US6092191A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Packet authentication and packet encryption/decryption scheme for security gateway
Assignee: Toshiba Corp
•
Filing: 1996-11-29
•
Granted: 2000-07-18
•
Expires: 2016-11-29
Abstract
Abstract A packet authentication and packet encryption/decryption scheme for a security gateway suitable for a hierarchically organized network system and a mobile computing environment. For the packet authentication, in addition to the end-to-end authentication at the destination side packet processing device, the link-by-link authentication at each intermediate packet processing device in the packet transfer route is used. The link-to-link authentication data being inspected by intermediate nodes and end-to-end data (different from link-to-link data) being inspected by destination node but not being inspected by intermediate nodes. For the packet encryption/decryption, each packet processing device determines whether or not to encrypt/decrypt the packet according to: an information on the computers which are directly managed by this packet processing device; or the encryption information and the signature information provided in the packet; or the encryption information, the signature information, and the encryption/decryption level information provided in the packer.
Inventors
- 👤 Atsushi Shimbo
- 👤 Atsushi Inoue
- 👤 Masahiro Ishiyama
- 👤 Toshio Okamoto
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-26 20:15
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; H04L63/0428; H04L63/12; H04L63/16; H04L63/164
Claims Analysis
Total Claims: 40
Claim 1
Independent Claim
248 words
A method for transferring a packet from a source computer to a destination computer in a network system formed by a plurality of computer networks in which a packet processing device is provided it a boundary between each computer network and an external of said each computer network, the method comprising the steps of: (a) transferring the packet transmitted by the source computer from a source side packet processing device managing the source computer to an adjacent packet processing device in a packet transfer route, after attaching to the packet an end-to-end authentication data for inspection by a destination side packet processing device managing the destination computer and not by any intermediate packet processing device in the packet transfer route and a link-by-link authentication data for inspection by at least one intermediate packet processing device in the packet transfer route; (b) inspecting the link-by-link authentication data attached to the packet at said at least one intermediate packet processing device without inspecting the end-to-end authentication data, and transferring the packet from said at least one intermediate packet processing device to a next packet processing device in the packet transfer route when the packet is authenticated by an inspection of the link-by-link authentication data; and (c) inspecting the end-to-end authentication data attached to the packet at the destination side packet processing device, and transferring the packet from the destination side packet processing device to the destination computer when the packet is authenticated by an inspection of the end-to-end authentication data.
Claim 2
Independent Claim
248 words
A method for transferring a packet from a source computer to a destination computer in a network system formed by a plurality of computer networks in which a packet processing device is provided it a boundary between each computer network and an external of said each computer network, the method comprising the steps of: (a) transferring the packet transmitted by the source computer from a source side packet processing device managing the source computer to an adjacent packet processing device in a packet transfer route, after attaching to the packet an end-to-end authentication data for inspection by a destination side packet processing device managing the destination computer and not by any intermediate packet processing device in the packet transfer route and a link-by-link authentication data for inspection by at least one intermediate packet processing device in the packet transfer route; (b) inspecting the link-by-link authentication data attached to the packet at said at least one intermediate packet processing device without inspecting the end-to-end authentication data, and transferring the packet from said at least one intermediate packet processing device to a next packet processing device in the packet transfer route when the packet is authenticated by an inspection of the link-by-link authentication data; and (c) inspecting the end-to-end authentication data attached to the packet at the destination side packet processing device, and transferring the packet from the destination side packet processing device to the destination computer when the packet is authenticated by an inspection of the end-to-end authentication data.
Claim 3
Dependent Claim
114 words
The method of claim 1, wherein at the step (a) the source side packet processing device attaches the link-by-link authentication data for inspection by said at least one intermediate packet processing device which is said adjacent packet processing device in the packet transfer route; and at the step (b) a corresponding link-by-link authentication data attached to the packet is inspected at each intermediate packet processing device in the packet transfer route including said adjacent packet processing device, and the packet is transferred from said each intermediate packet processing device to a next packet processing device in the packet transfer route when the packet is authenticated by an inspection of the corresponding link-by-link authentication data.
Claim 4
Dependent Claim
83 words
The method of claim 2, wherein the source side packet processing device generates the end-to-end authentication data at the step (a) by using an authentication key corresponding to the destination side packet processing device which is determined from an address information in the packet, and the destination side packet processing device inspects the end-to-end authentication data at the step (c) by using an authentication key corresponding to the source side packet processing device which is determined from the address information in the packet.
Claim 5
Dependent Claim
43 words
The method of claim 2, wherein the source side packet processing device generates the link-by-link authentication data at the step (a) by using an authentication key corresponding to said adjacent packet processing device which is determined from an address information in the packet.
