JP2002064482A - Encryption apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an encryption apparatus for reducing the amount of scrap of received data and preventing the capacity of the whole network from being reduced. SOLUTION: The encryption apparatus comprises a receiving section 1 for receiving data from the outside, a transmitting section 2 for transmitting the data to the outside, an encryption control section 5 for making a judgment whether the encrypting of the data received from the receiving section is necessary or not based on the address from which the data is transmitted or the address to which the data is transmitted, an encryption section 6 for encrypting the data, which the encryption section 5 judges to be encrypted, by the use of one encryption mode of a plurality of encryption modes and for outputting the encrypted data to the transmitting section 2, and a load control section 7 for monitoring the encrypting load of the encryption section 6 and changing the encryption mode of the encryption section 6 according to the encrypting load.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an encryption processing device for encrypting data received from one side and transmitting it to the other side.

[0002]

2. Description of the Related Art In recent years, for the purpose of security of data communication, an encryption processing device is arranged near a computer terminal, data transmitted from the computer terminal is subjected to encryption processing, and encrypted data is transmitted. The encrypted data received by the terminal may be subjected to decryption processing and received as normal data. In the cryptographic processing device used in such a case, it is determined whether or not to perform cryptographic processing on the data based on the source address and the destination address of the data. That being done is done.

[0003]

However, in the conventional cryptographic processing apparatus, complicated calculations are required for the cryptographic processing, so that the load of the cryptographic processing becomes large, and the processing of data received one after another may not be performed in time. there were. If the next data is received before the encryption of the previously received data is completed, the subsequent data is discarded and the data source has to send the data over the network again. . In order to cope with this, there is a buffer provided, and data is stored in the buffer and processed sequentially. However, when data is received one after another, the buffer overflows if the processing is not in time, and the overflowed data is received. Is discarded, and data transmission is performed again. As a result, there is a problem that the performance of the entire network using the cryptographic processing device as one node may be reduced.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and an object of the present invention is to provide a cryptographic processing apparatus for reducing discard of received data and preventing a reduction in overall network performance. An object of the present invention is to provide an encryption processing method and a recording medium on which a program for executing the method is recorded.

[0005]

In order to solve the above-mentioned problems, in a cryptographic processing apparatus according to the present invention, a receiving unit for receiving data from the outside, a transmitting unit for transmitting data to the outside, A plurality of encryption control units that determine whether encryption processing is necessary based on the source address or the destination address of the data received from the unit, and data that the encryption control unit determines that encryption processing is required. And a cryptographic processing unit that performs cryptographic processing using one of the cryptographic methods and outputs data of the processing result to the transmission unit. A load control unit for changing the encryption method of the encryption processing unit according to the load is provided.

It is preferable that the load control unit changes the encryption method of the encryption processing unit to a lighter encryption method when the load of the encryption processing in the encryption processing unit is high. Here, the high load means that if the processing is continued as it is, more data is received than data to be transmitted, and all data cannot be processed. Refers to a case where there is a risk of being destroyed.

In addition, the encryption control unit is provided with a type determination unit that determines the type of data and determines whether encryption processing is necessary based on the type. The type determination unit performs encryption processing on the data determined to require encryption processing. It may be output to a unit. The type refers to an attribute representing characteristics of the data itself, such as application software to which the data is applied and the type of the data. In this case, it is more preferable that the type determination unit instructs the encryption processing unit to perform the encryption process using the encryption method corresponding to the type.

On the other hand, between the receiving section and the encryption control section,
A buffer unit for temporarily storing received data,
A priority control unit may be provided for assigning a priority to data stored and stored in the buffer unit, and the encryption control unit may determine whether encryption processing is necessary based on the data having the higher priority. .

Further, a display unit for displaying an encryption system used for the encryption processing of the encryption processing unit may be provided. Further, the display unit may display information regarding encryption processing other than the encryption method.

[0010] In the encryption processing method of the present invention,
The method further comprises the step of monitoring the load of the encryption processing operation and changing the encryption method of the encryption processing unit according to the load. In addition, the step of controlling the load and changing the encryption method is performed when the load of the encryption processing is high.
It is preferable to change the encryption method to an encryption method with a lighter load.

In the step of determining whether or not the encryption processing is necessary,
It is also preferable to provide a step of judging the type of data and judging the necessity of encryption processing based on the type. In this case,
It is more preferable that the step of performing the encryption process performs the encryption process using an encryption method corresponding to the determined type.

