JP2000347565A - Cipher communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a cipher communication system permitting to reduce management load generating associated with changes in composition such as move or addition of users when plural different ciphering algorithms are used in concatenation. SOLUTION: A cipher communication channel control device 106 gives an information categorization ID to each ciphering device beforehand, and when a Japan administration client 104 and a U.S. accounting client 108 make access to a Japan personnel server 101, and Japan accounting servers 102 103, cipher concatenation is executed via a cipher gateway device 105 by using the information categorization ID given by the cipher communication channel control device 106.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a cryptographic communication system that employs a plurality of different encryption algorithms, and more particularly to a case where a plurality of different encryption algorithms are used in conjunction with a configuration change such as moving or adding a user. The present invention relates to a cryptographic communication system capable of reducing a management load that occurs.

[0002]

2. Description of the Related Art Recent DES (Data Encryption Standa)
With the spread of rd) cryptography and RSA (Rivest-Shamir-Adleman) cryptography, the need to handle different cryptographic algorithms in one cryptographic communication system has increased, and the need to perform cryptographic concatenation has increased.

For this reason, Japanese Unexamined Patent Publication No. Hei 6-85811 discloses that when a system adopts a different encryption algorithm, communication data encrypted by a first encryption algorithm is once decrypted at a predetermined secure node, and then decrypted. A technique is disclosed in which encrypted communication data is encrypted with a second encryption algorithm, thereby performing encryption connection between different encryption algorithms. Note that this safety node is the first
Is a kind of connection device for encryption (hereinafter, referred to as “encryption gateway device”) that couples an encryption communication channel using the encryption algorithm described above with an encryption communication channel using the second encryption algorithm. Each encrypted communication path is formed.

A conventional cryptographic communication system represented by this conventional technique employs a cryptographic management system for managing cryptography between cryptographic devices for encrypting communication data, that is, for each cryptographic communication channel.

FIG. 7 is a diagram showing an example of a conventional encryption communication system provided with such an encryption gateway device.
As shown in FIG.
0 is connected to a Japanese affairs server 71, a Japanese accounting server 72, a Japanese general affairs client 73, and an encryption gateway device 74.

Here, the Japanese affairs server 71 and the Nippon Accounting server 72 are provided with an encryption device 75 for Japan using an encryption algorithm A,
3 and the encryption gateway device 74 incorporate encryption software corresponding to the Japanese encryption device 75 using the encryption algorithm A.

Further, since the US accounting client 77 subscribes to the LAN 70 via the Internet 76, the US accounting client 77
2 can also be accessed. However, the US accounting client 77 and the encryption gateway device 74
The encryption software using the encryption algorithm B is built in, and the encryption for the encryption algorithm B for the Internet is used between the US accounting client 77 and the encryption gateway device 74.

In such a case, the encryption gateway device 74 performs encryption connection using the encryption management table 80 shown in FIG. Specifically, the encryption management table 8
0 indicates a source terminal address, a destination terminal address, an encryption algorithm, an encryption key, a type of encryption / decryption, presence / absence of establishment,
It consists of an encrypted communication path partner device address and a network type (I / L).

Here, the source terminal address and the destination terminal address indicate the source terminal address and the destination terminal address of the communication data, the encryption algorithm indicates the encryption algorithm used in the encryption communication path, and the encryption key indicates Indicates the encryption key used for encryption / decryption. Also, the type of encryption / decryption indicates the processing content of the received communication data, and the presence / absence of establishment is determined when an encryption communication path is opened with the encryption device indicated by the address of the other device of the encryption communication path. Indicates whether the communication channel is opened or not. The network type (I / L) indicates whether each encrypted communication channel is applied to the LAN side (Japan domestic network side).
Indicates whether it applies to the Internet side.

When the encryption gateway device 74 receives the communication data addressed to the Japan accounting server 72 from the US accounting client 77, the source terminal address of the communication data is the US accounting client 77 and the destination terminal address Is the accounting server 72 and is the data received from the Internet side. The encryption communication path indicated by 3 is selected.

