JPH0646052A - Encipherment system in high speed transport mechanism - Google Patents

Abstract

PURPOSE:To enhance the security by adding a machanism for changing a cipher key to a burst mechanism of a high speed transport protocol. CONSTITUTION:In a transmitting burst unit buffer 2, transmitting data is assembled by a burst unit by an assembling means 9, and the whole assembled data is enciphered by an enciphering means 6 by using cipher key which pairs with a cipher key identifier in a cipher information base 10, and sent out as a burst together with the cipher key identifier to a communication circuit. The side which receives the burst assembles in a lump, fetches the cipher key identifier by a decoding information fetching means 15, fetches the corresponding cipher key from cipher information base 20, decodes the burst unit by a decoding means 16, and thereafter, divides the data, and delivers it to a protocol user.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an encryption method for data transfer using a high speed transport protocol using flow control by a burst mechanism via a local area network.

[0002]

2. Description of the Related Art Conventionally, in a local area network,
When data is transferred by the high-speed transport protocol, when the transfer data is encrypted, the encryption and decryption are performed only by a fixed encryption key that is predetermined by the communication parties.

[0003]

In the above-mentioned conventional cryptosystem, the security of communication cannot be maintained once the key is discovered by a third party.

In view of the above problems, it is an object of the present invention to provide an encryption method in a high speed transport mechanism which enhances security by adding an encryption key changing mechanism to the burst mechanism of the high speed transport protocol. .

[0005]

The encryption method according to the high speed transport mechanism of the present invention transfers data between terminals by a high speed transport protocol using flow control by a burst mechanism via a local area network. At this time, in order to construct a burst that is a flow control unit from the data transmission buffer that stores the transmission request data from the protocol stack upper entity, the burst is assembled by the burst assembler and stored in the transmission burst unit buffer, and the cryptographic information base is stored. It is characterized in that it is encrypted by the encryption means with the encryption key taken out and stored in the transmission encryption burst unit buffer.

In addition, when a data transfer between terminals is performed by a high-speed transport protocol using a flow control by a burst mechanism via a local area network, the encryption used in the encryption when the above encryption method is used. In order to notify the other party of the key, the encryption information adding means adds an encryption key identifier corresponding to an encryption key predetermined between communication parties to the head of the burst unit extracted from the transmission encryption burst unit buffer, After the data dividing unit divides the burst unit into fixed length transmission frames, the burst information adding unit determines which burst belongs to the divided frame, a burst identifier, a sequence number in the burst, and a destination terminal address. Information is added and encrypted on the communication line via the data transmission / reception means. And wherein the sending the data.

Further, when data is transferred between terminals by a high-speed transport protocol using flow control by a burst mechanism via a local area network, the data is encrypted using the above-mentioned encryption method and is transmitted via a communication line. The data frame transmitted and received by the data transmission / reception means, by the burst information extraction means,
The burst identifier and the in-burst sequence number are extracted, the data is assembled in burst units by the data assembling unit based on the burst identifier and the in-burst sequence number, and when the assembly is completed, the decryption information extracting unit displays the encryption key identifier. And the burst unit other than the encryption key identifier is stored in the received encrypted burst unit buffer.

In addition, when a data transfer between terminals is performed by a high-speed transport protocol using flow control by a burst mechanism via a local area network, it corresponds to an encryption key identifier retrieved using the above-mentioned encryption method. The decryption means extracts the encryption key from the encryption information base, decrypts the burst unit by using the encryption key, stores the decrypted burst unit in the reception burst unit buffer, and the burst division means requests the protocol stack upper entity. It is characterized in that it is divided according to the length and stored in the data reception buffer.

[0009]

According to the above construction, the burst of the flow control unit is assembled from the transmission request data from the protocol stack upper entity stored in the data transmission buffer into the transmission burst unit buffer, and the encryption unit encrypts the burst. After encrypting with the encryption key extracted from the information base, it is stored in the transmission encryption burst unit buffer.

