System and scheme of cipher communication

• US 5,600,722 A
• Filed: 10/06/1994
• Issued: 02/04/1997
• Est. Priority Date: 10/06/1993
• Status: Expired due to Term

• Current Assignee: Nippon Telegraph and Telephone Corporation
• Original Assignee: Nippon Telegraph and Telephone Corporation
• Inventors: Yamaguchi, Toshikazu, Tanaka, Kiyoto
• Primary Examiner(s): Barron, Jr., Gilberto
• Application Number:
  US08/319,449
• Time in Patent Office: 852 Days
• Field of Search: 380/21, 380/30, 380/49, 380/48
• US Class Current: 713/155
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner

Abstract

A cipher communication system and scheme capable of realizing the cipher communication without affecting the already existing application programs and hardware, and establishing a synchronization at the start and end of the cipher communication. In the cipher communication, the session key generated by the key distribution center are obtained and shared at the first and second terminals at a timing of a request for establishing a cipher communication session between the first and second terminals, and then the cipher communication between the first and second terminals is carried out by using the shared session key. The synchronization at the start and end of the cipher communication is established by the matching of the synchronization data transmitted from the first terminal to second terminal or its enciphered form with the return data from the second terminal to the first terminal which is either the synchronization data as received at the second terminal, or its enciphered form depending on the communication state of the second terminal.

Claims

1. A method of cipher communication, comprising the steps of:

connecting a plurality of terminals with a key distribution center through a network;

generating a session key to be used in a cipher communication between first and second terminals among said plurality of terminals at the key distribution center;

obtaining and sharing the session key generated by the key distribution center at the first and second terminals at a timing of a request for establishing a cipher communication session between the first and second terminals during a connection establishing procedure; and

carrying out the cipher communication between the first and second terminals by establishing the cipher communication session between the first and second terminals by completing the connection establishing procedure and using the session key obtained at the obtaining step.

2. The method of claim 1, wherein at the obtaining step, the session key is distributed from the key distribution center to the first and second terminals by connectionless communications among the first and second terminals and the key distribution center which are carried out at the timing of the request for establishing the cipher communication session between the first and second terminals.

3. The method of claim 1, wherein at the obtaining step, the session key is distributed from the key distribution center to the first and second terminals by utilizing a key distribution session established among the first and second terminals and the key distribution center at the timing of the request for establishing the cipher communication session between the first and second terminals, where the key distribution session is closed after the session key is distributed from the key distribution center to the first and second terminals.

4. The method of claim 3, wherein at the obtaining step, the first terminal establishes the key distribution session with a specific port of the second terminal, and the second terminal establishes the key distribution session with the key distribution center at a timing of an establishment of the key distribution session at the specific port.

5. The method of claim 4, wherein at the obtaining step, the first terminal has a table registering a terminal identification of the second terminal and port numbers labelling ports of the second terminal, and establishes the key distribution session with the specific port of the second terminal according to the table.

6. The method of claim 3, wherein at the obtaining step, the first terminal transmits the session key obtained from the key distribution center and data for mapping the session key and the cipher communication session to the second terminal by utilizing the key distribution session between the first and second terminals.

7. The method of claim 6, wherein the terminals carry out communication using TCP/IP as a connection-oriented communication protocol, and the data for mapping the session key and the cipher communication session includes IP addresses of the first and second terminals and port numbers of ports of the first and second terminals to be used in the cipher communication session.

8. A cipher communication system, comprising:

a plurality of terminals including fist and second terminals for carrying out a cipher communication by establishing a cipher communication session between the first and second terminals; and

a key distribution center, connected with said plurality of terminals through a network, for generating a session key to be used in the cipher communication between first and second terminals;

wherein each terminal includes detecting means for detecting a request for establishing the cipher communication session between the first and second terminals such that the session key generated by the key distribution center is obtained and shared by the first and second terminals at a timing of the request for establishing the cipher communication session between the first and second terminals detected by the detecting means during a connection establishing procedure for establishing the cipher communication session.

9. The system of claim 8, wherein each terminal further includes communication means for carrying out a connectionless communication with other terminals and the key distribution center such that the session key is distributed from the key distribution center to the first and second terminals by connectionless communications among the first and second terminals and the key distribution center which are carried out at the timing of the request for establishing the cipher communication session between the first and second terminals detected by the detecting means.

10. The system of claim 8, wherein each terminal further includes session establishing means for establishing a session with other terminals and the key distribution means such that the session key is distributed from the key distribution center to the first and second terminals by utilizing a key distribution session established among the first and second terminals and the key distribution center at the timing of the request for establishing the cipher communication session between the first and second terminals detected by the detecting means, where the key distribution session is closed after the session key is distributed from the key distribution center to the first and second terminals.

11. The system of claim 10, wherein the session establishing means of the first terminal establishes the key distribution session with a specific port of the second terminal, and the session establishing means of the second terminal establishes the key distribution session with the key distribution center at a timing of an establishment of the key distribution session at the specific port.

12. The system of claim 11, wherein the session establishing means of the first terminal has a table registering a terminal identification of the second terminal and port numbers labelling ports of the second terminal, and establishes the key distribution session with the specific port of the second terminal according to the table.

13. The system of claim 10, wherein the communication means of the first terminal transmits the session key obtained from the key distribution center and data for mapping the session key and the cipher communication session to the second terminal by utilizing the key distribution session between the first and second terminals.

14. The system of claim 13, wherein the communication means of the terminals carry out communication using TCP/IP as a connection-oriented communication protocol, and the data for mapping the session key and, the cipher communication session includes IP addresses of the first and second terminals and port numbers of ports of the first and second terminals to be used in the cipher communication session.

15. The system of claim 8, wherein the detecting means of each terminal comprises a cipher gateway means, connected between each terminal and the network, for detecting the request for establishing the cipher communication session by monitoring outputs of each terminal.

16. The system of claim 8, wherein each terminal further includes a communication module for issuing the request for establishing the cipher communication session.