# US 11,444,789 B2 · Decrypted packet padding removal > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,789 B2 - Document ID: US11444789B2 - Status: Granted - Kind: B2 - Application number: 16/591,348 - Filed: 2019-10-02 - Published: 2020-01-30 - Granted: 2022-09-13 - Earliest claimed: 2017-04-04 - Assignees: Canon Kabushiki Kaisha - Applicants: Canon Kabushiki Kaisha - Inventors: Akiyoshi Momoi - Web page: https://patentgrep.com/patent/US11444789B2 ## CPC - H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys} - H04L 9/36: with means for detecting characters not meant for transmission - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up} - H04L 63/166: {at the transport layer} - H04L 2209/34: Encoding or coding, e.g. Huffman coding or error correction - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In order to improve the efficiency of transfer to outside devices while necessary buffer memory is suppressed, the present invention is an information processing apparatus for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length, the information processing apparatus including acquisition means for acquiring an encrypted packet on a unit data basis, decoding means for decoding the encrypted packet on the unit data basis, output means for outputting decoded data obtained through the decoding performed by the decoding means to an external device in accordance with an order in which the decoding is performed by the decoding means, and control means for restricting output to be performed by the output means in a case where a padding pattern is detected from the decoded data obtained through the decoding performed by the decoding means. ## Claims ### Claim 1 An information processing apparatus for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length, the information processing apparatus comprising: at least one circuit configured to function as: an acquisition unit configured to acquire an encrypted packet on a unit data basis; a decoding unit configured to decode the encrypted packet on the unit data basis; an output unit configured to output decoded data obtained through the decoding performed by the decoding unit to an external device in accordance with an order in which the decoding is performed by the decoding unit; and a restricting unit configured to restrict output to be performed by the output unit in a case where a padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit, and to keep restricting the output to be performed by the output unit until a pattern different from the padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit. ### Claim 2 (depends on 1) The information processing apparatus according to claim 1, wherein the restricting unit includes a transfer unit for acquiring the decoded data obtained through the decoding performed by the decoding unit and transferring the acquired decoded data obtained through the decoding performed by the decoding unit to the output unit, and restricts, in a case where the decoded data obtained through the decoding performed by the decoding unit contains the padding pattern, the output to be performed by the output unit by restricting transfer to be performed by the transfer unit. ### Claim 3 (depends on 2) The information processing apparatus according to claim 2, wherein the restricting unit allows the transfer unit to perform the transfer in a case where the padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit and where, after the padding pattern, a pattern different from the padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit. ### Claim 4 (depends on 2) The information processing apparatus according to claim 2, wherein the restricting unit does not perform transfer using the transfer unit in a case where the padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit and where a size of a padding pattern contained after the padding pattern is greater than a threshold. ### Claim 5 (depends on 1) The information processing apparatus according to claim 1, wherein the padding pattern is formed by repeating a value of zero. ### Claim 6 (depends on 5) The information processing apparatus according to claim 5, wherein the padding pattern is a pattern subsequent to a value indicating a type of the packet. ### Claim 7 (depends on 1) The information processing apparatus according to claim 1, wherein the padding pattern is a padding pattern defined in accordance with protocols. ### Claim 8 (depends on 7) The information processing apparatus according to claim 7, wherein the padding pattern is a padding pattern defined in accordance with TLS protocols. ### Claim 9 (depends on 1) The information processing apparatus according to claim 1, wherein the padding pattern is formed by repeating a fixed value a predetermined number of times. ### Claim 10 (depends on 1) The information processing apparatus according to claim 1, wherein the encrypted packet is a portion of image pickup data generated by an image capturing device. ### Claim 11 An information processing method for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length, the information processing method comprising: acquiring, by an acquisition unit, an encrypted packet on a unit data basis; decoding, by a decoding unit, the encrypted packet on the unit data basis; outputting, by an output unit, decoded data obtained through the decoding performed by the decoding unit to an external device in accordance with an order in which the decoding is performed by the decoding unit; and restricting, by a restricting unit, output to be performed by the output unit in a case where a padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit and keep restricting the output to be performed by the output unit until a pattern different from the padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit. ### Claim 12 (depends on 11) The information processing method according to claim 11, wherein the restricting includes transferring, by a transfer unit, in which the decoded data obtained through the decoding performed in the decoding is acquired and the acquired decoded data obtained through the decoding performed in the decoding is transferred to the output unit, and in a case where the decoded data obtained through the decoding performed in the decoding unit contains the padding pattern, the output to be performed by the output unit is restricted by restricting transfer to be