The encryption information adding means adds an encryption key identifier corresponding to the encryption key to the head of the burst unit extracted from the transmission encryption burst unit buffer, and the data dividing means converts this burst unit into a fixed length transmission frame. After the division, the burst information adding means adds the burst identifier, the sequence number in the burst, and the information about the address of the destination terminal to the divided frame, and the data transmitting / receiving means sends the information to the communication line.

On the other hand, on the side which receives the encrypted data via the data transmitting / receiving means, the burst information extracting means extracts the burst identifier and the sequence number in the burst,
Based on these, the data assembling means assembles in burst units, and when the assembly is completed, the decryption information extracting means extracts the encryption key identifier, and the burst unit other than the encryption key identifier is stored in the received encrypted burst unit buffer. The decryption means extracts the encryption key corresponding to the extracted encryption key identifier from the same encryption information base as the sender side, performs decryption in burst units using the encryption key, stores it in the reception burst unit buffer, and the burst division means Since the data is divided into the required length and then stored in the data reception buffer, it is possible to change the encryption key in burst units and enhance the security.

[0012]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a system configuration diagram of an embodiment of the present invention.

In FIG. 1, 1 is a data transmission buffer for storing transmission request data from a protocol stack upper entity, 2 is a transmission burst unit buffer for storing burst units, and 3 is an encrypted burst unit. Transmission encryption burst unit buffer, 4 is a data dividing means for dividing an encryption burst unit into transmission frames of fixed length, and 5 is an encryption key identifier corresponding to an encryption key predetermined between communication parties, and transmission encryption burst Cryptographic information adding means added to the head of the burst unit extracted from the unit buffer 3, 6 is a transmission burst unit buffer 2
Encrypting means for encrypting the burst unit stored in the above with an encryption key, and 7 is burst information adding means for adding information on the burst identifier, sequence number, and destination terminal address to the transmission frame divided by the data dividing means 4. , 8 and 18 are data transmitting / receiving means for transmitting / receiving via the communication line 21, 9 is a burst assembling means for forming a burst from the transmission request data in the data transmission buffer 1, and 10 is common encryption key information between the parties transmitting and receiving. It is a cryptographic information base.

Reference numeral 17 is a burst information extracting means for extracting a burst identifier and sequence number from the data frame received by the data transmitting / receiving means 18, 14 is a burst identifier, data assembling means for assembling burst units from the sequence number, and 15 is an encryption key. Decryption information extracting means for extracting an identifier, 13 is a reception encrypted burst unit buffer for storing burst units other than the encryption key identifier, 1
6 is the cryptographic information base 2 which is the cryptographic key corresponding to the cryptographic key identifier.
Decoding means for taking out from 0 and performing decoding in burst units using an encryption key, 12 is a reception burst unit buffer for storing burst units decoded by the decoding means 16, and 19 is requested by a protocol stack upper entity. A burst dividing means for dividing the data into lengths, and a data receiving buffer 11 for storing the data divided by the burst dividing means 19.

Next, the operation will be described.

In FIG. 2, 256 is sequentially passed from the protocol stack upper entity to the data transmission buffer 1.
It is an example of data transmitted to the same terminal byte by byte. The burst unit composed of these transmission data is as shown in FIG. When a fixed amount of transmission data of 4 Kbytes is accumulated, the burst assembly means 9 constitutes one burst unit. FIG. 4 shows the cryptographic information base 10.
Is an example of. One encryption key is selected from this encryption information base 10 for each burst unit. The contents of the cryptographic information base 10 are decided by the agreement between the communicating parties in advance, and the communicating parties are the same.
Shall have. Using this encryption key, the encryption means 6
As a result, the entire burst unit is encrypted as shown in FIG. Since the cryptographic key and the cryptographic key identifier are stored in the cryptographic information base 10 as a pair, the cryptographic information providing unit 5 takes out the cryptographic identifier and configures the encrypted burst unit together with the burst unit as shown in FIG. To do. This encrypted burst unit is divided by the data dividing means 4 into fixed length frames of the optimum size for transmission, and the burst identifier and the sequence number in the burst are added to each by the burst information adding means 7, and the data as shown in FIG. The communication line 21
Send on. On the side receiving the data, the burst information extracting means 17 extracts the burst identifier and the sequence number in the burst, and the data assembling means 14 assembles the burst unit based on these, and the encryption key identifier is added to the burst unit. Therefore, the decryption information extracting unit 15 extracts this, and the decryption unit 16 extracts the encryption key corresponding to this encryption key identifier from the encryption information base 20. Using this encryption key, decryption in burst units is performed, the result is decomposed, and user data to be passed to the higher-level entity is created.

