Network system, data transmission device, session monitor system and packet monitor transmission device

• US 20090080655A1
• Filed: 11/19/2008
• Published: 03/26/2009
• Est. Priority Date: 07/12/2004
• Status: Abandoned Application

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Sakamoto, Kenichi, Inouchi, Hidenori, Nakamura, Hitomi, Takeda, Yukiko, Miyamoto, Takashi
• Application Number:
  US12/292,445
• Publication Number:
  US 20090080655A1
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

In a network system for communication between a first terminal with an encrypting function and a second terminal without the encrypting function, a control data transmission device includes a receiving unit receiving control data sent from the first terminal to the second terminal, a data processing unit for extracting cipher information of the first terminal from the control data, a memory storing the cipher information of the first terminal, and a sending unit for sending the control data without the cipher information toward the second terminal, or sending to the first terminal the control data with the cipher information, and further sending the cipher information to the user data transmission device; a user data transmission device includes an encryption processing unit for decrypting the data that was sent from the first terminal to the second terminal while encrypting the data as sent from the second terminal to the first terminal.

Claims

1. A network system, comprising:

a first terminal which has an encrypting function;

a second terminal which does not have the encrypting function;

a control data transmission device for transmitting control data between said first terminal and said second terminal; and

a user data transmission device for transmitting user data between said first terminal and said second terminals,

wherein said control data transmission device adds first cipher information to first control data received from said first terminal, and then, transmits the first control data with the first cipher information to said second terminal,

said control data transmission device extracts second cipher information from second control data received from said second terminal, deletes said second cipher information from said second control data, and then, transmits the second control data without said second cipher information,

said control data transmission device generates third cipher information based on said first cipher information and said second cipher information, and notifies said user data transmission device of the third cipher information, and

said user data transmission device encrypts and decrypts the user data transmitted between said user data transmission device and said second terminals in accordance with said third cipher information.

2. The network system according to claim 1, wherein said control data transmission device determines addition or deletion of said first cipher information to or from said first control data based on at least one of information identifying a sending source drain, information identifying a destination domain, information identifying a user who is a sender, information identifying a destination user, information identifying a source IP address, information identifying a destination IP address, information identifying a source port number, information identifying a destination port number, information identifying a transfer route of said first control data, and information identifying a data type of the user data, each information included in said first control data.

3. A control data transmission device for transmitting control data between terminals,

wherein the control data transmission device is coupled with a first terminal which has an encrypting function, a second terminal which does not have the encrypting function and a user data transmission device for transmitting user data between said first terminal and said second terminal,

wherein said control data transmission device adds first cipher information to first control data received from said first terminal, and then, transmits the first control data added with the first cipher information to said second terminal,

said control data transmission device extracts second cipher information from second control data received from said second terminal, deletes said second cipher information from said second control data, and then, transmits the second control data without said second cipher information,

said control data transmission device generates third cipher information based on said first cipher information and said second cipher information, and notifies said user data transmission device of the third cipher information, and

said user data transmission device encrypts and decrypts the user data transmitted between said user data transmission device and said second terminals in accordance with said third cipher information.

4. The control data transmission device according to claim 3,

wherein said control data transmission device determines addition or deletion of said first cipher information to or from said first control data based on at least one of information identifying a sending source drain, information identifying a destination domain, information identifying a user who is a sender, information identifying a destination user, information identifying a source IP address, information identifying a destination IP address, information identifying a source port number, information identifying a destination port number, information identifying a transfer route of said first control data, and information identifying a data type of the user data, each information included in said first control data.

5. A network system having a control data transmission device and a user data transmission device as connected via a network to a first terminal with an encrypting function and a second terminal without the encrypting function, wherein

said control data transmission device comprises:

a receiving unit for receiving control data as sent from the first terminal to the second terminal;

a data processing unit for adding first cipher information to first control data received from said first terminal, extracting second cipher information from said second control data received from said second terminal, deletes said second cipher information from said second control data, generating third cipher information based on said first cipher information and said second cipher information;

a sending unit for sending to the second terminal the control data from which with the first cipher information and sending the second control data without the cipher second information; and

a notifying unit for notifying said user data transmission device of the third cipher information, and

wherein said user data transmission device comprises an encrypting unit for encrypting and decrypting the user data transmitted between said user data transmission device and said second terminal in accordance with said third cipher information.

6. The network system according to claim 5, wherein upon receipt of a request for non-encryptable communication as sent from said second terminal to said first terminal, said control data transmission device sends to said second terminal a notice as to refusal of data transmission.

7. The network system according to claim 5, wherein said control data transmission device determines addition of the first cipher information or deletion of the second cipher information based on at least one as selected from the group consisting of information identifying a sending source drain, information identifying a destination domain, information identifying a user who is a sender, information identifying a destination user, information identifying a source IP address, information identifying a destination IP address, information identifying a source port number, information identifying a destination port number, information identifying a transfer route of the control data, and information identifying a data type of a session to be established between the first and second terminals.

8. A control data transmission device to be coupled to a plurality of terminals via a network and to a user data transmission device, comprising:

a receiving unit for receiving control data as sent from the first terminal to the second terminal;

a data processing unit for adding first cipher information to first control data received from said first terminal, extracting second cipher information from said second control data received from said second terminal, deletes said second cipher information from said second control data, generating third cipher information based on said first cipher information and said second cipher information;

a sending unit for sending to the second terminal the control data with the first cipher information, sending the second control data without said second cipher information; and

a notifying unit for notifying said user data transmission device of the third cipher information.

9. The control data transmission device according to claim 8,

wherein said data processing unit for determining addition of the first cipher information or deletion of the second cipher information based on at least one as selected from the group consisting of information identifying a sending source drain, information identifying a destination domain, information identifying a user who is a sender, information identifying a destination user, information identifying a source IP address, information identifying a destination IP address, information identifying a source port number, information identifying a destination port number, information identifying a transfer route of the control data, and information identifying a data type of a session to be established between the first terminal and the second terminal.