Decrypted packet padding removal

Patent metadata

Field	Value
Publication number	US-11444789-B2
Application number	US-201916591348-A
Country	US
Kind code	B2
Filing date	Oct 2, 2019
Priority date	Apr 4, 2017
Publication date	Sep 13, 2022
Grant date	Sep 13, 2022

Abstract

In order to improve the efficiency of transfer to outside devices while necessary buffer memory is suppressed, the present invention is an information processing apparatus for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length, the information processing apparatus including acquisition means for acquiring an encrypted packet on a unit data basis, decoding means for decoding the encrypted packet on the unit data basis, output means for outputting decoded data obtained through the decoding performed by the decoding means to an external device in accordance with an order in which the decoding is performed by the decoding means, and control means for restricting output to be performed by the output means in a case where a padding pattern is detected from the decoded data obtained through the decoding performed by the decoding means.

First claim

The invention claimed is:

1. An information processing apparatus for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length, the information processing apparatus comprising:
at least one circuit configured to function as:
an acquisition unit configured to acquire an encrypted packet on a unit data basis;
a decoding unit configured to decode the encrypted packet on the unit data basis;
an output unit configured to output decoded data obtained through the decoding performed by the decoding unit to an external device in accordance with an order in which the decoding is performed by the decoding unit; and
a restricting unit configured to restrict output to be performed by the output unit in a case where a padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit, and to keep restricting the output to be performed by the output unit until a pattern different from the padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit.

2. The information processing apparatus according to claim 1 , wherein the restricting unit
includes a transfer unit for acquiring the decoded data obtained through the decoding performed by the decoding unit and transferring the acquired decoded data obtained through the decoding performed by the decoding unit to the output unit, and
restricts, in a case where the decoded data obtained through the decoding performed by the decoding unit contains the padding pattern, the output to be performed by the output unit by restricting transfer to be performed by the transfer unit.

3. The information processing apparatus according to claim 2 , wherein the restricting unit allows the transfer unit to perform the transfer in a case where the padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit and where, after the padding pattern, a pattern different from the padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit.

4. The information processing apparatus according to claim 2 , wherein the restricting unit does not perform transfer using the transfer unit in a case where the padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit and where a size of a padding pattern contained after the padding pattern is greater than a threshold.

5. The information processing apparatus according to claim 1 , wherein the padding pattern is formed by repeating a value of zero.

6. The information processing apparatus according to claim 5 , wherein the padding pattern is a pattern subsequent to a value indicating a type of the packet.

7. The information processing apparatus according to claim 1 , wherein the padding pattern is a padding pattern defined in accordance with protocols.

8. The information processing apparatus according to claim 7 , wherein the padding pattern is a padding pattern defined in accordance with TLS protocols.

9. The information processing apparatus according to claim 1 , wherein the padding pattern is formed by repeating a fixed value a predetermined number of times.

10. The information processing apparatus according to claim 1 , wherein the encrypted packet is a portion of image pickup data generated by an image capturing device.

11. An information processing method for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length, the information processing method comprising:
acquiring, by an acquisition unit, an encrypted packet on a unit data basis;
decoding, by a decoding unit, the encrypted packet on the unit data basis;
outputting, by an output unit, decoded data obtained through the decoding performed by the decoding unit to an external device in accordance with an order in which the decoding is performed by the decoding unit; and
restricting, by a restricting unit, output to be performed by the output unit in a case where a padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit and keep restricting the output to be performed by the output unit until a pattern different from the padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit.

12. The information processing method according to claim 11 , wherein
the restricting includes transferring, by a transfer unit, in which the decoded data obtained through the decoding performed in the decoding is acquired and the acquired decoded data obtained through the decoding performed in the decoding is transferred to the output unit, and
in a case where the decoded data obtained through the decoding performed in the decoding unit contains the padding pattern, the output to be performed by the output unit is restricted by restricting transfer to be performed in the transferring.

13. The information processing method according to claim 12 , wherein in the restricting, the transfer in the transferring is allowed in a case where the padding pattern is detected from the decoded data obtained through the decoding performed in the decoding and where, after the padding pattern, a pattern different from the padding pattern is detected from the decoded data obtained through the decoding performed in the decoding step.

14. The information processing method according to claim 12 , wherein in the restricting, the transfer in the transferring is not performed in a case where the padding pattern is detected from the decoded data obtained through the decoding performed in the decoding and where a size of a padding pattern contained after the padding pattern is greater than a threshold.

15. The information processing method according to claim 11 , wherein the padding pattern is formed by repeating a value of zero.

16. The information processing method according to claim 15 , wherein the padding pattern is a pattern subsequent to a value indicating a type of the packet.

17. The information processing method according to claim 11 , wherein the padding pattern is a padding pattern defined in accordance with protocols.

18. The information processing method according to claim 17 , wherein the padding pattern is a padding pattern defined in accordance with TLS protocols.

19. The information processing method according to claim 11 , wherein the padding pattern is formed by repeating a fixed value.

20. A non-transitory storage medium storing a program causing an information processing apparatus for decoding a packet that is encrypted in accordance with Transport Layer Security (TLS) protocols and in which a padding portion has a variable length to execute an information processing method, the information processing method comprising:
acquiring, by an acquisition unit, an encrypted packet on a unit data basis;
decoding, by a decoding unit, the encrypted packet on the unit data basis;
outputting, by an output unit, decoded data obtained through the decoding performed by the decoding unit to an external device in accordance with an order in which the decoding is performed by the decoding unit; and
restricting, by a restricting unit, output to be performed by the output unit in a case where a padding pattern is detected from the decoded data obtained through the decoding performed by the decoding unit and keep restricting the o

Assignees

• Canon Kk

Inventors

• Momoi Akiyoshi

Classifications

• H04L63/166 Primary

  at the transport layer · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L9/36 Primary

  with means for detecting characters not meant for transmission · CPC title

• H04L2209/34

  Encoding or coding, e.g. Huffman coding or error correction · CPC title

• H04L63/0485

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title