Claim 6
Dependent Claim
35 words
The method of claim 2, wherein said each intermediate packet processing device inspects the corresponding link-by-link authentication data at the step (b) by using an authentication key determined from the address information in the packet.
Claim 7
Dependent Claim
26 words
The method of claim 2, wherein sa-d each intermediate packet processing device transfers the packet as received when the packet is authenticated at the step (b).
Claim 8
Dependent Claim
34 words
The method of claim 2, wherein said each intermediate packet processing device transfers the packet after removing the corresponding link-by-link authentication data from the packet when the packet is authenticated at the step (b).
Claim 9
Dependent Claim
44 words
The method of claim 2, wherein said each intermediate packet processing device generates a new link-by-link authentication data for inspection by the next packet processing device, and transfers the packet after attaching the new link-by-link authentication data to the packet at the step (b).
Claim 10
Dependent Claim
44 words
The method of claim 8, wherein said each intermediate packet processing device generates the new link-by-link authentication data at the step (b) by using an authentication key corresponding to the next packet processing device which is determined from an address information in the packet.
Claim 11
Dependent Claim
58 words
The method of claim 2, wherein the source side packet processing device generates each corresponding link-by-link authentication data to be inspected by said each intermediate packet processing device, and transfers the packet after attaching all the corresponding link-by-link authentication data for all intermediate packet processing devices in the packet transfer route to the packet at the step (a).
Claim 12
Dependent Claim
46 words
The method of claim 10, wherein the source side packet processing device generates said each corresponding link-by-link authentication data at the step (a) by using an authentication key corresponding to said each intermediate packet processing device which is determined from an address information in the packet.
Claim 13
Dependent Claim
59 words
The method of claim 2, wherein the source side packet processing device generates a common link-by-link authentication data to be inspected by every intermediate packet processing device in the packet transfer route at the step (a), and said each intermediate packet processing device inspects said common link-by-link authentication data as the corresponding link-by-link authentication data at the step (b).
Claim 14
Dependent Claim
49 words
The method of claim 12, wherein the source side packet processing device generates said common link-by-link authentication data at the step (a) by using an authentication key common to all intermediate packet processing devices in the packet transfer route which is determined from an address information in the packet.
Claim 15
Dependent Claim
62 words
The method of claim 2, wherein the source computer is a mobile computer capable of carrying out communications by moving among the computer networks in the network system, and the source side packet processing device is implemented in the mobile computer, so that the packet is transferred by the source side packet processing device in the mobile computer at the step (a).
Claim 16
Dependent Claim
62 words
The method of claim 2, wherein he destination computer is a mobile computer capable of carrying out communications by moving among the computer networks in the network system, and the destination side packet processing device is implemented in the mobile computer, so that the packet is inspected by the destination side packet processing device in the mobile computer at the step (c).
Claim 17
Dependent Claim
68 words
The method of claim 2, wherein at the step (a), the source side packet processing device generates the end-to-end authentication data depending on all bits of the packet transmitted by the source computer, and the link-by-link authentication data depending on selective bits corresponding to a part of data formed by the packet transmitted by the source computer and the end-to-end authentication data which contains the end-to-end authentication data.
Claim 18
Dependent Claim
38 words
The method of claim 2, wherein at the step (a), the source side packet processing device generates the end-to-end authentication data and the link-by-link authentication data depending on all bits of the packet transmitted by the source computer.
Claim 19
Dependent Claim
171 words
A packet processing device for transferring a packet transmitted from a source computer to a destination computer in a network system formed by a plurality of computer networks, the device being provided at a boundary between one computer network and an external of said one computer network, and the device comprising: authentication data generation means for generating an end-to-end authentication data for inspection by a destination side packet processing device managing the destination computer and not by any intermediate packet processing device in a packet transfer route and a link-by-link authentication data for inspection by at least one intermediate packet processing device in the packet transfer route; packet formatting means for attaching the end-to-end authentication data and the link-by-link authentication data generated by the authentication data generation means to the packet transmitted by the source computer; and transfer means for transferring the packet with the end-to-end authentication data and the link-by-link authentication data attached thereto by the packet formatting means, to an adjacent packet processing device in the packet transfer route.
Claim 20
Dependent Claim
171 words
A packet processing device for transferring a packet transmitted from a source computer to a destination computer in a network system formed by a plurality of computer networks, the device being provided at a boundary between one computer network and an external of said one computer network, and the device comprising: authentication data generation means for generating an end-to-end authentication data for inspection by a destination side packet processing device managing the destination computer and not by any intermediate packet processing device in a packet transfer route and a link-by-link authentication data for inspection by at least one intermediate packet processing device in the packet transfer route; packet formatting means for attaching the end-to-end authentication data and the link-by-link authentication data generated by the authentication data generation means to the packet transmitted by the source computer; and transfer means for transferring the packet with the end-to-end authentication data and the link-by-link authentication data attached thereto by the packet formatting means, to an adjacent packet processing device in the packet transfer route.
