Granted Patent B2

US 8,478,994 · App. 12/675,333 · Granted Jul 2, 2013

Abstract

Claims (29)

1. A method for decrypting at least one encrypted data stream containing data packets in which a first data stream is data-stream-specifically generated and data-stream-specifically encrypted according to a network protocol for encrypting and transmitting data streams, comprising:

providing the network protocol defining an extendable header for the data packets;

determining a data packet type in such a way that data packets of the first data stream are discarded by a second component of the communication arrangement when the data packets of the first data stream include key information inserted within the extendable header of the data packets in accordance with the network protocol;

a first component of a communication arrangement generating the key information data-stream-specifically;

the first component inserting the key information into the extendable header of a data packet of the first data stream;

the first component transmitting the data packet of the first data stream to the second component of the communication arrangement via a network connection;

a diagnosis unit recording the data packet of the first data stream;

the diagnosis unit selecting the key information from the header of the received data packet of the first data stream; and

the diagnosis unit decrypting the data packet of the first data stream using the key information from the header.

2. The method of claim 1 , wherein the network protocol with the defined extendable header is a standardized network protocol according to RFC Standard 3550 or 1889, and wherein the first data stream is encrypted according to the Secured Real Time Protocol.

3. The method of claim 1 , comprising providing as the data packet type for the data packets having the key information within the extendable header of the data packets a data packet type selected from the group consisting of a data packet type that is new to the network and an unused data packet type.

4. The method of claim 1 , comprising continuously generating data-stream-specific key information in the data packets of the first data stream and inserting the generated data-stream-specific key information within the header of the data packets of first data stream.

5. The method of claim 1 , comprising encrypting the key information with key encryption related information, the key encryption related information provided for at least one of analysis, diagnostics, and a recording.

6. The method of claim 5 , comprising representing the key encryption related information as an asymmetrical piece of key information so that a piece of key information is provided for encrypting the key information that is different than that used to encrypt the data packet of the first data stream.

7. The method of claim 1 , comprising activating and subsequently deactivating the data-stream-specific insertion of key information for at least one of analysis, diagnosis, and recording of the data streams.

8. An arrangement for decrypting at least one encrypted data stream containing data packets in which a data stream is data-stream-specifically generated and data-stream-specifically encrypted according to a network protocol for encrypting and transmitting data streams, comprising:

a diagnosing unit having memory, a recording unit, a monitoring unit and a decryption unit;

the recording unit recording a first data packet of an encrypted data stream from a first component of a network via a network connection, the encrypted data stream being directed to a second component of the network, the first data packet having an extended header in which key information for encrypting the first data packet was inserted, the key information being generated data stream specifically;

the monitoring unit searching data packets recorded by the recording unit and storing the first data packet upon a determination that the extended header of the first data packet included the key information;

the decryption unit decrypting the first data packet based upon the key information within the extended header of the first data packet, the first data packet being decrypted so that the first data packet is diagnosable or analyzable; and

wherein the first data packet is a data packet type that is defined by the network protocol in such a way that the first data packet is discarded by the second component in accordance with the network protocol.

9. The arrangement of claim 8 , wherein the monitoring unit and the decryption unit are integrated.

10. The arrangement of claim 8 , wherein the monitoring unit searches data packets recorded by the recording unit to determine whether any of the recorded data packets has an extended header that is extended in accordance with the network protocol.

11. The arrangement of claim 8 , wherein the key information is encrypted within the first data packet and the first data packet and the decryption unit has a private key usable to decrypt the encrypted key information prior to using the decrypted key information to decrypt the first data packet.

12. The method of claim 1 wherein the data packet is structured so that there is no payload data within the data packet and the data packet is discarded after receipt by a data receiver that is compliant with the network protocol such that the data receiver does not read the data packet.

13. The method of claim 12 wherein the second component comprises the data receiver.

14. The method of claim 1 wherein the generation of the key information and the insertion of the key information is enabled only during diagnostics of the first data stream.

15. The arrangement of claim 11 wherein the diagnosis unit decrypts the key information via the private key.

16. The arrangement of claim 8 wherein the network protocol with the defined extendable header is based on a standardized network protocol according to RFC Standard 3550 or 1889, and wherein the first data packet is encrypted according to the Secured Real Time Protocol.

Assignments (12)