Encrypted communication method

• US 7,774,592 B2
• Filed: 12/28/2004
• Issued: 08/10/2010
• Est. Priority Date: 01/14/2004
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Iijima, Akio, Iwata, Atsushi, Ishikawa, Yuichi, Fujita, Norihito
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US10/585,850
• Publication Number:
  US 20080235507A1
• Time in Patent Office: 2,051 Days
• Field of Search: 713/150, 726/3, 726/5, 709/224, 709/245
• US Class Current: 713/150
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

A DNS Proxy unit (A12a) holds the domain name of an encrypted communication target node in a CUG setting table (A125a), intercepts a name resolution request for a communication partner node output from an application (A11x) to a DNS server (B1a), determines by looking up the CUG setting table (A125a) whether the communication partner is an encrypted communication target node, and if the communication partner is an encrypted communication target node, registers the IP address of the name-resolved communication partner in an encrypted communication path setting table (A142a). A data packet sent from the application (A11x) to the IP address is intercepted by a data transmission/reception unit (A14a). A data packet to an IP address registered in the encrypted communication path setting table (A142a) is encrypted by a communication encryption unit (A141a) and transmitted to the communication partner. In this way, in executing encrypted communication with a plurality of communication partners by using a communication encryption function provided by an OS, setting of the encrypted communication target node can be done by using a domain name.

Claims

1. An encrypted communication method characterized by comprising the steps of:

a) causing a communication method resolution unit to determine on the basis of a domain name contained in one of a name resolution query transmitted from an application that communicates with a node apparatus connected to a network to resolve an IP address of the node apparatus and a name resolution response as a response to the name resolution query whether the node apparatus is an encrypted communication target node;

b) causing an encrypted communication path setting unit to register the IP address of the node apparatus in an encrypted communication path setting table when the node apparatus is the encrypted communication target node;

c) causing a name resolution query/response transmission/reception unit to transmit the IP address of the node apparatus contained in the name resolution response to the application;

d) causing the application to transmit a data packet in which the IP address of the node apparatus is set as a destination address; and

e) causing a data transmission/reception unit to receive the data packet transmitted from the application and, if a communication partner IP address set as the destination address of the data packet is registered in the encrypted communication path setting table, encrypt and transmit the data packet.

2. An encrypted communication method according to claim 1, characterized in that processes of the step a, the step b, and the step c are executed by a name resolution proxy unit provided in a node apparatus in which the application operates.

3. An encrypted communication method according to claim 1, characterized in that a process of the step a is executed by a name resolution server, and processes of the step b and the step c are executed by a name resolution proxy unit provided in a node apparatus in which the application operates.

4. An encrypted communication method according to claim 1, characterized in that the communication method resolution unit determines whether the node apparatus is an encrypted communication target node by looking up a setting table in which at least part of the domain name of the encrypted communication target node is registered.

5. An encrypted communication method characterized by comprising the steps of:

a) causing a communication method resolution unit to determine on the basis of a domain name contained in one of a name resolution query transmitted from an application on a client node to resolve an IP address of another node apparatus serving as a communication target of the application and a name resolution response as a response to the name resolution query whether said other node apparatus is an encrypted communication target node;

b) causing an encrypted communication path setting unit to register, in an encrypted communication path setting table, a correspondence between the IP address of said other node apparatus and an intercept address that is not used in any other communication session when said other node apparatus is the encrypted communication target node;

c) causing a name resolution query/response transmission/reception unit to transmit, to the application as the name resolution response, an intercept address corresponding to the IP address of said other node apparatus contained in the name resolution response;

d) causing the application to transmit a data packet in which the intercept address is set as a destination address; and

e) causing a data transmission/reception unit to receive the data packet transmitted from the application, read out, from the encrypted communication path setting table, a communication partner IP address corresponding to the intercept address set as the destination address of the data packet, set the readout communication partner IP address as the destination address of the data packet, and encrypt and transmit the set data packet.

6. An encrypted communication method according to claim 5, characterized in that processes of the step a, the step b, and the step c are executed by a name resolution proxy unit provided in a communication encryption node apparatus having the data transmission/reception unit.

7. An encrypted communication method according to claim 5, characterized in that a process of the step a is executed by a name resolution server, and processes of the step b and the step c are executed by a name resolution proxy unit provided in a communication encryption node apparatus having the data transmission/reception unit.

8. An encrypted communication method according to claim 5, characterized in that the communication method resolution unit determines whether said other node apparatus is an encrypted communication target node by looking up a setting table in which at least part of the domain name of the encrypted communication target node is registered.

9. A node apparatus characterized by comprising:

an application that communicates with another node apparatus connected to a network;

a data transmission/reception unit provided in a kernel unit; and

a name resolution proxy unit which relays a name resolution query transmitted from said application to a name resolution server to resolve an IP address of said other node apparatus and a name resolution response as a response to the name resolution query,

said data transmission/reception unit comprising

an encrypted communication path setting table which holds a communication partner IP address, and

a communication encryption unit which receives a data packet transmitted from said application and encrypts and transmits the data packet when a communication partner IP address set as the destination address of the data packet is registered in said encrypted communication path setting table, and

said name resolution proxy unit comprising an encrypted communication path setting unit which registers, in said encrypted communication path setting table, the IP address of said other node apparatus resolved by the name resolution response if it is determined on the basis of a domain name of said other node apparatus contained in one of the name resolution query and the name resolution response that said other node apparatus is an encrypted communication target node.

10. A node apparatus according to claim 9, characterized in that said encrypted communication path setting table holds a plurality of communication partner IP addresses.

11. A node apparatus according to claim 9, characterized in that said name resolution proxy unit further comprises a communication method resolution unit which determines on the basis of the domain name of said other node apparatus whether said other node apparatus is the encrypted communication target node.

12. A node apparatus according to claim 11, characterized in that

said encrypted communication path setting table holds encrypted communication path setting information to be used for communication with a communication partner in correspondence with the communication partner IP address,

said communication encryption unit reads out corresponding encrypted communication path setting information from said encrypted communication path setting table, encrypts the data packet in accordance with the readout encrypted communication path setting information, and transmits the data packet when the communication partner IP address set as the destination address of the received data packet is registered in said encrypted communication path setting table,

said name resolution proxy unit further comprises a setting table which holds a correspondence between a domain name condition to specify an encrypted communication target node and encrypted communication path setting information,

said communication method resolution unit determines that said other node apparatus is the encrypted communication target node when the domain name of said other node apparatus matches any one of domain name conditions held in said setting table, and

said encrypted communication path setting unit registers, in said encrypted communication path setting table, encrypted communication path setting information corresponding to the matched domain name condition in correspondence with the IP address of said other node apparatus.

13. A node apparatus according to claim 11, characterized in that said communication method resolution unit determines whether said other node apparatus is an encrypted communication target node by looking up a setting table in which at least part of the domain name of the encrypted communication target node is registered.

14. A node apparatus according to claim 9, characterized in that said name resolution proxy unit further comprises a name resolution query/response transmission/reception unit which transmits, to the name resolution server, the name resolution query transmitted from said application to resolve the IP address of said other node apparatus, receives, from the name resolution server, the name resolution response containing a determination result indicating whether said other node apparatus is an encrypted communication target node and the IP address of said other node apparatus, and transmits, to said application, the name resolution response containing the IP address of said other node apparatus contained in the name resolution response.

15. A node apparatus according to claim 14, characterized in that

said encrypted communication path setting table holds encrypted communication path setting information to be used for communication with a communication partner in correspondence with the communication partner IP address,

said communication encryption unit reads out corresponding encrypted communication path setting information from said encrypted communication path setting table, encrypts the data packet in accordance with the readout encrypted communication path setting information, and transmits the data packet when the communication partner IP address set as the destination address of the received data packet is registered in said encrypted communication path setting table,

said name resolution query/response transmission/reception unit receives, from the name resolution server, the name resolution response further containing encrypted communication path setting information in addition to the determination result and the IP address of said other node apparatus, and

said encrypted communication path setting unit registers, in said encrypted communication path setting table, encrypted communication path setting information contained in the name resolution response in correspondence with the IP address of said other node apparatus.

16. A communication encryption node apparatus connected, through a network, to a client node apparatus in which an application that communicates with another node apparatus connected to the network operates, characterized by comprising:

a data transmission/reception unit provided in a kernel unit; and

a name resolution proxy unit which relays a name resolution query transmitted from the application to a name resolution server to resolve an IP address of said other node apparatus and a name resolution response as a response to the name resolution query,

said data transmission/reception unit comprising

an encrypted communication path setting table which holds a correspondence between a communication partner IP address and an intercept address, and

a communication encryption unit which receives a data packet transmitted from the application, reads out, from said encrypted communication path setting table, a communication partner IP address corresponding to an intercept address set as a destination address of the data packet, sets the readout communication partner IP address as the destination address of the data packet, and encrypts and transmits the set data packet, and

said name resolution proxy unit comprising

an encrypted communication path setting unit which registers, in said encrypted communication path setting table, a correspondence between the IP address of said other node apparatus resolved by the name resolution response and an intercept address that is not used in any other communication session if it is determined on the basis of a domain name of said other node apparatus contained in one of the name resolution query and the name resolution response that said other node apparatus is an encrypted communication target node, and

a name resolution query/response transmission/reception unit which transmits, to the application as the name resolution response, the intercept address corresponding to the IP address of said other node apparatus contained in the name resolution response received from the name resolution server.

17. A communication encryption node apparatus according to claim 16, characterized in that said encrypted communication path setting table holds a plurality of correspondences between the communication partner IP address and the intercept address.

18. A communication encryption node apparatus according to claim 17, characterized in that

said encrypted communication path setting table holds encrypted communication path setting information to be used for communication with a communication partner in correspondence with the communication partner IP address and the intercept address,

said communication encryption unit reads out, from said encrypted communication path setting table, encrypted communication path setting information and the communication partner IP address corresponding to the intercept address set as the destination address of the received data packet, encrypts the data packet having the readout communication partner IP address set as the destination address in accordance with the readout encrypted communication path setting information, and transmits the data packet,

said name resolution proxy unit further comprises a setting table which holds a correspondence between a domain name condition to specify an encrypted communication target node and encrypted communication path setting information,

said communication method resolution unit determines that said other node apparatus is the encrypted communication target node when the domain name of said other node apparatus matches any one of domain name conditions held in said setting table, and

said encrypted communication path setting unit registers, in said encrypted communication path setting table, encrypted communication path setting information corresponding to the matched domain name condition in correspondence with the IP address of said other node apparatus and the intercept address.

19. A communication encryption node apparatus according to claim 16, characterized in that said name resolution proxy unit further comprises a communication method resolution unit which determines on the basis of the domain name of said other node apparatus whether said other node apparatus is the encrypted communication target node.

20. A communication encryption node apparatus according to claim 19, characterized in that said communication method resolution unit determines whether said other node apparatus is an encrypted communication target node by looking up a setting table in which at least part of the domain name of the encrypted communication target node is registered.

21. A communication encryption node apparatus according to claim 16, characterized in that said name resolution query/response transmission/reception unit transmits, to the name resolution server, the name resolution query transmitted from the application to resolve the IP address of said other node apparatus, receives, from the name resolution server, the name resolution response containing a determination result indicating whether said other node apparatus is an encrypted communication target node and the IP address of said other node apparatus, and replaces the IP address of said other node apparatus contained in the name resolution response with the intercept address and transmits the name resolution response to the application if it is determined that said other node apparatus is the encrypted communication target node.

22. A communication encryption node apparatus according to claim 21, characterized in that

said encrypted communication path setting table holds encrypted communication path setting information to be used for communication with a communication partner in correspondence with the communication partner IP address and the intercept address,

said communication encryption unit reads out, from said encrypted communication path setting table, encrypted communication path setting information and the communication partner IP address corresponding to the intercept address set as the destination address of the received data packet, encrypts the data packet having the readout communication partner IP address set as the destination address in accordance with the readout encrypted communication path setting information, and transmits the data packet,

said name resolution query/response transmission/reception unit receives, from the name resolution server, the name resolution response further containing encrypted communication path setting information in addition to the determination result and the IP address of said other node apparatus, and

said encrypted communication path setting unit registers, in said encrypted communication path setting table, encrypted communication path setting information contained in the name resolution response in correspondence with the IP address of said other node apparatus and the intercept address.

23. An encrypted communication system characterized by comprising:

a node apparatus in which an application that communicates with another node apparatus connected to a network operates; and

a name resolution server which resolves an IP address of each of said node apparatuses,

said node apparatus comprising

a data transmission/reception unit provided in a kernel unit, and

a name resolution proxy unit which relays a name resolution query transmitted from the application to said name resolution server to resolve the IP address of said other node apparatus and a name resolution response as a response to the name resolution query,

said data transmission/reception unit comprising

an encrypted communication path setting table which holds a communication partner IP address, and

a communication encryption unit which receives a data packet transmitted from the application and encrypts and transmits the data packet when a communication partner IP address set as the destination address of the data packet is registered in said encrypted communication path setting table,

said name resolution server comprising a communication method resolution unit which determines on the basis of a domain name of said other node apparatus contained in one of the name resolution query and the name resolution response whether said other node apparatus is an encrypted communication target node, and

said name resolution proxy unit comprising an encrypted communication path setting unit which registers, in said encrypted communication path setting table, the IP address of said other node apparatus resolved by the name resolution response if said other node apparatus is an encrypted communication target node.

24. An encrypted communication system according to claim 23, characterized in that said encrypted communication path setting table holds a plurality of communication partner IP addresses.

25. An encrypted communication system according to claim 23, characterized in that

said encrypted communication path setting table holds encrypted communication path setting information to be used for communication with a communication partner in correspondence with the communication partner IP address,

said communication encryption unit reads out corresponding encrypted communication path setting information from said encrypted communication path setting table, encrypts the data packet in accordance with the readout encrypted communication path setting information, and transmits the data packet when the communication partner IP address set as the destination address of the received data packet is registered in said encrypted communication path setting table,

said name resolution server comprises

a setting table which holds a correspondence between a domain name condition to specify an encrypted communication target node and encrypted communication path setting information,

means, serving as said communication method resolution unit, for determining whether the domain name of said other node apparatus matches any one of domain name conditions held in said setting table, and

a name resolution query/response transmission/reception unit which adds encrypted communication path setting information corresponding to the matched domain name condition to the name resolution response and transmits the name resolution response, and

said encrypted communication path setting unit registers the encrypted communication path setting information in said encrypted communication path setting table in correspondence with the IP address of said other node apparatus upon receiving the name resolution response added the encrypted communication path setting information from said name resolution server.

26. An encrypted communication system according to claim 23, characterized in that said communication method resolution unit determines whether said other node apparatus is an encrypted communication target node by looking up a setting table in which at least part of the domain name of the encrypted communication target node is registered.

27. An encrypted communication system characterized by comprising:

a client node apparatus in which an application that communicates with another node apparatus connected to a network operates;

a communication encryption node apparatus connected to said client node apparatus through the network; and

a name resolution server which resolves an IP address of each of said node apparatuses,

said communication encryption node apparatus comprising

a data transmission/reception unit provided in a kernel unit, and

a name resolution proxy unit which relays a name resolution query transmitted from the application to said name resolution server to resolve the IP address of said other node apparatus and a name resolution response as a response to the name resolution query,

said data transmission/reception unit comprising

an encrypted communication path setting table which holds a correspondence between a communication partner IP address and an intercept address, and

a communication encryption unit which receives a data packet transmitted from the application, reads out, from said encrypted communication path setting table, a communication partner IP address corresponding to an intercept address set as a destination address of the data packet, sets the readout communication partner IP address as the destination address of the data packet, and encrypts and transmits the set data packet,

said name resolution server comprising a communication method resolution unit which determines on the basis of a domain name of said other node apparatus contained in one of the name resolution query and the name resolution response whether said other node apparatus is an encrypted communication target node, and

said name resolution proxy unit comprising

an encrypted communication path setting unit which registers, in said encrypted communication path setting table, a correspondence between the IP address of said other node apparatus resolved by the name resolution response and an intercept address that is not used in any other communication session if said other node apparatus is an encrypted communication target node, and

a name resolution query/response transmission/reception unit which transmits, to the application as the name resolution response, the intercept address corresponding to the IP address of said other node apparatus contained in the name resolution response received from the name resolution server.

28. An encrypted communication system according to claim 27, characterized in that said encrypted communication path setting table holds a plurality of correspondences between the communication partner IP address and the intercept address.

29. An encrypted communication system according to claim 27, characterized in that

said encrypted communication path setting table holds encrypted communication path setting information to be used for communication with a communication partner in correspondence with the communication partner IP address and the intercept address,

said communication encryption unit reads out, from said encrypted communication path setting table, encrypted communication path setting information and the communication partner IP address corresponding to the intercept address set as the destination address of the received data packet, encrypts the data packet having the readout communication partner IP address set as the destination address in accordance with the readout encrypted communication path setting information, and transmits the data packet,

said name resolution server comprises

a setting table which holds a correspondence between a domain name condition to specify an encrypted communication target node and encrypted communication path setting information,

means, serving as said communication method resolution unit, for determining whether the domain name of said other node apparatus matches any one of domain name conditions held in said setting table, and

a name resolution query/response transmission/reception unit which adds encrypted communication path setting information corresponding to the matched domain name condition to the name resolution response and transmits the name resolution response, and

said encrypted communication path setting unit registers the encrypted communication path setting information in said encrypted communication path setting table in correspondence with the IP address of said other node apparatus and the intercept address upon receiving the name resolution response added the encrypted communication path setting information from said name resolution server.