Claim 21
Dependent Claim
39 words
The device of claim 18, wherein the authentication data generation means generates the link-by-link authentication data for inspection by said at least one intermediate packet processing device which is said adjacent packet processing device in the packet transfer route.
Claim 22
Dependent Claim
39 words
The device of claim 19, wherein the authentication data generation means generates the end-to-end authentication data by using an authentication key corresponding to the destination side packet processing device which is determined from an address information in the packet.
Claim 23
Dependent Claim
38 words
The device of claim 19, wherein the authentication data generation means generates the link-by-link authentication data by using an authentication key corresponding to said adjacent packet processing device which is determined from an address information in the packet.
Claim 24
Dependent Claim
86 words
The device of claim 19, further comprising: an authentication key memory for storing a first authentication key corresponding to the destination side packet processing device and a second authentication key corresponding to said adjacent packet processing device, in correspondence to an address information in the packet; wherein the authentication data generation means generates the end-to-end authentication data by using the first authentication key stored in the authentication key memory, and the link-by-link authentication data by using the second authentication key stored in the authentication key memory.
Claim 25
Dependent Claim
57 words
The device of claim 19, wherein tie authentication data generation means generates each corresponding link-by-link authentication data to be inspected by each intermediate packet processing device in the packet transfer route, and the packet formatting means attaches all the corresponding link-by-link authentication data for all intermediate packet processing devices in the packet transfer route to the packet.
Claim 26
Dependent Claim
41 words
The device of claim 23, wherein the authentication data generation means generates said each corresponding link-by-link authentication data by using an authentication key corresponding to said each intermediate packet processing device which is determined from an address information in the packet.
Claim 27
Dependent Claim
73 words
The device of claim 23, Further comprising: an authentication key memory for storing authentication keys corresponding to the destination side packet processing device and all the intermediate packet processing devices in the packet transfer route, in correspondence to an address information in the packet; wherein the authentication data generation means generates the end-to-end authentication data and said each corresponding link-by-link authentication data by using the authentication keys stored in the authentication key memory.
Claim 28
Dependent Claim
31 words
The device of claim 19, wherein the authentication data generation means generates a common link-by-link authentication data to be inspected by every intermediate packet processing device in the packet transfer route.
Claim 29
Dependent Claim
44 words
The device of claim 26, wherein the authentication data generation means generates said common link-by-link authentication data by using an authentication key common to all intermediate packet processing devices in the packet transfer route which is determined from an address information in the packet.
Claim 30
Dependent Claim
93 words
The device of claim 26, further comprising: an authentication key memory for storing a first authentication key corresponding to the destination side packet processing device and a second authentication key corresponding to all the intermediate packet processing devices in the packet transfer route, in correspondence to an address information in the packet; wherein the authentication data generation means generates the end-to-end authentication data by using the first authentication key stored in the authentication key memory, and said common link-by-link authentication data by using the second authentication key stared in the authentication key memory.
Claim 31
Dependent Claim
151 words
A packet processing device for relaying a packet transmitted from a source computer to a destination computer in a network system formed by a plurality of computer networks, the device being provided at a boundary between one computer network and an external of said one computer network, and the device comprising; inspection means for inspecting a corresponding link-by-link authentication data attached to the packet received from an adjacent packet processing device in the packet transfer route, without inspecting an end-to-end authentication data for inspection by a destination side packet processing device managing the destination computer and not by any intermediate packet processing device in the packet transfer route which is also attached to the packet; and transfer means for transferring the packet to a next packet processing device in the packet transfer route when the packet is authenticated by an inspection of the corresponding link-by-link authentication data by the inspection means.
Claim 32
Dependent Claim
151 words
A packet processing device for relaying a packet transmitted from a source computer to a destination computer in a network system formed by a plurality of computer networks, the device being provided at a boundary between one computer network and an external of said one computer network, and the device comprising; inspection means for inspecting a corresponding link-by-link authentication data attached to the packet received from an adjacent packet processing device in the packet transfer route, without inspecting an end-to-end authentication data for inspection by a destination side packet processing device managing the destination computer and not by any intermediate packet processing device in the packet transfer route which is also attached to the packet; and transfer means for transferring the packet to a next packet processing device in the packet transfer route when the packet is authenticated by an inspection of the corresponding link-by-link authentication data by the inspection means.
Claim 33
Dependent Claim
28 words
The device of claim 29, wherein the inspection means inspects the corresponding link-by-link authentication data by using an authentication key determined from the address information in the packet.
Claim 34
Dependent Claim
23 words
The device of claim 29, wherein the transfer means transfers the packet as received when the packet is authenticated by the inspection means.