performed in the transferring. ### Claim 13 (depends on 12) The information processing method according to claim 12, wherein in the restricting, the transfer in the transferring is allowed in a case where the padding pattern is detected from the decoded data obtained through the decoding performed in the decoding and where, after the padding pattern, a pattern different from the padding pattern is detected from the decoded data obtained through the decoding performed in the decoding step. ### Claim 14 (depends on 12) The information processing method according to claim 12, wherein in the restricting, the transfer in the transferring is not performed in a case where the padding pattern is detected from the decoded data obtained through the decoding performed in the decoding and where a size of a padding pattern contained after the padding pattern is greater than a threshold. ### Claim 15 (depends on 11) The information processing method according to claim 11, wherein the padding pattern is formed by repeating a value of zero. ### Claim 16 (depends on 15) The information processing method according to claim 15, wherein the padding pattern is a pattern subsequent to a value indicating a type of the packet. ### Claim 17 (depends on 11) The information processing method according to claim 11, wherein the padding pattern is a padding pattern defined in accordance with protocols. ### Claim 18 (depends on 17) The information processing method according to claim 17, wherein the padding pattern is a padding pattern defined in accordance with TLS protocols. ### Claim 19 (depends on 11) The information processing method according to claim 11, wherein the padding pattern is formed by repeating a fixed value. ### Claim 20 A non-transitory storage medium storing a program causing an information processing apparatus for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length to execute an information processing method, the information processing method comprising: acquiring, by an acquisition unit, an encrypted packet on a unit data basis; decoding, by a decoding unit, the encrypted packet on the unit data basis; outputting, by an output unit, decoded data obtained through the decoding performed by the decoding unit to an external device in accordance with an order in which the decoding is performed by the decoding unit; and restricting, by a restricting unit, output to be performed by the output unit in a case where a padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit and keep restricting the output to be performed by the output unit until a pattern different from the padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit. ### Claim 21 An information processing apparatus for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length, the information processing apparatus comprising: at least one circuit configured to function as: an acquisition unit configured to acquire an encrypted packet on a unit data basis; a decoding unit configured to decode the encrypted packet on the unit data basis; an output unit configured to output decoded data obtained through the decoding performed by the decoding unit to an external device in accordance with an order in which the decoding is performed by the decoding unit; and a restricting unit configured to restrict output to be performed by the output unit in a case where a first padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit, and to keep restricting the output to be performed by the output unit until a pattern different from a second padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit. ### Claim 22 (depends on 21) The information processing apparatus according to claim 21, wherein the first padding pattern is a value indicating a type of the packet. ### Claim 23 (depends on 22) The information processing apparatus according to claim 22, wherein the second padding pattern is a value of zero. ### Claim 24 (depends on 21) The information processing apparatus according to claim 21, wherein the first padding pattern and the second padding pattern are defined in accordance with TLS protocols. ### Claim 25 An information processing method for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length, the information processing method comprising: acquiring, by an acquisition unit, an encrypted packet on a unit data basis; decoding, by a decoding unit, the encrypted packet on the unit data basis; outputting, by an output unit, decoded data obtained through the decoding performed by the decoding unit to an external device in accordance with an order in which the decoding is performed by the decoding unit; and restricting, by a restricting unit, output to be performed by the output unit in a case where a first padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit and keep restricting the output to be performed by the output unit until a pattern different from a second padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit. ### Claim 26 (depends on 25) The information processing method according to claim 25, wherein the first padding pattern is a value indicating a type of the packet. ### Claim 27 (depends on 26) The information processing method according to claim 26, wherein the second padding pattern is a value of zero. ### Claim 28 (depends on 25) The information processing method according to claim 25, wherein the first padding pattern and the second padding pattern are defined in accordance with TLS protocols. ### Claim 29 A non-transitory storage medium storing a program causing an information processing apparatus for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length to execute an information processing method, the information processing method comprising: acquiring, by an acquisition unit, an encrypted packet on a unit data basis; decoding, by a decoding unit, the encrypted packet on the unit data basis; outputting, by an output unit, decoded data obtained through the decoding performed by the decoding unit to an external device in accordance with an order in which the decoding is performed by the decoding unit; and restricting, by a restricting unit, output to be performed by the output unit in a case where a first padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit and keep restricting the output to be performed by the output unit until a pattern different from a second padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit.