JP3672517B2 - Communication device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a communication apparatus, and is suitable for application to, for example, securing confidentiality of communication on a network without performing encryption based on a complicated algorithm.
[0002]
[Prior art]
Conventionally, various encryption technologies such as a common key system and a public key system exist as methods for ensuring the confidentiality of communication on a network, and the progress has been remarkable.
[0003]
With such encryption technology, operations based on algorithms for encryption and decryption are performed at the time of encryption for converting plaintext to ciphertext on the transmission side and at the time of decryption for converting ciphertext received on the reception side to plaintext. By doing so, encryption and decryption are performed to increase the confidentiality of communication.
[0004]
[Problems to be solved by the invention]
However, in order to counter such advances in encryption technology, since the third party has also advanced the decryption technology for intercepting the ciphertext on the network and decrypting it into plaintext, the conventional encryption technology However, it is not always possible to secure the confidentiality of communication, and it cannot be said that it is sufficiently safe.
[0005]
On the other hand, conventionally, even if a communication means capable of setting a plurality of Paths such as ATM (Asynchronous Transfer Mode) is used, only one of a plurality of candidate Paths is set when communication is started. Select only one path to perform communication, and even in a network environment based on IP (Internet Protocol) etc., the data transmission path has a special situation such as a communication failure in the transmission path. Unless specified, it is set using a fixed communication path.
[0006]
Therefore, if the decryption technology is superior to the encryption technology used for communication, a malicious third party who monitors only one place on the network and uses the decryption technology for the ciphertext obtained therefrom. Therefore, there is a possibility that it can be decoded relatively easily.
[0007]
Furthermore, in order to execute encryption and decryption algorithms and perform encryption and decryption, it is not only necessary to be equipped with hardware and software functions for that purpose, but also usually a huge amount of operations. However, it may be sent to the network as plain text without using the conventional encryption technology, but in that case, it is extremely difficult by a third party who monitors only one place on the network. Since the entire contents of communication are easily known, it is equivalent to no secrecy.
[0008]
[Means for Solving the Problems]
In order to solve this problem, the first present invention Communication equipment In a communication device that transmits a series of continuous signal sequences to higher layers to multiple lines , The signal sequence is divided into each component signal, and each component signal obtained by dividing is divided according to a predetermined distribution procedure. each Equipped with distribution means to distribute to the line , Minutes Distribution method is While establishing a plurality of transport connections in the transport layer in OSI between the first communication terminal and the second communication terminal, Based on the load information of each line , So that each transport connection uses a physically different line Communication path Dynamically For multiple lines corresponding to the determined communication path, In OSI Using the network layer communication path selection function , Each element signal is distributed. Further, the second invention Communication equipment Then, each element signal constituting a signal series having a series of meanings that are continuous for the upper layer is received by a communication device that receives from a plurality of lines. Essential By synthesizing an elementary signal according to a predetermined synthesis procedure , Has a synthesis means to restore the issue series , Go The creation means While establishing a plurality of transport connections in the transport layer in OSI between the first communication terminal and the second communication terminal, Based on the load information of each line , OSI Network layer Each of the transport connections is dynamically determined to use a physically different line. Multiple corresponding to communication paths Times Distributed to the line Each Multiple element signals Times It is characterized by receiving via a line.
[0009]
DETAILED DESCRIPTION OF THE INVENTION
(A) Embodiment
Embodiments of a communication apparatus according to the present invention will be described below.
[0010]
A feature common to the first to fourth embodiments is that, when communicating a series of continuous data series, each data constituting the data series is communicated using a separate line. It is in the point which can improve the secrecy of communication, without depending on encryption technology.
[0011]
The first embodiment mainly uses a physical layer of an OSI (Open System Interconnection) reference model.
[0012]
The physical layer is a layer directly connected to a physical communication line, and performs conversion of electrical signals and conversion of transmission speed.
[0013]
(A-1) Configuration of the first embodiment
An example of the overall configuration of the communication system of the present embodiment is shown in FIG.
[0014]
In FIG. 5, the communication system includes communication terminals 10 and 11 and a network 12. Here, the communication terminal 10 is operated by the user U1, and the communication terminal 11 is operated by the user U2.
[0015]
The communication terminals 10 and 11 are terminals that perform communication via the network 12. The communication may be two-way communication, but here, in order to simplify the description, mainly one-way communication is performed in which the communication terminal 10 is a transmission source terminal and the communication terminal 11 is a transmission destination terminal. The case will be described.
