JP2005065004A - Method, device and program for inspecting encrypted communication data - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform the appropriate data inspection of encrypted communication data. <P>SOLUTION: When a transmitting side communication terminal 1-1 and a receiving side communication terminal 1-2 (hereinafter communication terminals) perform encryption communication using an encryption key, a third communication apparatus 1-3 for transferring the communication data interrupts encrypted communication data whose contents cannot be confirmed by network security management criteria. The third communication apparatus 1-3 notifies the communication terminals 1-1 and/or 1-2 that the encrypted communication data are interrupted. After mutual authentication procedures are exchanged between the communication terminals 1-1 or 1-2 that has received the notification and the third communication apparatus, an encryption communication path is generated between both the apparatuses. The encryption key is transmitted from the communication terminal 1-1 or 1-2 to the third communication apparatus 1-3 through the encryption communication path. The third communication apparatus 1-3 uses the received encryption key to decrypt contents of the encryption communication data and performs contents inspection, filtering processing or the like. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an encrypted communication data inspection method, an encrypted communication data inspection apparatus, and an encrypted communication data inspection program, and in particular, in data communication on the Internet, such as IPsec (IP security) and SSL (secure socket layer). While realizing encrypted communication, in accordance with certain network management standards, the content of the communication data is inspected based on arbitrary filtering conditions, and if necessary, the transfer of communication data on the network is blocked. It relates to a communication method to be realized.

  Communication data transferred over the Internet or the like is generally classified into a plurality of communication protocol layers based on the framework of the OSI (open system interconnection) reference model, and each communication device constituting the network has an arbitrary communication protocol layer. Transmission / reception is performed by executing predetermined processing. As a result, the communication data transmitted by the transmission side communication terminal reaches the reception side communication terminal via a specific appropriate route. The transfer of these communication data is realized by communication devices around the world that support communication protocols represented by IP (Internet protocol), and today all communication terminals perform data communication through the Internet. It became possible to realize. Along with this, a wide variety of services using the Internet are rapidly spreading, and it is expected that a wide variety of services will be developed and spread throughout the world in the future.

  On the other hand, various services using the Internet have become widespread, and the act of trying to illegally use the Internet has frequently occurred. For example, network security management is positioned as a very important issue today, when a wide variety of unauthorized communication activities such as wiretapping, tampering, impersonation, and denial have occurred.

  Therefore, in order to maintain the confidentiality and integrity of communication data, encryption technology typified by SSL technology has come to be widely used, and PKI (public key infrastructure, public key authentication) that realizes personal authentication. Security is advanced by appropriately implementing various security measures such as the spread of infrastructure), non-repudiation by digital signatures, filtering based on IP addresses and port numbers, Internet virus detection, virus scanning for Internet viruses, and security hole countermeasures. Internet communication secured in the Internet.

  For example, as a document related to security, there is a document that introduces basic technology related to a firewall as a security measure in the Internet and a security policy (see, for example, Non-Patent Document 1). Among them, in particular, Section 3.23 describes encrypted communication as a security measure. In addition, there are documents in which basic technologies related to encryption, concepts, and construction of practical systems are introduced (for example, see Non-Patent Document 2). Among them, Chapter 2 describes the Diffie-Hellman algorithm for public key encryption, and Chapter 3 describes social and political issues related to encryption.

  The security measures as described above are ideally realized by each communication terminal having its security measure function installed. However, in reality, it is also considered that general users use communication terminals. Therefore, it is almost impossible to install the latest security countermeasure function that is always sufficient in all communication terminals. Therefore, FW (firewall, firewall), GW (gateway), etc. are installed as a third communication device with a security countermeasure function in a place that actually corresponds to the edge of the access network. Maintains the FW, GW, etc., and realizes security maintenance instead of individual communication terminals. In addition, even if a communication terminal with insufficient security measures is connected in a network, this prevents the network from being compromised by using the communication terminal as a stepping stone due to unauthorized external access. It becomes possible.

Karanjit Siyan, Ph. D. By Chris Hare, translated by Hideki Takatsuki, “Internet Firewall”, ASCII, published March 1996 Pete Losin, “Security Guide for Encryption”, published by Shosuisha, June 1999

  However, if a certain communication terminal is performing encrypted communication with another communication terminal, even if an FW or GW is installed as a third communication device having a security countermeasure function, the contents of the communication data Encryption and filtering inconsistencies occur, such as the inability to decrypt the security and insufficient security measures. In other words, the communication terminals perform encrypted communication to maintain their confidentiality. However, as a network administrator, the encrypted data cannot be decrypted by FW, GW, etc. Since it becomes impossible to confirm, it becomes difficult to implement security measures such as appropriate filtering. As a result, it becomes impossible to defend itself against unauthorized data transfer or access or invasion of Internet viruses. As for this problem, as the encryption is performed at a deeper layer in the communication protocol hierarchy (deeper as the layer number is smaller), information such as a communication header that can be used as a filtering condition decreases, and it becomes difficult to perform appropriate filtering.