[0018]

As described above, according to the present invention, since the encryption key can be changed in burst units, a third party is not exposed to a ciphertext encrypted with the same key for a long time. Further, even if one key is detected, a different key is used in the next burst, so that the damage can be suppressed to the minimum, which has the effect of providing stronger security for the transmission data.

[Brief description of drawings]

FIG. 1 is a system block diagram of an embodiment of the present invention.

FIG. 2 is a diagram showing an example of transmission data from a higher-order entity stored in a data transmission buffer shown in FIG.

3 is a diagram showing an example of burst units assembled from the transmission data shown in FIG.

FIG. 4 is a diagram showing an example of the cryptographic information base shown in FIG. 1.

FIG. 5 is a diagram showing an example of an encrypted burst unit.

FIG. 6 is a diagram showing an example of a combination of an encryption key identifier and an encrypted burst unit.

FIG. 7 is a diagram showing an example of data flowing on a communication line.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 data transmission buffer 2 transmission burst unit buffer 3 transmission encryption burst unit buffer 4 data dividing means 5 cryptographic information adding means 6 encryption means 7 burst information adding means 8 data transmitting / receiving means 9 burst assembling means 10 cryptographic information base 11 data receiving buffer 12 reception burst unit buffer 13 reception encryption burst unit buffer 14 data assembling means 15 decryption information extracting means 16 decoding means 17 burst information extracting means 18 data transmitting / receiving means 19 burst dividing means 20 cryptographic information base 21 communication line

Claims (4)

[Claims] 1. When performing data transfer between terminals by a high-speed transport protocol using flow control by a burst mechanism through a local area network, flow control is performed from a data transmission buffer that stores transmission request data from a protocol stack upper entity. To construct a burst as a unit, the burst is assembled by the burst assembling means, stored in the transmission burst unit buffer, encrypted by the encryption means with the encryption key extracted from the cryptographic information base, and stored in the transmission encryption burst unit buffer. An encryption method in a high-speed transport mechanism characterized by the above. 2. The encryption method in the high speed transport mechanism according to claim 1 is used when transferring data between terminals by a high speed transport protocol using flow control by a burst mechanism via a local area network. At this time, in order to notify the other party of the encryption key used for encryption, the encryption information adding means fetches the encryption key identifier corresponding to the encryption key predetermined between the communicating parties from the transmission encryption burst unit buffer. After the burst unit is added to the head and the burst unit is divided into transmission frames of fixed length by the data dividing means, the burst information adding means indicates the burst to which the divided frame belongs Information about the sequence number of the In addition, the encryption method in the high-speed transport mechanism is characterized in that the encrypted data is transmitted to the communication line via the data transmission / reception means. 3. The encryption method in the high speed transport mechanism according to claim 1 or 2 when transferring data between terminals by a high speed transport protocol using flow control by a burst mechanism through a local area network. The data frame encrypted by using the data frame, transmitted through the communication line, and received by the data transmission / reception means is
When the burst identifier and the sequence number in the burst are extracted, the data assembling unit assembles the burst unit based on the burst identifier and the sequence number in the burst. An encryption method in a high-speed transport mechanism, wherein an identifier is taken out and the burst unit other than the encryption key identifier is stored in a reception encryption burst unit buffer. 4. The encryption method in the high speed transport mechanism according to claim 1, wherein when performing data transfer between terminals by a high speed transport protocol using flow control by a burst mechanism via a local area network, The decryption means extracts the encryption key corresponding to the extracted encryption key identifier from the encryption information base by using the encryption key to decrypt the burst unit by using the encryption key and stores the decrypted burst unit in the reception burst unit buffer. An encryption method in a high-speed transport mechanism, characterized in that it is stored, divided by a burst division means according to a length requested by an upper entity of a protocol stack, and stored in a data reception buffer.