BRIDGING SYSTEM, BRIDGE, AND BRIDGING METHOD

• US 20090271615A1
• Filed: 05/05/2009
• Published: 10/29/2009
• Est. Priority Date: 11/07/2007
• Status: Active Grant

• Current Assignee: Meidensha Corporation
• Original Assignee: Meidensha Corporation
• Inventors: AIZAWA, Kazumasa
• Granted Patent: US 8,880,870 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

Bridges 30, 40 are interposed between a server 10 or a client 20 having two channels 2ch, one of the two channels making a LAN connection to either the server or the client and the other channel making the LAN connection to the internet. Each of bridges 30, 40 performs a LAN packet scramble, a scramble purpose encryption key management, a scramble purpose encryption key management, and a bridging system authentication. Furthermore, each of bridges 30, 40 performs a LAN packet scramble, a scramble purpose encryption key management, and a bridging system authentication for a packet derived from the server or the client. Furthermore, a composite authentication having a plurality of authentication purpose interfaces is carried out in each of the bridges. Furthermore, a composite authentication having a plurality of authentication purpose interfaces is carried out in each of the bridges. The bridge has a plurality of authentication purpose interfaces to perform a composite authentication. Each of the bridges performs a key management to manage and hold the common key in the authentication and performs a non-decryption file management which manages and holds a file information encrypting and transmitting a payload of an application communicated with a common key at an internal of a transmission side bridge.

Claims

1. A bridging system for performing an encryption communication between a server and a client via a LAN, comprising:

a bridge in which one of two channels which makes a LAN connection to either the server or the client and the other channel thereof which makes the LAN connection to an internet are equipped and via which the server and the client are connected to the internet; and

means, provided in the bridge, for performing a LAN packet scramble and a scramble purpose encryption key management for a packet from either the server or the client through a key exchange mechanism, an encryption mechanism, and an authentication information addition.

2. The bridging system as claimed in claim 1, wherein the bridge is either a wire connection bridge configured to perform the encryption communication for the internet via a network equipment or a wireless connection bridge configured to be connected to an access point at the internet wirelessly to perform the encryption communication.

3. The bridging system as claimed in claim 1, wherein the bridge performs a direct forwarding for a network address of the packet transmission side to a packet scramble &

bridging gateway.

4. The bridging system as claimed in claim 1, wherein the bridge is provided with a composite authentication management mechanism provided with a plurality of authentication interfaces to perform a composite authentication.

5. The bridging system as claimed in claim 4, wherein the composite authentication management mechanism recognizes an individual authentication device and a biometrics authentication device via a device reader and reads an authentication data and the individual authentication device performs a unique management using a system ID.

6. The bridging system as claimed in claim 4, wherein the bridge is provided with the composite authentication management mechanism and a concealment/save mechanism and the composite authentication management mechanism is provided with means for performing a mutual authentication with an opposing bridge including an On/Off state of the concealment/save mechanism, for performing an automatic key exchange, and for determining a common key and wherein the concealment/save mechanism includes:

key management means for managing and saving the common key in the On state of the concealment/save mechanism after the communication and non-decryption file management means for encrypting and transmitting a payload of an application communicated with the common key at an internal of the transmission side bridge.

7. A bridge for performing a bridging to perform an encryption communication between a server and a client via a LAN, the bridge comprising:

two channels, one of the channels making a LAN connection to either the server or the client and the other channel making a LAN connection to an internet; and

means for performing a LAN packet scramble and an encryption key management and performing a bridging system authentication for the packet from either the server or the client by a key exchange mechanism, an encryption mechanism, and an authentication information addition.

8. The bridge as claimed in claim 7, wherein the bridge performs the direct forwarding for the network address at a packet transmission side to a scramble &

bridging gateway of the packet.

9. The bridge as claimed in claim 7, wherein the bridge performs the direct forwarding for the network address at the packet transmission side to the scramble &

bridging gateway of the packet.

10. The bridge as claimed in claim 7, wherein the bridge includes a composite authentication management mechanism configured to have a plurality of authentication purpose interfaces to perform a composite authentication

11. The bridge as claimed in claim 10, wherein the composite authentication management mechanism recognizes an individual recognition purpose device and a biometrics authentication purpose device via a device reader and reads an authentication purpose data and the individual authentication purpose device performs a unique management using a system ID.

12. The bridge as claimed in claim 10, wherein the bridge includes:

the composite authentication management mechanism; and

a concealment/save mechanism and wherein the bridge further includes means for performing a mutual authentication by means of the composite authentication management mechanism including an On/Off state of the concealment/save mechanism with an opposing bridge, for performing an automatic key management, and for determining a common key and wherein the concealment/save mechanism further includes;

key management means for managing and holding the common key even after the communication when the concealment/save mechanism is in an On state; and

non-decryption file management means for managing and holding a file information encrypting and transmitting a payload of an application communicated with the common key at an internal of a transmission side bridge.

13. A bridging method for performing an encryption communication between a server and a client via a LAN, the bridging method comprising:

connecting an internet via a bridge in which two channels are equipped, one of the two channels making a LAN connection to either the server or the client and the other channel making a LAN connection to an internet and wherein the bridge is provided with a composite authentication management procedure to perform a LAN packet scramble, a scramble purpose encryption key management, and a bridging system authentication for a packet from either the server or the client.

14. The bridging method as claimed in claim 13, wherein the bridge is either a wire connection bridge for performing an encryption communication with the internet via wire connection network equipment or a wireless connection bridge for performing the encryption communication with an access point at the internet wirelessly.

15. The bridging method as claimed in claim 13, wherein the bridge is provided with a procedure to perform a direct forwarding for a network address at the packet transmission side to a scramble &

bridging gateway.

16. The bridging method as claimed in claim 13, wherein the bridge is provided with a procedure to perform a direct forwarding of a network address at the packet transmission side to a packet scramble &

bridging gateway.

17. The bridging method as claimed in claim 16, wherein the composite authentication management procedure recognizes an individual authentication purpose device and a biometrics authentication purpose device via a device reader and reads an authentication purpose data, and the individual authentication purpose device is provided with a procedure for performing a unique management using a system ID.

18. The bridging method as claimed in claim 16, wherein the bridge is provided with the composite authentication management mechanism and a concealment/save mechanism, the composite authentication management mechanism is provided with a procedure to perform a mutual authentication including an On/Off state of the concealment/save mechanism with an opposing bridge, to perform an automatic key exchange, and to determine a common key and the concealment/save mechanism is provided with a key management procedure to manage and hold the common key even after the communication when the concealment/save mechanism is in an On state and provided with a non-decryption file management procedure to manage and hold a file information encrypting and transmitting a payload of an application communicated with the common key at an internal of a transmission side bridge.