This No. The encryption algorithm used in the third encryption channel is "Internet encryption algorithm B".
Since the encryption key to be used is “3333” and the processing operation is “decryption”, the received communication data is decrypted using the encryption algorithm B and the encryption key 3333, and is temporarily converted to plaintext.

Thereafter, since this communication data is to be transmitted to the LAN side, the communication data is transmitted from the destination terminal address to the No. in the encryption management table 80. No. 1 is selected, and this No. 1 is selected. The communication data is encrypted using the first encryption algorithm A and the encryption key 1111 and transmitted to the LAN 70.

As described above, in the conventional cryptographic communication system, since the cryptographic management system for managing the ciphers in units of cryptographic communication channels is employed, even when the cryptographic connection is performed, the system in which the cryptographic communication channels are connected is employed. . Specifically, the encryption gateway device 74 is responsible for linking the encryption communication path. The encryption gateway device 74 decrypts the communication data based on the encryption management table 80 and re-encrypts the decrypted plaintext. Was doing it.

[0014]

However, when the cryptographic communication paths are connected by using the cryptographic gateway 74, the more the number of cryptographic communication paths increases, the more the number of encryptions to be managed increases. There is a problem that the load of updating the encryption management table 80 increases. In particular, if the source terminal user moves from the United States to the United States,
When a user who has stayed in the United States returns to the United States from the United States, the encryption management table 80 must be updated each time, which complicates encryption management.

For example, when the user of the Japanese general affairs client 73 shown in FIG. 7 moves to the United States and accesses the Japanese accounting server 72 from the United States, the encryption management table 80 shown in FIG. 90, the cryptographic gateway device 74 must be able to handle the client after the move, and when this user returns from the destination for security reasons, the database changed at the time of the move is immediately restored to the original. Must be returned to

As described above, when the conventional encryption management table is used, the burden of updating the encryption management table accompanying the movement of the user operating the client is large,
This was a major cause of lowering the efficiency and operability of cipher management.

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and it is possible to reduce a management load caused by a configuration change such as a movement or addition of a user when a plurality of different encryption algorithms are used jointly. An object of the present invention is to obtain a cryptographic communication system capable of performing such a communication.

[0018]

In order to achieve the above object, an encryption communication system according to the present invention comprises a first encryption algorithm provided corresponding to a first server for providing first information. A first encryption device that employs a second encryption algorithm, and a second encryption device that employs a second encryption algorithm provided corresponding to a second server that provides second information; Cryptographic communication in which a plurality of third cryptographic devices that employ the same or different cryptographic algorithm as the first or second cryptographic algorithm provided for each of a plurality of clients receiving services from the second server are connected via a network. In the system, identification information providing means for providing predetermined identification information to the first encryption device, the second encryption device, and the third encryption device; And cryptographic communication path opening means for opening each of the cryptographic communication paths between the client and the server based on the identification information given to the first cryptographic apparatus, the second cryptographic apparatus, and the third cryptographic apparatus. Features.

According to the present invention, the first encryption device and the second encryption device
Given identification information to the first encryption device, the third encryption device, and the third encryption device, and based on the identification information assigned to the first encryption device, the second encryption device, and the third encryption device, a client-server Since we decided to open each encryption communication channel,
Even in the case where the client moves, the establishment of the encrypted communication path can be easily performed by using the identification information.

[0020] The cryptographic communication system according to the next invention comprises:
The first encryption device, the second encryption device, and the third encryption device may be an encryption device provided separately from the first server, the second server, and the client, or the first server;
The encryption software is installed on the second server and the client.

[0021] The cryptographic communication system according to the next invention comprises:
The identification information assigning means assigns different identification information to the first information and the second information, and the first server,
It is characterized in that identification information corresponding to the first encryption device, the second encryption device, and the third encryption device is added according to the content of information handled by the second server and each client.