On the other hand, after the step of receiving data,
A step of temporarily storing and storing the received data; and a step of assigning priorities to the stored and stored data. It may determine whether processing is necessary.

Further, the recording medium of the present invention is characterized in that a program for executing the above-mentioned encryption processing method is recorded.

[0014]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A first embodiment of a cryptographic processing apparatus according to the present invention will be described with reference to FIGS. FIG. 1 is a block diagram showing a configuration example of the cryptographic processing device of the present invention, and FIG. 2 is a perspective view showing an appearance of the cryptographic processing device. FIG. 3 is a flowchart for explaining the overall operation of the cryptographic processing device of the present invention. FIG. 4 is a flowchart illustrating another example of the operation of changing the encryption method of the encryption processing device of the present invention.

In FIG. 1, the cryptographic processing apparatus includes a receiving section 1, a buffer section 2, a packet processing section 3, a transmitting section 4, a cryptographic control section 5, a cryptographic processing section 6, a load control section 7, a priority control section 8, Statistical information collection unit 9, display control unit 10, display unit 11
Is configured to pass data from a specific source address or data to a specific destination address, and further, among them, data from a specific source address or data to a specific destination address. It is transmitted after being encrypted. Therefore, there are three types of data: data that cannot pass through the cryptographic processing device, data that passes through the cryptographic processing device without being encrypted, and data that passes through the cryptographic processing device after being encrypted.

The receiving section 1 has a connector and receives external data through a signal line connected to the connector. The received data is plaintext data that is not encrypted and whose contents can be grasped as it is, for example, in the form of a packet. Upon receiving the data, the receiving unit 1 outputs the data to the buffer unit 2.

The buffer section 2 temporarily stores received data and is composed of a readable and writable memory. When the buffer unit 2 receives the data,
Store data at the end of the queue. By providing the buffer unit 2, even if the next data is received before the encryption processing of the previous data is completed, the next data can be accumulated and stored, thereby preventing the data from being discarded.

The packet processing unit 3 extracts data from the head of the queue of the buffer unit 2 and determines whether or not the data can be passed through the cryptographic processing device. The packet processing unit 3 outputs to the encryption control unit 5 data from a specific source address or data to a specific destination address that is permitted to pass through the cryptographic processing device in the buffer unit 2 and permits the data to pass through the cryptographic processing device. Discard the data for other data that you do not want. The relation between the source address or the destination address of the data and the necessity of passing is provided with a separate setting table, and the packet processing unit 3 judges by referring to the table.

The encryption control unit 5 determines whether or not data to be passed through the encryption processing device is subjected to encryption processing, and includes an address determination unit 5a and a type determination unit 5b.

The address judging section 5a judges whether or not the data needs to be encrypted based on the source address or the destination address of the data. Data which does not require the encryption processing is output to the transmission section 4 as it is. Then, data that needs to be encrypted is output to the type determination unit 5b.
A setting table is provided separately for the relationship between the source address or the destination address of the data and the necessity of the encryption processing, and the address determination unit 5a determines the relation with reference to the table.

The type judging section 5b judges the type of data and judges necessity of encryption processing based on the type. The type may be a type of application software corresponding to the data, such as a specific word processor or a specific image processing software, or may be a data type such as text data or image data. In the present embodiment, the type of application software corresponding to the data is used as the type. The type determination unit 5b outputs the data determined not to require the encryption processing based on the data type to the transmission unit 4 as it is, and performs the encryption processing on the data determined to require the encryption processing based on the data type. Output to the unit 6. At this time, the type determination unit 5b instructs the encryption processing unit to perform the encryption process using the encryption method corresponding to the type. Specifically, the type determination unit 5b instructs, for example, to perform encryption processing on the data corresponding to the application software P using the encryption method X, and to apply the encryption method Y on the data corresponding to the application software Q. To perform encryption processing. The relationship between the type, the necessity of encryption processing, and the encryption method is as follows.
A setting table is provided separately, and the type determining unit 5b makes a determination with reference to the table.

The necessity of encryption processing is determined by the type of data by the type determination unit 5b, so that when the encryption processing is unnecessary depending on the type of data, the unnecessary encryption processing is not performed. The load of the cryptographic processing operation can be reduced. In other words, even among the data uniformly determined to require encryption processing by the address determination unit 5a,
Depending on the type of data, there is a case where there is no need to perform the encryption processing. By omitting the encryption processing of these data, the load of the encryption processing operation can be reduced. In addition, the type determination unit 5b instructs the encryption processing unit to perform the encryption process according to the type of encryption, so that the encryption strength can be selected according to the type. This makes it possible to increase the efficiency of the encryption process.

