Communication device, communication system, communication method, and program

• US 8,250,643 B2
• Filed: 02/23/2006
• Issued: 08/21/2012
• Est. Priority Date: 02/28/2005
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Enomoto, Nobuyuki, Yoshimi, Hideo, Hidaka, Youichi
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US11/885,249
• Publication Number:
  US 20080137855A1
• Time in Patent Office: 2,371 Days
• Field of Search: 726/12, 726/15
• US Class Current: 726/12
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A TCP 2003 is terminated in an intermediate driver 2006 within a gateway device 20, a TCP 3003 is terminated in an intermediate driver 3006 within a gateway device 30, and a frame is transferred between the intermediate drivers with a method not causing a congestion control such as a UDP. Besides, an SSL session is constructed between an SSL 2002 and an SSL 3002, and upon completing construction of the session, a public key and a secret key are sent by means of an Ethernet frame from a processing speed acceleration engine control to a processing speed acceleration engine. Thus, the gateway device transfers the frame not through a CPU but by employing the processing speed acceleration engine within an NIC in later communication between a terminal 21 and a server 31.

Claims

1. A communication system, comprising:

a first terminal which transmits a frame in a first TCP session; and

a first communication device comprising i) a central processing unit establishing a second TCP session over the first TCP session in order to transfer the frame received from the first terminal, and ii) an intermediate driver which terminates the second TCP session established by the central processing unit in the first communication device in order to terminate the second TCP session inside the first communication device and then transfers the frame through the first TCP session to a second terminal,

wherein the first communication device that receives the frame from the first terminal over the first TCP connection is the only device that establishes the second TCP connection over the existing first TCP connection so that the second TCP connection does not occur elsewhere over the Internet.

2. The communication system according to claim 1, wherein said first communication device further comprises a transferring means which deletes header information included in the frame as received from the first terminal and transfers the frame, with the header information deleted, back to the second terminal.

3. The communication system according to claim 2, wherein,

said transferring means comprises an encrypting means for preserving an encryption key that is used in employing said first TCP session to make encrypted communication, and upon receipt of a processing speed acceleration process start command, employing this preserved encryption key to encrypt or decode the frame.

4. The communication system according to claim 2, wherein,

said transferring means comprises an encrypting key acquiring means for acquiring an encryption key that is used in employing the first TCP session to make encrypted communication,

an encryptor for preserving said acquired encryption key, and upon receipt of a processing speed acceleration process start command, employing the preserved encryption key to encrypt the frame for transmission as an encrypted frame,

an encapsulator for adding an encryption header and an encapsulation header to said encrypted frame,

a de-encapsulator for deleting the encryption header and the encapsulation header from the received frame, and

a decoder for employing said preserved encryption key to decode the frame from which said encryption header and said encapsulation header have been deleted.

5. A communication system, comprising:

a first terminal which creates a first SSL session and transmits an Ether-over-SSL frame in a first TCP session; and

a first communication device comprising i) a central processing unit establishing a second TCP session over the first TCP session in order to transfer the frame received from the first terminal, and ii) an intermediate driver which terminates the second TCP session established by the central processing unit in the first communication device in order to terminate the second TCP session inside the first communication device and then transfers the frame of the first TCP session to a second terminal within the first SSL,

wherein the first communication device that receives the frame from the first terminal over the first TCP connection is the only device that establishes the second TCP connection over the existing first TCP connection so that the second TCP connection does not occur elsewhere over the Internet.

6. A communication device, comprising:

a central processing unit configured for receiving a frame of a first TCP session from a first terminal, the central processing unit establishing a second TCP session over the first TCP session in order to transfer the frame received from the first terminal; and

an intermediate driver which terminates the second TCP session established by the central processing unit in the first communication device in order to terminate the second TCP session inside the first communication device and then transfers the frame of the first TCP session to a second terminal,

wherein the first communication device that receives the frame from the first terminal over the first TCP connection is the only device that establishes the second TCP connection over the existing first TCP connection so that the second TCP connection does not occur elsewhere over the Internet.

7. The communication device according to claim 6, further comprising a transferring means which deletes header information included in the frame as received from the first terminal and transfers the frame back to the second terminal.

8. The communication device according to claim 7, wherein said transferring means comprises an encrypting means for preserving an encryption key that is used in employing said first TCP session to make encrypted communication, and upon receipt of a processing speed acceleration process start command, employing this preserved encryption key to encrypt or decode the frame.

9. The communication device according to claim 7, wherein,

said transferring means comprises an encrypting key acquiring means for acquiring an encryption key that is used in employing the first TCP session to make encrypted communication,

an encryptor for preserving said acquired encryption key, and upon receipt of a processing speed acceleration process start command, employing the preserved encryption key to encrypt the frame for transmission as an encrypted frame,

an encapsulator for adding an encryption header and an encapsulation header to said encrypted frame,

a de-encapsulator for deleting the encryption header and the encapsulation header from the received frame, and

a decoder for employing said preserved encryption key to decode the frame from which said encryption header and said encapsulation header have been deleted.

