Decryption apparatus for use in encrypted communications

• US 20070180227A1
• Filed: 02/24/2006
• Published: 08/02/2007
• Est. Priority Date: 03/01/2005
• Status: Abandoned Application

• Current Assignee: Panasonic Electric Works Company Limited (Panasonic Holdings Corporation)
• Original Assignee: Asahi Matsushita Electric Works Ltd. (Panasonic Holdings Corporation)
• Inventors: Akimoto, Masao
• Application Number:
  US11/360,497
• Publication Number:
  US 20070180227A1
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A decryption apparatus for use in encrypted communications is installed between a first communications apparatus and a second communications apparatus to transmit and receive encrypted packets therebetween and allowing a monitoring apparatus to monitor contents of the transmitted and received packets. The decryption apparatus includes a storage unit, a relay unit and an output unit. The storage unit stores first key information, second key information, and an encryption algorithm using the first and the second key data. The relay unit decrypts a first and a second packet received from the first and the second communications apparatus by using the first and the second key information and encrypting a decrypted first and second packet by using the second and the first key information according to the encryption algorithm and then transmitting an encrypted first and the second packet to the second and the first communications apparatus.

Claims

1. A decryption apparatus for use in encrypted communications installed between a first communications apparatus and a second communications apparatus to transmit and receive encrypted packets therebetween and allowing a monitoring apparatus to monitor contents of the transmitted and received packets, comprising:

a storage unit for storing first key information for decrypting a packet transmitted from the first communications apparatus and encrypting a packet to be transmitted thereto, second key information for decrypting a packet received from the second communications apparatus and encrypting a packet to be transmitted thereto, and an encryption algorithm using the first and the second key information;

a relay unit for decrypting a first packet received from the first communications apparatus by using the first key information and encrypting a decrypted first packet by using the second key information according to the encryption algorithm and then transmitting an encrypted first packet to the second communications apparatus, and decrypting a second packet received from the second communications apparatus by using the second key information and encrypting a decrypted second packet by using the first key information according to the encryption algorithm and then transmitting an encrypted second packet to the first communications; and

an output unit for standardizing a decrypted packet produced by the relay unit to provide the monitoring apparatus with a standardized decrypted packet of a form capable of being processed by the monitoring apparatus, thereby allowing the monitoring apparatus to monitor contents of the standardized decrypted packet.

2. The decryption apparatus of claim 1, wherein the output unit produces the standardized packet by setting an address of the monitoring apparatus as a destination of the decrypted packet, extracting a header and a trailer needed for an encryption process and a decryption process from headers and trailers appended to the decrypted packet, and replacing next header protocol information contained in a header appended in front of the decrypted packet with next header protocol information contained in the extracted header or trailer.

3. The decryption apparatus of claim 1, further comprising:

an input unit for inputting process information on a process to be performed before the decrypted packet is encrypted, and

wherein the relay unit performs the process on the decrypted packet based on the process information inputted by the input unit and then encrypts the thus processed decrypted packet by using the first or second key information to thereby transmit the thus encrypted packet to the first or second communications apparatus.

4. The decryption apparatus of claim 1, wherein one of the communications apparatuses is an initiating communications apparatus and the other thereof is a responding communications apparatus, and the decryption apparatus further comprising a key generation unit for generating the first key information and the second key information,

wherein the key generation unit includes:

a key sharing data storage subunit for storing selected numbers on which the decryption apparatus and the initiating and the responding communications apparatus agreed in advance;

a secret key generation subunit for generating a random number to create a secret key;

a public key generation subunit for generating a public key by using the secret key and the selected numbers; and

a common secret key generation subunit for generating a common secret key by using a public key received from the initiating or the responding communications apparatus, the secret key, and the selected number, and

wherein, when a key exchange is performed between the initiating and the responding communications apparatus, the secret key generation subunit generates an initiator'"'"'s side secret key on behalf of the responding communications apparatus and a responder'"'"'s side secret key on behalf of the initiating communications apparatus,

the public key generation subunit generates an initiator'"'"'s side public key on behalf of the responding communications apparatus by using the initiator'"'"'s side secret key and an responder'"'"'s side public key by using the responder'"'"'s side secret key on behalf of the initiating communications apparatus,

the initiator'"'"'s side public key that is equivalent to a responder'"'"'s public key is sent to the initiating communications apparatus and the responder'"'"'s side public key that is equivalent to an initiator'"'"'s public key is sent to the responding communications apparatus,

the common secret key generation subunit generates a responder'"'"'s side common secret key by using the initiator'"'"'s side secret key created by the secret key generation subunit and a responder'"'"'s public key received from the responding communications apparatus, and also generates an initiator'"'"'s common secret key by using the responder'"'"'s side secret key created by the secret key generation subunit and an initiator'"'"'s public key received from the initiating communications apparatus, and

the storage unit stores the responder'"'"'s side common secret key as one of the first and the second key information, and also stores the initiator'"'"'s side common secret key as the other of the first and the second key information.

5. The decryption apparatus of claim 1, wherein the relay unit encrypts the decrypted packet produced to be outputted from the output unit to the monitoring apparatus and relays a thus encrypted packet after if a monitoring result that the relay unit receives from the monitoring apparatus indicates that a packet outputted from the output unit to the monitoring apparatus is a legitimate packet;

and the relay unit stops relaying the decrypted packet produced to be outputted from the output unit to the monitoring apparatus if the monitoring result that the relay unit receives from the monitoring apparatus indicates that the packet outputted from the output unit to the monitoring apparatus is an illegitimate packet.

6. The decryption apparatus of claim 1, wherein, if the relay unit receives a packet outputted from the output unit and then processed by the monitoring apparatus, the relay unit encrypts and then relays a thus received packet.

7. A decryption apparatus for use in encrypted communications, wherein the decryption apparatus intercepts encrypted packets transmitted and received between a first communications apparatus and a second communications apparatus through a relay apparatus installed on a communications path therebetween to have a monitoring apparatus monitor contents of the encrypted packets, comprising:

a storage unit for storing first key information for decrypting a packet sent from the first communications apparatus to the second communications apparatus, second key information for decrypting a packet sent from the second communications apparatus to the first communications apparatus, and an encryption algorithm using the first and the second key information;

a decryption unit for decrypting the packet received from the first communications apparatus by using the first key information according to the encryption algorithm, and decrypting the packet received from the second communications apparatus by using the second key information according to the encryption algorithm; and

an output unit for standardizing a decrypted packet produced by the decryption unit to provide the monitoring apparatus with a standardized packet of a form capable of being processed by the monitoring apparatus, thereby allowing the monitoring apparatus to monitor contents of the standardized packet.

8. The decryption apparatus of claim 7, wherein the output unit adjusts data of the decrypted packet to have a data length capable of being processed by the monitoring apparatus, and generates a new packet by appending to adjusted data a header including protocol information of the adjusted data and an address of the monitoring apparatus set as a destination of the new packet, thereby standardizing the decrypted packet to produce the standardized packet of the form capable of being processed by the monitoring apparatus.

9. The decryption apparatus of claim 7, further comprising:

a secret key setting unit for setting secret keys for the first and second communications apparatus to be used in creating the first and the second key information; and

a key generation unit for intercepting information packets required for negotiating and determining the first key information, the second key information and the encryption algorithm between the first and the second communications apparatus, generating the first key information and the second key information, and determining the encryption algorithm based on intercepted packets and the secret keys.