The encryption processing unit 6 is capable of performing encryption processing using a plurality of encryption methods such as a single DES method and a triple DES method, and converts the data received from the encryption control unit 5 into an encryption code designated by the type determination unit 5b. It is encrypted by a method. However, the encryption processing unit 6 may also be designated by the load control unit 7 to be described below with an encryption method, and when the encryption method is designated by the load control unit 7, the encryption processing unit 6 is not given priority over the designation. It is. The encryption processing unit 6 outputs the encrypted data to the transmission unit 4 via the encryption control unit 5.

The load control unit 7 monitors the load of the encryption processing operation of the encryption processing unit 6 and changes the encryption method of the encryption processing unit 6 according to the load. When the load of the cryptographic processing operation is higher than the predetermined load threshold A, the load control unit 7 instructs the cryptographic processing unit 6 to change the encryption method to another encryption method with a lighter load. do. The load threshold may be any value that represents the load on the cryptographic processing unit 6, but in the present embodiment, the load threshold is the number of unprocessed data stored in the buffer unit 2.

More specifically, the load control unit 7 detects the number of data in the queue of the buffer unit 2 and stores and stores the data to such an extent that the data is likely to overflow from the queue of the buffer unit 2. If the encryption processing has been performed, it is determined that the encryption processing operation has a high load. For example, when data is stored in 80% of the queue of the buffer unit 2, the load control unit 7
The load is equal to or more than the load threshold A and is determined to be high. When the load control unit 7 determines that the cryptographic processing operation has a high load, the load control unit 7 issues an instruction to the cryptographic processing unit 6 to change the cryptographic method of the cryptographic processing unit 6 to a cryptographic method with a lighter load. . For example, the encryption control unit 7 instructs a change to the encryption method X with a lighter load when the encryption processing unit 6 is going to perform the encryption processing using the encryption method Y.

The priority control unit 8 assigns a priority to the data stored and stored in the buffer unit 2, and controls the data so that the data with the higher priority is at the head of the queue. It is. In this case, the priority control unit 8 may store the data in the queue again so that the data is physically arranged in the priority order in the memory, or an index indicating the priority is assigned to the data. The packet processing unit 3 may be provided separately and take out the data in the order of priority indicated by the index so that the data is logically arranged in the order of priority. The priority control unit 8 determines a priority based on a data protocol, corresponding application software, a file type, a destination address, a source address, and the like.

The statistical information collecting unit 9 collects various kinds of statistical information such as the number of times each encryption method is used, the number of times the encryption method is changed, and the encryption method currently being processed, for the encryption methods processed by the encryption processing unit 6. Things.

The display control unit 10 displays the statistical information collected by the statistical information collecting unit 9 and the encryption method currently being processed by the display unit 11.
Is output to Specifically, the display control unit 10
As shown in FIG. 2, the statistical information is output to the liquid crystal display unit 11a of the display unit 11 and is visualized as character or graphic information.
The encryption method currently being processed is output to the LED display unit 11b of the display unit 11. The LED display section 11b has a plurality of L
An ED is provided, and a lighting pattern indicates an encryption system.

Next, the operation of the cryptographic processing apparatus configured as described above will be described with reference to FIG.

First, the receiving unit 1 receives data in a packet format (step S101), and stores the received data in the buffer unit 2. At this time, the priority control unit 8 assigns a priority to the stored data (step S101). Then, the packet processing unit 3 extracts the data with the highest priority from the queue of the buffer unit 2 and determines whether or not the data can be passed based on the source address and the destination address ( Step S102).

When the packet processing unit 3 determines that the data can be passed, it outputs the data to the encryption control unit 5. In the encryption control unit 5, first, the address determination unit 5a
Determines from the source address and destination address of the data whether encryption processing is necessary (step S103), and the data determined not to require encryption processing is transmitted as it is (step S1).
12). On the other hand, data determined to require encryption
The data is output to the type determination unit 5b, and based on the type of data, it is determined whether encryption processing is necessary (step S10).
4). Specifically, in the present embodiment, the necessity of encryption processing is determined based on application software corresponding to data. Then, the data determined not to require the encryption processing is transmitted as it is (step S1).
12), the data determined to require encryption processing is output to the encryption processing unit 6, and the type determination unit 5b specifies the encryption method and instructs the encryption processing unit 6 (step S10).
5 to S107).

Next, the load control unit 7 controls the current encryption processing unit 6
After monitoring the load of the cryptographic processing in step (1) and confirming the current cryptographic method (step S108), the cryptographic method Y having a high processing load is designated as the cryptographic method, and the load of the cryptographic processing operation is reduced to a predetermined load threshold A In the case of a high load as described above (step S109), the encryption processing unit 6 is instructed to change the encryption method Y to the encryption method X with a lighter load (step S110), and the load of the encryption processing operation is reduced. If the load is less than the predetermined load threshold A, the encryption method is not changed. Further, even when the encryption method X with a light load is specified as the encryption method, the process is continued without changing the encryption method (step S108).

The encryption processing unit 6 encrypts the data based on the encryption method specified as described above (Step S).
111), and outputs the encrypted data to the transmission unit 4 via the encryption control unit 5. The transmitting unit 4 transmits the data to the outside (step S112), and a series of operations is completed. This operation is repeatedly performed. However, a series of flows from step S102 to step S112 are performed one by one continuously, but data reception processing (step S101)
Is performed separately from the above series of flows.

In the above description, the encryption method is not particularly changed when the load of the encryption processing operation is light. However, as shown in FIG. (S113, S114). In this case, when the load on the cryptographic processing device is light, there is an advantage that it is possible to transmit data that has been subjected to stronger encryption.

In the cryptographic processing apparatus and the cryptographic processing method configured as described above, when the load is increased and data is likely to overflow from the buffer unit 2, the cryptographic processing unit 6
In this case, the encryption method is changed to one with a lighter load, so that data overflow can be prevented, data can be prevented from being discarded, and the performance of the entire network using the cryptographic processor as one node can be reduced. Can be prevented.

It should be noted that the cryptographic processing device of the present invention is not limited to the above-described one, and it is needless to say that various changes can be made without departing from the scope of the present invention.

[0037]

According to the present invention, the load control unit monitors the load of the cryptographic processing operation of the cryptographic processing unit. And
Since the encryption method of the encryption processing unit is changed according to the load,
There is an effect that an encryption method corresponding to a load situation can be used.

According to the second aspect of the invention, when the load of the encryption processing in the encryption processing unit is high, the load control unit changes the encryption method of the encryption processing unit to an encryption method with a lighter load. Therefore, it is possible to prevent the data from being discarded due to the overload of the cryptographic processing operation, and to prevent the performance of the entire network from being deteriorated.

According to the third aspect of the present invention, the encryption control unit is provided with a type determination unit for determining the type of data and determining whether or not encryption processing is necessary based on the type. Is output to the cryptographic processing unit, so that when the cryptographic processing becomes unnecessary depending on the type of data, the unnecessary cryptographic processing is not performed, thereby reducing the load of the cryptographic processing operation. This has the effect that it can be performed.

According to the fourth aspect of the present invention, since the encryption processing unit performs encryption processing using an encryption method corresponding to the type determined by the type determination unit, the encryption strength can be appropriately set for each data type, and the efficiency can be improved. By performing the cryptographic processing in an efficient manner, there is an effect that the load of the cryptographic processing operation can be reduced.

According to the fifth aspect of the present invention, the priority control unit assigns priorities to the data stored and stored in the buffer unit, and the encryption control unit determines whether the data having the higher priority is required for the encryption process. Since the determination is made as to whether or not the data is high, it is possible to more quickly process and transmit the data having the higher priority.

According to the present invention, the display unit displays the encryption method used for the encryption processing of the encryption processing unit, so that the user can visually confirm the current encryption method and use the encryption processing device. This makes it easy to check for malfunctions.

According to the seventh aspect of the present invention, a step of monitoring the load of the encryption processing operation and changing the encryption method of the encryption processing unit according to the load is provided. There is an effect that can be used.

In the invention according to claim 8, the step of controlling the load and changing the encryption method includes changing the encryption method to a lighter encryption method when the load of the encryption processing is high. Therefore, it is possible to prevent the data from being discarded due to the overload of the cryptographic processing operation, and to prevent the performance of the entire network from decreasing.

According to the ninth aspect of the present invention, in the step of determining whether or not the encryption processing is required, the type of the data is determined.
A step is provided for determining whether or not encryption processing is necessary depending on the type. When encryption processing is not required depending on the type of data, the unnecessary encryption processing is not performed, thereby reducing the load on the encryption processing operation. It has the effect that it can be done.

According to the tenth aspect of the present invention, in the step of performing the encryption processing, the encryption processing is performed by the encryption method corresponding to the determined type, so that the encryption strength can be appropriately set for each data type and the encryption can be efficiently performed. By performing the processing, there is an effect that the load of the encryption processing operation can be reduced.

According to the eleventh aspect of the present invention, after the step of receiving data, a step of temporarily storing the received data, and a step of assigning a priority to the stored data. The step of determining whether encryption processing is necessary determines the necessity of encryption processing from the high-priority data, so that high-priority data can be processed and transmitted more quickly. Play.

According to the twelfth aspect of the present invention, the recording medium is read and executed by a computer or the like,
The effects of the invention according to any one of claims 7 to 11 are achieved.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating an example of a configuration of a cryptographic processing device according to the present invention.

FIG. 2 is a perspective view showing the appearance of the cryptographic processing device of the present invention.

FIG. 3 is a flowchart illustrating an example of a cryptographic processing method according to the present invention.

FIG. 4 is a flowchart showing another example of the encryption processing method of the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Receiving part 2 Buffer part 4 Transmitting part 5 Encryption control part 5b Type determination part 6 Encryption processing part 7 Load control part 8 Priority control part 11 Display part

Claims (12)

[Claims] 1. A receiving unit for receiving data from the outside, a transmitting unit for transmitting data to the outside, and a necessity of encryption processing of the data based on a source address or a destination address of the data received from the receiving unit. An encryption control unit for determining, and an encryption unit for performing encryption processing on data determined to require encryption processing by one of a plurality of encryption systems and outputting data of a processing result to a transmission unit. A processing unit;
An encryption processing device comprising: a load control unit that monitors a load of an encryption processing operation of an encryption processing unit and changes an encryption method of the encryption processing unit according to the load. 2. The method according to claim 1, wherein the load control unit changes the encryption method of the encryption processing unit to an encryption method with a lighter load when the load of the encryption processing in the encryption processing unit is high. 2. The encryption processing device according to 1. 3. The encryption control unit further includes a type determination unit that determines the type of data and determines whether encryption processing is necessary based on the type. The type determination unit encrypts the data determined to require encryption processing. The cryptographic processing device according to claim 1, wherein the output is outputted to a processing unit. 4. The cryptographic processing apparatus according to claim 3, wherein said cryptographic processing unit performs cryptographic processing using a cryptographic method corresponding to a type determined by said type determining unit. 5. A buffer unit for temporarily storing received data between the receiving unit and the encryption control unit, and a priority control for assigning a priority to data stored and stored in the buffer unit. 5. The encryption processing device according to claim 1, wherein the encryption control unit determines whether encryption processing is necessary based on the data having the higher priority. 6. The cryptographic processing apparatus according to claim 1, further comprising a display unit for displaying a cryptographic system used for cryptographic processing of said cryptographic processing unit. 7. Receiving data from outside,
A step of determining whether or not encryption processing of the data received from the receiving unit is required based on the source address or the destination address of the data; A cryptographic processing method comprising the steps of: performing cryptographic processing using one of the cryptographic methods; and transmitting data of a processing result; monitoring a load of the cryptographic processing operation; And a step of changing the encryption method. 8. The method according to claim 1, wherein the step of monitoring the load and changing the encryption method changes the encryption method to a lighter encryption method when the load of the encryption processing is high. 7. The encryption processing method according to 7. 9. The method according to claim 7, wherein the step of judging the necessity of the encryption processing includes a step of judging the type of data and judging the necessity of the encryption processing based on the type. 8. The encryption processing method according to 8. 10. The encryption processing method according to claim 9, wherein in the encryption processing step, encryption processing is performed by an encryption method corresponding to the determined type. 11. A step of temporarily storing and storing received data after the step of receiving data, and a step of assigning a priority to the stored and stored data, wherein the necessity of the encryption processing is determined. 11. The encryption processing method according to claim 7, wherein the step of determining whether encryption processing is necessary is determined based on the data having the higher priority. 12. 12. A recording medium recording a program for executing the encryption processing method according to claim 6. Description: