JP2006019975A - Cipher packet communication system, receiving device and transmitting device with which same is equipped , and communication method, receiving method, transmitting method, receiving program and transmitting program for cipher packet which are applied thereto - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To update a ciphering key and a deciphering key by a cipher packet communication system without losing communication data. <P>SOLUTION: The cipher packet communication system is characterized in that a receiving device 410 is equipped with: a deciphering key management part 415 which stores at least two deciphering keys that are a new deciphering key received from a key update part 420 and an old deciphering key before the reception; a deciphering part 413 which selects one of the old and new deciphering keys to decipher ciphered packages; and a new deciphering key storage information transmission part 421 which transmits new deciphering key storage information 503 showing that the new deciphering key is stored in the deciphering key management part 415, wherein a transmitting device is equipped with: a ciphering key management part 405 which discards an old ciphering key and stores the new ciphering key after receiving the new deciphering key storage information 503; and a ciphering key update information transmission part 408 which transmits ciphering key update information 504 showing that the ciphering key management part 405 has updated the ciphering key. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an encrypted packet communication system and an encrypted packet communication method for transmitting and receiving encrypted packets between terminals, and more particularly to an encrypted packet communication system and an encrypted packet communication method for updating an encryption key and a decryption key at predetermined intervals.

  2. Description of the Related Art Conventionally, in an encrypted packet communication system, there is a system that updates an encryption key and a decryption key at predetermined intervals in order to prevent the key from being overlooked by using the same encryption key / decryption key pair for a long time ( For example, Patent Document 1 and Patent Document 2).

  FIG. 9 is a configuration diagram showing a schematic configuration of a conventional encrypted packet communication system that updates a key at predetermined intervals. This conventional encrypted packet communication system receives a transmission application 101 that transmits a plaintext packet, an encrypted packet transmitter 102 that encrypts a plaintext packet and transmits it as an encrypted packet, and an encrypted packet transmitted by the encrypted packet transmitter 102. An encrypted packet receiving unit 112 that decrypts the encrypted packet, and a receiving application 111 that receives the plaintext packet decrypted by the encrypted packet receiving unit 112.

  Furthermore, the encryption packet transmission unit 102 includes an encryption key storage unit 106 that stores the encryption key and a key ID storage unit 107 that stores a key ID corresponding to the encryption key. The encryption key management unit 105, the encryption unit 103 that encrypts a plaintext packet using the encryption key stored in the encryption key storage unit 106, and the encapsulation unit 104 that encapsulates the key ID in the encryption packet.

  The encrypted packet receiving unit 112 manages the replacement of the new decryption key and the old decryption key, and includes a decryption key storage unit 116 that stores the decryption key and a decryption key that includes a key ID storage unit 117 that stores a key ID corresponding to the decryption key. A key management unit 115, a decapsulation unit 114 that separates the key ID from the encrypted packet, and a decryption key corresponding to the key ID are called from the decryption key storage unit 116, and the encrypted packet is decrypted using the decryption key to obtain a plaintext packet And a decryption unit 113.

FIG. 10 shows an example of a conventional key update method.
The encrypted packet transmitting unit 102 and the encrypted packet receiving unit 112 update the encryption key and the decryption key corresponding to each other at regular intervals in order to ensure the safety of the encrypted packet, but decrypt the transmitted / received encrypted packet. In order to do so, it is necessary to update both the encrypted packet transmitting means 102 and the encrypted packet receiving means 112 at the same timing.

Conventionally, as shown in FIG. 10, by transmitting a key update packet 212 including a new decryption key encrypted with an old encryption key, notification of the timing of transmission of the new decryption key and key update has been performed. Yes.
JP 2001-189721 A JP 2003-318881 A

  However, when AV data having a large amount of data is encrypted and transmitted / received, it may be time to update the key while AV data is being transmitted / received. In this case, if the timing of updating the key at both terminals that communicate with each other is not matched very accurately, there will be a flaw between the encryption key that encrypts a packet and the decryption key that attempts to decrypt it. In this case, since the decryption key is not updated, the encrypted packet being communicated cannot be decrypted, and a part of the AV data is lost. As a result, the AV cannot be viewed.

  Also, even if it is attempted to synchronize the key update timing by transmitting / receiving a packet for notifying the timing of key update between both terminals, the packet for matching the timing is lost during communication, so that the AV data is decrypted. May not be possible.

  Furthermore, encrypted packets are not always received in the order in which they were sent, and before and after updating the encryption key, an encrypted packet encrypted with the old encryption key is followed by an encrypted packet encrypted with the new encryption key. It may be received, and it is difficult to update the key during long data transmission.

  FIG. 11 presents an example when the packet for notifying the timing of key update is lost. A key update packet 212 for notifying the timing of key update is inserted between the packets 211, 213, and 214, the packet 211 is encrypted with the old encryption key, and the packet 213 and the packet 214 are encrypted with the new encryption key. Has been. If the key update packet 212 is lost during communication, the receiving apparatus 110 cannot decrypt the packets 213 and 214 encrypted with the updated encryption key without knowing the timing for updating the decryption key. . Therefore, encrypted packets after the packet 213 cannot be received.

  In order to solve the above-described conventional problems, the present invention generates a transmitting device that transmits an encrypted packet, a receiving device that receives the encrypted packet, and new encryption keys and decryption keys that correspond to each other at predetermined time intervals. A decryption key for storing at least two decryption keys, a new decryption key received from the key update means and an old decryption key before reception. Sends management means, decryption means for selecting one of the old and new decryption keys and decrypting the encrypted packet, and new decryption key storage information indicating that the new decryption key is stored in the decryption key management means A new decryption key storage information transmitting means, and the transmitting device receives the new decryption key storage information, then discards the old encryption key and stores a new encryption key, and an encryption key management means Renews encryption key Providing the encryption key update information transmitting means for transmitting the encryption key update information that was providing encrypted packet communication system according to claim.

  Accordingly, it is possible to confirm that the transmission device and the reception device have a new key, and subsequent processing, for example, deletion of the old decryption key can be performed smoothly. Moreover, even if packets that have been encrypted with either the old or new encryption key are sent or received while confirming the possession of these new keys, the receiving device can decrypt using the old and new decryption keys. Therefore, even if the key is updated while a long packet such as AV data is being transmitted / received, a situation in which the intermediate packet cannot be decrypted can be avoided.

  The receiving apparatus further includes a retransmission management means for transmitting new decryption key storage information again when encryption key update information is not received even after a predetermined period of time has elapsed after transmitting new decryption key storage information. Is preferred.

  As a result, even if information that confirms possession of a new key disappears due to some kind of communication failure, the receiving device retains the old and new decryption keys until it confirms possession of the new key. Encryption packets can be decrypted.

  In addition, although this invention is realizable as an encryption packet communication system in this way, it is realizable by providing the receiver and transmission device concerning this invention. Further, it can be realized as a reception method or transmission method using steps characteristic of the reception device or the transmission device, or as a program for causing a computer to execute these steps.

  Needless to say, such a program can be distributed via a recording medium such as a CD-ROM or a transmission medium such as the Internet.

  According to the encrypted packet communication system of the present invention, a new key can be obtained without interrupting encrypted packet communication even when a key update occurs during transmission of long data such as AV data in encrypted packet communication. Can communicate with each other.

Embodiments of the present invention will be described below with reference to the drawings.
(Embodiment 1)
FIG. 1 is a configuration diagram showing the configuration of the cryptographic communication system according to Embodiment 1 of the present invention. The encryption communication system according to the present embodiment is a system that transmits and receives long data such as AV data in encrypted packets, and includes a transmission device 400 and a reception device 410.

  The transmitting device 400 generates an encryption key and a corresponding decryption key based on random numbers at regular intervals, a transmission application 401 that transmits a plaintext packet, and encrypts the plaintext packet and transmits it as an encrypted packet. And an encrypted packet transmission unit 402.

  The receiving apparatus 410 receives the encrypted packet transmitted by the encrypted packet transmitting unit 402, decrypts the packet and returns it to a plaintext packet, and receives the packet received by the encrypted packet receiving unit 412. And an application 411.

  Furthermore, the encryption packet transmission unit 402 includes an encryption key management unit 405 that manages an encryption key storage unit 406 that stores an encryption key and a key ID storage unit 407 that stores an encryption key ID 612 corresponding to the encryption key. An encryption unit 403 that encrypts a plaintext packet using an encryption key managed by the encryption key management unit 405, and an encryption key managed by the encryption key management unit 405 for the encrypted packet encrypted by the encryption unit 403 A capsuler 404 that encapsulates the ID 612 and an encryption key update information transmitter 408 that creates and transmits encryption key update information when the encryption key manager 405 updates the encryption key.

  On the other hand, the encrypted packet receiving unit 412 includes old and new decryption key storage units 416 and 418 for storing old and new decryption keys, and old and new key ID storage units 417 for storing key IDs 602 and 603 respectively corresponding to these new and old decryption keys. And a decryption key management unit 415 that manages 419, a decapsuling unit 414 that extracts the encryption key ID 612 included in the encrypted packet, and a decryption key corresponding to the encryption key ID 612 from the decryption key management unit 415, When the decryption unit 413 decrypts the encrypted packet by using either the old decryption key or the new decryption key to form a plaintext packet, and the decryption key management unit 415 stores the new decryption key, the new decryption key storage information is stored. A new decryption key storage information transmission unit 421 for transmission.

  FIG. 2 shows the setting timing of the encryption key / decryption key between the transmission device 400 and the reception device 410 when updating the encryption key / decryption key according to Embodiment 1 of the present invention, the new decryption key storage information 503, and the encryption key. It is a sequence diagram which shows the mode of the exchange of the update information 504. The sequence shown in this figure particularly shows a case of a good communication state in which no communication failure occurs.

  When receiving the new decryption key generated by the key updating unit 420, the receiving device 410 stores the new decryption key in the new decryption key storage unit 418 of the decryption key management unit 415 (S501). Accordingly, the decryption key management unit 415 stores the decryption key that has become the old decryption key in the old decryption key storage unit 416. As a result, the decryption unit 413 of the receiving apparatus 410 can decrypt the encrypted packet encrypted with the encryption key corresponding to the old or new decryption key.

  After storing the new decryption key, new decryption key storage information 503 including the old decryption key ID 602 corresponding to the old decryption key and the new decryption key ID 603 corresponding to the new decryption key is transmitted to the transmission device 400 (S502). While the new decryption key storage information 503 is being transmitted, a packet related to AV data continues to be transmitted from the transmission device 400. Since the packet is encrypted with the old encryption key, the reception device 410 decrypts the packet. The unit 413 decrypts the encrypted packet with the old decryption key.

  Upon receiving the new decryption key storage information 503, the transmission device 400 uses the old and new decryption key IDs 602 and 603 included in the new decryption key storage information 503 to transmit the old decryption key and the new decryption key to the decryption key management unit 415 of the reception device 410. Is stored and the encrypted packet encrypted with the updated encryption key can be decrypted. Therefore, the transmission device 400 updates the encryption key stored in the encryption key storage unit 406 of the encryption key management unit 405 (S505). The encryption key update information transmission unit 408 transmits the encryption key update information 504 including the encryption key ID 612 of the new encryption key to the reception device 410 (S506). Thereafter, the encrypted packet encrypted with the new encryption key 406 is transmitted to the receiving device 410.

  When receiving the encryption key update information 504, the reception device 410 recognizes that the transmission device has set the updated encryption key in the encryption key management means 405 from the encryption key ID 612 included in the encryption key update information 504, and manages the decryption key. The old decryption key is deleted from the part 415 (S507).

  Even if the encryption key is updated during transmission / reception of a series of long AV data and the like, and the encrypted packet encrypted with the new encryption key is transmitted, the receiving apparatus 410 supports the new encryption key. Since it is certain that the decryption key to be held is possessed, the encrypted packet is not dropped.

  3A shows the contents of the new decryption key storage information 503 transmitted from the receiving apparatus 410 to the transmitting apparatus 400, and FIG. 3B shows the encryption key update information 504 transmitted from the transmitting apparatus 400 to the receiving apparatus 410. The contents are shown.

  The new decryption key storage information 503 and the encryption key update information 504 are provided with headers 601 and 611 such as an IP header, a UPD header header, and a TCP header necessary for transmitting a packet at the head, and a new decryption key storage. The information 503 includes an old decryption key ID 602 and a new decryption key ID 603, and the encryption key update information 504 includes an encryption key ID 612.

  Thus, by including the new and old decryption key IDs 602 and 603 in the new decryption key storage information 503, the transmitting device 400 that has received the information 503 receives the packet encrypted by the receiving device 410 with any of the old and new encryption keys. It is possible to reliably recognize that it can also be decrypted.

  Next, FIG. 4 shows the update timing of the encryption key and the decryption key between the transmission device 400 and the reception device 410 and the new decryption key storage information when the encryption key update information 504 is lost during transmission due to a failure during communication. FIG. 503 is a sequence diagram showing exchange of encryption key update information 504.

  When receiving the new decryption key, the receiving device 410 stores it in the new decryption key storage unit 418 of the decryption key management unit 415 (S701). The decryption unit 413 of the reception device 410 can decrypt both the encrypted packet encrypted with the encryption key corresponding to the old decryption key and the encrypted packet encrypted with the encryption key corresponding to the new decryption key. Thereafter, the new encryption key storage information transmission unit 421 transmits the new decryption key storage information 503 including the old and new decryption key IDs 602 and 603 to the transmission device 400 (S702).

  Upon receiving the new decryption key storage information 503, the transmission device 400 uses the old and new decryption key IDs 602 and 603 included in the new decryption key storage information 503 to store the old decryption unit 413 of the reception device 410 in the decryption key management unit 415. Knows that the decryption key can be decrypted with the new decryption key. Therefore, the encryption key management unit 405 stores the new encryption key (S703), and transmits the encrypted packet encrypted with the new encryption key. Further, the encryption key update information transmission unit 408 transmits the encryption key update information 504 including the encryption key ID 612 to the reception device 410 (S704). Here, it is assumed that the encryption key update information 504 is lost on the transmission path.

  The encrypted packet transmitted by the transmitting device after transmitting the encryption key update information 504 is encrypted with the new encryption key, but the receiving device 410 can also decrypt it because the new decryption key 418 is also set. .

  Since the reception device 410 does not receive the encryption key update information for the new decryption key storage information 503 within a certain period from the time of transmission of the new decryption key storage information 503, the retransmission management unit 422 provided in the reception device 410 receives the new decryption key storage information 503. The key storage information 503 is retransmitted (S705). Upon receiving the retransmitted new decryption key storage information 503, the transmission device 400 transmits encryption key update information 504 (S706).

  When receiving the encryption key update information 504, the reception device 410 recognizes that the updated encryption key is stored in the encryption key management unit 405 from the encryption key ID 612 included in the encryption key update information 504, and receives the decryption key. The old decryption key is deleted from the management unit 415 (S707).

  As described above, according to the present embodiment, even if the encryption key update information 504 is lost during transmission, the receiving apparatus 410 holds both the old and new decryption keys, so that an encrypted packet encrypted with any encryption key can be used. Decryption can continue. Further, the transmission apparatus 400 can surely know the update timing of the encryption key from the new decryption key storage information 503. On the other hand, the receiving device 410 that has received the encryption key update information can know that the encryption key has been updated, and can then delete the old decryption key that is no longer needed.

  Although the case where the encryption key update information 504 transmitted by the transmission device 400 is lost has been described with reference to FIG. 4, the same applies to the case where the new decryption key storage information 503 transmitted by the reception device 410 is lost.

  That is, when communicating without failure, the transmitting apparatus 400 updates the encryption key and transmits the encryption key update information 504 after receiving the new decryption key storage information 503. The new decryption key storage information 503 is communicated. If the transmission device 400 is lost on the way, the transmission device 400 that has not received the new decryption key storage information 503 does not update the encryption key, and further does not transmit the encryption key update information 504. Accordingly, since the receiving apparatus 410 does not receive the encryption key update information 504 even after a certain period of time has elapsed after transmitting the new decryption key storage information 503, the new decryption key storage information 503 is retransmitted again. Even if lost, the new decryption key storage information 503 continues to be transmitted until a pair of new decryption key storage information 503 and encryption key update information 504 are finally exchanged.

  Thereby, even if either the request information 503 or the response information 504 is lost, it is possible to mutually confirm that the key has been updated between the transmission device 400 and the reception device 410.

While this confirmation sequence is being performed, packets encrypted with either the old or new encryption key may be transmitted / received, but a series of long data such as AV data may be transmitted during transmission. Even if the update is performed, since the packet encrypted with the old and new ciphers can be decrypted by the communication system according to the present embodiment, it is possible to reliably avoid the state in which AV data cannot be viewed due to the inability to decrypt. It becomes possible.
(Embodiment 2)
FIG. 5 is a configuration diagram showing the configuration of an encryption communication system including a key distribution server 821 according to another embodiment of the present invention.

  The cryptographic communication system according to the present embodiment includes a key distribution server 821 that distributes an encryption key and a decryption key to the transmission device 400 and the reception device 410 in addition to the transmission device 400 and the reception device 410 that are the same as those of the above-described embodiment. The key distribution server 821 has a key update unit 420 that generates keys at regular intervals, and a key distribution that controls a sequence of distributing the encryption key and the decryption key generated by the key update unit 420 to the transmission device 400 and the reception device 410. A sequence management unit 822 is provided.

The key distribution sequence management unit 822 transmits a decryption key to the reception device 410 at predetermined intervals, and transmits an encryption key corresponding to the decryption key to the transmission device 400 at a predetermined timing. When performing key distribution, the transmission apparatus 400 and the reception apparatus 410 are respectively connected to a key distribution server 821, SSL (Secure Socket Layer), and IPSec (Security Architecture for Security Architecture).
Establish a secure communication path using a method such as Internet Protocol.

  FIG. 6 shows the setting timing of the encryption key / decryption key between the transmission device 400, the reception device 410 and the key distribution server 821 for distributing the encryption key / decryption key when updating the encryption key and the decryption key in this embodiment. It is a sequence diagram which shows exchange of new decryption key storage information and response information.

  When the key is updated, the key distribution server 821 distributes the decryption key to the receiving device 410 (S901). When receiving the decryption key, the receiving device 410 stores the decryption key in the new decryption key storage unit 418 of the decryption key management unit 415 (S902), and transmits the new decryption key storage information 503 to the key distribution server 821 (S903). ).

  Upon receiving the new decryption key storage information 503 from the receiving device 410, the key distribution server 821 adds a new encryption key to the new decryption key storage information 503 and transmits it to the transmission device 400 (S904). The above sequence is performed by the key distribution sequence management unit 822 on the key distribution server 821.

  Upon receiving the new decryption key storage information 503 to which the encryption key is added, the transmission device 400 updates the encryption key of the encryption key management unit 405 (S905), and sends the key ID of the updated encryption key to the reception device 410. The encryption key update information 504 including is transmitted (S906).

  When receiving the encryption key update information 504, the reception device 410 recognizes that the encryption key has been updated in the transmission device 400 from the included key ID, and deletes the old decryption key from the decryption key management unit 415 (S907). Thereafter, the key update confirmation information 805 including the key ID of the new decryption key is transmitted to the transmission device 400 (S908).

  The key distribution server 821 can confirm from the new decryption key storage information 503 that the decryption key is stored in the receiving device 410. Thereafter, the updated encryption key is transmitted to the transmission device 400. Therefore, when the transmission apparatus 400 receives the updated encryption key, the encryption key can be immediately updated because the new decryption key is already stored in the decryption key management means in the reception apparatus. The receiving device 410 can delete the old decryption key when receiving the encryption key update request from the transmitting device 400.

Note that the key distribution server 821 may transmit the decryption key again if it does not receive the new decryption key storage information 503 even after a certain period of time has elapsed after transmitting the decryption key to the receiving device 410.
If the receiving device 410 does not receive the encryption key update information 504 even after a certain period of time has elapsed after transmitting the new decryption key storage information 503, the reception device 410 again uses the new decryption key storage information 503 as the key, as in the above embodiment. It transmits to the distribution server 821.

According to the present embodiment, the transmission apparatus 400 can know the timing when the new encryption key is set, and the reception apparatus 410 can know the timing when the old decryption key is deleted. In addition, since the encryption key is added to the new decryption key storage information and transmitted, the amount of packets required for key update can be reduced. Furthermore, the system according to the present embodiment does not cause a situation in which the data packet cannot be decrypted while updating the encryption key / decryption key. Therefore, even when the key is updated during transmission of long data, the data is not lost.
(Embodiment 3)
FIG. 7 shows another embodiment of the present invention, which is a cryptographic communication system provided with a key distribution server 821, and shows a configuration in which a receiving apparatus 410 is connected to a communication network 701 via a router 700. FIG.

  The cryptographic communication system according to the present embodiment includes a transmission device 400, a reception device 410, and a key distribution server 821 that are the same as those of the above-described embodiment, and a router 700 that relays data communication.

The key distribution server 821 includes a key update unit 420 and a key distribution sequence management unit 822, and a connection support unit 702 that manages setting information and the like of the router 700.
FIG. 8 is a sequence diagram showing a state until the transmission device 400 and the reception device 410 first establish communication in the cryptographic communication system including the router.

  In the figure, the receiving device 410 performs router setting for the router 700 so that the key distribution server 821 can connect to the receiving device 410 (S1005). Also, the setting information 750 of the router 700 is notified to the key distribution server 821 (S1006). By receiving the router setting information 750, the connection support unit 702 of the key distribution server 821 sets the key distribution server 821 so that it can connect to the receiving device 410 via the router 700.

These exchanges are performed immediately after the receiving apparatus 410 is turned on.
Next, in order for the transmitting device 400 to connect to the receiving device 410 and transmit an encrypted packet, first, connection request information 751 that is information indicating that the transmitting device 400 wants to connect to the receiving device 410 is transmitted to the key distribution server 821 ( S1007). The reason why the transmitting device 400 cannot directly connect to the receiving device 410 is that there is a router 700 between the two devices, and it is necessary to perform communication that matches the router 700.

The receiving device 410 determines whether to accept or reject the connection from the transmitting device 400.
When accepting the connection, the decryption key is stored in the new decryption key storage unit 418 of the decryption key management means 415 (S1010). Further, the router 700 is set so that the transmission device 400 can directly connect to the reception device 410 (S1009).

  Thereafter, the receiving device 410 transmits the new decryption key storage information 503 to which the connection response information and the router setting information for the transmitting device 400 are added to the key distribution server 821 (S1011).

The transmission device 400 and the reception device 410 establish a secure communication path using a key distribution server 821 and a method such as SSL or IPSec, respectively.
When the key distribution server 821 receives the new decryption key storage information 503 from the reception device 410, the key distribution server 821 transmits the new decryption key storage information 503 to which the encryption key is further added to the transmission device 400 (S1012).

  Since this new decryption key storage information 503 is added with the connection response information and router setting information of the receiving device, if the transmitting device transmits a packet to which port of the receiving router, the packet reaches the receiving device. Can know.

  When receiving the new decryption key storage information 503, the transmission device 400 confirms that the reception device 410 can decrypt the new decryption key, knows the router setting information 750, and obtains the encryption key. Next, the newly received encryption key is stored in the encryption key management means 405 (S1013). After connection completion notification information is transmitted to the key distribution server 821 (S1014), a connection is established to the receiving device 410 based on the received router setting information 750, and encrypted communication is started.

After the communication is established as described above, the encryption key update information 504 is directly transmitted to the receiving device 410 (not shown), and the subsequent processing is the same as in the above embodiment.
According to the present embodiment, by combining the encryption key / decryption key distribution with the connection support by the key distribution server 821 provided with the connection support unit 702, it is possible to shorten the time until connection of the encrypted communication.

The present invention can be applied to encrypted packet communication, and particularly applicable to encrypted packet communication of long data such as AV data.

It is a block diagram which shows the structure of the transmitter in the encryption communication system of this invention, and a receiver. It is a sequence diagram which shows the transmission state of the key update between a transmitter and a receiver in the encryption communication system concerning this invention, and information. (A) is a figure which shows the packet structure of the new decryption key storage information in embodiment of this invention, (b) is a figure which similarly shows the packet structure of encryption key update information. It is a sequence diagram which shows the transmission state of the information between the transmitter in the encryption communication system concerning this invention, and a receiver. It is a block diagram which shows the other structure of the encryption communication system concerning this invention. It is a sequence diagram which shows the transmission state of the information between the transmitter in the encryption communication system of the said structure, a receiver, and a key distribution server. It is a block diagram which shows the other structure of the encryption communication system concerning this invention. The sequence diagram which shows the transmission state of the information between the transmitter in the said encryption communication system, a receiver, and a key distribution server. The structure of the transmitter in a conventional encryption communication system and a receiver is shown. The data packet and key update packet which flow between a transmitter and a receiver are shown. The case where the data packet and key update packet which flow between a transmission apparatus and a reception apparatus are lost is shown.

Explanation of symbols

400 Transmission device 401 Transmission application 402 Encryption packet transmission unit 403 Encryption unit 404 Encapsulation unit 405 Encryption key management unit 406 Encryption key storage unit 407 Encryption key ID storage unit 408 Encryption key update information transmission unit 410 Reception device 411 Reception application 412 Encryption Packet reception unit 413 Decryption unit 414 Decapsulation unit 415 Decryption key management unit 416 Old decryption key storage unit 417 Old decryption key ID storage unit 418 New decryption key storage unit 419 New decryption key ID storage unit 420 Key update unit 421 New decryption key Storage information transmission unit 422 Retransmission management unit 503 New decryption key storage information 504 Encryption key update information 602 Old decryption key ID
603 New decryption key ID
612 Encryption key ID
700 Router 805 Key update confirmation information 821 Key distribution server 831 Key distribution response information

Claims (12)

2. Description of the Related Art An encryption packet communication system including a transmission device that transmits an encryption packet, a reception device that receives an encryption packet, and a key update unit that generates new encryption keys and decryption keys that correspond to each other at predetermined time intervals. And
The receiving device is:
Decryption key management means for storing at least two decryption keys, a new decryption key received from the key update means and an old decryption key before reception;
Decryption means for decrypting the encrypted packet by selecting one of the old and new decryption keys;
New decryption key storage information transmitting means for transmitting new decryption key storage information indicating that a new decryption key is stored in the decryption key management means,
The transmitter is
After receiving the new decryption key storage information, the encryption key management means for discarding the old encryption key and storing a new encryption key;
An encryption packet communication system comprising: encryption key update information transmission means for transmitting encryption key update information indicating that the encryption key management means has updated the encryption key. The receiving device further includes:
The re-transmission management means for transmitting the new decryption key storage information again when the encryption key update information is not received even after a predetermined period of time has elapsed after transmitting the new decryption key storage information. The encryption packet communication system described. The encrypted packet communication system further includes:
A key distribution server,
The key distribution server
The key update means;
3. The encrypted packet communication system according to claim 2, further comprising key distribution sequence management means for adding an encryption key to the received new decryption key storage information and transmitting the information. The encrypted packet communication system further includes:
A router that relays encrypted packets
4. The encryption packet communication system according to claim 3, wherein the key distribution server further comprises connection support means for managing setting information of the router. The transmitting device further includes a capsuling means for capsulating the key ID corresponding to the encryption key into the encryption packet,
The encrypted packet communication system according to claim 1, further comprising a decapsulating unit that decapsulates the key ID from the received encrypted packet. Reception in a cryptographic packet communication system comprising: a transmitting device that transmits an encrypted packet; a receiving device that receives the encrypted packet; and a key update unit that generates a new encryption key and a decryption key that correspond to each other at a predetermined time interval. A device,
Decryption key management means for storing at least two decryption keys, a new decryption key received from the key update means and an old decryption key before reception;
Decryption means for decrypting the encrypted packet by selecting one of the old and new decryption keys;
A receiving apparatus comprising: new decryption key storage information transmitting means for transmitting new decryption key storage information indicating that a new decryption key is stored in the decryption key management means. Transmission in a cryptographic packet communication system comprising: a transmitting device that transmits an encrypted packet; a receiving device that receives the encrypted packet; and a key update unit that generates a new encryption key and a decryption key that correspond to each other at a predetermined time interval. A device,
After receiving the new decryption key storage information, the encryption key management means for discarding the old encryption key and storing the new encryption key;
A transmission apparatus comprising: encryption key update information transmission means for transmitting encryption key update information indicating that the encryption key management means has updated the encryption key. An encryption packet communication system comprising: a transmission device that transmits an encryption packet; a reception device that receives an encryption packet; and a key update unit that generates a new encryption key and a decryption key that correspond to each other at a predetermined time interval. The receiving device selects either the decryption key management means for storing at least two decryption keys, the new decryption key received from the key update means and the old decryption key before reception, or the old and new decryption keys. And a decryption means for decrypting the encrypted packet, and a method applied to the encrypted packet communication system,
A new decryption key storage information transmission step in which the reception device transmits new decryption key storage information indicating that a new decryption key is stored in the decryption key management means;
After the transmission device receives the new decryption key storage information, an encryption key management step of discarding the old encryption key and storing a new encryption key;
An encryption packet communication method comprising: an encryption key update information transmission step of transmitting encryption key update information indicating that the encryption key management means has updated the encryption key. In the method applied to the receiver of Claim 1,
A new decryption key storage information transmission step in which the reception device transmits new decryption key storage information indicating that a new decryption key is stored in the decryption key management means;
A transmission method comprising: a retransmission management step of transmitting new decryption key storage information again when encryption key update information is not received even after a predetermined period of time has elapsed after transmitting new decryption key storage information.   A receiving program for causing a computer to execute the steps included in the receiving method according to claim 9. A method applied to the transmission device according to claim 1,
After receiving the new decryption key storage information, an encryption key management step for discarding the old encryption key and storing a new encryption key;
A transmission method comprising: an encryption key update information transmission step of transmitting encryption key update information indicating that the encryption key management means has updated the encryption key. A reception program for causing a computer to execute the steps included in the transmission method according to claim 11.

Images