Claim 35
Dependent Claim
52 words
The device of claim 29, farther comprising: packet formatting means for removing the corresponding link-by-link authentication data from the packet when the packet is authenticated by the inspection means; wherein the transfer means transfers the packet after the corresponding link-by-Link authentication data is removed from the packet by the packet formatting means.
Claim 36
Dependent Claim
80 words
The device of claim 29, further comprising: authentication data generation means for generating a new link-by-link authentication data which is to be inspected by the next packet processing device; and packet formatting means for attaching the new link-by-link authentication data generated by the authentication key generation means to the packet received from the adjacent packet processing device; wherein the transfer means transfers the packet after the new link-by-link authentication data is attached to the packet by the packet formatting means.
Claim 37
Dependent Claim
226 words
An article of manufacture, comprising; a computer usable medium having computer readable program code means embodied therein for causing a computer to function as a packet processing device for transferring a packet transmitted from a source computer to a destination computer in a network system formed by a plurality of computer networks, the packet processing device being provided at a boundary between one computer network and an external of said one computer network, the computer readable program code means including: first computer readable program code means for causing said computer to generate an end-to-end authentication data for inspection by a destination side packet processing device managing the destination computer and not by any intermediate packet processing device in a packet transfer route and a link-by-link authentication data for inspection by at least one intermediate packet processing device in the packet transfer route; second computer readable program code means for causing said computer to attach the end-to-end authentication data and the link-by-link authentication data generated by the first computer readable program code means to the packet transmitted by the source computer; and third computer readable program code means for causing said computer to transfer the packet with the end-to-end authentication data and the link-by-link authentication data attached thereto by the second computer readable program code means, to an adjacent packet processing device in the packet transfer route.
Claim 38
Dependent Claim
226 words
An article of manufacture, comprising; a computer usable medium having computer readable program code means embodied therein for causing a computer to function as a packet processing device for transferring a packet transmitted from a source computer to a destination computer in a network system formed by a plurality of computer networks, the packet processing device being provided at a boundary between one computer network and an external of said one computer network, the computer readable program code means including: first computer readable program code means for causing said computer to generate an end-to-end authentication data for inspection by a destination side packet processing device managing the destination computer and not by any intermediate packet processing device in a packet transfer route and a link-by-link authentication data for inspection by at least one intermediate packet processing device in the packet transfer route; second computer readable program code means for causing said computer to attach the end-to-end authentication data and the link-by-link authentication data generated by the first computer readable program code means to the packet transmitted by the source computer; and third computer readable program code means for causing said computer to transfer the packet with the end-to-end authentication data and the link-by-link authentication data attached thereto by the second computer readable program code means, to an adjacent packet processing device in the packet transfer route.
Claim 39
Dependent Claim
200 words
An article of manufacture, comprising: a computer usable medium having computer readable program code means embodied therein for causing a computer to function as a packet processing device for relaying a packet transmitted from a source computer to a destination computer in a network system formed by a plurality of computer networks, the packet processing device being provided at a boundary between one computer network and an external of said one computer network, the compute readable program code means including: first computer readable program code means for causing said computer to inspect a corresponding link-by-link authentication data attached to the packet received from an adjacent packet processing device in the packet transfer route, without inspecting an end-to-end authentication data for inspection by a destination side packet processing device managing the destination computer and not by any intermediate packet processing device in the packet transfer route which is also attached to the packet; and second computer readable program code means for causing said computer to transfer the packet to a next packet processing device in the packet transfer route when the packet is authenticated by an inspection of the corresponding link-by-link authentication data by the first computer readable program code means.
Claim 40
Dependent Claim
200 words
An article of manufacture, comprising: a computer usable medium having computer readable program code means embodied therein for causing a computer to function as a packet processing device for relaying a packet transmitted from a source computer to a destination computer in a network system formed by a plurality of computer networks, the packet processing device being provided at a boundary between one computer network and an external of said one computer network, the compute readable program code means including: first computer readable program code means for causing said computer to inspect a corresponding link-by-link authentication data attached to the packet received from an adjacent packet processing device in the packet transfer route, without inspecting an end-to-end authentication data for inspection by a destination side packet processing device managing the destination computer and not by any intermediate packet processing device in the packet transfer route which is also attached to the packet; and second computer readable program code means for causing said computer to transfer the packet to a next packet processing device in the packet transfer route when the packet is authenticated by an inspection of the corresponding link-by-link authentication data by the first computer readable program code means.
References Cited (Backward Citations)
US5455865A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-07-18 | 2004-01-17 | 2004-07-18 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-07-18 | 2008-01-17 | 2008-07-18 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-07-18 | 2012-01-17 | 2012-07-18 | $7700.00 | Window Closed / Lapsed |