JP5987076B2 - Setting information collecting apparatus, method and program thereof - Google Patents

Description

  The present invention relates to a technique for establishing a virtual encryption communication path and performing encryption communication, and more particularly, to a technique for collecting setting information of an encryption communication path establishment request source.

  A server device that performs cryptographic communication such as a Web server device accepts connection requests from a plurality of client devices having different settings, and establishes a virtual cryptographic communication path (for example, an SSL / TLS session) with the client device. To perform encrypted communication. In the virtual encryption channel establishment process, the client device that is the establishment request source presents a list of encryption methods that can be used by the client device to the server device, and the server device selects an encryption method to be used from the list. As a method for confirming the encryption method used in such encrypted communication, there are methods disclosed in Patent Document 1 and Non-Patent Document 1.

Japanese Patent No. 5112498

Tatsuo, Yoshihito Oyama, Eiji Okamoto, “Proposal of Cryptographic SLA for Cryptographic Compromise and Realization of Support Tool”, Transactions of Information Processing Society of Japan, Vol. 48 No. 1, Jan. 2007.

  When the security of an encryption method decreases, it is necessary to stop using the encryption method and shift to a highly secure encryption method. On the other hand, the encryption method that can be used by the client device is not necessarily the same, and if the use of the encryption method is stopped without considering the encryption method that can be used by the client device, the connectivity decreases. For this reason, in order to maintain security and connectivity, it is necessary to sufficiently collect setting information related to an encryption method that can be used by the client device.

  However, the list of encryption methods that the client device presents to the server device in the establishment process described above does not necessarily include all the encryption methods that can be used by the client device. For this reason, it is not possible to sufficiently collect setting information relating to an encryption method that can be used in the client device by simply monitoring the communication state between the server device and the client device. Even with the methods disclosed in Patent Literature 1 and Non-Patent Literature 1, it is possible to obtain information relating to actually used encryption methods and information relating to encryption methods that can be handled on the server device side. Setting information related to the method cannot be collected sufficiently.

  An object of the present invention is to sufficiently collect setting information relating to an encryption method that can be used by a requester of establishment of a virtual encryption communication path.

  An extraction process that accepts a virtual encryption channel establishment request, extracts from the received message based on the establishment request the setting information related to the encryption method that can be used by the encryption channel establishment request source, and the received message And a response process for performing a simulated error response that simulates an error response during the process of establishing a virtual encryption communication path.

  As a result, it is possible to sufficiently collect setting information related to the encryption method that can be used by the establishment requester of the encryption communication path.

FIG. 1 is a block diagram illustrating a functional configuration of a communication system according to an embodiment. FIG. 2 is a block diagram illustrating a functional configuration of the setting information collection apparatus according to the embodiment. FIG. 3A is a diagram for illustrating an error pattern (contents of a simulated error response). FIG. 3B is a diagram for illustrating a list of error patterns. FIG. 4 is a flowchart for explaining the processing of the setting information collection apparatus of the embodiment. FIG. 5 is a sequence diagram for illustrating the processing of the embodiment. FIG. 6 is a sequence diagram for illustrating the processing of the embodiment. FIG. 7 is a sequence diagram for illustrating processing of the embodiment. FIG. 8 is a diagram for illustrating a record data structure of a message. FIG. 9 is a diagram for illustrating a record data structure of a message. FIG. 10A is a diagram for illustrating setting information extracted by message analysis. FIG. 10B is a diagram for illustrating the tabulation result based on the extracted setting information. FIG. 10C is a diagram for illustrating an evaluation information list representing the security evaluation of the encryption method. FIG. 11 is a diagram for illustrating the inspection result.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
<Configuration>
As illustrated in FIG. 1, the communication system 1 according to the present embodiment includes a setting information collection device 11 that functions as a server device and N client devices 12-1 to 12 -N. It is configured to be able to communicate. N is an integer of 1 or more. For convenience of explanation, FIG. 1 shows one setting information collection device 11, but a plurality of setting information collection devices 11 may exist.

  As illustrated in FIG. 2, the setting information collection device 11 according to the present embodiment includes a communication unit 111 (reception unit), an error pattern list storage unit 112, a response unit 113, an extraction unit 114, a setting information storage unit 115, and an analysis aggregation unit 116, an evaluation information list storage unit 117, an inspection result output unit 118, and a control unit 119. The response unit 113 includes a negotiation execution unit 1131 and a simulated error response management unit 1132. The setting information collection device 11 includes, for example, a general-purpose or dedicated memory including a processor (hardware processor) such as a CPU (central processing unit) and a memory such as random-access memory (RAM) and read-only memory (ROM). An apparatus configured by a computer executing a predetermined program. The computer may include a single processor and memory, or may include a plurality of processors and memory. This program may be installed in a computer, or may be recorded in a ROM or the like in advance. In addition, some or all of the processing units are configured using an electronic circuit that realizes a processing function without using a program, instead of an electronic circuit (circuitry) that realizes a functional configuration by reading a program like a CPU. May be. In addition, an electronic circuit constituting one device may include a plurality of CPUs. The setting information collection device 11 executes each process based on the control of the control unit 119.

<Pre-configuration>
As a preset, the error pattern list is stored in the error pattern list storage unit 112. “Error pattern” means information representing a simulated error response that simulates an error response during the process of establishing a virtual encrypted communication path. The “virtual encryption communication path” means a communication environment in which an encryption method is agreed between the server device and the client device in order to perform encryption communication. In other words, an environment in which an encryption method used for encryption communication is determined based on a predetermined protocol is referred to as a “virtual encryption communication path”. Examples of the “virtual cryptographic communication path” are SSL (Secure Sockets Layer) and TLS (Transport Layer Security) SSL / TLS sessions. “Establishment of a virtual encrypted communication path” means that a communication method including an encryption method is agreed between the server device and the client device in order to perform encrypted communication. An example of “establishing a virtual encrypted communication path” is establishment of an SSL / TLS session. The “virtual encryption communication path establishment process” means a process executed between the server apparatus and the client apparatus in order to establish a virtual encryption communication path. A specific example of “virtual encryption communication path establishment process” is a handshake process in SSL or TLS. The “error response during the establishment process” is a response that is returned by the server device when an error occurs during the establishment process. Specific examples of the “error response during the establishment process” include a process of returning an alert to the client apparatus and a process of disconnecting the connection with the client apparatus. The “simulated error response” is a simulation of such an “error response during the establishment process”. That is, the “error response at the time of establishment” is originally returned according to the error when an error actually occurs, but the “simulated error response” is returned regardless of whether or not an error has occurred. It is a response. In other words, the “simulated error response” means a response returned by simulating the occurrence of an error regardless of whether or not an error has occurred. The content of the “simulated error response” itself may or may not be the same as the response returned in the normal “error response during establishment process”. The “error pattern indicating a simulated error response” is information indicating the content of such a “simulated error response”. FIG. 3A illustrates an error pattern representing an “error response (alert)” returned from the server device during the SSL / TLS session establishment process. The error pattern in this example includes “data length” and “ID” of “record type”, “version”, “data length”, “alert level”, and “alert description”. For example, such an error pattern is “an error pattern indicating a simulated error response”. The “error pattern list” means a set of such “error patterns”. The “list of error patterns” includes a plurality of “error patterns”, and these “error patterns” are ordered, whereby the contents of a plurality of “simulated error responses” are ordered. For example, a plurality of “error patterns” included in the “error pattern list” are associated with ranks that do not overlap each other. Alternatively, some “error patterns” may have the same rank. FIG. 3B shows a specific example of the “error pattern list”. In this example, “error type” that is a simulated error response such as “session disconnection” or “alert” is associated with “number” corresponding to each rank.

  The evaluation information list storage unit 117 stores an evaluation information list representing the security of each encryption method. This evaluation information list is a list showing the evaluation results of the security of each known encryption method. FIG. 10C shows an example of the evaluation information list. In this example, the version of a protocol such as SSL or TLS (Version), the value of a cipher suite (CS: Cipher suite) that represents the ciphers that can be used in that protocol, and the security evaluation corresponding to them ("Safety" ”“ Caution ”“ Danger ”). This evaluation information list is updated whenever there is a change in the security evaluation of each encryption method.

