JP2008301072A - Encryption communication line restoration method, encryption communications device, and encryption communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an encryption communication line restoration method which allows a virtual encryption communication line to be restored automatically, quickly in the case of disconnection of the virtual encryption communication line, an encryption communications device, and to provide an encryption communication system. <P>SOLUTION: The encryption communication line restoration method for automatically restoring the virtual encryption communication line at disconnection of the line includes an information storing step of storing information necessary for use of the virtual encryption communication line into terminals 1 and 2; an information registering step of registering the information with a management device 3; an information reading step of making at least one of terminals 1 and 2, wherein information is unavailable, read the information from the management device 3, when at least one piece of information stored in the terminal 1 and information stored in the terminal 2 becomes unavailable, and the virtual encryption communication line is disconnected; and an encryption communication line restoring step of automatically restoring the virtual encryption communication line, by using information read out from the management deice 3. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an encryption communication path recovery method, an encryption communication apparatus, and an encryption communication system, and more particularly, an encryption communication path recovery that automatically recovers a virtual encryption communication path when an established virtual encryption communication path is disconnected. The present invention relates to a method, an encryption communication device, and an encryption communication system.

For example, in encrypted communication using a secure protocol such as IPsec, an IPsec tunnel, which is a virtual encrypted communication path, is exchanged and shared with security association (SA) information such as encryption method and encryption key before starting encrypted communication. Establish. IPsec is a secure protocol that performs encryption and authentication at the IP level (network layer). SA information in IPsec is negotiated by IKE (Internet Key Exchange) which is a key exchange protocol. In IPsec, when negotiation is completed, encrypted communication through an IPsec tunnel is possible. Patent Document 1 describes an example of encrypted communication using IPsec.
Japanese Patent Laid-Open No. 2003-115834

  By the way, a terminal that has established an IPsec tunnel with another terminal sometimes loses SA information due to a power cut or the like. In this case, other terminals that have not lost the SA information recognize that the IPsec tunnel remains established. Accordingly, other terminals that have not lost the SA information try to perform encrypted communication using the IPsec tunnel even after the terminal of the encryption communication partner has lost the SA information.

  On the other hand, even if a terminal that has lost SA information receives encrypted data via an IPsec tunnel, there is a problem that the encrypted data cannot be decrypted because SA information has been lost. Conventionally, in encryption communication using an IPsec tunnel, if any of the terminals that have established the IPsec tunnel loses SA information, it is necessary to negotiate again with IKE, which is a key exchange protocol. There was a problem of hanging.

  The present invention has been made in view of the above points. An encryption communication path recovery method and encryption communication capable of automatically returning a virtual encryption communication path quickly when the virtual encryption communication path is disconnected. An object is to provide an apparatus and a cryptographic communication system.

  In order to solve the above problems, the present invention provides an encryption communication path restoration method for automatically restoring the virtual encryption communication path when the virtual encryption communication path established in the communication system is disconnected. When the virtual encryption communication path is established between the first terminal and the second terminal, information necessary for using the virtual encryption communication path is obtained from the first terminal and the second terminal. An information storage step for storing information in a terminal, an information registration step in which at least one of the first terminal and the second terminal registers the information in a management device other than the first terminal and the second terminal, At least one of the information stored in the first terminal and the second terminal becomes unusable, and the information becomes unusable when the virtual encryption communication path is disconnected Less of the first terminal or the second terminal The other includes an information reading step for reading the information from the management device, and an encryption communication channel return step for automatically returning the virtual encryption communication channel using the information read from the management device. Features.

  The present invention also provides a non-volatile storage of the start of cryptographic communication via the virtual cryptographic communication path when the virtual cryptographic communication path is established between the first terminal and the second terminal. Further comprising: a cipher communication start recording step for recording in the means, wherein the information reading step is configured to change the virtual cipher communication path from the second terminal after the information of the first terminal becomes unusable. When the encrypted data used is received and the start of encrypted communication by the virtual encrypted communication path is recorded in the non-volatile storage means of the first terminal, the information is unusable. The first terminal that has become may read the information from the management device.

