METHOD, APPARATUS, AND SYSTEM FOR MONITORING ENCRYPTED COMMUNICATION SESSION

• US 20180198766A1
• Filed: 06/02/2016
• Published: 07/12/2018
• Est. Priority Date: 07/06/2015
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: MOON, Han-gil, PARK, Jin-soo
• Granted Patent: US 11,153,287 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 65/1066 Session management
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0471 Key exchange
• CPC Class Codes: H04W 12/80 Arrangements enabling lawful interception [LI]
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

The disclosure relates to a method of supporting monitoring of an encrypted data communication session of a first device, the method comprising: receiving a signal for initiating a communication session with a second device; generating an encryption key for encryption of the communication session; determining whether a monitoring signal is received for the communication session; and transmitting information about the encryption key to the second device by using a predetermined packet based on the determination.

Claims

1. A method of supporting monitoring of an encrypted data communication session of a first device, the method comprising:

receiving a signal for initiating a communication session with a second device;

generating an encryption key for encryption of the communication session;

determining whether a monitoring signal is received for the communication session; and

transmitting information about the encryption key to the second device by using a predetermined packet based on the determination.

2. The method of claim 1, wherein a third device obtains the information about the encryption key by obtaining the predetermined packet.

3. The method of claim 1, wherein the generating of the encryption key comprises:

generating the encryption key based on at least one of an encryption algorithm of the first device and the second device, a public key of the communication session, and a private key of the first device.

4. The method of claim 1, wherein the generating of the encryption key comprises:

generating the encryption key to be different from an encryption key generated by the second device.

5. The method of claim 1,

wherein the generating of the encryption key comprises:

generating the encryption key for each of at least one piece of content transmitted and received via the communication session,

wherein the determining whether the monitoring signal is received comprises;

determining which content among the at least one piece of content relates to the received monitoring signal, and

wherein the transmitting of the information about the encryption key to the second device by using the predetermined packet based on the determination comprises;

transmitting information about an encryption key of the content to be monitored to the second device by using the predetermined packet based on determination.

6. The method of claim 1, wherein the transmitting of the information about the encryption key to the second device by using the predetermined packet based on the determination comprises:

transmitting the information about the encryption key to the second device by using a packet including a ZRTP confirm message.

7. The method of claim 1, wherein the generating of the encryption key for encryption of the communication session comprises:

receiving, from the second device, encryption protocol version information used for encryption of the communication session, an identifier for identifying a session with the second device, and information about an encryption algorithm supported by the second device;

determining an encryption algorithm for generating the encryption key based on the received information; and

generating the encryption key by using the determined encryption algorithm.

15. A non-transitory computer-readable recording medium having recorded thereon a program for executing the method of claim 1.

8. A method of supporting monitoring of an encrypted communication session, the method comprising:

a first device receiving a signal for initiating a communication session with a second device;

a third device transmitting a monitoring signal for a communication session to the first device;

the first device generating an encryption key for encryption of the communication session;

the first device transmitting information about the encryption key to the second device through a predetermined packet based on whether the monitoring signal is received;

the third device obtaining the predetermined packet to be transmitted to the second device based on at least one of address information of the first device and address information of the second device; and

the third device generating an encryption key for the communication session based on information about the encryption key included in the predetermined packet,

wherein the third device decrypts encrypted data transmitted and received through the communication session based on the generated encryption key.

9. The method of claim 8,

wherein the generating of the encryption key comprises:

generating an encryption key for each of at least one piece of content transmitted and received via the communication session,

wherein the transmitting of the monitoring signal comprises;

determining which content to monitor among the at least one piece of content; and

transmitting a monitoring signal based on the determination, and

wherein the transmitting of the information about the encryption key to the second device by using the predetermined packet comprises;

transmitting information about an encryption key of the content to be monitored to the second device by using the predetermined packet based on the received monitoring signal.

10. The method of claim 8, wherein the encryption key generated by the third device is the same as the encryption key generated by the first device and is different from the encryption key generated by the second device, and

wherein the third device decrypts only data transmitted from the first device to the second device based on the generated encryption key.

11. A first device for supporting monitoring of an encrypted data communication session, the first device comprising:

a receiver configured to receive a signal for initiating a communication session with a second device;

a controller configured to generate an encryption key for encryption of the communication session and determine whether a monitoring signal is received for the communication session; and

a transmitter configured to transmit information about the encryption key to the second device by using a predetermined packet based on the determination.

12. The first device of claim 11,

wherein the controller is further configured to generate the encryption key for each of at least one piece of content transmitted and received via the communication session, and determine which content among the at least one piece of content relates to the received monitoring signal, and

wherein the transmitter is further configured to transmit information about an encryption key of the content to be monitored to the second device by using the predetermined packet based on the determination.

13. The first device of claim 11,

wherein the receiver is further configured to receive, from the second device, encryption protocol version information used for encryption of the communication session, an identifier for identifying a session with the second device, and information about an encryption algorithm supported by the second device, and

wherein the controller is further configured to determine an encryption algorithm for generating the encryption key based on the received information and generate the encryption key by using the determined encryption algorithm.

14. A third device for monitoring an encrypted data communication channel between a first device and a second device, the third device comprising:

an address information obtainer configured to obtain address information of the first device or the second device;

a transmitter configured to transmit a monitoring signal for a communication session between the first device and the second device;

a receiver configured to obtain a predetermined packet including information about an encryption key of the communication session transmitted through the communication session to be monitored based on the obtained address information; and

a controller configured to generate an encryption key of the communication session based on the information about the encryption key and decrypt encrypted data transmitted and received through the communication session based on the generated encryption key.