According to the present invention, the first information and the second information
Different identification information is assigned to the first encryption device, the second encryption device, and the third encryption device according to the content of the information handled by the first server, the second server, and each client.
Since the identification information corresponding to the encryption device is assigned, identification information corresponding to the type of information such as personnel information or accounting information can be assigned to each encryption device.

[0023] The cryptographic communication system according to the next invention comprises:
The identification information providing means includes a first server and a second server.
Different identification information is allocated to the first encryption device, the second encryption device, and the third encryption device according to the type of server accessed by each client. And

According to the present invention, different identification information is assigned to the first server and the second server, and the first encryption device, the second encryption device, and the second encryption device are assigned according to the type of server accessed by each client. Since the identification information is assigned to the third encryption device, identification information corresponding to the type of the server providing the service can be assigned to each encryption device.

[0025] The cryptographic communication system according to the next invention comprises:
The identification information assigning means assigns the identification information to the first encryption device, the second encryption device, and the third encryption device via a predetermined recording medium.

According to the present invention, the identification information is given to the first encryption device, the second encryption device, and the third encryption device via the predetermined recording medium. Performance can be improved.

[0027] The cryptographic communication system according to the next invention comprises:
When the third encryption device employs an encryption algorithm different from the first encryption algorithm and the second encryption algorithm, an encryption gateway device that encrypts and connects the encryption algorithm with the first or second encryption algorithm. And the encryption gateway device further comprises:
The encryption algorithm of the third encryption device is changed to the first encryption device based on the identification information given by the identification information giving means.
Alternatively, it is cryptographically connected with the second encryption algorithm.

According to the present invention, when the encryption algorithm of the third encryption device is different from the first encryption algorithm and the second encryption algorithm, the encryption algorithm is changed to the first or second encryption algorithm based on the assigned identification information. Since the cryptographic connection is established with the second cryptographic algorithm, it is not necessary to frequently update the table of the cryptographic gateway device according to the movement of the client.

[0029]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of an encryption communication system, an encryption communication method and a recording medium according to the present invention will be described below in detail with reference to the accompanying drawings.

FIG. 1 is a block diagram showing a system configuration of a cryptographic communication system used in the present embodiment. The cryptographic communication system according to the present invention shown in the figure does not simply perform cryptographic management of the cryptographic communication system for each cryptographic communication path, but rather sets cryptographic communication paths between cryptographic devices based on identification information assigned to clients. By performing such negotiation and automatically updating the encryption management table of the encryption gateway device 105 by the negotiation, the encryption management by the encryption administrator is facilitated.

As shown in FIG. 1, this cryptographic communication system includes a LAN 100 and a Japanese affairs server 101, Nippon Accounting servers 102 and 103, and a Japanese general affairs client 1
04, an encryption gateway device 105, and an encryption communication channel management device 106 are connected. Note that the encryption gateway device 105 and the Internet 107
To the LAN 100 via the US accounting client 108
Is connected.

The LAN 100 is a local area network for general affairs related information provided in Japan, and the Japanese affairs server 101 is a server that provides personnel information to each client. Note that this Japanese thing server 101
Is connected to the LAN 100 via a Japanese encryption device 101a that employs a Japanese encryption algorithm. The accounting servers 102 and 103 are servers that provide accounting information to each client, and are connected to the LAN 100 via encryption devices 102a and 103a for Japan that employ encryption algorithms for Japan.

The Japanese general affairs client 104 is a client terminal for accessing personnel information and accounting information to the Japanese affairs server 101 and the accounting servers 102 and 103, respectively, and employs the encryption algorithm of the Japanese encryption devices 101a, 102a and 103a. Built-in encryption software. The Japanese general affairs client 104 configures the personnel information encryption path 110 with the Japanese encryption device 101a, and the Japanese encryption device 1
A cryptographic communication channel 111 for accounting information is formed between the cryptographic device 02a and the cryptographic device 103a for Japan.

