Key allocating method and key allocation system for encrypted communication

• US 7,443,986 B2
• Filed: 09/01/2004
• Issued: 10/28/2008
• Est. Priority Date: 04/08/2004
• Status: Expired due to Fees

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Hoshino, Kazuyoshi, Fujishiro, Takahiro, Kaji, Tadashi, Takata, Osamu
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Cervetti; David Garcia
• Application Number:
  US10/931,219
• Publication Number:
  US 20050226424A1
• Time in Patent Office: 1,518 Days
• Field of Search: 713/153, 713/155, 380/279
• US Class Current: 380/279
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819

Abstract

Both a management server and a validation server are installed. Both a terminal and a terminal register setting information which is usable in an encrypted communication in the management server. When carrying out the encrypted communication, the management server searches the registered setting information for coincident setting information. The management server generates keys for the encrypted communications which can be used by the terminals, and delivers these generated keys in combination with the coincident setting information. The management server authenticates both the terminals in conjunction with the validation server. Since the terminals trust such results that the management server has authenticated the terminals respectively, these terminals need not authenticate the respective communication counter terminals.

Claims

1. A communication system in which a communication source apparatus and a communication destination apparatus perform an encrypted communication with each other;

wherein;

the communication source registers, at a management server, store a first setting information for the encrypted communication including a plurality of setting items whose setting values are to be determined in order to designate an encryption key available for the communication source apparatus;

the communication destination registers, at the managing server, store a second setting information for the encrypted communication including a plurality of setting items whose setting values are to be determined in order to designate an encryption key available for the communication destination apparatus;

said communication source apparatus transmits a connection request between communication source apparatus and communication destination apparatus to the management server;

said management server searches the first and the second setting information having been previously registered into the management server respectively by both said communication source apparatus and said communication destination apparatus for setting information, for at least one of the setting items, the setting item to be searched being available for both the communication source apparatus and the communication destination apparatus designated by reception of the connection request in order to generate an encryption key; and

in the case that the management server can search for the setting item in order to generate the encryption key available for both the communication source apparatus and the communication destination apparatus, both the communication source apparatus and the communication destination apparatus perform an encrypted communication by employing the encryption key for the encrypted communication, which has been produced based upon the searched setting item for the encrypted communication, without the management server relaying data of the encrypted communication between the communication source apparatus and the communication destination apparatus.

2. A communication system as claimed in claim 1 wherein:

said management server transmits said connection request to said communication destination apparatus; and

said communication destination apparatus judges as to whether or not said connection request can be accepted.

3. A communication system as claimed in claim 1 wherein:

said management server produces the key used in said encrypted communication based upon the coincident setting item for the encrypted communication, and transmits said key used in the encrypted communication to both the communication source apparatus and the communication destination apparatus.

4. A communication system as claimed in claim 1 wherein:

said management server produces information which constitutes a seed of the key used in the encrypted communication based upon the setting item for the encrypted communication, and transmits said produced information which constitutes the seed of the key used in the encrypted communication to both the communication source apparatus and the communication destination apparatus; and

both said communication source apparatus and said communication destination apparatus produce the keys used in said encrypted communication based upon the received information which constitutes the seed of the key, respectively.

5. A communication system as claimed in claim 1 wherein;

each of said communication source apparatus and said communication destination apparatus registers the setting item of said setting information for the encrypted communications into said management server, while priority orders are applied to said plurality of setting information for the encrypted communications; and

said management server refers to said priority orders so as to search said plurality of setting item.

6. A communication system as claimed in claim 1 wherein:

said communication source apparatus establishes an encrypted communication path between the own communication source apparatus and said management server in order to transmit said connection request to said communication destination apparatus; and

said management server establishes an encrypted communication path between the own management server and said communication destination apparatus in order to transmit said connection request from said communication source apparatus to said communication destination apparatus by said communication source apparatus.

7. A communication system as claimed in claim 6 wherein:

said communication system is further comprised of;

a validation server;

said communication source apparatus transmits a public key certificate of said communication source apparatus to said management server;

said management server requests said validation server to verify the public key certificate of said communication source apparatus;

said validation server verifies the public key certificate of said communication source apparatus, and then, responds a validation result to said management server; and

said management server establishes said encrypted communication path between said communication source apparatus and said management server in the case that the validation as to the public key certificate of said communication source apparatus can succeed.

8. A communication system as claimed in claim 7 wherein:

said communication destination apparatus transmits a public key certificate of said communication destination apparatus to said management server;

said management server requests said validation server to verify the public key certificate of said communication destination apparatus;

said validation server verifies the public key certificate of said communication destination apparatus, and then, responds a validation result to said management server; and

said management server establishes said encrypted communication path between the said management server and said communication destination apparatus in the case that the validation as to the public key certificate of said communication destination apparatus can succeed.

9. A communication system as claimed in claim 8 wherein:

said communication source apparatus or said communication destination apparatus requests said management server to transmit the public key certificate of said management server;

said management server transmits said requested public key certificate of said management server to said apparatus that requested transmitting the public key certificate; and

said apparatus that requested transmitting the public key certificate receives the public key certificate of said management server from said management server, and verifies the public key certificate of said management server, and also, establishes said encrypted communication path between said communication source apparatus and said management server in such a case that the validation can succeed.

10. A communication system as claimed in claim 6 wherein:

said communication source apparatus and/or said communication destination apparatus registers the setting information for the encrypted communication between said communication source apparatus and said communication destination apparatus into said management server by employing said encrypted communication path.

11. A communication system as claimed in claim 1, wherein:

the management server is configured to produce an encrypted key and to distribute the encrypted key to each of the communication apparatuses.