  The present invention also provides a non-volatile storage of the start of cryptographic communication via the virtual cryptographic communication path when the virtual cryptographic communication path is established between the first terminal and the second terminal. Further comprising an encryption communication start recording step for recording in the means, wherein the information reading step is performed by the virtual terminal from the second terminal to the first terminal after the information of the second terminal becomes unusable. When transmitting encrypted data using a typical encrypted communication path, if the start of encrypted communication via the virtual encrypted communication path is recorded in the non-volatile storage means of the second terminal, The second terminal where the information becomes unusable may read the information from the management device.

  Further, the present invention may be characterized in that the information necessary for using the virtual cryptographic communication path is information relating to authentication and encryption negotiated using a key exchange protocol.

  Further, the present invention may be characterized in that the virtual cryptographic communication path is established using a secure protocol that performs authentication and encryption in a network layer.

  In addition, what applied the component, expression, or arbitrary combination of the component of this invention to a method, an apparatus, a system, a computer program, a recording medium, a data structure, etc. is also effective as an aspect of this invention.

  ADVANTAGE OF THE INVENTION According to this invention, when a virtual encryption communication path is cut | disconnected, the encryption communication path return method, encryption communication apparatus, and encryption communication system which can automatically return a virtual encryption communication path quickly can be provided. It is.

  Next, the best mode for carrying out the present invention will be described based on the following embodiments with reference to the drawings. In this embodiment, IPsec, which is a secure protocol, is described as an example, but L2TP (Layer2 Tunneling Protocol), which is a protocol for establishing a virtual communication path (tunnel), and a protocol for performing cryptographic communication. Application to SSL (Secure Socket Layer) is also possible. For example, in SSL, the secret key and the encryption key correspond to the SA information of IPsec.

  FIG. 1 is a block diagram of an example of a cryptographic communication system according to the present invention. In the cryptographic communication system of FIG. 1, a plurality of terminals 1 and 2 and an SA (security association) management server 3 are communicably connected to a public network 4 such as a LAN or the Internet. Note that the terminal 1 and the terminal 2 are a PC, a multifunction machine, or the like capable of encrypted communication using IPsec.

  When starting encryption communication using IPsec, the terminals 1 and 2 negotiate to exchange and share SA information such as an encryption method and an encryption key (IKE phase), and establish an IPsec tunnel 5. When the IPsec tunnel 5 is established, the terminals 1 and 2 start encrypted communication using the IPsec tunnel 5 (IPsec phase).

  The SA management server 3 manages SA information registered as described later from one or both of the terminals 1 and 2. The SA management server 3 provides SA information to either one or both of the inquiry source terminals 1 and 2 when there is an inquiry about SA information from either one or both of the terminals 1 and 2 as described later.

  FIG. 2 is a functional diagram of an example of a cryptographic communication system according to the present invention. The terminals 1 and 2 are configured to include an IP function unit 11 having an IPsec function unit 12, a TCP / UDP function unit 13, an IKE daemon 14, an HTTP function unit 15, and an FTP function unit 16. The IP function unit 11 having the IPsec function unit 12 is included in the network layer. The TCP / UDP function unit 13 is included in the transport layer. The IKE daemon 14, the HTTP function unit 15, and the FTP function unit 16 are included in the application layer. The HTTP function unit 15 is an example of a protocol belonging to the application layer, and may be another protocol.

  The IKE daemon 14 can record the start of encrypted communication using IPsec in addition to the confirmation and acquisition of the IPsec policy managed by the security policy database (SPD) 17 in the SPD. Although FIG. 2 shows an example in which the SPD is realized by the external storage devices of the terminals 1 and 2, the SPD may be realized by an internal storage device (for example, an auxiliary storage device) of the terminals 1 and 2.

  The IKE daemon 14 of the terminals 1 and 2 performs negotiation for exchanging and sharing SA information such as an encryption method and an encryption key in accordance with an IKE standard procedure. Terminals 1 and 2 store SA information in a RAM as a main storage device. As described above, since the SA information exists on the RAMs of the terminals 1 and 2, the SA information is lost when the terminals 1 and 2 are powered off.

  The SA management server 3 is configured to include an SA information registration daemon 21 and an SA information search daemon 22. The SA information registration daemon 21 registers SA information requested to be stored from either one or both of the terminals 1 and 2 in the SA information management database 23. Although FIG. 2 shows an example in which the SA information management database 23 is realized by an external storage device of the SA management server 3, it may be realized by an internal storage device (for example, an auxiliary storage device) of the SA management server 3. The SA information search daemon 22 searches the SA information management database 23 for SA information requested to be searched from either one or both of the terminals 1 and 2.

  Next, a hardware configuration when the terminals 1 and 2 are PCs will be briefly described. FIG. 3 is a hardware configuration diagram of an example of a terminal.

  The terminals 1 and 2 are configured to include an input device 31, an output device 32, a drive device 33, an auxiliary storage device 34, a main storage device 35, an arithmetic processing device 36, and an interface device 37 connected to each other via a bus B. Is done.

  The input device 31 includes a keyboard and a mouse, and is used for inputting various information. The output device 32 includes a display device and is used to display various windows, data, and the like. The interface device 37 includes a modem, a LAN card, and the like, and is used for connecting to the public network 4.

  Various programs for controlling the terminals 1 and 2 are provided by, for example, distribution of the recording medium 38 or downloading from the public network 4. A recording medium 38 on which various programs are recorded is a recording medium such as a CD-ROM, a flexible disk, a magneto-optical disk, etc. for recording information optically, electrically or magnetically, a ROM, a flash memory, etc. Various types of recording media such as a semiconductor memory for electrical recording can be used.

  When the recording medium 38 on which various programs are recorded is set in the drive device 33, the various programs are installed from the recording medium 38 to the auxiliary storage device 34 via the drive device 33. Various programs downloaded from the public network 4 are installed in the auxiliary storage device 34 via the interface device 37.

  The auxiliary storage device 34 stores various installed programs and files, data, and the like necessary for executing the various programs. The main storage device 35 reads and stores various programs from the auxiliary storage device 34 when the computer is activated. The arithmetic processing unit 36 implements various processes as described later in accordance with various programs stored in the main storage device 35.

  FIG. 4 is a sequence diagram illustrating an example of a processing procedure when SA information is lost in the cryptographic communication system according to the present invention. In step S1, the terminal 2 acquires the IPsec policy addressed to the terminal 1 managed by the SPD 17 of the terminal 2 itself. The terminal 2 proceeds to step S2 and transmits an IPsec start request corresponding to the IPsec policy addressed to the terminal 1 to the terminal 1.

  When receiving the IPsec start request from the terminal 2, the terminal 1 proceeds to step S3, and searches for an IP policy addressed to the terminal 2 managed by the SPD 17 of its own terminal. If the IP policy addressed to the terminal 2 is retrieved from the SPD, the terminal 1 proceeds to step S4, and transmits an IPsec start acceptance corresponding to the IPsec policy addressed to the terminal 2 to the terminal 2.

  By the processing up to step S4, the SA information shown in FIGS. 5 and 6 is stored in the RAM as the main storage device 35 in the terminals 1 and 2. FIG. 5 is a schematic diagram showing an example of SA information of the terminal 1. FIG. 6 is a schematic diagram showing an example of SA information of the terminal 2.

  The SA information in FIGS. 5 and 6 includes items (Field) and values (Value). The items include ID, src, dst, mode, protocol, direction, SPI, auth key, encrypt key, and recovery.

  The item “ID” is a unique identifier for management by the SA management server 3. The item “src” is a source IP address. The item “dst” is a destination IP address. The item “mode” specifies either “transport mode” or “tunnel mode”. The item “protocol” designates a protocol that provides an encryption function. The item “direction” is used to specify the input / output direction viewed from the own terminal.

  The item “SPI” is an identifier for managing SA information called a security parameter index. The item “auth key” represents an authentication key. The item “encrypt key” represents an encryption key. The item “recovery” is a recovery enable / disable flag specifying whether or not SA information can be recovered.

  In step S5, the terminal 2 transmits to the SA management server 3 an SA information registration request for storing SA information as shown in FIG. When receiving the SA information registration request, the SA management server 3 proceeds to step S6 and registers the SA information in the SA information management database 23.

  4 represents an example in which the terminal 2 registers the SA information in the SA information management database 23. However, the terminal 1 may register the SA information in the SA information management database 23. 1 and 2 may register SA information in the SA information management database 23. As is clear from the SA information in FIGS. 5 and 6, if at least one SA information of the terminal 1 and the terminal 2 is known, the other SA information can be created.

  The terminals 1 and 2 record the start of encrypted communication using IPsec in the SPD 17 of their own terminals. In step S 7, the terminal 2 transmits the encrypted IPsec packet to the terminal 1 via the established IPsec tunnel 5. In step S8, the terminal 1 decodes the received IPsec packet based on the SA information in FIG. The terminal 1 then responds to the IPsec packet received from the terminal 2 in step S7.

  After step S8, the terminal 1 is assumed to have been powered off. In step S 9, the terminal 2 transmits the encrypted IPsec packet to the terminal 1 via the established IPsec tunnel 5. At this time, since the terminal 1 is in a power-off state, the terminal 1 cannot receive an IPsec packet and make a response to the IPsec packet.

  If a predetermined time elapses from step S9 without receiving a response to the IPsec packet, the terminal 2 proceeds to step S10, and retransmits the IPsec packet transmitted to the terminal 1 in step S9. However, since the terminal 1 is in a power-off state, the terminal 1 cannot receive an IPsec packet and make a response to the IPsec packet.

  After step S10, the terminal 1 is assumed to be turned on. When a predetermined time has elapsed from step S10 without receiving a response to the IPsec packet, the terminal 2 proceeds to step S11, and retransmits the IPsec packet transmitted to the terminal 1 in steps S9 and S10.

  However, since the terminal 1 establishes the IPsec tunnel 5 with the terminal 2 and then the power is turned off, the SA information stored in the RAM is lost. Therefore, the terminal 1 cannot decode the received IPsec packet.

  Therefore, the terminal 1 proceeds to step S12, confirms the SPD 17 of its own terminal, and determines whether the start of encrypted communication with the terminal 2 using IPsec is recorded. If the start of encrypted communication with the terminal 2 using IPsec is recorded in the SPD 17, the terminal 1 proceeds to step S 13 and determines that the encrypted communication was performed with the terminal 2 before the power was turned off. The SA management server 3 is inquired about the SA information of its own terminal.

  If the start of encrypted communication with the terminal 2 using IPsec is not recorded in the SPD 17, the terminal 1 determines that it has not performed encrypted communication with the terminal 2 before the power is turned off. The IPsec packet received from 2 is discarded.

  In step S 14, the SA management server 3 searches the SA information management database 23 for SA information inquired from the terminal 1. In step S 15, the SA management server 3 reads the SA information of the searched terminal 1 from the SA information management database 23 and transmits it to the terminal 1.

  The terminal 1 refers to the item “recovery” of the received SA information, and if recovery is specified for whether or not the SA information can be recovered, the terminal 1 stores the SA information in the RAM and performs SA recovery processing to make it usable. Thereafter, the terminal 1 decodes the IPsec packet received in step S11 based on the restored SA information of FIG. Terminal 1 then responds to the IPsec packet received from terminal 2 in step S11.

  When terminals 1 and 2 end encryption communication using IPsec, they are recorded in the SPD 17 of their own terminals so that the end of encryption communication using IPsec can be recognized.

  FIG. 7 is a flowchart illustrating an example of a processing procedure when SA information is lost in the cryptographic communication system according to the present invention.

  In step S22, the terminal 2 receives a packet transmission request addressed to the terminal 1. In step S22, the terminal 2 searches for and acquires an IPsec policy addressed to the terminal 1 managed by the SPD 17 of the terminal 2 itself. In step S23, the terminal 2 transmits an IPsec start request corresponding to the IPsec policy addressed to the terminal 1 to the terminal 1.

  In step S24, the terminal 1 is waiting for an IPsec start request. When receiving the IPsec start request from the terminal 2, the terminal 1 proceeds from step S24 to step S25, and searches for the IP policy addressed to the terminal 2 managed by the SPD 17 of the own terminal.

  If the IP policy addressed to terminal 2 is retrieved from the SPD (YES in S26), terminal 1 proceeds to step S27, and transmits an IPsec start acceptance corresponding to the IPsec policy addressed to terminal 2 to terminal 2. If the IP policy addressed to terminal 2 is not retrieved from the SPD (NO in S26), terminal 1 returns to step S24 and waits for the next IPsec start request.

  By the processing up to step S27, the SA information shown in FIGS. 5 and 6 is stored in the RAM as the main storage device 35 in the terminals 1 and 2. In step S28, the terminal 2 is waiting for IPsec start acceptance. When receiving the IPsec start acceptance from the terminal 1, the terminal 2 proceeds from step S28 to step S29, and transmits to the SA management server 3 an SA information registration request for storing SA information as shown in FIG. To do.

  In step S30, the SA management server 3 waits for a request from the terminal 1 or 2. When the SA information registration request is received from the terminal 2, the SA management server 3 proceeds from step S30 to step S31, and registers the SA information in the SA information management database 23. In step S32, the SA management server 3 again waits for a request from the terminal 1 or 2.

  In step S33, the terminal 1 records the start of encrypted communication with the terminal 2 using IPsec in the SPD 17 of its own terminal. On the other hand, in step S34, the terminal 2 records the start of encrypted communication with the terminal 1 using IPsec in the SPD 17 of its own terminal.

  In step S 35, the terminal 2 transmits the encrypted IPsec packet to the terminal 1 through the established IPsec tunnel 5. In step S36, the terminal 1 decodes the received IPsec packet based on the SA information in FIG. Terminal 1 then responds to the IPsec packet received from terminal 2.

  After step S36, the terminal 1 is powered off. In step S 37, the terminal 2 transmits the encrypted IPsec packet to the terminal 1 through the established IPsec tunnel 5. At this time, since the terminal 1 is in a power-off state, the terminal 1 cannot receive an IPsec packet and make a response to the IPsec packet.

  After step S37, the terminal 1 is turned on. When a predetermined time elapses from step S37 without receiving a response to the IPsec packet, the terminal 2 proceeds to step S38, and retransmits the IPsec packet transmitted to the terminal 1 in step S37. In step S39, the terminal 1 waits for an IPsec start request.

  When an encrypted IPsec packet is received from the terminal 2 via the established IPsec tunnel 5, the terminal 1 tries to read SA information from the RAM. However, since the SA information is not stored in the RAM, the terminal 1 proceeds from step S39 to step S40, confirms the SPD 17 of its own terminal, and searches whether the start of encrypted communication with the terminal 2 using IPsec is recorded. To do.

  If the start of encrypted communication with terminal 2 using IPsec is recorded in SPD 17 (YES in S41), terminal 1 proceeds to step S42 and performs encrypted communication with terminal 2 before the power is turned off. It is determined that it has been performed, and the SA management server 3 is inquired about the SA information of its own terminal.

  If the start of encrypted communication with the terminal 2 using IPsec is not recorded in the SPD 17 (NO in S41), the terminal 1 has not performed encrypted communication with the terminal 2 before the power is turned off. After discarding the IPsec packet received from the terminal 2, the process returns to step S39 and waits for an IPsec start request.

  In step S 43, the SA management server 3 searches the SA information management database 23 for the SA information inquired from the terminal 1. Then, the SA management server 3 reads the searched SA information of the terminal 1 from the SA information management database 23 and transmits it to the terminal 1.