[0016]
Among these, an example of the internal configuration of the main part of the communication terminal 10 is as shown in FIG.
[0017]
In FIG. 1, the communication terminal 10 includes an input / output terminal 101, a disassembly / assembly unit 121, and communication lines 131 to 13N (N is a natural number of 2 or more).
[0018]
The disassembly / assembly unit 121 and the communication lines 131 to 13N are components belonging to the physical layer that is the first layer of the OSI reference model. Therefore, in the present embodiment, physically, N lines are set for one communication performed by one communication terminal 10. In order to improve confidentiality, the larger the value of N, the better. However, in general, as the number of physical lines increases, the cost of communication increases, so it is not always practical to employ a very large value. At least, if N = 2, effective confidentiality can be obtained, but FIGS. 5 and 6 show the case of N = 3.
[0019]
The input / output terminal 101 shown in FIG. 1 may be a terminal used when the communication terminal 10 receives transmission data DL1 from the outside. Here, a logical protocol interface is shown here. That is, the input / output terminal 101 is an interface between the second data link layer and the first physical layer of the OSI reference model, and supplies the transmission data DL1 from the data link layer to the disassembly / assembly unit 121 belonging to the physical layer. This is the part used when
[0020]
In principle, the transmission method of the physical layer is set regardless of the upper data link layer. For example, when ATM is used in the data link layer, the physical layer has SONET (synchronous optical link). Fiber network) is often used.
[0021]
The disassembly / assembly unit 121 belonging to the physical layer is a part for disassembling and assembling physical unit data, which is unit data (PDU: protocol data unit) used in the physical layer, and when transmitting to the lines 131 to 13N, the physical unit data And a disassembling function for disassembling physical unit data when received from the lines 131 to 13N.
[0022]
This point is different from other OSI reference models and network architectures other than the OSI reference model in which each layer has a clear contrast relationship with the OSI reference model (for example, ATM reference model, TCP / IP (Transmission Control Protocol)). / Internet Protocol) protocol system, etc. In particular, when it is generally expressed so as to apply to the layer corresponding to the transmission control function below the transport layer of the OSI reference model, when transmitting to the lines 131 to 13N, In order to accommodate data link unit data which is unit data (PDU) of the upper layer data link layer, physical unit data is assembled and sent to the communication lines 131 to 13N, and vice versa. When physical unit data is received from the lines 131 to 13N, it is input from the communication lines 131 to 13N. The physical unit data to decompose the retrieve data link unit data can be described as the retrieved data link unit data outputted from the input-output terminal 101.
[0023]
However, the physical layer of the OSI reference model does not have a function of distinguishing a data series as a group having a structure such as a frame or a cell, and the data series is recognized as a mere bit stream. Therefore, the physical unit data is a bit.
[0024]
Therefore, the assembly corresponds to an operation of converting data link unit data into a bit stream (or an operation of recognizing the data as a bit stream), and the decomposition is performed so that the data link unit data can be generated from the bit stream. This corresponds to the operation of taking out
[0025]
The assembly function of the disassembly / assembly unit 121 includes a distribution function that distributes the assembled physical unit data to the communication lines 131 to 13N. Various procedures can be used as a specific procedure for realizing the distribution function. For example, the round robin method of switching the destination line in order according to a fixed order set in advance, the white noise pseudo-randomness in the switching order (however, this randomness must be reproducible) Can be used, and an evaluation value method that sets an evaluation value and selects an evaluation value that is high (or low) can be used. However, in this embodiment, for simplicity of explanation The simplest round robin method shall be adopted.
[0026]
The last digit of the codes 131 to 13N assigned to the communication lines 131 to 13N is taken out and is prefixed with C as a physical line number for uniquely specifying each communication line. The physical line number of the distribution destination in the robin method is a simple repetition of C1, C2, C3, C1, C2, C3, C1, C2, C3, C1,... (The first may not necessarily be C1, The order may not be the order of C1->C2-> C3).
[0027]
The disassembling function as opposed to the assembling function includes a collecting function for collecting each physical unit data to be disassembled from each of the communication lines 131 to 13N. As a specific procedure of the collecting function, a round robin method, a random method, an evaluation value method, and the like, which are the same as the procedure of the sorting function, can be used. However, the procedure of the collecting function that is executed when the communication terminal 10 becomes the receiving side needs to correspond to the procedure of the distribution function of the communication terminal 11 that becomes the transmitting side at that time.