  For example, in IPsec, which will be supported by IPv6 (Internet Protocol version 6) as standard, encryption at layer 3 (network layer) is executed, so even communication header information at layer 4 or higher can be confirmed. The information that can be used as filtering conditions for communication data packets is greatly reduced. For example, it becomes impossible to refer to communication header information such as a port number, and in the application of IPsec in the tunnel mode, the IP address information indicating the source and destination of the original IP packet is within the scope of encryption. The third communication device may not be able to refer to various contents of communication data.

  Therefore, when an encrypted packet such as IPsec is transferred in FW or GW interposed between the transmission side communication terminal and the reception side communication terminal, there is no problem if the contents of the packet are not conscious. In networks with restrictions on conditions and management conditions (for example, corporate LANs and commercial networks that require a high security level), packets are encrypted even though there is actually no problem with the packet contents. If the content cannot be confirmed, there may be a case where a filtering condition of blocking the packet transfer itself has to be provided. That is, as a specific network security management standard, when the content of communication data cannot be confirmed, the third communication device existing at the edge of the specific network blocks the transfer of the communication information. Will be blocked regardless of whether there is a problem with the actual content.

  In view of the above, an object of the present invention is to enable appropriate data inspection on encrypted communication data and to solve the contradiction between encryption and filtering. In addition, in the present invention, when any communication terminal performs encrypted communication such as SSL or IPsec, the third communication device that transfers the encrypted communication data on the network can check the content of the communication data. The purpose is to. Another object of the present invention is to realize a filtering function equivalent to the case of unencrypted data communication for encrypted communication data. Furthermore, according to the present invention, the application range of encryption for communication data is wide, that is, encryption is performed at a deeper layer in the communication protocol hierarchy (deeper as the layer number is smaller), thereby filtering conditions in the third communication device. An object of the present invention is to enable appropriate filtering to be performed on encrypted communication data even when there is less communication data information such as packet headers that can be used as Another object of the present invention is to enable appropriate filtering to be performed in IPv6 in which IPsec encrypted in layer 3 is supported as standard.

  If FW, GW, etc. are in a position where there is no problem even if the communication contents are decrypted and it is guaranteed that the contents of the communication data will not be leaked elsewhere, the contradiction between the encryption and the filtering pointed out above In order to solve this problem, it is possible to confirm the content of the communication data by notifying the encryption key to FW, GW, etc. that need to decrypt the encrypted communication data, so that the encryption can be performed substantially without any harmful effect. It becomes possible to solve the contradiction of filtering.

  Therefore, in order to solve this problem, first, communication data that cannot be confirmed because the FW or GW is encrypted is blocked, and the FW or GW tries to perform encrypted communication. For example, a message notifying that the communication data is blocked is transmitted to the side communication terminal. If FW, GW or the like does not notify anything while the communication data is blocked, the transmitting communication terminal and the receiving communication terminal cannot recognize where and why the communication data is blocked. Therefore, the transmission side communication terminal and the reception side communication terminal are notified that the communication data is blocked because the specific FW or GW cannot confirm the content of the encrypted communication. The transmission destination of the communication cutoff message can be determined based on, for example, the transmission source address or transmission destination address of the encrypted communication data.

  Secondly, when the transmitting communication terminal or the receiving communication terminal recognizes that the encrypted communication is blocked by a specific FW or GW by receiving the communication blocking message, the FW or GW is encrypted. It is determined whether or not the communication device can decode the contents of the encrypted communication data. That is, for the communication terminal on the transmission side and the communication terminal on the reception side, depending on the purpose of encrypting the communication data, the contents may be known to other communication devices, or the secret must be maintained. It may not be possible. The determination also depends on the position and attributes of FW and GW. Therefore, the transmitting communication terminal or the receiving communication terminal clarifies the position and attributes of the specific FW, GW, etc. by executing an authentication procedure using a specific FW, GW, etc. and a PKI certificate authority, etc. To do. As a result, the transmission side communication terminal or the reception side communication terminal determines whether or not the encryption key may be passed to the FW or GW.

  Third, an encryption communication path is secured by newly generating an encryption key between the transmission side communication terminal or the reception side communication terminal and the FW or GW. This is because the encryption key of the encrypted communication data is received by the transmission side communication terminal or the reception when the specific FW or GW determines that there is no problem even if the content of the encrypted communication data is decrypted by the procedure described above. The purpose is to prevent the encryption key from leaking to the other when the side communication terminal transmits to the FW or GW. When a new encryption key is generated between the transmission-side communication terminal or the reception-side communication terminal and the FW or GW, it can be easily realized by applying the Diffie-Ferman algorithm or the like.

  By realizing the above procedure, the transmitting communication terminal or the receiving communication terminal notifies the FW or GW of the encryption key, and the FW or GW can confirm the contents of the encrypted communication data. As a result, FW, GW, etc. can implement security measures such as filtering even when the transmission side communication terminal and the reception side communication terminal are performing encrypted communication, as in the case of not being encrypted. Become.