  In step S44, the terminal 1 refers to the item “recovery” of the SA information received from the SA management server 3. If recovery is specified in the recovery possibility of SA information, the terminal 1 determines that the recovery of SA information is necessary, and proceeds to step S45. In step S45, the terminal 1 performs SA restoration processing for storing the SA information in the RAM and making it usable.

  Thereafter, the terminal 1 decodes the IPsec packet received in step S38 based on the restored SA information of FIG. Then, the terminal 1 proceeds to step S46, and makes a response to the IPsec packet received from the terminal 2 in step S38. When terminals 1 and 2 end encryption communication using IPsec, they are recorded in the SPD 17 of their own terminals so that the end of encryption communication using IPsec can be recognized.

  FIG. 8 is a sequence diagram of another example showing a processing procedure when SA information is lost in the cryptographic communication system according to the present invention. In addition, since the process of step S51-S58 is the same as that of step S1-S8 of FIG. 4, description is abbreviate | omitted.

  After step S58, it is assumed that the terminal 2 is once turned off and then turned on again. Terminal 2 receives a packet transmission request addressed to terminal 1. However, since the terminal 2 establishes the IPsec tunnel 5 with the terminal 1 and then the power is turned off, the SA information stored in the RAM is lost.

  Therefore, the terminal 2 proceeds to step S59, confirms the SPD 17 of the own terminal, and determines whether the start of encrypted communication with the terminal 1 using IPsec is recorded. If the start of encrypted communication with the terminal 1 using IPsec is recorded in the SPD 17, the terminal 2 proceeds to step S60 and determines that the encrypted communication was performed with the terminal 1 before the power was turned off. The SA management server 3 is inquired about the SA information of its own terminal.

  Note that if the start of encrypted communication with the terminal 1 using IPsec is not recorded in the SPD 17, the terminal 2 determines that the encrypted communication with the terminal 1 was not performed before the power was turned off, and the terminal Discard packets addressed to 1.

  In step S 61, the SA management server 3 searches the SA information management database 23 for SA information inquired from the terminal 2. In step S62, the SA management server 3 reads the SA information of the searched terminal 2 from the SA information management database 23 and transmits it to the terminal 2.

  The terminal 2 refers to the item “recovery” of the received SA information, and if recovery is specified for whether or not the SA information can be recovered, performs SA recovery processing for storing the SA information in the RAM and making it usable.

  The terminal 2 encrypts the IPsec packet based on the restored SA information of FIG. 6 and transmits it to the terminal 1 via the IPsec tunnel 5. Then, the terminal 1 makes a response to the IPsec packet received from the terminal 2 in step S63.

  When terminals 1 and 2 end encryption communication using IPsec, they are recorded in the SPD 17 of their own terminals so that the end of encryption communication using IPsec can be recognized.

  In the cryptographic communication system according to the present invention, even if SA information is lost due to a power failure or the like, the start of cryptographic communication using IPsec is recorded in the SPD of the terminal itself, and the SA information is stored in the SA management server 3. Thus, when the IPsec tunnel 5 is disconnected, the IPsec tunnel 5 can be automatically returned quickly and without being negotiated again by IKE.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

It is a block diagram of an example of the encryption communication system by this invention. It is a functional diagram of an example of the encryption communication system by this invention. It is a hardware block diagram of an example of a terminal. It is a sequence diagram of an example showing the processing procedure when SA information is lost in the cryptographic communication system according to the present invention. 3 is a schematic diagram illustrating an example of SA information of a terminal 1. FIG. 4 is a schematic diagram illustrating an example of SA information of a terminal 2. FIG. It is a flowchart of an example showing the process sequence when SA information lose | disappears in the encryption communication system by this invention. It is a sequence diagram of the other example showing the process sequence when SA information lose | disappears in the encryption communication system by this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1, 2 Terminal 3 SA (security association) management server 4 Public network 5 IPsec tunnel 11 IP function part 12 IPsec function part 13 TCP / UDP function part 14 IKE daemon 15 HTTP function part 16 FTP function part 17 Security policy database (SPD)
21 SA Information Registration Daemon 22 SA Information Search Daemon 23 SA Information Management Database 31 Input Device 32 Output Device 33 Drive Device 34 Auxiliary Storage Device 35 Main Storage Device 36 Arithmetic Processing Device 37 Interface Device 38 Recording Medium B Bus