<Setting information collection processing>
Next, the setting information collection processing of the embodiment will be illustrated using FIG.
The setting information collection device 11 waits for a “virtual encryption communication path establishment request (request)” from any of the client devices 12-n (where n = 1,..., N) as a server device. This establishment request is made by transmitting a message (for example, a ClientHello message) from the client apparatus 12-n to the setting information collection apparatus 11. This message includes setting information related to an encryption method that can be used by the client device 12-n (encryption channel establishment request source). Examples of such setting information are cryptographic suite value CS, protocol version, and other auxiliary information. FIG. 8 shows an example of a record data structure of a ClientHello message in the case of SSL 2.0. The ClientHello message in the example of FIG. 8 includes “record type”, “data length”, “message type”, “version”, “encrypted source data length”, “session ID”, “random number length”, “encrypted sweets value”, “ “Data length” and “ID” of “random number value” are included. In this case, “setting information relating to available encryption methods” is, for example, “version” and “value of encryption sweets”. FIG. 9 shows an example of the record data structure of the ClientHello message in the case of SSL3.0 / TLS. The ClientHello message in the example of FIG. 9 includes “record type” “version” “record data length” “message type” “handshake message length” “version” “random number” “session ID length” “session ID” “encrypted sweets” “Data length”, “Encryption sweet value”, “Data compression format”, “Data length of extended attribute”, “Data length” and “ID” of “Extended attribute data” are included. In this case, “setting information relating to available encryption methods” is, for example, “version”, “value of encryption sweets”, and “extended attribute data”.

  The negotiation execution unit 1131 of the setting information collection device 11 (FIG. 2) waits for transmission of a message (step S1) and determines whether the message has been transmitted to the communication unit 111 (step S2). This message may be a message (for example, an SSL or TLS ClientHello message) sent at the time of an establishment request from the client device 12-n, or a message sent from the client device 12-n in a subsequent handshake. It may be. Here, when the message is not transmitted to the communication unit 111, the negotiation executing unit 1131 determines whether or not the message waiting end condition is satisfied. Examples of the message waiting end condition are that the message waiting time has passed a predetermined time (timeout), and that a trial end instruction has been given (step S3). If the message waiting end condition is not satisfied, the process returns to step S1. On the other hand, if the message waiting completion condition is satisfied, the response process for the client device 12-n is terminated, and the process proceeds to step S9 described later. On the other hand, when a message is transmitted to the communication unit 111, the communication unit 111 receives this message (received message based on the establishment request) (accepts a request for establishment of a virtual encrypted communication path) and sends it to the negotiation execution unit 1131. (Step S4).

  The negotiation execution unit 1131 sends the received message sent to the extraction unit 114. The extraction unit 114 analyzes this received message (received message based on the establishment request), and extracts setting information related to the encryption method that can be used by the client apparatus 12-n that is the establishment request source of the encrypted communication path. In the example of FIG. 10A, “version (record level / protocol level)”, “cipher suite value (CS)”, and “extended attribute data” are extracted as setting information together with “client address: port number”. The extracted setting information is stored (accumulated) in the setting information storage unit 115 (step S5).

  The simulated error response management unit 1132 selects an error pattern from the error pattern list storage unit 112 for the received message. The error pattern is selected according to the above-mentioned ordering. That is, in principle, the error pattern is not selected according to the content of the received message, but is selected in order according to the above-mentioned ordering. For example, each time a message is transmitted from the same client device 12-n to the setting information collection device 11, error patterns are selected in order according to the above-described ordering. In the case of the example of FIG. 3B, when a message is transmitted for the first time from the client device 12-n, an error pattern “session disconnection” corresponding to the number “1” is selected and a message is transmitted for the second time. If the error pattern “Alert (Level = warning, Description = CLOSE NOTIFY)” corresponding to the number “2” is selected and the message is sent for the second time, the error pattern corresponding to the number “2” “Alert (Level = warning, Description = INSUFFICIENT SECURITY)” is selected. Thereby, the content of the simulated error response is selected according to the above-mentioned ordering. Alternatively, the simulated error response management unit 1132 changes the order of error patterns according to the received message (changes the order of the contents of a plurality of simulated error responses), and selects the error pattern for the received message (simulates according to the changed ordering). The content of the error response may be selected). For example, it is predetermined how to change the ordering according to the type of received message and the type of setting information extracted in step S5, and the simulated error response management unit 1132 sets the order of error patterns accordingly. Change and select the error pattern for the received message. If some error patterns have the same order, any one of the error patterns may be selected according to the received message. For example, depending on the type of received message and the type of setting information extracted in step S5, which error pattern is selected is determined in advance, and the simulated error response management unit 1132 determines which error pattern Select. It should be noted that the error pattern that has been selected, the change contents of the error pattern ordering, and the like are stored in the error pattern list storage unit 112 and used when the next error pattern is selected (step S6). The simulated error response management unit 1132 instructs the negotiation execution unit 1131 to perform a simulated error response having the content represented by the selected error pattern. For example, when the simulated error response is “processing to return an alert to the client device”, the simulated error response management unit 1132 instructs the negotiation execution unit 1131 to reply the alert represented by the selected error pattern. For example, when the simulated error response is “processing to disconnect the connection with the client device”, the simulated error response management unit 1132 instructs the negotiation execution unit 1131 to disconnect the connection with the client device 12-n. The negotiation execution unit 1131 performs a simulated error response according to an instruction from the simulated error response management unit 1132. For example, the negotiation execution unit 1131 sends an alert represented by an error pattern to the communication unit 111, and the communication unit 111 transmits the alert or disconnects the connection with the client device 12-n (step S7).

  The simulated error response management unit 1132 determines whether a predetermined end condition is satisfied. This end condition is not limited, and any end condition may be defined. An example of the end condition is “the number of repetitions (number of trials) of steps S1 to S8 in the same client device 12-n or the same establishment process has reached a predetermined maximum value Max (Max ≧ 2), That the time required to implement the number of trials (maximum trial time) has been reached, that all error patterns stored in the error pattern list storage unit 112 or error patterns whose order relation has been changed have been selected, For example, an instruction to end the trial has been given (step S8) Here, if the predetermined end condition is not satisfied, the process returns to step S1, while if the predetermined end condition is satisfied, the client device 12-n. Is completed, and the process proceeds to step S9.

  In step S9, the negotiation execution unit 1131 determines whether the client device 12-n is connected to the setting information collection device 11 (step S9). If the client device 12-n is in the connected state, the process advances to step S11 after disconnecting the client device 12-n. On the other hand, if not in the connected state, the process proceeds to step S11 as it is.

  In step S11, the analysis totaling unit 116 generates total information obtained by totaling the setting information stored in the setting information storage unit 115, and further refers to the evaluation information list stored in the evaluation information list storage unit 117. Evaluates the security of the encryption method in the aggregate information, and generates and outputs a test result. The total information includes information (for example, the value of the encryption sweet) that represents the encryption method of the stored setting information. In addition, the aggregate information may include information such as the protocol version, whether or not the encryption method is selectable by the client apparatus 12-n (supported / not supported (ON / OFF)), and the priority order of the encryption methods. The “priority order of encryption schemes” means “priority order of encryption schemes” selected by the client apparatus 12-n when the client apparatus 12-n requests “establishment processing” from the server apparatus. For example, when the client device 12-n first requests “establishment processing” from the server device, the encryption method having the highest priority among the encryption methods stored in the client device 12-n or a set thereof is selected. This request is made by selecting the set, and when the encryption method is rejected by the server apparatus, the request is made by selecting an encryption method or a set having a lower priority order than the encryption method. Such estimation of “priority order of encryption schemes” is performed based on the order of “setting information related to encryption schemes” extracted by the extraction unit 114, for example. That is, the analysis totaling unit 116 obtains an estimated value of “priority order of encryption schemes” based on “setting information related to encryption schemes” extracted by the extraction unit 114. For example, the processing of steps S1 to S8 is performed a plurality of times for the same client device 12-n, and the analysis and counting unit 116 specifies how many times each setting information has been extracted in step S5. Based on this, the priority order of the encryption schemes of the setting information is estimated. For example, it is assumed that the encryption scheme of the setting information extracted in step S5 with a smaller number of trials has a higher “priority order of encryption scheme”. The aggregate information in the example of FIG. 10B includes a protocol version, presence / absence of correspondence (ON / OFF), a cipher suite value CS, and a cipher scheme priority order. In addition, the inspection result of the present embodiment includes information specified by the total information and information indicating the security of the encryption method specified by the total information. The test result in the example of FIG. 11 includes a list including a protocol version, information indicating an encryption method (ID, label, alias), presence / absence of correspondence (ON / OFF), and priority order of encryption methods. The system safety ("safety" "caution" "danger") is color-coded. For example, information corresponding to the “safe” encryption method is indicated in green, information corresponding to the “caution” encryption method is indicated in yellow, and information corresponding to the “dangerous” encryption method is indicated in “red”. Is attached. The obtained inspection result is sent to the inspection result output unit 118 and outputted therefrom (step S11). By executing the above processing for a plurality of client apparatuses 12-1 to 12-N, it is possible to obtain inspection results for these.

<Specific example of simulated error response>
A specific example of the simulated error response described above will be described with reference to FIGS.
The example of FIG. 5 is an example in which “processing to disconnect the connection with the client device” is repeated as “simulated error response”. In this example, after the message is received in step S4 and message analysis / setting information is extracted in step S5, an error pattern representing “processing for disconnecting the connection with the client device” is selected in step S6. In step S7, the connection with the client device 12-n is disconnected. The negotiation execution unit 1131 then waits for the client device 12-n to send a message again (step S1). The disconnected client device 12-n makes an establishment request to the setting information collecting device 11 with a different setting information message. This message is received in step S4, and after message analysis / setting information is extracted in step S5, an error pattern representing “processing for disconnecting from the client device” is selected again in step S6. In S7, the connection with the client device 12-n is disconnected. Thereby, setting information different from the first trial is extracted. Further, the same processing is executed again, and further setting information is extracted. Thereafter, the termination condition of step S3 (for example, a predetermined time has elapsed for message waiting) is satisfied, and the process proceeds to step S11.

  The example of FIG. 6 is an example in which “processing to return an alert to the client device” is repeated as “simulated error response”. In this example, after a message is received in step S4 and message analysis / setting information is extracted in step S5, an error pattern representing “processing for returning an alert to the client device” is selected in step S6, and in step S7. An alert is returned to the client device 12-n. The negotiation execution unit 1131 waits for the client device 12-n to transmit a message again without disconnecting the connection (step S1). The client device 12-n that has received the alert transmits a setting information message different from the previous one to the setting information collection device 11. This message is received in step S4, and after message analysis / setting information is extracted in step S5, an error pattern representing “processing for returning an alert to the client device” is selected again in step S6, and in step S7. An alert is returned to the client device 12-n. Thereby, setting information different from the first trial is extracted. Thereafter, the termination condition in step S8 (for example, the instruction to terminate the trial is satisfied) is satisfied, the connection is disconnected in step S10, and the process proceeds to step S11.

  The example of FIG. 7 is also an example in which “processing to return an alert to the client device” is repeated as “simulated error response”. In this example, after a message is received in step S4 and message analysis / setting information is extracted in step S5, an error pattern representing “processing for returning an alert to the client device” is selected in step S6, and in step S7. An alert is returned to the client device 12-n. The client device 12-n that has received the alert disconnects the connection. Thereafter, the negotiation executing unit 1131 waits for the client device 12-n to transmit a message again (step S1). The disconnected client device 12-n transmits a setting information message different from the previous one to the setting information collecting device 11. This message is received in step S4, and after message analysis / setting information is extracted in step S5, an error pattern representing “processing for returning an alert to the client device” is selected again in step S6, and in step S7. An alert is returned to the client device 12-n. Thereby, setting information different from the first trial is extracted. The client device 12-n that has received the alert disconnects the connection. Thereafter, the end condition of step S8 (for example, an instruction to end trial) is satisfied, and the process proceeds to step S11.

<Features of this embodiment>
In this embodiment, the setting information collection device 11 that functions as a server device accepts a “virtual encryption communication path establishment request” transmitted from the client device 12-n. In response to this, the setting information collection device 11 extracts setting information related to an encryption method that can be used by the client device 12-n that is the “encryption channel establishment request source” from the received message based on the “establishment request”. The extraction process and a response process for performing a simulated error response that simulates an error response during the virtual encryption channel establishment process are repeatedly executed for the received message. Here, since the client apparatus 12-n to which the simulated error response is made tries to connect to the setting information collection apparatus 11 again, there is a high possibility that the client apparatus 12-n transmits a message with setting information different from the previous time. Therefore, by repeating the extraction process and the response process a plurality of times for the same client apparatus 12-n, it is possible to sufficiently extract the setting information regarding the encryption method that can be used by the client apparatus 12-n.

  In this embodiment, the error patterns in the error pattern list are ordered, the contents of a plurality of simulated error responses corresponding to them are ordered, and the contents of the simulated error responses are selected according to this ordering. Thus, if the response order of simulated error responses that can efficiently collect setting information is known, simulated error responses can be made according to the ordering and the setting information can be efficiently collected.

  Also, by changing the ordering of the contents of multiple simulated error responses according to the received message and selecting the contents of the simulated error response according to the changed ordering, setting information can be efficiently collected in consideration of the contents of the received message The order of simulated error responses can be selected.

  Further, the priority order of the encryption methods can be estimated based on the order of the setting information regarding the extracted encryption methods. The priority order of encryption methods is largely related to security. In other words, encryption schemes with high priority are frequently used, and if there is a problem with the security of the encryption scheme, immediate response is necessary. On the other hand, since the encryption method with a low priority is used less frequently, even if there is a problem with the security of the encryption method, the necessity for dealing with it is low. By efficiently extracting such priority order, it is possible to easily deal with safety and connectivity.

[Modifications, etc.]
The present invention is not limited to the embodiment described above. For example, instead of each device exchanging information via a network, at least some of the devices may exchange information via a portable recording medium. Alternatively, at least some of the devices may exchange information via a non-portable recording medium. The combination which consists of a part of these apparatuses may be the same apparatus. For example, in the above-described embodiment, the “error pattern list” includes a plurality of “error patterns” ordered, and the “error pattern” is selected according to this ordering. However, the same “error pattern” may be selected every time. The error pattern list may be updated according to the collected setting information. That is, based on the relationship between the content of the simulated error response and the setting information extracted from the received message input to the setting information collection device 11 after the simulated error response, at least one of the content and ordering of the plurality of simulated error responses is It may be updated. For example, by summing up the relationship between the content of simulated error responses and the number or type of encryption methods represented by the extracted setting information, a combination of simulated error responses that can acquire setting information related to more encryption methods is calculated, and Then, the “error pattern list” or the order relationship of the “error pattern” may be updated. In the above-described embodiment, a simulated error response is performed every time a message is received. However, after receiving a message (for example, a ClientHello message) for an establishment request, a normal establishment process (for example, handshaking) is performed for a while, and a simulated error response is sent to the message that was sent in the middle. Also good. A message transmitted during such an establishment process also corresponds to a “received message based on an establishment request”.

  The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. For example, steps S6 and S7 may be executed between steps S4 and S5. For example, the setting information acquisition device may execute the above-described processing in parallel with a plurality of client devices. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  When the above configuration is realized by a computer, the processing contents of the functions that each device should have are described by a program. By executing this program on a computer, the above processing functions are realized on the computer. The program describing the processing contents can be recorded on a computer-readable recording medium. An example of a computer-readable recording medium is a non-transitory recording medium. Examples of such a recording medium are a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, and the like.

  This program is distributed, for example, by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, this computer reads a program stored in its own recording device and executes a process according to the read program. As another execution form of the program, the computer may read the program directly from the portable recording medium and execute processing according to the program, and each time the program is transferred from the server computer to the computer. The processing according to the received program may be executed sequentially. The above-described processing may be executed by a so-called ASP (Application Service Provider) type service that realizes a processing function only by an execution instruction and result acquisition without transferring a program from the server computer to the computer. Good.

  In the above embodiment, the processing functions of the apparatus are realized by executing a predetermined program on a computer. However, at least a part of these processing functions may be realized by hardware.

  The above-described technique can be used in the field of performing communication in accordance with a protocol for establishing a virtual encryption communication path such as SSL or TLS and performing encryption communication.

1 Communication System 11 Setting Information Collection Device 12-1 to 12-N Client Device

Claims (7)

A receiving unit that accepts a request to establish a virtual encrypted communication path;
An extraction unit that extracts setting information related to an encryption method that can be used by the establishment request source of the encrypted communication path from the received message based on the establishment request;
In response to the received message, a response unit that performs a simulated error response that simulates an error response at the time of establishing a virtual encryption communication path;
A control unit that repeatedly executes the processing of the extraction unit and the response unit;
A setting information collecting apparatus. The setting information collection device according to claim 1,
The contents of multiple mock error responses are ordered,
The setting information collection device, wherein the response unit selects the content of a simulated error response according to the ordering and performs a simulated error response of the selected content. The setting information collection device according to claim 2,
The response unit changes the ordering of the contents of the plurality of simulated error responses according to the received message, and selects the contents of the simulated error response according to the changed ordering. The setting information collection device according to any one of claims 1 to 3,
The setting information collection device, wherein the processing of the extraction unit and the response unit is executed a plurality of times for the same establishment request source. The setting information collecting device according to claim 4,
A setting information collecting apparatus, comprising: an analysis totaling unit that estimates a priority order of the encryption methods based on an order of setting information relating to the encryption methods extracted by the extraction unit. A receiving step for receiving a request for establishment of a virtual encrypted communication path;
An extraction step for extracting setting information related to an encryption method that can be used at the establishment request source of the encrypted communication path from the received message based on the establishment request;
A response unit that performs a simulated error response that simulates an error response during the process of establishing a virtual encryption communication path with respect to the received message; and
A setting information collection method for repeatedly executing the extraction step and the response step.   A program for causing a computer to function as the setting information collection device according to claim 1.

Images