  Specifically, when an arbitrary transmission side communication terminal and a reception side communication terminal perform encrypted communication using a shared encryption key, the encrypted communication data is blocked according to security management filtering conditions. When there is one or more third communication devices that can be transferred on the transfer path of the encrypted communication data, the third communication device can transmit the encrypted communication to the transmitting communication terminal or the receiving communication terminal. The third communication device transmits a communication cut-off message indicating that the encrypted communication data is cut off, and the transmission-side communication terminal or the reception-side communication terminal that has received the communication cut-off message It is recognized that the encrypted communication data is blocked by the communication device.

  Further, by executing an authentication procedure or the like between the transmission side communication terminal and the third communication device, or between the reception side communication terminal and the third communication device, the transmission side or the reception side communication terminal becomes the third communication. It is judged whether or not the device can decrypt the encrypted communication data and decrypt the content of the encrypted communication data. If it is determined that decryption is allowed, for example, an individual encryption key is generated and shared between the transmission-side communication terminal and the third communication device or between the reception-side communication terminal and the third communication device. Thus, an encrypted communication path is secured. Using the encrypted communication path generated in advance between the sending communication terminal and the third communication device or between the receiving communication terminal and the third communication device, the sending communication terminal and the receiving communication terminal The third communication apparatus is notified of the encryption key shared in the encrypted communication between the transmission side communication terminal and the reception side communication terminal.

  Further, the third communication device is an encryption key applied in encrypted communication between the transmission side communication terminal and the reception side communication terminal notified from the transmission side communication terminal or the reception side communication terminal to the third communication device. Is used to decrypt and decrypt the encrypted communication data transmitted from the transmission side communication terminal to the reception side communication terminal, and for the content of the decrypted encrypted communication data, Apply the same filtering conditions as when forwarding. According to the result of applying the filtering condition, the third communication device transfers the encrypted communication data as it is when the transfer is permitted, and transfers the encrypted communication data when the transfer is not permitted. Cut off.

According to the first solution of the present invention,
Encryption encrypted with the first encryption key between the first communication device and the second communication device via the third communication device that transfers and / or blocks data according to a predetermined filtering condition In encrypted communication in which communication data is transmitted,
A third communication device blocking encrypted communication data received from the first or second communication device that cannot be decrypted or decrypted;
The third communication device indicates to the first and / or second communication device that the encrypted communication data is blocked based on the source address and / or destination address of the data. A step of sending
The third communication apparatus authenticates the third communication apparatus with the first encryption key used in the encrypted communication between the first communication apparatus and the second communication apparatus. Receiving from the communication device of:
A third communication device decrypting the encrypted communication data received from the first and / or second communication device using the received first encryption key;
The third communication device applies a predetermined filtering condition to the decrypted encrypted communication data, and transfers or blocks the encrypted communication data according to the application result of the condition. A method and an encrypted communication data inspection program for causing a third communication device to execute each of these processes are provided.

According to the second solution of the present invention,
It is interposed between the first communication device and the second communication device that transmit / receive encrypted communication data encrypted by the encryption key, and transfers data to / from the encrypted communication data according to a predetermined filtering condition. Or an encrypted communication data inspection device for blocking,
The encrypted communication data inspection device includes:
Block encrypted communication data received from the first or second communication device that cannot be decrypted or decrypted;
Based on the source address and / or destination address of the data, a communication cutoff message indicating that the encrypted communication data is blocked is transmitted to the first and / or second communication device,
A first encryption key used in encrypted communication between the first communication device and the second communication device is obtained from the first or second communication device that has authenticated the third communication device. Receive
Decrypting the encrypted communication data received from the first and / or second communication device using the received first encryption key;
The encrypted communication data inspection device is provided that applies a predetermined filtering condition to the decrypted encrypted communication data and transfers or blocks the encrypted communication data according to the application result of the condition.

  According to the present invention, when an arbitrary communication terminal performs encrypted communication such as SSL or IPsec, the third communication device that transfers the encrypted communication data on the network transmits a part of the content of the communication data. It can be confirmed. In addition, according to the present invention, the third communication device can decrypt the encrypted communication data and decrypt the contents, so that filtering such as packet header information that could not be referred to by encrypted communication is possible. The conditions can be referred to, and a filtering function equivalent to that in the case of data communication without encryption can be realized.

  Furthermore, according to the present invention, the application range of encryption for communication data is wide, that is, encryption is performed at a deeper layer in the communication protocol hierarchy (deeper as the layer number is smaller), thereby filtering conditions in the third communication device. Even if there is less communication data information such as packet headers that can be used as, it is possible to perform appropriate filtering on encrypted communication data. In particular, in IPv6, which is expected to be widely used in the future, IPsec that is encrypted in layer 3 is supported as a standard, so that the significance of realizing the above functions is great.

1. First Embodiment FIG. 1 is a schematic diagram of an apparatus configuration and an encryption path of an encrypted communication data inspection system. FIG. 1 shows a device configuration and an encryption path when a transmission side communication terminal and a reception side communication terminal perform encrypted communication via a third communication device that does not allow encrypted data communication.

  The encrypted communication data inspection system includes a transmission side communication terminal 1-1, a reception side communication terminal 1-2, and a third communication device 1-3. Furthermore, the certificate authority 1-4 can also be provided.