30. An encrypted communication system according to claim 27, characterized in that said communication method resolution unit determines whether said other node apparatus is an encrypted communication target node by looking up a setting table in which at least part of the domain name of the encrypted communication target node is registered.

31. A non-transitory computer-readable medium having stored thereon a program which enables a computer included in a node apparatus, the node apparatus having an application operates therein which communicates with another node apparatus connected to a network, to function as:

communication encryption means provided in a data transmission/reception unit of a kernel unit, and name resolution proxy means for relaying a name resolution query transmitted from the application to a name resolution server to resolve an IP address of said other node apparatus and a name resolution response as a response to the name resolution query, characterized in that;

the program enables said communication encryption means to receive a data packet transmitted from the application and encrypt and transmit the data packet when a communication partner IP address set as the destination address of the data packet is registered in an encrypted communication path setting table that holds a communication partner IP address, and

the program enables an encrypted communication path setting means, of said name resolution proxy means, to register, in the encrypted communication path setting table, the IP address of said other node apparatus resolved by the name resolution response if it is determined on the basis of a domain name of said other node apparatus contained in one of the name resolution query and the name resolution response that said other node apparatus is an encrypted communication target node.

32. A non-transitory computer-readable medium according to claim 31, characterized in that the encrypted communication path setting table holds a plurality of communication partner IP addresses.

33. A non-transitory computer-readable medium according to claim 31, characterized in that the program further enables a communication method resolution means, of said name resolution proxy means, to determine, on the basis of the domain name of said other node apparatus, whether said other node apparatus is an encrypted communication target node.

34. A non-transitory computer-readable medium according to claim 33, characterized in that

the encrypted communication path setting table holds encrypted communication path setting information to be used for communication with a communication partner in correspondence with the communication partner IP address,

the program further enables said communication encryption means to read out corresponding encrypted communication path setting information from said encrypted communication path setting table, encrypt the data packet in accordance with the readout encrypted communication path setting information, and transmit the data packet when the communication partner IP address set as the destination address of the received data packet is registered in said encrypted communication path setting table,

the program further enables said communication method resolution means to determine that said other node apparatus is an encrypted communication target node when the domain name of said other node apparatus matches any one of domain name conditions held in a setting table that holds a correspondence between a domain name condition to specify an encrypted communication target node and encrypted communication path setting information, and

the program further enables said encrypted communication path setting means to register, in the encrypted communication path setting table, encrypted communication path setting information corresponding to the matched domain name condition in correspondence with the IP address of said other node apparatus.

35. A non-transitory computer-readable medium according to claim 33, characterized in that the program further enables said communication method resolution means to determine whether said other node apparatus is an encrypted communication target node by looking up a setting table in which at least part of the domain name of the encrypted communication target node is registered.

36. A non-transitory computer-readable medium according to claim 31, characterized in that the program further enables a name resolution query/response transmission/reception means, of said name resolution proxy means, to transmit, to the name resolution server, the name resolution query transmitted from the application to resolve the IP address of said other node apparatus, receive, from the name resolution server, the name resolution response containing a determination result indicating whether said other node apparatus is an encrypted communication target node and the IP address of said other node apparatus, and transmit, to the application, the name resolution response containing the IP address of said other node apparatus contained in the name resolution response.

37. A non-transitory computer-readable medium according to claim 36, characterized in that

the encrypted communication path setting table holds encrypted communication path setting information to be used for communication with a communication partner in correspondence with the communication partner IP address,

the program further enables said communication encryption means to read out corresponding encrypted communication path setting information from the encrypted communication path setting table, encrypt the data packet in accordance with the readout encrypted communication path setting information, and transmit the data packet when the communication partner IP address set as the destination address of the received data packet is registered in the encrypted communication path setting table,

the program further enables said name resolution query/response transmission/reception means to receive, from the name resolution server, the name resolution response further containing encrypted communication path setting information in addition to the determination result and the IP address of said other node apparatus, and

the program further enables said encrypted communication path setting means to register, in the encrypted communication path setting table, encrypted communication path setting information contained in the name resolution response in correspondence with the IP address of said other node apparatus.

