Back to results
US 2003/0126429 A1Published application
Node device and communication control method for improving security of packet communications
AssigneeKabushiki Kaisha Toshiba
InventorsTatuya Jinmei, Masahiro Ishiyama
Life of this patent
Estimating the term…
Abstract
At a node device, after an exchange procedure for exchanging a security association information is carried out, the security association information is stored in a memory unit while a management information including the destination address, the identification information, and an information regarding a valid period of the security association information is stored in a non-volatile medium, such that it is possible to recover the normal state quickly without damaging the safety, when a temporary operation trouble occurs at one node under an environment in which a plurality of nodes are carrying out communications safely by using a prescribed security protocol.
Claims16
A node device, comprising:
- an exchange procedure processing unit configured to carry out an exchange procedure for exchanging a security association information including a destination address of a packet communication, an identification information of the destination address that is unique to the destination address, and a parameter information regarding a cryptographic processing to be used in the packet communication, with a node that becomes a correspondent of the packet communication according to a prescribed protocol, prior to the packet communication;
- a memory unit configured to store the security association information exchanged by the exchange procedure;
- a management unit configured to store and manage a management information including the destination address, the identification information, and an information regarding a valid period of the security association information, for each security association information stored in the memory unit, in a non-volatile medium;
- and
- a packet processing unit configured to transmit a notification message containing the destination address and the identification information to the node that becomes the correspondent, when the security association information specified by the destination address that indicates the node device itself and the identification information that are contained in a header of a received packet destined to the node device according the prescribed security protocol does not exist as a valid security association information and the management information corresponding to that security association information exists as a valid management information in the non-volatile medium, in order to notify this fact to the node that becomes the correspondent.
2 more elements
A communication control method for a node device for carrying out a packet communication with another node device, comprising:
- carrying out an exchange procedure for exchanging a security association information including a destination address of the packet communication, an identification information of the destination address that is unique to the destination address, and a parameter information regarding a cryptographic processing to be used in the packet communication, with the another node device that becomes a correspondent of the packet communication according to a prescribed protocol, prior to the packet communication;
- storing the security association information exchanged by the exchange procedure in an internal memory device, and storing a management information including the destination address, the identification information, and an information regarding a valid period of the security association information, for each security association information stored in the internal memory device, in a non-volatile medium;
- receiving a packet destined to the node device according to the prescribed security protocol from the another node device;
- and
- transmitting a notification message containing the destination address and the identification information to the another node device, when the security association information specified by the destination address that indicates the node device itself and the identification information that are contained in a header of a received packet does not exist as a valid security association information and the management information corresponding to that security association information exists as a valid management information in the non-volatile medium, in order to notify this fact to the another node device.
2 more elements
A communication control method for a first node device and a second node device that carry out a packet communication, comprising:
- carrying out an exchange procedure for exchanging a security association information including a destination address of the packet communication, an identification information of the destination address that is unique to the destination address, and a parameter information regarding a cryptographic processing to be used in the packet communication, between the first node device and the second node device according to a prescribed protocol, prior to the packet communication;
- storing the security association information exchanged by the exchange procedure in an internal memory device of each one of the first node device and the second node device, and storing a management information including the destination address, the identification information, and an information regarding a valid period of the security association information, for each security association information stored in the internal memory device, in a non-volatile medium at least at the second node device;
- producing a packet according to the prescribed security protocol according to the parameter information regarding the cryptographic processing contained in the security association information at the first node device, and transmitting the packet to the second node device;
- receiving the packet destined to the another node device according to the prescribed security protocol from the first node device at the second node device;
- carrying out another exchanging procedure for exchanging the security association information including the destination address of the packet communication according to a notification message, the identification information of the destination address that is unique to the destination address, and the parameter information regarding the cryptographic processing to be used in the packet communication, prior to transmitting the notification message containing the destination address and the identification information to the first node device;
- producing another packet according to the prescribed security protocol that contains the notification message according to the parameter information regarding the cryptographic processing contained in the security association information at the second node device, and transmitting the another packet to the first node device;
- receiving the another packet according to the prescribed security protocol that contains the notification message from the second node device at the first node device;
- and
- verifying an authenticity of the notification message, and if the authenticity of the notification message is verified, deleting the security association information specified by the destination address and the identification information contained in the notification message, at the first node device.
6 more elements
A computer program product for causing a computer to function as a node device, the computer program product comprising:
- a first computer program code for causing the computer to carry out an exchange procedure for exchanging a security association information including a destination address of a packet communication, an identification information of the destination address that is unique to the destination address, and a parameter information regarding a cryptographic processing to be used in the packet communication, with a node that becomes a correspondent of the packet communication according to a prescribed protocol, prior to the packet communication;
- a second computer program code for causing the computer to store the security association information exchanged by the exchange procedure;
- a third computer program code for causing the computer to store and manage a management information including the destination address, the identification information, and an information regarding a valid period of the security association information, for each security association information stored by the second computer program code, in a non-volatile medium;
- and
- a fourth computer program code for causing the computer to transmit a notification message containing the destination address and the identification information to the node that becomes the correspondent, when the security association information specified by the destination address that indicates the node device itself and the identification information that are contained in a header of a received packet destined to the node device according the prescribed security protocol does not exist as a valid security association information and the management information corresponding to that security association information exists as a valid management information in the non-volatile medium, in order to notify this fact to the node that becomes the correspondent.
2 more elements
Dependencies are inferred from the claim text.