The cryptographic gateway device 105 is a cryptographic connection device for performing a cryptographic connection when each client 108 located in, for example, the United States, which is connected via the Internet 107, accesses the Japanese affairs server 101 and the accounting servers 102 and 103. It is. Accordingly, the cryptographic gateway device 105 incorporates cryptographic software that employs the cryptographic algorithm of the Japanese cryptographic devices 101a, 102a, and 103a, like the Japanese general affairs client 104, and the US accounting client 10
8 incorporates encryption software that employs an encryption algorithm for the Internet.

Then, the encryption gateway device 105
In this example, a personnel information encryption path 110 is configured with the Japanese encryption apparatus 101a, and an accounting information encryption communication path 1 is defined between the Japanese encryption apparatus 102a and the Japanese encryption apparatus 103a.
11 and the US accounting client 108
, A cryptographic communication path 112 for the Internet is configured. When the user of the Japanese general affairs client 104 moves to the United States, the encrypted communication path 11 indicated by a broken line in FIG.
3 is configured separately.

The cryptographic communication path management device 106 is a device for assigning an information type ID to each cryptographic device constructed by hardware or software forming the cryptographic communication system. Is “1”, and the information type ID of the accounting information is “2”.

By using the cryptographic communication system having the above configuration, it is possible to assign an information type ID to each encryption device and configure an encrypted communication path based on the assigned information type ID.

Next, the information type ID assigned to each encryption device by the encryption channel management device 106 shown in FIG. 1 will be described. FIG. 2 is a block diagram of the cryptographic communication path management device 10 shown in FIG.
FIG. 6 is an explanatory diagram showing an information type ID assigned to each encryption device. As shown in FIG.
Deals with only accounting information, the encryption software of the U.S. accounting client 108 is assigned an information type "2". Also, since the Japanese general affairs client 104 handles both personnel information and accounting information, the encryption software of the Japanese general affairs client 104 is assigned information types "1" and "2".

Since the Japanese affairs server 101 handles only personnel affairs information, the information type "1" is assigned to the Japanese cryptographic device 101a corresponding to the Japanese affairs server 101. Handles only accounting information, so this Nippon Accounting Server 102
The information type “2” is assigned to the Japanese cryptographic devices 102 a and 103 a corresponding to and 103.

The information (source address and destination terminal address) required for establishing an encryption communication path between the encryption devices must be set in the encryption management table in advance as described in the section of the prior art. Can be, but IPSE
When communication occurs like C (IP Security Protocol),
Negotiation can be performed between related cryptographic devices to open a cryptographic communication channel. When an encrypted communication channel is established at the time of communication, as in IPSEC, it is necessary to hold in advance a table for specifying a party to establish an encrypted communication channel as shown in FIG.

As described above, the encrypted communication path management device 10
6 assigns the information type ID to each encryption device, and if the table information for establishing the encryption communication path possessed by each encryption device is set at the time of system construction, it is not necessary to update it later.

FIG. 3 is a table for specifying a partner who establishes a cryptographic communication channel held by the cryptographic gateway device 105 shown in FIG. Referring to the table shown in the figure, the opposite encryption device corresponding to the U.S.A. accounting client 108 is encryption software of the U.S.A. accounting client 108, the encryption algorithm is for the Internet, and the Japanese general affairs client 104 (after moving) ) Is the encryption software of the Japan General Affairs Client 104 (after moving), and it can be seen that the encryption algorithm is for the Internet.

The Japanese general affairs client 104
Is usually located in Japan, so there is no need to register it in the table held by the cryptographic gateway 105. However, in order to avoid complicated updating of this table, the Japanese general affairs client 104 after moving is registered in the table in advance. ing.

The opposite encryption device corresponding to the Japanese affairs server 101 is the Japanese encryption device 101a, the opposite encryption device corresponding to the Nippon Accounting server 102 is the Japanese encryption device 102a, and the corresponding Nippon accounting server 103. It can be seen that the opposite encryption device is the Japanese encryption device 103a.

Next, a communication procedure between the US accounting client 108 and the Japanese accounting server 102 shown in FIG. 1 will be described. FIG. 4 is a sequence diagram showing a communication procedure between the U.S. accounting client 108 and the Nippon accounting server 102 shown in FIG. It should be noted that here, a case is shown in which an encryption communication channel is established when communication occurs, as in IPSEC.

As shown in the figure, when the US accounting client 108 communicates with the Japanese accounting server 102, first, the information type ID “2” of the US accounting client 108 is transmitted via the encryption gateway device 105. Notify the Japanese encryption device 102a (step S40)
1).

Then, the Japanese encryption device 102b that has received the information type ID compares the notified information type ID with the information type ID held therein, and performs a close examination of the information type ID (step S402). . Specifically, when both match, a connection permission notice for permitting communication is issued (step S403), and when the information type IDs do not match, connection is not permitted.

Then, the U.S.A. accounting client 108 that has received the connection permission notification establishes an encrypted communication path for the Internet with the encryption gateway device 105 (step S404). At the time of establishing the communication path, the information indicating that the information type ID is “2” is simultaneously notified to the encryption gateway apparatus 105. Then, the cryptographic gateway device 105 that has established the cryptographic communication path with the US accounting client 108 opens the Japanese cryptographic communication path with the Japanese cryptographic device 102b (step S405).

When the Internet cryptographic communication path and the Japanese cryptographic communication path are established, encrypted communication data is transmitted and received between the US accounting client 108 and the cryptographic gateway device 105 via the Internet 107 (step S406), encrypted communication data is transmitted and received between the encryption gateway device 105 and the Japanese encryption device 102b using the Japanese domestic encryption (step S407), and the plaintext communication data decrypted by the Japanese encryption device 102b is transmitted to the Nippon Accounting Server. The data is transmitted to the client 102 (step S408).

Thus, in this cryptographic communication system,
Information type I performed by the encryption device prior to encrypted communication
Since the encryption gateway device 105 automatically determines the establishment of the encryption communication path through the establishment of the encryption communication path using D, the burden of updating the encryption management table by the encryption administrator can be reduced.

Note that the procedure for establishing the encryption communication path of each encryption device differs depending on the encryption communication path establishment method to be used, and a detailed description thereof will be omitted. Also, here, the information type ID is compared prior to the establishment of the encryption communication path, but the information type ID to be relayed is set in the encryption gateway device 105 in advance,
It is also possible to configure so that the information type ID is compared at the time of establishing the encrypted communication path.

Next, in this cryptographic communication system,
A case where the user of the Japanese general affairs client 104 shown in FIG. 1 has moved to the United States will be described. FIG. 5 is a block diagram showing a system configuration when the user of the Japanese general affairs client 104 shown in FIG. 1 moves to the United States.

As shown in the figure, when the user of the Japanese general affairs client 104 moves to the United States, the Japanese general affairs client 104 cannot use the Japanese encryption algorithm in the United States. The encryption software that employs the Internet encryption algorithm of the US accounting client 108 is installed.

Then, this Japanese general affairs client 104
Has moved to the United States, the information type ID “1” or “2” owned by itself is transmitted to the Japanese cryptographic device 101 prior to communication, as in the case of the US accounting client 108 described above.
a to 103a, and establishes a cryptographic communication path for the Internet and a cryptographic communication path for Japan. At this time, the work of changing the table setting of the encryption gateway device 105 as described in the related art is unnecessary.

In the above series of descriptions, the information type ID is assigned to each information type such as personnel information and accounting information. However, the present invention is not limited to this. In addition, a detailed encryption communication path can be realized while suppressing an increase in management load by assigning a server ID as a server ID.

For example, the server ID of the Japanese affairs server 101 is set to “1”,
Is set to “2” and the server ID of the Nippon Accounting Server 103 is set to “3”, each encryption device holds a server ID as shown in FIG.

Specifically, the US accounting client 108
Handles only accounting information, so the encryption software of the U.S. accounting client 108 has a server ID "2"
And "3" are assigned to the
Since the server handles personnel information and accounting information, server software IDs "1", "2" and "3" are assigned to the encryption software of the Japanese general affairs client 104.

Since the Japanese encryption device 101a is provided corresponding to the Japanese affairs server 101,
A server ID “1” is assigned to the Japanese encryption device 101a, and the Japanese encryption device 102a is
02, the server ID “2” is assigned to the Japanese cryptographic device 102a, and the Japanese cryptographic device 103a is provided corresponding to the Nippon Accounting Server 103. So, this Japanese encryption device 1
03a is assigned a server ID “3”.

In the above series of descriptions, the information type ID
Alternatively, the server ID is set in the client terminal (Japan General Affairs Client 104, US Accounting Client 108), but the present invention is not limited to this, and the ID is set in an external medium such as an IC card,
This can be configured to be passed to the user of each client. When such an IC card or the like is used, for example, when the user of the Japanese general affairs client 104 moves to the United States, only the IC card for the user of the Japanese general affairs client 104 is taken out to the United States, and the United States accesses each server in Japan. In this case, it is sufficient to insert an IC card into a client machine in the United States, so that the convenience at the time of moving is greatly improved.

As described above, in the present embodiment,
Since the cryptographic communication path management device 106 is configured to assign an information type ID to each encryption device and perform cryptographic concatenation via the encryption gateway device 105 using the assigned information type ID, a plurality of different encryption algorithms can be used. In the case of continuous use, it is possible to reduce a management load caused by a configuration change such as moving or adding a user.

In the present embodiment, the information type ID or the server ID is notified as it is. However, the ID can be encrypted to further increase the security strength.

In this embodiment, the encryption software of the encryption algorithm for the Internet and the encryption software of the encryption algorithm for Japan are installed in one encryption gateway device 105.
The present invention is not limited to this, and the encryption gateway device 105 may be composed of two devices, an Internet encryption device and a Japanese domestic encryption device.

[0063]

As described above, according to the present invention, predetermined identification information is given to the first encryption device, the second encryption device, and the third encryption device, and the first encryption device, 2
Is configured to open each encrypted communication path between the client and the server based on the identification information given to the third encryption device and the third encryption device. The information can be used to easily establish an encrypted communication path.

According to the next invention, different identification information is assigned to the first information and the second information, and the first server
Since the identification information corresponding to the first encryption device, the second encryption device, and the third encryption device is provided in accordance with the content of the information handled by the second server and each client, personnel information or accounting is provided. Identification information corresponding to the type of information such as information can be given to each encryption device.

According to the next invention, different identification information is assigned to the first server and the second server, and the first encryption device, the second encryption device, and the second encryption device are assigned according to the type of server accessed by each client. Since the configuration is such that the identification information is assigned to the third encryption device, identification information corresponding to the type of server providing the service can be assigned to each encryption device.

According to the next invention, the identification information is provided to the first encryption device, the second encryption device, and the third encryption device via the predetermined recording medium. Convenience can be improved.

According to the next invention, the encryption algorithm of the third encryption device is the first encryption algorithm and the second encryption algorithm.
When the encryption algorithm is different from the encryption algorithm, the encryption algorithm is configured to be cryptographically connected to the first or second encryption algorithm based on the assigned identification information. The need for frequent updates can be eliminated.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a system configuration of a cryptographic communication system used in the present embodiment.

FIG. 2 is an explanatory diagram showing an information type ID assigned to each encryption device by an encryption channel management device shown in FIG. 1;

FIG. 3 is an explanatory diagram showing a table for specifying a partner who establishes a cryptographic communication channel held by the cryptographic gateway device shown in FIG. 1;

FIG. 4 is a sequence diagram showing a communication procedure between the US accounting client and the Nippon Accounting server shown in FIG. 1;

FIG. 5 is a block diagram showing a system configuration when the user of the Japanese general affairs client shown in FIG. 1 moves to the United States.

FIG. 6 is an explanatory diagram for explaining a server ID provided for each server.

FIG. 7 is a diagram showing an example of a conventional cryptographic communication system provided with a cryptographic gateway device.

8 is a diagram illustrating an example of an encryption management table included in the encryption gateway device illustrated in FIG. 7;

9 is a diagram illustrating an example of an encryption management table when the user of the Japanese general affairs client illustrated in FIG. 7 moves to the United States.

[Explanation of symbols]

100 LAN, 101 Japanese Affairs Server, 102, 1
03 Nippon Accounting Server, 101a, 102a, 103
a Japanese cryptographic device, 104 Japanese general affairs client,
Reference Signs List 105 encryption gateway device, 106 encryption communication channel management device, 107 Internet, 108 US accounting client, 110 personnel information encryption communication channel, 111 accounting information encryption communication channel, 112 Internet encryption communication channel, 113 encryption used when moving Communication path.

Continuation of the front page (72) Inventor Shinobu Gozawa 2-3-2 Marunouchi, Chiyoda-ku, Tokyo F-term (reference) in Mitsubishi Electric Corporation 5J104 AA32 DA03 EA26 NA36 PA07 5K030 GA15 HC01 HC14 HD03 HD07 9A001 CC07 EE03 JJ13 JJ25 KK56 LL03

Claims (6)

[Claims] 1. A first encryption device that employs a first encryption algorithm and is provided corresponding to a first server that provides first information, and a second server that provides second information. And a second encryption device that employs a second encryption algorithm provided in correspondence with the first or second client provided for each of a plurality of clients receiving services from the first server or the second server. In a cryptographic communication system in which a plurality of third cryptographic devices adopting the same or different cryptographic algorithm from the second cryptographic algorithm are connected via a network, the first cryptographic device, the second cryptographic device, and the third cryptographic device Identification information providing means for providing predetermined identification information to the first encryption device, the second encryption device,
And a cryptographic communication path opening means for opening each of the cryptographic communication paths between the client and the server based on the identification information given to the cryptographic apparatus and the third cryptographic apparatus. 2. The first encryption device, the second encryption device, and the third encryption device may be encryption devices provided separately from the first server, the second server, and the client, or the first server. 2. The cryptographic communication system according to claim 1, wherein the cryptographic software is cryptographic software installed in the second server and the client. 3. The identification information assigning means assigns different identification information to the first information and the second information, and according to the contents of information handled by the first server, the second server, and each client. , The first encryption device, the second
The cryptographic communication system according to claim 1, wherein identification information corresponding to the first encryption device and the third encryption device is provided. 4. The identification information assigning means assigns different identification information to the first server and the second server,
Depending on the type of server each client accesses,
3. The cryptographic communication system according to claim 1, wherein identification information is given to the first cryptographic device, the second cryptographic device, and the third cryptographic device. 5. The apparatus according to claim 1, wherein the identification information assigning means assigns the identification information to the first encryption device, the second encryption device, and the third encryption device via a predetermined recording medium. Item 5. The encryption communication system according to any one of Items 1 to 4. 6. When the third encryption device employs an encryption algorithm different from the first encryption algorithm and the second encryption algorithm, the third encryption device encrypts the encryption algorithm with the first or second encryption algorithm. A cryptographic gateway device connected to the third cryptographic device, the cryptographic gateway device changing the cryptographic algorithm of the third cryptographic device to the first or second cryptographic algorithm based on the identification information provided by the identification information providing means; The cryptographic communication system according to any one of claims 1 to 5, wherein cryptographic connection is performed.