JP3005490B2 - Apparatus and method for securing data security by inter-HUB data encryption - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus and method for securing data security by inter-HUB data encryption, and more particularly to inter-HUB data encryption for protecting data confidentiality by performing data encryption in communication between HUBs and HUBs. And a method and apparatus for ensuring data security.

[0002]

2. Description of the Related Art Conventionally, packet communication includes connection-type packet communication and connectionless packet communication. In the case of connection-type packet communication, communication is started in the following procedure. That is, connection of a communication line (phase 1), data link setting and establishment (phase 2),
Transmission of information or message body (phase 3).

However, in the case of connectionless packet communication, communication starts immediately from phase 3.

[0004] In general, a network includes a plurality of sub-networks connected to each other. However, when this sub-network can be connected by an unspecified third party such as a general public telephone line or a public telephone network. Cannot protect confidentiality.

[0005] For this reason, in a network connection device when a subnetwork connects to another subnetwork, data encryption is performed when a packet to be transmitted passes through a range where security cannot be secured.

More specifically, when communication is performed using connectionless packets, in a network connection device installed at a place where a plurality of sub-networks are connected, the transmission side network connection device first selects a transmission path of the received packet. When the transmission path passes through a range that cannot be secured, the data relating to the network layer of the packet is encrypted, and a network connection device located outside the range is set as a new destination as the final destination of the encrypted data. It is sent in a packet.

Next, when receiving the encrypted data, the receiving-side network connecting device decrypts the data and sends it to the terminal device at the final destination in a normal packet configuration. For example, Japanese Patent Application Laid-Open No. 6-69962 discloses a conventional technique for securing such communication confidentiality.

[0008]

However, the above-described conventional method has the following problems. That is, the first problem is that since the object of encryption is limited to connectionless packet communication, confidentiality cannot be maintained when performing connection packet communication.

The reason is that there is still a possibility of security leakage when a packet passes through a range that cannot be secured, whether connection-oriented or connectionless.

A second problem is that it is necessary to store in advance a range that cannot be secured for each transmission route.

[0011] The reason is that the network configuration is not permanent, and the number of subnets may increase or the route may be changed in the middle. This is because it is impossible to memorize everything.

An object of the present invention is to secure data security by encrypting data in HUB-to-HUB communication.

An object of the present invention is to improve data reliability by ensuring data security.

That is, in HUB-to-HUB communication, data encryption is performed without depending on the type of communication protocol and without being affected even when the network configuration is changed, thereby improving data reliability. An object of the present invention is to provide an apparatus and a method for ensuring data security by inter-HUB data encryption.

[0015]

SUMMARY OF THE INVENTION An apparatus and method for securing data security by inter-HUB data encryption according to the present invention are:
When a packet is received from a terminating device directly connected to the UB, regardless of whether the packet is connection type or connectionless type, look at the destination terminating device of the packet,
An encryption determining unit that determines whether a packet should be encrypted, an encryption and decryption processing unit, and means that encryption was performed immediately after the destination address and source address of the packet when encryption was performed. Is set to ON, and if there is information necessary for decryption, an encapsulation unit for encapsulating the encrypted data after adding the information is provided. When a packet is received not from the device but from the outside, first, it is determined whether or not the destination physical address of the packet is a terminating device directly connected to the HUB. To determine whether the packet is encrypted data, and if the packet is encrypted data,
A decryption unit that transmits a packet to a terminating device that is directly connected to the final destination of the data after the decryption; When a packet is received from a terminating device that refers to the destination physical address and it is a packet to be encrypted, the packet is encrypted and transmitted after the next part of the destination and source physical address part of the packet. If the packet is not to be encrypted, the packet is sent as it is without encryption.If the packet has no information on whether to encrypt or not, the packet is encrypted beforehand. HU characterized by sending a confirmation packet and performing automatic discrimination
A method for securing data security by encrypting data between B.

[0016]

Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing an embodiment of an apparatus and method for securing data security by inter-HUB data encryption according to the present invention.

Referring to FIG. 1, at the time of packet transmission, first, the interface 6 receives a packet transmitted from a terminating device directly connected to the HUB 1 and passes it to the packet management unit 2.

The packet management unit 2 passes the received packet to the encryption determining unit 3 and determines whether to perform encryption.

If encryption is to be performed, the data is encrypted by the encryption and decryption processing unit 4.

Thereafter, the encapsulation unit 5 encapsulates the data including the encrypted data, and sends the packet from the packet management unit to the destination via the interface 6.

Next, the processing at the time of packet reception will be described.

When the HUB 1 receives a packet through the interface 6, the packet is first passed to the packet management unit 2.

The packet management unit 2 hands over the received packet to the encryption judgment unit 3 in order to confirm whether or not the packet has been encrypted.

When the encryption judging section 3 judges that the received packet has been encrypted, it transfers it to the encryption / decryption processing section 4.

Thereafter, the decrypted packet is transmitted to the destination of the packet through the interface 6.

Next, the operation of the embodiment of the present invention will be described in detail with reference to FIG. 2, FIG. 3, FIG. 4, and FIG.

FIG. 2 is a configuration diagram showing a configuration of a packet to be transmitted to a destination after encapsulation is performed in the apparatus and method for securing data security by inter-HUB data encryption according to the present invention. FIG. 3 is a flowchart showing an operation at the time of transmitting a packet in the apparatus and method for securing data security by inter-HUB data encryption according to the present invention. FIG. 4 shows the HU of the present invention.
FIG. 3 is a configuration diagram showing a configuration of a packet before encapsulation in a data security ensuring device and method by inter-B data encryption. FIG. 5 is a configuration diagram of a network.

The HUB 17 is a directly connected terminating device 1
8 is regarded as a transmission request packet, and a packet received from the terminal device 21 not directly connected is regarded as a received packet.

Terminator 1 to which HUB 17 is directly connected
A process when a packet to be transmitted to the network 20 from the network 8 is received will be described with reference to FIG.

The HUB 1 that has received the packet via the interface 6 transfers the received packet from the interface 6 to the packet management unit 2 (step S).
1).

The packet management unit 2 transfers the received packet to the encryption determining unit 3. The encryption determining unit 3 refers to the destination physical address 13 of the packet and determines whether the packet is registered in the destination list to be encrypted. It is checked whether the destination IP address is on the destination list to be encrypted (step S2).

If it has been registered, the process proceeds to the next encryption / decryption processing unit 4, that is, "performs encryption" (step S3).

If the destination physical address has not been registered, it is checked whether or not the destination physical address is registered in the destination list not to be encrypted (step S6). If the packet has been registered, the packet is transmitted from the packet management unit 2 to the destination via the interface 6 without performing encryption (step S5).

If the destination physical address 13 is not registered in the destination list that does not perform encryption, the following processing is performed to determine whether or not to encrypt.

That is, a confirmation packet is transmitted to the destination terminal device as to whether or not encryption is supported (step S7). If a reply (ACK) packet is returned, it is assumed that encryption is supported,
The destination is registered in the destination list to be encrypted, and the process proceeds to the next encryption / decryption processing unit 4 (step S8).

If an acknowledgment (ACK) packet is not returned, the destination is registered in a destination list that does not perform encryption.
The packet is transmitted without encryption, that is, "added to the destination list without encryption" (step S9).

The encryption / decryption processing section 4 encrypts the transmission data 16 from the packet type 15 and proceeds to the encapsulation section 5 (step S3). Note that the actual encryption method is not particularly limited.

The encapsulation unit 5 performs encapsulation by turning on the encrypted data 12, the encryption information 11 necessary for decryption, and the encryption flag 9 (step S4).
Here, information necessary for decryption (for example, a key, a packet length, and the like required for decryption) is fetched as Length 10 of encrypted information with a length added at the beginning.

Next, a process for receiving a packet from the terminating device 21 not directly connected to the HUB 17 will be described with reference to FIG.

When a packet is received by the interface 6, the packet is passed to the packet management unit 2.

The packet management unit 2 delivers the received packet to the encryption judgment unit 3, where it checks whether the received packet is encrypted.

That is, referring to the encryption flag 9 portion of the packet, if the encryption flag 9 is ON, the packet is transferred to the encryption / decryption processing section 4 because the packet has been encrypted.

The encryption / decryption processing unit 4 first passes the packet to the encapsulation unit 5 and converts the encapsulated packet into the encrypted data Le, which is the encrypted data part.
ngth10, encrypted information 11, encrypted data 12,
The physical address portion is divided into a destination physical address 7 and a source physical address 8.

Subsequently, the encrypted data portion is decrypted.

Here, at the time of decryption, the encryption information 11 added to the encapsulated packet and required at the time of decryption is required. That is, a key, a packet length, and the like required for decryption are extracted from the encrypted information 11 for the Length 10 of the encrypted information, and the encrypted data 12 is decrypted using the key and the like.

A packet that has been completely reassembled after the completion of all decoding processing is transmitted to the destination terminating device in its original form.

[0048]

As described above, in the apparatus and method for securing data security by inter-HUB data encryption according to the present invention, the first effect is that the communication means such as connection type or connectionless type is completely unconscious. That is, the data can be encrypted. As a result, data confidentiality can be maintained irrespective of communication means.

The reason is that the present invention can encrypt data without depending on communication means of connection type or connectionless type.

The second effect is that data can be encrypted by automatically detecting whether or not the packet destination supports encryption regardless of the network configuration.

The reason for this is that the present invention does not consider the network configuration at all, and a function for automatically confirming whether or not the destination of a packet supports the encryption function without user setting. It is because it has.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an embodiment of an apparatus and method for securing data security by inter-HUB data encryption according to the present invention.

FIG. 2 is a configuration diagram showing a configuration of a packet to be transmitted to a destination after encapsulation in the data security ensuring device and method by inter-HUB data encryption of the present invention.

FIG. 3 is a flowchart showing an operation at the time of transmitting a packet in the apparatus and method for securing data security by inter-HUB data encryption according to the present invention;

FIG. 4 is a configuration diagram showing a configuration of a packet before encapsulation in the apparatus and method for securing data security by inter-HUB data encryption according to the present invention.

FIG. 5 is a configuration diagram of a network.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 HUB 2 Packet management part 3 Encryption judgment part 4 Encryption and decryption processing part 5 Encapsulation part 6 Interface

──────────────────────────────────────────────────続 き Continued on the front page (58) Field surveyed (Int.Cl. ⁷ , DB name) H04L 12/56 H04L 9/36 H04L 12/22

Claims (2)

(57) [Claims] 1. When a packet is received from a terminating device directly connected to a HUB, regardless of whether the packet is a connection type or a connectionless type, the physical address of the destination terminating device of the packet is checked and “encryption” is performed. Should be done
If the destination physical address is registered in the
In this case, determine that the packet is to be encrypted, or
The destination physical address corresponding to the destination list
If the password is registered, the password should not be encrypted.
Packet, and if both destination physical
If there is no address, support encryption to the destination terminating device.
Sends a confirmation packet as to whether
If it comes, assume that it supports encryption
Encrypt after registering in "List of destinations to be encrypted"
Judge that it is a packet that should be
If it does not come, register it in "List of destinations without encryption"
Go and determine that the packet should not be encrypted
An encryption determining unit, an encryption / decryption processing unit, and a flag, which means that encryption was performed immediately after the destination address and the source address of the packet when performing encryption, is set to ON, and decryption is performed. If there is information necessary for the encryption, it is provided with an encapsulation unit for encapsulating the encrypted data after adding it, and a packet is received from outside instead of the terminal device directly connected to the HUB. trough a case, it is determined whether the terminating device first destination physical address of the packet is directly connected to a HUB, which was encrypted by the above-mentioned encryption determination unit when connected directly
Check the meaning of the flag.
It is determined that the data is not
Transmits the packet to the connected terminating device,
If the flag is ON, it is determined that the data is encrypted.
A data security assurance device for inter-HUB data encryption, wherein a packet is transmitted to a terminal device directly connected to a HUB which is a final destination of data after decryption. 2. When the HUB receives a packet from a terminating device directly connected thereto, the HUB refers to the destination physical address, and when the corresponding destination physical address is registered in the “list of destinations to be encrypted”. Indicates that the packet should be encrypted, and "List of destinations without encryption"
If the destination physical address is registered in
If it is determined that the packet should not be encrypted, and if there is no corresponding destination physical address, a packet confirming whether encryption is supported is sent to the destination terminating device, and a reply is returned. If it is, it is assumed that encryption is supported and "List of destinations to be encrypted"
If it is determined that the packet is to be encrypted after registering it, and if no reply is returned, it should be registered in the "List of Destinations Not Encrypted" and should not be encrypted. Is determined, and if the packet is to be encrypted, the packet after the next part of the destination and source physical address portions of the packet is all encrypted, and a flag indicating that encryption has been performed is set to ON. If there is information necessary for decryption, add the information and encapsulate the encrypted data, send the packet, and if it is determined that the packet should not be encrypted, When the packet is transmitted as it is without encryption, and when the HUB receives the packet from outside instead of the directly connected terminal device, first, the destination physical address of the packet is set to HU. It is determined whether or not the terminal device is directly connected to the terminal. If the terminal device is directly connected, the flag indicating that the above-described encryption has been performed is confirmed. Then, the packet is sent to the terminating device directly connected to the HUB which is the final destination of the data, and if the flag is ON, it is determined that the data is encrypted data, and the data is decrypted. A method for securing data security by inter-HUB data encryption, wherein a packet is transmitted to a terminating device directly connected to a final destination HUB.