processing proxy apparatus according to any of claims 2 to 5, further comprising a terminal information collection part which collects a part of at least one of the cryptographic communication channel information and the filter information and stores the information in said filter information storage part.
9. The packet cryptographic processing proxy apparatus according to claim 1, further comprising:
a packet determination part which determines from a received packet whether or not to agree with the counterpart apparatus on cryptographic communication channel information for establishing a packet communication channel between the counterpart apparatus and the terminal;
a cryptographic communication channel information agreement part which, if the packet determination determines necessity of agreement, makes the agreement and stores the agreed cryptographic communication channel information in said cryptographic communication channel information storage part; and
10. The packet cryptographic processing proxy apparatus according to claim 9, wherein, if determining necessity of agreement on cryptographic communication channel information, said packet determination part determines whether valid cryptographic communication channel information corresponding to the received packet is stored in said cryptographic communication channel information storage part, causes said key information setting part to set key information in the cryptographic communication channel information for the terminal if the valid cryptographic communication channel information is stored, and causes said cryptographic communication channel information agreement part to make agreement on cryptographic communication channel information if the valid cryptographic communication channel is not stored.
11. The packet cryptographic processing proxy apparatus according to claim 10, wherein, if said packet determination part determines necessity of agreement on the cryptographic communication channel information, and address information in the received packet is stored in said filter information storage part, said packet determination part causes agreement on the key information to be made.
12. The packet cryptographic processing proxy apparatus according to claim 11, further comprising a terminal information acquisition part which detects the terminal, acquires address information from the terminal and stores the acquired address information in said filter information storage part.
13. A packet cryptographic processing method comprising the steps of:
(a) storing cryptographic communication channel information used for establishing a cryptographic communication channel at least for packet communication on the Internet, in packet communication between a counterpart apparatus connected to the Internet and a terminal, in a cryptographic communication channel information storage part under agreement with the counterpart apparatus; and
(b) performing cryptographic processing for a received packet based on the cryptographic communication channel information.
14. The packet cryptographic processing method according to claim 13, wherein the step (b) comprises the steps of:
15. The packet cryptographic processing method according to claim 13, wherein the step (a) comprises the steps of:
(a-1) determining whether or not a received packet requires agreement on cryptographic communication channel information and, if agreement is required, making agreement, for packet communication between a counterpart apparatus connected to the Internet and a terminal, with the counterpart apparatus on cryptographic communication channel information for performing cryptographic processing of a packet transmitted with the counterpart apparatus;
(a-2) setting the agreed cryptographic communication channel information for the terminal; and
(a-3) if agreement is not required, bypassing or discarding the received packet.
16. The packet cryptographic processing method according to claim 15, wherein the step (a-1) comprises the steps of:
17. The packet cryptographic processing method according to claim 16, wherein the step (a-1-1) comprises a step of, if agreement on cryptographic communication channel information for the packet is required, determining first whether address information in the received packet is stored in a filter information storage part; and, if the address information is stored, performing the determination about whether valid cryptographic communication channel information is stored in the cryptographic communication channel information storage part.
18. A readable recording medium on which a program for causing a computer to perform the packet cryptographic processing method according to any of claims 13 to 17 is recorded.
US20060184789A1 true true US20060184789A1 (en) 2006-08-17
US7539858B2 US7539858B2 (en) 2009-05-26
US20140208094A1 (en) * 2013-01-23 2014-07-24 Alcatel-Lucent Canada Inc. Control plane encryption in ip/mpls networks
JPH11308264A (en) * 1998-04-17 1999-11-05 Mitsubishi Electric Corp Cryptocommunication system
JP2001007849A (en) * 1999-06-18 2001-01-12 Toshiba Corp Mpls packet processing method and mpls packet processor
JP3651424B2 (en) * 2001-08-28 2005-05-25 日本電気株式会社 Large IPSecVPN construction method, large IPSecVPN system, program, and key sharing processing apparatus
JP2003179627A (en) * 2001-12-10 2003-06-27 Mitsubishi Electric Corp Packet communication equipment and packet communication method
JP3918693B2 (en) * 2002-09-17 2007-05-23 松下電器産業株式会社 Cooked rice warmer
US8639929B2 (en) * 2010-06-30 2014-01-28 Huawei Technologies Co., Ltd. Method, device and system for authenticating gateway, node and server
US7539858B2 (en) 2009-05-26 grant