  The transmission side communication terminal 1-1 and the reception side communication terminal 1-2 perform encrypted communication. In the present embodiment, the communication terminals are described as the transmission side and the reception side in order to make the explanation easy to understand. However, each communication terminal does not have to be a communication terminal limited to transmission and reception.

  The third communication device 1-3 is a communication device for transferring communication data between the transmission side communication terminal 1-1 and the reception side communication terminal 1-2, and plays a role of FW or GW. Further, the third communication device 1-3 executes processing related to security measures such as filtering processing based on a predetermined filtering condition for the encrypted communication data (hereinafter referred to as encrypted communication data). Transfer and / or block encrypted communication data.

  The certificate authority 1-4 is a device for authenticating the communication partner. For example, the certificate authority 1-4 has information such as the position and attributes of the terminal and the server. The certificate authority 1-4 is used to evaluate the validity of whether the transmitting communication terminal 1-1 or the receiving communication terminal 1-2 can pass the encryption key to the third communication apparatus 1-3. Is done. The certificate authority 1-4 can also be used for mutual authentication in performing encrypted communication between the transmitting communication terminal 1-1 and the receiving communication terminal 1-2.

  In FIG. 1, the transmission side communication terminal 1-1 is connected to the Internet through the LAN 1-5 and the reception side communication terminal 1-2 is connected to the Internet through the LAN 1-6, and the transmission side communication terminal 1-1 and the reception side communication terminal 1 are connected. 2 shows an image when encrypted communication is performed with -2. Here, for example, the LAN 1-5 will be described assuming that network security management is not particularly performed. On the other hand, the LAN 1-6 is connected to the Internet through the third communication device 1-3 as a role of FW, GW, etc. in order to realize certain network security management. The same applies even if the third communication device 1-3 exists in the LAN 1-5 instead of the LAN 1-6. Moreover, you may exist in both LAN1-5 and LAN1-6.

  It is assumed that one or more third communication devices 1-3 exist between the transmission-side communication terminal 1-1 and the reception-side communication terminal 1-2, but FIG. Assumed. The case where there are a plurality of third communication devices 1-3 will be described later. Here, if the third communication device 1-3 cannot decrypt the content of communication data (for example, information necessary for a predetermined filtering process such as an IP address) in the communication data to be transferred, the third communication device 1-3 maintains security. It is assumed that the communication data is controlled based on a policy for blocking the transfer of the communication data itself for the purpose.

  The case where the contents of the communication data cannot be decrypted may be a case where the data cannot be decrypted and predetermined information cannot be obtained because there is no encryption key necessary for decrypting the encrypted communication data. In addition, even if the third communication device 1-3 cannot decrypt the data or cannot decrypt all the contents of the data, the third communication device 1-3 can obtain predetermined information necessary for the filtering process or the like. The data may be transferred.

  FIG. 2 is a sequence diagram regarding a procedure for realizing encrypted communication. FIG. 2 illustrates a case where the transmission side communication terminal 1-1 and the reception side communication terminal 1-2 perform encrypted communication via the third communication device 1-3 that does not allow encrypted data communication. A sequence diagram is shown.

  First, since the transmitting communication terminal 1-1 and the receiving communication terminal 1-2 cannot recognize the presence of the third communication device 1-3 from the beginning, they try to perform normal encrypted communication. Here, when sharing the encryption key X for encrypted communication between the transmission side communication terminal 1-1 and the reception side communication terminal 1-2, several means are conceivable. It may be possible to physically share In addition to this, there may be a case where the shared encryption key X is generated by applying the Diffie-Ferman algorithm after performing the authentication procedure using the PKI certificate authority 1-4 or the like. For example, in IPsec, it is possible to securely generate a shared encryption key by following an IKE (internet key exchange) procedure. However, the present invention is not limited thereto, and a shared encryption key may be generated by an appropriate method or means.

  The transmission side communication terminal 1-1 transmits the encrypted communication data encrypted using the encryption key X to the reception side communication terminal 1-2. However, the third communication device 1-3 that will transfer the encrypted communication data blocks the encrypted communication data that it cannot decrypt and decrypt. Since the transmission side communication terminal 1-1 and the reception side communication terminal 1-2 cannot recognize where the encrypted communication data is blocked only by blocking here, the third communication device 1-3, for example, Based on the source address (SA) and / or the destination address (DA) of the encrypted communication data packet, a communication cutoff message indicating that the third communication device 1-3 itself is blocking this encrypted communication data, The data is transmitted to the transmission side communication terminal 1-1 and / or the reception side communication terminal 1-2. The transmission side communication terminal 1-1 and the reception side communication terminal 1-2 that have received the communication cut-off message can recognize for the first time that the encrypted communication data is cut off by the third communication device 1-3. .