10. A communication method of making communication via a TCP session, comprising:

a call-origination step of a first terminal transmitting a frame in a first TCP session; and

a connecting step of a first communication device receiving the frame over the first TCP session from the first terminal, the first communication device comprising i) a central processing unit establishing a second TCP session over the first TCP session in order to transfer the frame received from the first terminal, and ii) an intermediate driver terminating the second TCP session established by the central processing unit in the first communication device in order to terminate the second TCP session inside the first communication device and then transferring the frame of the first TCP session to a second terminal,

wherein the first communication device that receives the frame from the first terminal over the first TCP connection is the only device that establishes the second TCP connection over the existing first TCP connection so that the second TCP connection does not occur elsewhere over the Internet.

11. The communication method according to claim 10, wherein said connecting step further comprises:

an acquiring step of acquiring an encryption key that is used in employing the first TCP session to make encrypted communication; and

an encryption step of, upon receipt of a processing speed acceleration process start command, employing said preserved encryption key to encrypt the frame for transmission as an encrypted frame.

12. The communication method according to claim 10, wherein said connecting step comprises:

an acquiring step of acquiring an encryption key that is used in employing the first TCP session to make encrypted communication; and

a decoding step of, upon receipt of a processing speed acceleration process start command, employing said preserved encryption key to decode the frame transmitted from the first terminal.

13. The communication method according to claim 11, wherein said connecting step comprises:

an acquiring step of acquiring an encryption key that is used in employing the first TCP session to make encrypted communication; and

a decoding step of, upon receipt of a processing speed acceleration process start command, employing said preserved encryption key to decode the frame transmitted from the first terminal.

14. A communication method of making communication via a TCP session, comprising:

using a communication device comprised of a central processing unit, to receive a frame of a first TCP session from a first terminal, the central processing unit establishing a second TCP session over the first TCP session in order to transfer the frame received from the first terminal;

using an intermediate driver of the communication device, terminating the second TCP session established by the central processing unit in the first communication device in order to terminate the second TCP session inside the first communication device and then transferring the frame of the first TCP session to a second terminal, including

an encryption key acquisition step of acquiring an encryption key that is used in employing the first TCP session to make encrypted communication;

an encryption step of preserving said acquired encryption key, and upon receipt of a processing speed acceleration process start command, employing the preserved encryption key to encrypt the frame for transmission as an encrypted frame;

a transmission step of adding an encryption header and an encapsulation header to said encrypted frame, and transmitting said encrypted frame in the first TCP session to a second terminal;

a de-encapsulation step of deleting the encryption header and the encapsulation header from the received frame; and

a decoding step of employing said preserved encryption key to decode the frame from which said encryption header as well as said encapsulation header have been deleted,

wherein the first communication device that receives the frame from the first terminal over the first TCP connection is the only device that establishes the second TCP connection over the existing first TCP connection so that the second TCP connection does not occur elsewhere over the Internet.

15. A non-transitory tangible computer readable medium storing a program of a communication device, the program causing said communication device to function as:

a communication device comprised of i) a central processing unit configured for receiving a frame of a first TCP session from a first terminal, the central processing unit establishing a second TCP session over the first TCP session in order to transfer the frame received from the first terminal; and

ii) an intermediate driver which terminates the second TCP session established by the central processing unit in the first communication device in order to terminate the second TCP session inside the first communication device and then transfers the frame of the first TCP session to a second terminal,

wherein the first communication device that receives the frame from the first terminal over the first TCP connection is the only device that establishes the second TCP connection over the existing first TCP connection so that the second TCP connection does not occur elsewhere over the Internet.

16. A non-transitory tangible computer readable medium storing a program of a communication device for making communication via a TCP session, said program causing said communication device to function as:

a receiver receiving a frame of a first TCP session from a first terminal, establishing a second TCP session over the first TCP session in order to transfer the frame received from the first terminal, terminating the second TCP session established in the first communication device in order to terminate the second TCP session inside the first communication device and then transfering the frame of the first TCP session to a second terminal;

an encryption key acquiring means for acquiring an encryption key that is used in employing the first TCP session to make encrypted communication;

an encryptor for preserving said acquired encryption key, and upon receipt of a processing speed acceleration process start command, employing this preserved encryption key to encrypt the frame for transmission as an encrypted frame;

an encapsulator for adding an encryption header and an encapsulation header to said encrypted frame, and transmitting the encrypted frame to a destination of the first TCP session;

a de-encapsulator for deleting the encryption header and the encapsulation header from the received frame; and

a decoder for employing said preserved encryption key to decode the frame from which said encryption header and said encapsulation header have been deleted,

wherein the first communication device that receives the frame from the first terminal over the first TCP connection is the only device that establishes the second TCP connection over the existing first TCP connection so that the second TCP connection does not occur elsewhere over the Internet.