Claims (7)

An encryption communication path return method for automatically returning the virtual encryption communication path when the virtual encryption communication path established in the communication system is disconnected,
When the virtual encryption communication path is established between the first terminal and the second terminal, information necessary for using the virtual encryption communication path is obtained from the first terminal and the second terminal. An information storage step to be stored in the terminal
An information registration step in which at least one of the first terminal and the second terminal registers the information in a management device other than the first terminal and the second terminal;
At least one of the information stored in the first terminal and the second terminal becomes unusable, and the information becomes unusable when the virtual encryption communication path is disconnected An information reading step in which at least one of the first terminal and the second terminal reads the information from the management device;
An encryption communication path restoration method comprising: an encryption communication path restoration step of automatically restoring the virtual encryption communication path using the information read from the management device. Cryptographic communication that records the start of cryptographic communication over the virtual cryptographic communication path in a nonvolatile storage means when the virtual cryptographic communication path is established between the first terminal and the second terminal A start recording step,
The information reading step receives encrypted data using the virtual encrypted communication path from the second terminal after the information of the first terminal becomes unusable, and the first terminal When the start of encrypted communication using the virtual encrypted communication path is recorded in the non-volatile storage unit of the first terminal, the first terminal in which the information becomes unusable is transmitted from the management device to the non-volatile storage unit. 2. The encryption communication path restoration method according to claim 1, wherein information is read out. Cryptographic communication for recording in the nonvolatile storage means the start of cryptographic communication via the virtual cryptographic communication path when the virtual cryptographic communication path is established between the first terminal and the second terminal A start recording step,
In the information reading step, after the information of the second terminal becomes unusable, encrypted data using the virtual encrypted communication path is transferred from the second terminal to the first terminal. When transmitting, if the start of encrypted communication by the virtual encrypted communication channel is recorded in the non-volatile storage means of the second terminal, the second terminal in which the information becomes unusable 2. The encryption communication path restoration method according to claim 1, wherein the information is read from the management apparatus.   2. The encryption communication path restoration method according to claim 1, wherein the information necessary for using the virtual encryption communication path is information on authentication and encryption negotiated using a key exchange protocol.   2. The encryption communication path restoration method according to claim 1, wherein the virtual encryption communication path is established by using a secure protocol that performs authentication and encryption in a network layer. An encryption communication device for automatically returning the virtual encryption communication path when the virtual encryption communication path established in the communication system is disconnected,
Information storage means for storing information necessary to use the virtual encryption communication path when the virtual encryption communication path is established with the terminal of the encryption communication partner;
Information registration means for registering the information in a management device other than the terminal of the encryption communication partner;
Information reading means for reading the information from the management device when the information stored in the information storage means becomes unusable and the virtual encrypted communication path is disconnected;
An encryption communication apparatus comprising: an encryption communication path recovery unit that automatically recovers the virtual encryption communication path using the information read from the management apparatus. An encryption communication system for automatically returning the virtual encryption communication path when the established virtual encryption communication path is disconnected,
When the virtual encryption communication path is established between the first terminal and the second terminal, information necessary for using the virtual encryption communication path is obtained from the first terminal and the second terminal. Information storage means for storing in the terminal,
Information registration means for registering at least one of the first terminal and the second terminal with a management device other than the first terminal and the second terminal;
At least one of the information stored in the first terminal and the second terminal becomes unusable, and the information becomes unusable when the virtual encryption communication path is disconnected Information reading means for reading at least one of the first terminal and the second terminal from the management device;
An encryption communication system comprising: an encryption communication path recovery unit that automatically recovers the virtual encryption communication path using the information read from the management device.

Images