38. A non-transitory computer-readable medium having stored thereon a program which enables a computer included in a communication encryption node apparatus connected, through a network, to a client node apparatus having an application that operates therein and communicates with another node apparatus connected to the network, to function as

communication encryption means provided in a data transmission/reception unit of a kernel unit, and name resolution proxy means for relaying a name resolution query transmitted from the application to a name resolution server to resolve an IP address of said other node apparatus and a name resolution response as a response to the name resolution query, characterized in that

the program further enables said communication encryption means to receive a data packet transmitted from the application, read out, from an encrypted communication path setting table that holds a correspondence between a communication partner IP address and an intercept address, a communication partner IP address corresponding to an intercept address set as a destination address of the data packet, set the readout communication partner IP address as the destination address of the data packet, and encrypt and transmit the set data packet,

the program further enables an encrypted communication path setting means of said name resolution proxy means to register, in the encrypted communication path setting table, a correspondence between the IP address of said other node apparatus resolved by the name resolution response and an intercept address that is not used in any other communication session if it is determined on the basis of a domain name of said other node apparatus contained in one of the name resolution query and the name resolution response that said other node apparatus is an encrypted communication target node, and

the program further enables a name resolution query/response transmission/reception means, of said name resolution proxy means, to transmit, to the application as the name resolution response, the intercept address corresponding to the IP address of said other node apparatus contained in the name resolution response received from the name resolution server.

39. A non-transitory computer-readable medium according to claim 38, characterized in that the encrypted communication path setting table holds a plurality of correspondences between the communication partner IP address and the intercept address.

40. A non-transitory computer readable medium according to claim 38, characterized in that the program further enables communication method resolution means of said name resolution proxy means, to determine on the basis of the domain name of said other node apparatus whether said other node apparatus is the encrypted communication target node.

41. A non-transitory computer-readable medium according to claim 40, characterized in that

the encrypted communication path setting table holds encrypted communication path setting information to be used for communication with a communication partner in correspondence with the communication partner IP address and the intercept address,

the program further enables said communication encryption means to read out, from the encrypted communication path setting table, encrypted communication path setting information and the communication partner IP address corresponding to the intercept address set as the destination address of the received data packet, encrypt the data packet having the readout communication partner IP address set as the destination address in accordance with the readout encrypted communication path setting information, and transmit the data packet,

the program further enables said communication method resolution means to determine that said other node apparatus is an encrypted communication target node when the domain name of said other node apparatus matches any one of domain name conditions held in a setting table that holds a correspondence between a domain name condition to specify an encrypted communication target node and encrypted communication path setting information, and

the program further enables said encrypted communication path setting means to register, in the encrypted communication path setting table, encrypted communication path setting information corresponding to the matched domain name condition in correspondence with the IP address of said other node apparatus and the intercept address.

42. A non-transitory computer-readable medium according to claim 40, characterized in that the program further enables said communication method resolution means to determine whether said other node apparatus is an encrypted communication target node by looking up a setting table in which at least part of the domain name of the encrypted communication target node is registered.

43. A non-transitory computer-readable medium according to claim 38, characterized in that the program further enables said name resolution query/response transmission/reception means to transmit, to the name resolution server, the name resolution query transmitted from the application to resolve the IP address of said other node apparatus, receive, from the name resolution server, the name resolution response containing a determination result indicating whether said other node apparatus is an encrypted communication target node and the IP address of said other node apparatus, and replace the IP address of said other node apparatus contained in the name resolution response with the intercept address and transmit the name resolution response to the application if it is determined that said other node apparatus is the encrypted communication target node.

44. A non-transitory computer-readable medium according to claim 43, characterized in that

the encrypted communication path setting table holds encrypted communication path setting information to be used for communication with a communication partner in correspondence with the communication partner IP address and the intercept address,

the program further enables said communication encryption means to read out, from the encrypted communication path setting table, encrypted communication path setting information and the communication partner IP address corresponding to the intercept address set as the destination address of the received data packet, encrypt the data packet having the readout communication partner IP address set as the destination address in accordance with the readout encrypted communication path setting information, and transmit the data packet,

the program further enables said name resolution query/response transmission/reception means to receive, from the name resolution server, the name resolution response further containing encrypted communication path setting information in addition to the determination result and the IP address of said other node apparatus, and

the program further enables said encrypted communication path setting means to register, in the encrypted communication path setting table, encrypted communication path setting information contained in the name resolution response in correspondence with the IP address of said other node apparatus and the intercept address.