Information processing apparatus and encryption communicating method

Patent metadata

Field	Value
Publication number	US-2016021110-A1
Application number	US-201514789091-A
Country	US
Kind code	A1
Filing date	Jul 1, 2015
Priority date	Jul 16, 2014
Publication date	Jan 21, 2016
Grant date	—

Abstract

An information processing apparatus for performing encryption communication with an external apparatus by an encryption communication protocol has an inhibition unit for inhibiting use of a set of algorithms which do not satisfy a predetermined condition among a plurality of sets of algorithms used in the encryption communication protocol. The set of algorithms whose use if inhibited is a set of algorithms which need to transmit a message with a signature of the information processing apparatus to the external apparatus at the time of handshake performed with the external apparatus prior to the encryption communication.

First claim

What is claimed is:

1 . An information processing apparatus for performing encryption communication with an external apparatus in accordance with an encryption communication protocol, comprising:
an inhibition unit configured to inhibit use of a set of algorithms which do not satisfy a predetermined condition among a plurality of sets of algorithms which are used, in the encryption communication protocol, wherein the set of algorithms whose use is inhibited, by the inhibition unit is a set of algorithms which need to transmit a message with a signature of the information processing apparatus to the external apparatus at the time of handshake which is performed between the information processing apparatus and the external apparatus prior to the encryption communication.

2 . The information processing apparatus according to claim 1 , further comprising;
a decision unit configured to decide whether or not the set of algorithms which are used in the encryption communication protocol is the set of algorithms whose use is inhibited with respect to each of the plurality of sets of algorithms; and a communication unit configured to perform the handshake and the encryption communication by using the set of algorithms whose use is not inhibited by the inhibition unit among the plurality of sets of algorithms.

3 . The information processing apparatus according to claim 2 , wherein use of the set of algorithms which do not satisfy a predetermined condition among the plurality of sets of algorithms which are used in the encryption communication protocol is inhibited by the inhibition unit in accordance with a setting to inhibit the encryption communication of a predetermined cipher intensity.

4 . The information processing apparatus according to claim 2 , wherein with respect to the plurality of algorithms, the decision unit decides whether or not those algorithms are a set of algorithms which need to transmit a. message with a signature of a server from the server to a client at the time of handshake.

5 . The information processing apparatus according to claim 4 , wherein:
the set of algorithms includes an algorithm for authentication of the information processing apparatus and an algorithm for exchange of the cipher key with the external apparatus; and on the basis of a result of discrimination about a name of the algorithm for authentication of the information processing apparatus and a name of the algorithm for exchange of a cipher key with the external apparatus, the decision unit decides whether or not the set of algorithms which are used in the encryption communication protocol is a set of algorithms whose use is inhibited, with respect to each of the plurality of sets of algorithms.

6 . The information processing apparatus according to claim 2 , wherein with respect to the plurality of algorithms, the decision unit further decides whether or not those algorithms satisfy a reference regarding a safety based on a cipher intensity by sequentially selecting the plurality of algorithms.

7 . The information processing apparatus according to claim 6 , wherein the set of algorithms includes an algorithm for authentication of the information processing apparatus, and the reference regarding the safety based on the cipher intensity includes at least one of a reference regarding a safety of a hash algorithm used for the signature to a certification of the information processing apparatus and a reference regarding a safety of a public key in the certification of the information processing apparatus.

8 . The information processing apparatus according to claim 6 , wherein the reference regarding the safety based on the cipher intensity includes at least one of a reference regarding a size of a cipher key which is used in the algorithms constructing the set of algorithms and a reference regarding names of the algorithms constructing the set of algorithms.

9 . The information processing apparatus according to claim 2 , wherein;
when the information processing apparatus receives, as a server, a connection request from the external apparatus as a client, the decision unit decides whether or not hash algorithms which can be used for the signature to a certification of the information processing apparatus have been, presented from the external apparatus as a client; and as a result of the decision, if it is decided that the hash algorithms which can be used for the signature to the certification of the information processing apparatus have been presented, the decision unit does not decide whether or not the set of algorithms which are used in the encryption communication protocol is the set of algorithms whose use is inhibited with respect to each of the plurality of sets of algorithms.

10 . The information processing apparatus according to claim 9 , wherein;
if it is decided that the hash algorithms which can be used for the signature to the certification of the information processing apparatus have been presented from the external apparatus as a client, the decision unit decides whether or not a hash algorithm which satisfies a predetermined cipher intensity exists in the presented hash algorithms; and as a result of the decision, if it is decided that the hash algorithm which satisfies the predetermined cipher intensity exists, the decision unit does not decide whether or not the set of algorithms which are used in the encryption communication protocol is a set of algorithms whose use is inhibited with respect to each of the plurality of sets of algorithms.

11 . The information processing apparatus according to claim 10 , wherein if it is decided that the hash algorithm which satisfies the predetermined cipher intensity does not exist, the decision unit decides whether or not the set of algorithms which are used in the encryption communication protocol is a set of algorithms whose use is inhibited with respect to each of the plurality of sets of algorithms.

12 . The information processing apparatus according to claim 2 , wherein;
when the information processing apparatus receives, as a server, a connection request from the external apparatus as a client, the decision unit further decides whether or not hash algorithms which can be used for the signature to a certification of the information processing apparatus have been presented from the external apparatus as a client; and as a result of the decision, if it is decided that the hash algorithms which can be used for the signature to the certification of the information processing apparatus are not presented, the decision unit decides whether or not the set of algorithms which are used in the encryption communication protocol is the set of algorithms whose use is inhibited with respect to each of the plurality of sets of algorithms.

13 . The information processing apparatus according to claim 1 , wherein:
the set of algorithms whose use is inhibited includes a set of algorithms which need to transmit a message with a signature of a server from the server to a client at the time of handshake; and the set of algorithms whose use is permitted includes a set of algorithms which exchange a cipher key by using a public key of the server at the time of handshake.

14 . The information processing apparatus according to claim 1 , wherein the encryption communication protocol is SSL (Secure Socket Layer) or TLS (Transport Layer Security).

15 . The information processing apparatus according to claim 2 , further comprising a protocol inhibition unit configured to inhibit use of the encryption communication protocol using a predetermined algorithm among the plurality o

Assignees

• Canon Kk

Inventors

• Sugano Yasuharu

Classifications

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title