  Next, the transmission-side communication terminal 1-1 or the reception-side communication terminal 1-2 that has received the communication cutoff message sends the encryption key X to the third communication device 1-3 in order to cancel the cutoff of the encrypted communication data. In order to determine whether or not to pass, mutual authentication with the third communication terminal 1-3 is performed. The same applies to the case where the transmitting communication terminal 1-1 performs mutual authentication with the third communication device 1-3. This mutual authentication does not pose a problem even if the third communication device 1-3 that has received the communication cutoff message can decrypt the encrypted communication data with the encryption key X, or the third communication device 1- The main purpose is to confirm whether there is a risk of 3 leaking the contents of communication data to others. Hereinafter, in order to simplify the description, it is assumed that the receiving communication terminal 1-2 performs mutual authentication with the third communication device 1-3.

  In order to realize such mutual authentication, for example, the receiving communication terminal 1-2 and the third communication are connected in the same manner as the transmitting communication terminal 1-1 and the receiving communication terminal 1-2 authenticate each other. Whether the receiving side communication terminal 1-2 can pass the encryption key X to the third communication device 1-3 by using the PKI certificate authority 1-4 or the like with the device 1-3. Can be determined. Here, for example, by holding a list of identification information indicating a reliable communication apparatus or a group thereof that may pass the encryption key X in the receiving communication terminal 1-2 in advance, the receiving communication terminal 1-2 If the third communication device 1-3 falls within the list, it passes the encryption key X and determines that there is no problem, and otherwise determines that the encryption key X should not be passed. In addition, mutual authentication can be performed by an appropriate method. In the present embodiment, mutual authentication is performed. However, in determining whether or not an encryption key may be passed, at least the transmission side communication terminal 1-1 or the reception side communication terminal 1-2 is the third one. What is necessary is just to be able to authenticate the communication terminal 1-3.

  As a result, when it is determined that there is no problem, the encryption key X is securely transmitted from the reception side communication terminal 1-2 to the third communication device 1-3. The encryption key Y used for realizing new encrypted communication with the communication device 1-3 is generated. In generating the encryption key Y, as in the case of generating the encryption key X, the shared encryption key Y can be generated by applying the Diffie-Ferman algorithm or the like.

  Then, using the encrypted communication path secured with the encryption key Y, the receiving communication terminal 1-2 transmits the encryption key X to the third communication device 1-3. The third communication device 1-3 receives the encryption key X and stores the received encryption key in a storage unit or the like as appropriate. For example, the third communication device 1-3 stores the encryption key X in association with the identification information of the encrypted communication path, the identification information of the transmission side communication terminal 1-1 and the reception side communication terminal 1-2, and the like.

  Further, the reception side communication terminal 1-2 notifies the transmission side communication terminal 1-1 of the restart of the data communication encrypted with the encryption key X, for example. Since the encrypted communication between the transmitting communication terminal 1-1 and the receiving communication terminal 1-2 is stopped in a blocked state, a trigger for resuming communication is given to the transmitting communication terminal 1-1. is there. In addition to the notification performed by the receiving communication terminal 1-2 that has transmitted the encryption key X, the third communication device 1-3 that has received the encryption key X notifies the transmitting communication terminal 1-1 of this notification. You may do it. In addition, a trigger for resuming data communication can be given by an appropriate method such as resuming communication after a predetermined time has elapsed. Further, the third communication device 1-3 may temporarily store the blocked data, and may not transmit the data again from the transmission side communication terminal 1-1.

  Receiving the notice of resumption of data communication, the transmission side communication terminal 1-1 transmits the encrypted communication data to the reception side communication terminal 1-2 again. The third communication device 1-3 uses the already received encryption key X to decrypt and decrypt the encrypted communication data between the transmission side communication terminal 1-1 and the reception side communication terminal 1-2. It is possible to confirm the contents.

  Based on the content of the encrypted communication data that has been confirmed, the third communication device 1-3 performs processing equivalent to the filtering standard for the case where the original communication is not encrypted, and determines that there is no problem with the transfer. In such a case, the encrypted communication data is transferred as it is. As a result, the receiving communication terminal 1-2 can receive the encrypted communication data. On the other hand, if the third communication device 1-3 determines that transfer is impossible by the filtering process, the third communication device 1-3 discards the data.

2. Second Embodiment FIG. 3 is a schematic diagram of an apparatus configuration and an encryption path of an encrypted data inspection system that performs encrypted communication via a plurality of communication apparatuses. FIG. 3 is based on the schematic diagram of FIG. The fourth communication device 3-4 for blocking the communication data is provided. Note that a communication device such as a fifth communication device or a sixth communication device may be further provided.

  Here, as the location of the fourth communication device, the location between the transmission-side communication terminal 3-1 and the third communication device 3-3, the third communication device 3-3, and the reception-side communication terminal 3 are used. 2, the encrypted communication data between the transmission side communication terminal 3-1 and the reception side communication terminal 3-2 is transmitted via the Internet or the like to the third communication device 3-3. 3, the location of the fourth communication device 3-4 that blocks the encrypted communication data as a role such as FW or GW is, for example, the third communication device 3-3 and the receiving side communication. It can be a place between the terminal 3-2. In addition, the 3rd communication terminal 3-3 and the 4th communication terminal 3-4 can be arrange | positioned in not only this but an appropriate place.

  It should be noted that when the receiving communication terminal 3-2 transmits the encryption key X to the third communication device 3-3, the encrypted communication using the encrypted communication path (Y) is performed as described above. Is to occur. In this case, since the fourth communication device 3-4 blocks the transfer of the encrypted communication data, the receiving side communication terminal 3-2 simply transmits the encryption key X to the third communication device 3-3. I can't. However, the above problem can be solved by recursively executing the procedure according to the first embodiment described above.

  That is, in the encrypted communication between the receiving communication terminal 3-2 and the third communication terminal 3-3, the receiving communication terminal 3-2 shown in FIG. 3 is connected to the transmitting communication terminal 1-1 shown in FIGS. The third communication device 3-3 in FIG. 3 is the receiving communication terminal 1-2 in FIGS. 1 and 2, and the fourth communication device 3-4 in FIG. 3 is the third communication device in FIGS. The same procedure as described above may be executed in correspondence with each of the communication devices 1-3. Even if the fourth communication device 3-4 exists, finally, encrypted communication between the transmission side communication terminal 3-1 and the reception side communication terminal 3-2 becomes possible. A specific example of a series of processing will be described below.

  4 and 5 are sequence diagrams of the encrypted data inspection when there are a plurality of communication devices that do not allow encrypted data communication.

  Similarly to the above, even when there are a plurality of communication devices that play a role such as FW and GW, encrypted communication can be performed by recursively executing the same procedure as described above. As an example, in FIG. 4 and FIG. 5, three communication devices (third) that block encrypted communication data as a role such as FW or GW between the transmission-side communication terminal 3-1 and the reception-side communication terminal 3-2. , 4th and 5th communication apparatus) will be described in detail. These third, fourth, and fifth communication devices are disposed, for example, in the LAN 1-6 in FIG. The same applies to cases where the number of communication devices is other than three.

  First, referring to FIG. 4, in realizing the encrypted communication (X) between the transmission side communication terminal 3-1 and the reception side communication terminal 3-2, the third communication device 3-3 performs the encrypted communication. (X) is rejected and transmission fails. When the communication cutoff message is transmitted from the third communication device 3-3 to the receiving communication terminal 3-2 based on the transmission source address or the like, the receiving communication terminal 3-2 and the third communication device 3-3 An encrypted communication path (Y) is created between them, and encrypted communication (Y) is attempted. However, this time, the fifth communication device 3-5 refuses the encrypted communication (Y) and the transmission of the encryption key (X) fails. When the communication cutoff message is transmitted from the fifth communication device 3-5 to the third communication device 3-3, encrypted communication is performed between the third communication device 3-3 and the fifth communication device 3-5. A route (Z) is created, and encrypted communication (Z) is attempted. However, this time, the encrypted communication (Z) is rejected by the fourth communication device 3-4, and the encryption key (Y) transmission fails.

  When the communication cutoff message is transmitted from the fourth communication device 3-4 to the fifth communication device 3-5, encrypted communication is performed between the fifth communication device 3-5 and the fourth communication device 3-4. A route (W) is created and encrypted communication (W) is attempted. The encrypted communication (W) is established for the first time here, and the transmission of the encryption key (Z) from the fifth communication device 3-5 to the fourth communication device 3-4 is successful. As a result, transmission of the encryption key (Y) from the third communication device 3-3 to the fifth communication device 3-5 via the encrypted communication path (Z) is also successful. Here, for example, after the transmission of the encryption key (Z) is successful, the fifth communication device 3-5 resumes the data communication as in the first embodiment described above, and the third communication device 3-3. May be notified. Hereinafter, the same applies to the case where the transmission of the encryption key is successful.

  Next, the encryption key (X) is transmitted from the receiving communication terminal 3-2 to the third communication device 3-3. Since the fifth communication device 3-5 has the encryption key (Y) by the above processing, the encrypted communication (Y) passes through the fifth communication device 3-5 unless other filtering conditions are met. can do. In the following description, description will be made on the assumption that other filtering conditions do not apply. On the other hand, since the fourth communication device 3-4 does not have the encryption key (Y), the encrypted communication (Y) is rejected and the transmission of the encryption key (X) fails. When the communication cutoff message is transmitted from the fourth communication device 3-4 to the third communication device 3-3, encrypted communication is performed between the third communication device 3-3 and the fourth communication device 3-4. A route (V) is created and encrypted communication (V) is attempted. Encrypted communication (V) is established, and transmission of the encryption key (Y) from the third communication device 3-3 to the fourth communication device 3-4 is successful. As a result, transmission of the encryption key (X) from the receiving communication terminal 3-2 to the third communication device 3-3 via the encrypted communication path (Y) is successful.

  Next, referring to FIG. 5, the transmission side communication terminal 3-1 again tries to realize encrypted communication (X) with the reception side communication terminal 3-2, but this time, the fourth communication device 3-4 performs encryption. Encrypted communication (X) is rejected and transmission of encrypted communication data fails. Thereafter, the encryption key (X) is passed to the fourth communication device 3-4 in the same procedure as when the encrypted communication (X) is rejected by the third communication device 3-3. In the fifth communication device 3-5 as well, the encryption key (X) is passed in the same manner, so that finally the encrypted communication (from the transmission side communication terminal 3-1 to the reception side communication terminal 3-2) ( X) will be successful.

  FIG. 6 is a sequence diagram of the encrypted data inspection in which the transmission side communication terminal 3-1 executes the response procedure for the communication cutoff message.

  In the above description, the reception side (for example, the reception side communication terminal 3-2) executes the corresponding procedure for the communication cutoff message generated by the communication device that blocks the encrypted communication data as a role such as FW or GW. However, the same applies to the case where the transmission side (for example, the transmission side communication terminal 3-1) executes the corresponding procedure. In FIG. 6, on the assumption that the transmission side executes the corresponding procedure, the encrypted communication data is blocked between the transmission side communication terminal 3-1 and the reception side communication terminal 3-2 as a role of FW, GW or the like. A specific procedure flow when three communication devices (third, fourth, and fifth communication devices) exist is shown. These third, fourth, and fifth communication devices are disposed, for example, in the LAN 1-6 in FIG. The same applies to cases where the number of communication devices is other than three.

  In realizing the encrypted communication (X) between the transmission side communication terminal 3-1 and the reception side communication terminal 3-2, the encrypted communication (X) is first rejected by the third communication device 3-3. Transmission of encrypted communication data fails. When a communication cut-off message is transmitted from the third communication device 3-3 to the transmission side communication terminal 3-1 based on the source address of the data, the transmission side communication terminal 3-1 and the third communication device 3 are transmitted. -3 to create an encrypted communication path (Y) and try encrypted communication (Y). The encrypted communication (Y) is successful, and the encryption key (X) is transmitted from the transmission side communication terminal 3-1 to the third communication device 3-3. In FIG. 6, the communication cut-off message is transmitted only to the transmission side communication terminal 3-1, but may be transmitted to the reception side communication terminal 3-2. The same applies to the transmission of the following communication cutoff message.

  If another attempt is made to perform encrypted communication (X) from the transmission side communication terminal 3-1 to the reception side communication terminal 3-2, the third communication device 3-3 has the encryption key (X). The encrypted communication (X) is not blocked unless the other filtering conditions are met, but this time, the fourth communication device 3-4 rejects the encrypted communication (X) and fails to transmit the encrypted communication data. When the communication cut-off message is transmitted from the fourth communication device 3-4 to the transmission-side communication terminal 3-1, the encrypted communication path between the transmission-side communication terminal 3-1 and the fourth communication device 3-4 ( Z) and try encrypted communication (Z).

  However, this time, the encrypted communication (Z) is rejected by the third communication device 3-3 and the transmission of the encryption key (X) fails. When the communication cutoff message is transmitted from the third communication device 3-3 to the transmission side communication terminal 3-1, it has already been generated between the transmission side communication terminal 3-1 and the third communication device 3-3. The encryption key (Z) is transmitted by encrypted communication (Y). As a result, this time, the encrypted communication (Z) succeeds between the transmission side communication terminal 3-1 and the fourth communication device 3-4, and the encryption key (X) is transferred from the transmission side communication terminal 3-1 to the fourth. To the communication device 3-4. In addition, when the transmission side communication terminal 3-1 performs the process with respect to a communication interruption | blocking message, it is not necessary to notify the above-mentioned communication resumption.

  Thereafter, when the encrypted communication (X) from the transmitting communication terminal 3-1 to the receiving communication terminal 3-2 is attempted, the encrypted communication (X) is rejected in the fifth communication device 3-5. Although the transmission of the encrypted communication data fails, the encryption key (X) is transmitted to the fifth communication device 3-5 by the same recursive process. Eventually, the encrypted communication (X) from the transmitting communication terminal 3-1 to the receiving communication terminal 3-2 will be successful.

3. Additional Notes The encrypted communication data inspection method or the encrypted communication data inspection system of the present invention is an encrypted communication data inspection program for causing a computer or a communication device to execute each procedure, and a computer reading that records the encrypted communication data inspection program It can be provided by a possible recording medium, a program product that includes an encrypted communication data inspection program and can be loaded into an internal memory of a computer, a computer such as a server including the program, and the like.

FIG. 5 shows a schematic diagram of a device configuration and an encryption path when a transmitting communication terminal and a receiving communication terminal perform encrypted communication via a third communication device that does not allow encrypted data communication. The sequence diagram in the case of performing encrypted communication via the 3rd communication apparatus which does not permit the data communication in which the transmission side communication terminal and the reception side communication terminal were encrypted is shown. Based on the schematic diagram of FIG. 1, a schematic diagram of a device configuration and an encryption path when encrypted communication is performed via another communication device that does not permit encrypted data communication is shown. Allow 3 encrypted data communications between the sending communication terminal and the receiving communication terminal on the premise that the receiving communication terminal or device of the communication data executes the procedure for the communication cut-off message A sequence diagram (1) of a specific procedure when there is a communication device that does not exist is shown. Allow 3 encrypted data communications between the sending communication terminal and the receiving communication terminal on the premise that the receiving communication terminal or device of the communication data executes the procedure for the communication cut-off message A sequence diagram (2) of a specific procedure when there is a communication device that does not exist is shown. 3 encrypted data communications are allowed between the sending communication terminal and the receiving communication terminal on the assumption that the sending communication terminal or device of the communication data executes the procedure for the communication cut-off message. A sequence diagram of a specific procedure when there is a communication device that does not exist is shown.

Explanation of symbols

1-1 Transmission side communication terminal that executes encrypted communication 1-2 Reception side communication terminal that executes encrypted communication 1-3 Third communication device that plays a role such as FW or GW 1-4 Transmission side communication terminal or Certificate authority 1-5 LAN used to evaluate the validity of whether the receiving communication terminal can pass the encryption key to the third communication device (when security management is not performed)
1-6 LAN (when security management is performed)
3-1 Sending side communication terminal that executes encrypted communication 3-2 Receiving side communication terminal that executes encrypted communication 3-3 Third communication device that plays a role such as FW or GW 3-4 FW or GW Fourth communication device that plays a role 3-5 Fifth communication device that plays a role such as FW or GW

Claims (7)

Encryption encrypted with the first encryption key between the first communication device and the second communication device via the third communication device that transfers and / or blocks data according to a predetermined filtering condition In encrypted communication in which communication data is transmitted,
A third communication device blocking encrypted communication data received from the first or second communication device that cannot be decrypted or decrypted;
The third communication device indicates to the first and / or second communication device that the encrypted communication data is blocked based on the source address and / or destination address of the data. A step of sending
The third communication apparatus authenticates the third communication apparatus with the first encryption key used in the encrypted communication between the first communication apparatus and the second communication apparatus. Receiving from the communication device of:
A third communication device decrypting the encrypted communication data received from the first and / or second communication device using the received first encryption key;
The third communication device applies a predetermined filtering condition to the decrypted encrypted communication data, and transfers or blocks the encrypted communication data according to the application result of the condition. Method. The first and / or second communication device receiving the communication cut-off message determines whether the third communication device may decrypt the encrypted communication data and / or decrypt the content;
The first and / or second communication device further includes the step of transmitting the first encryption key to a third communication device determined to be able to decrypt and / or decrypt. 2. The encrypted communication data inspection method according to 1.   The encrypted communication data according to claim 2, wherein the first and / or second communication device executes an authentication procedure using a certificate authority having information indicating the position and / or attribute of the third communication device. Inspection method. Further comprising generating a new encrypted communication path between the third communication device and the first or second communication device;
4. The encrypted communication data inspection method according to claim 1, wherein an encryption key is transmitted / received via the generated encrypted communication path. The fourth communication device interposed between the encrypted communication between the first or second communication device and the third communication device is a cipher received from the first, second or third communication device that cannot be decrypted or decrypted. Blocking the communication data;
The fourth communication device transmits a communication cutoff message indicating that the encrypted communication data is blocked based on the transmission source address and / or the transmission destination address of the encrypted communication data;
A fourth communication device receiving a second encryption key corresponding to the encrypted communication from the first, second, or third communication device that has authenticated the fourth communication device;
A fourth communication device decrypting the encrypted communication data using the received second encryption key;
The fourth communication device further includes a step of applying a predetermined filtering condition to the decrypted encrypted communication data, and transferring or blocking the encrypted communication data according to an application result of the condition. 5. The encrypted communication data inspection method according to any one of items 1 to 4. It is interposed between the first communication device and the second communication device that transmit / receive encrypted communication data encrypted by the encryption key, and transfers data to / from the encrypted communication data according to a predetermined filtering condition. Or an encrypted communication data inspection device for blocking,
The encrypted communication data inspection device includes:
Block encrypted communication data received from the first or second communication device that cannot be decrypted or decrypted;
Based on the source address and / or destination address of the data, a communication cutoff message indicating that the encrypted communication data is blocked is transmitted to the first and / or second communication device,
The first or second communication device that authenticates the encrypted communication data inspection device with a first encryption key used in encrypted communication between the first communication device and the second communication device. Received from
Decrypting the encrypted communication data received from the first and / or second communication device using the received first encryption key;
The encrypted communication data inspection device that applies a predetermined filtering condition to the decrypted encrypted communication data, and transfers or blocks the encrypted communication data according to an application result of the condition. The encrypted communication data encrypted with the encryption key is transmitted between the first communication device and the second communication device via the third communication device that transfers and / or blocks the data according to a predetermined filtering condition. In an encrypted communication data inspection program for causing a third communication device to execute encrypted communication for transmission,
A third communication device blocking encrypted communication data received from the first or second communication device that cannot be decrypted or decrypted;
The third communication device indicates to the first and / or second communication device that the encrypted communication data is blocked based on the source address and / or destination address of the data. A step of sending
The third communication apparatus authenticates the third communication apparatus with the first encryption key used in the encrypted communication between the first communication apparatus and the second communication apparatus. Receiving from the communication device of:
A third communication device decrypting the encrypted communication data received from the first and / or second communication device using the received first encryption key;
The third communication device applies a predetermined filtering condition to the decrypted encrypted communication data, and transfers or blocks the encrypted communication data according to the application result of the condition to the third communication device. An encrypted communication data inspection program for execution.

Images