RELAY APPARATUS FOR ENCRYPTING AND RELAYING A FRAME

• US 20080052533A1
• Filed: 01/12/2007
• Published: 02/28/2008
• Est. Priority Date: 08/09/2006
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: IIDA, Takamitsu, Obara, Satoshi, Nakajima, Yukihiro, Sakuma, Takayuki, Sakurai, Hideshi
• Granted Patent: US 7,979,693 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/4645 Details on frame tagging routing of packets H04L45/00; support for virtual LAN H04L49/354
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

A relay apparatus comprises a frame relay processing unit for relaying a frame, a plurality of ports for sending and receiving the frame to and from the outside, and a cryptographic processing module corresponding to each of the ports. Each cryptographic processing module is connected to the corresponding port and to the frame relay processing unit by means of general-purpose interfaces such as MII. The cryptographic processing module performs the encryption process and decryption process so that the frame relay processing unit can concentrate on the relay process and the relay speed is not subject to degradation. Also, the cryptographic processing module can generate a different cryptographic key for each frame without requiring dynamic exchange of key information.

Claims

1. A relay apparatus relaying a frame in a data link layer, comprising:

a plurality of ports for transmitting and receiving the frame to and from an outside of the relay apparatus;

a frame relay processing unit for relaying the frame; and

a cryptographic processing unit that has a first interface for transmitting and receiving the frame to and from one of the plurality of ports and a second interface for transmitting and receiving the frame to and from the frame relay processing unit, performs an encryption process when receiving the frame from either one of the first interface or the second interface by encrypting the frame and generating an encrypted frame, and performs a decryption process when receiving the encrypted frame from the other one of the first interface or the second interface by decrypting the encrypted frame.

2. The relay apparatus according to claim 1, wherein

when the frame contains Virtual Local Area Network identification information to identify a Virtual Local Area Network, the cryptographic processing unit determines whether to perform either the encryption process or the decryption process to the received frame, or whether not to perform either process to the received frame on the basis of the Virtual Local Area Network identification information.

3. The relay apparatus according to claim 1, wherein

in the encryption process, the cryptographic processing unit encrypts a data part of the frame excluding a header, and generates the encrypted frame by disposing a cryptographic header containing information required for a decryption in a position between the header and encrypted data obtained by encrypting the data part.

4. The relay apparatus according to claim 1, wherein

the cryptographic processing unit performs the encryption process when receiving the frame from the port corresponding to the cryptographic processing unit via the first interface, and transmits the generated encrypted frame to the frame relay processing unit via the second interface, and

the cryptographic processing unit performs the decryption process when receiving the frame from the frame relay processing unit via the second interface, and transmits the decrypted frame to the port corresponding to the cryptographic processing unit via the first interface.

5. The relay apparatus according to claim 1, wherein

the cryptographic processing unit performs the decryption process when receiving the frame from the port corresponding to the cryptographic processing unit via the first interface, and transmits the decrypted frame to the frame relay processing unit via the second interface, and

the cryptographic processing unit performs the encryption process when receiving the frame from the frame relay processing unit via the second interface, and transmits the generated encrypted frame to the port corresponding to the cryptographic processing unit via the first interface.

6. The relay apparatus according to claim 1, wherein

the cryptographic processing unit comprises a number storage unit for storing a sequence number, and

when performing the encryption process, the cryptographic processing unit generates a cryptographic key on the basis of the sequence number, generates the encrypted frame by encrypting the frame using the cryptographic key, incorporates the sequence number into the encrypted frame, and changes a value of the sequence number stored in the number storage unit, and

when performing the decryption process, the cryptographic processing unit generates the cryptographic key on the basis of the sequence number incorporated into the encrypted frame, and performs the decryption process using the cryptographic key.

7. The relay apparatus according to claim 6, wherein

the cryptographic processing unit generates the cryptographic key further on the basis of Media Access Control header information obtained from either a destination Media Access Control address, a source Media Access Control address, or both, contained in the frame.

8. The relay apparatus according to claim 6, wherein

the cryptographic processing unit generates the cryptographic key further on the basis of a pre-shared key that is a value preset in each of a plurality of the relay apparatuses combined to be used for transmitting and receiving the encrypted frame as an identical value from among the plurality of relay apparatuses.

9. The relay apparatus according to claim 6, wherein

the cryptographic processing unit generates the cryptographic key using a hash function.

10. The relay apparatus according to claim 6, wherein

the cryptographic processing unit generates M number of values, M being 2 or a larger integral number, and stores the M number of values as candidate values on the basis of a pre-shared key that is a value preset in each of a plurality of the relay apparatuses combined to be used for transmitting and receiving the encrypted frame as an identical value from among the plurality of relay apparatuses, and

the cryptographic processing unit selects one of the M number of candidate values on the basis of the sequence number, and generates the cryptographic key on the basis of the selected candidate value.

11. The relay apparatus according to claim 8, wherein

the cryptographic processing unit generates a random value by giving, as a seed, a value calculated on the basis of a character string defined uniquely by firmware in the relay apparatus and the pre-shared key to a random function generating an identical value from the same seed, and generates the cryptographic key on the basis of the random value.

12. The relay apparatus according to claim 8, wherein

the cryptographic processing unit calculates a hash value by using, as an argument of a hash function, a value calculated on the basis of a character string defined uniquely by firmware in the relay apparatus and the pre-shared key and generates the cryptographic key on the basis of the hash value.

13. The relay apparatus according to claim 10, wherein

the cryptographic processing unit generates, for each of M number of different index values, the M number of candidate values by calculating a seed on the basis of a character string defined uniquely by firmware in the relay apparatus, the pre-shared key, and the index value, and calculating a random value by giving the seed to a random function generating an identical value from the same seed.

14. The relay apparatus according to claim 10, wherein

the cryptographic processing unit generates, for each of M number of different index values, the M number of candidate values by giving, as an argument of a hash function, a value calculated on the basis of a character string defined uniquely by firmware in the relay apparatus, the pre-shared key, and the index value.

15. The relay apparatus according to claim 1, wherein

in the encryption process, the cryptographic processing unit further divides the encrypted frame and generates a plurality of fragment frames when a length of the encrypted frame exceeds a predetermined length, and

in the decryption process, the cryptographic processing unit further determines whether a received frame is the fragment frame or the undivided encrypted frame, and when determining the received frame as the fragment frame, receives all of the plurality of fragment frames corresponding to the encrypted frame before a division, and reassembles all of the plurality of fragment frames into the encrypted frame before the division.