[0028]
Therefore, for example, when the procedure of the distribution function of the communication terminal 11 is a random method, the procedure of the collection function of the communication terminal 10 is also a random method, and detailed procedures in each random method on the transmission side and the reception side are also included. It needs to be perfectly consistent.
[0029]
On the other hand, the network 12 connecting these communication terminals 10 and 11 may be basically in any form. However, in the case of this embodiment, the network 12 corresponds to a WAN, an internetwork, a public line network, or the like, which is an aggregate of a plurality of LANs, and does not include a normal LAN.
[0030]
In the case of an IEEE 802.3 LAN, a bus topology is generally used, and the number of physical lines (that is, the number of buses) in one LAN is one, and the one physical line (transmission) This is because the medium is connected to all communication terminals in the LAN.
[0031]
Since conventional communication is executed using one line, which is physically and logically set between the communication terminals 10 and 11 on the network 12, the line is, for example, 131 in FIG. In this case, the third party UX can intercept the data series DS1 transmitted by the communication terminal 10 at an arbitrary point PX on the 131 without any omission. If the data series is not encrypted, the meaning of the data series DS1 can be decrypted immediately by using a decryption technique when the data series is encrypted.
[0032]
When the network 12 is, for example, a WAN or an internetwork, the line 131 is often set via a third LAN different from the LAN to which the communication terminal 10 belongs and the LAN to which the communication terminal 11 belongs. The third party UX can also intercept all of the data series DS1 on the third LAN.
[0033]
This embodiment prevents such interception.
[0034]
Note that the internal configuration of the communication terminal 11 facing the communication terminal 10 via the network 12 may be the same as in FIG. Further, when the communication terminal 10 is a terminal dedicated to transmission, the communication terminal 11 may be a terminal dedicated to reception.
[0035]
The operation of the present embodiment having the above configuration will be described below.
[0036]
(A-2) Operation of the first embodiment
Each physical unit data assembled by the disassembly / assembly unit 121 in the communication terminal 10 of the present embodiment, that is, the order immediately after the assembly of the transmission bits, as shown in FIG. , D3,..., DM,..., The physical unit data is received in this order (normal reception order) and processed, and only meaningful information for the user (U2 or UX) is obtained.
[0037]
However, in the present embodiment, the communication terminal 10 is physically provided with a plurality of communication lines 131 to 13N, and the disassembly and assembling unit 121 distributes physical unit data. The normal reception order is not established.
[0038]
For example, when N = 3 and distribution according to the round robin method described above is performed, the physical unit data series sent to the communication lines 131 to 133 is as shown in FIG. That is, the physical unit data series DS11 transmitted on the communication line 131 with the physical line number C1 is D1, D4, D7,..., And the physical unit data transmitted on the communication line 132 with the physical line number C2 The sequence DS12 is D2, D5, D8,..., And the physical unit data sequence DS13 transmitted on the communication line 133 with the physical line number C3 is D3, D6, DM (here, M = 9),. It is.
[0039]
Therefore, even if the third party UX attempts to intercept the communication at the point PX on the line 131, the information obtained from it is only the physical unit data D1, D4, D7,... Corresponding to the physical unit data series DS11. And physical unit data D2, D5, D8,... Corresponding to the physical unit data series DS12 and physical unit data D3, D6, D9,. Since two-thirds of the data required for decryption does not physically exist, the third party UX knows the content of communication between the communication terminals 10 and 11 no matter what decryption technology is applied. Is almost impossible.
[0040]
The lines 131 to 133 used here are physical lines, but it is not always necessary to use the entire line capacity only for communication between the communication terminals 10 and 11. Physical unit data by communication between other communication terminals (not shown) may be transmitted along with the physical unit data D1, D4, D7, etc. on the line (for example, 131). Rather, it is considered preferable to do so in terms of improving confidentiality.
[0041]
On the other hand, in the communication terminal 11 which is a legitimate receiving terminal that has received the physical unit data series DS11, DS12, DS13 from the respective lines 131-133, finally, all the data transmitted on the lines 131-133 have been transmitted. The physical unit data series DS11, DS12, DS13 can be received. Then, the received physical unit data D1 and the like are collected by a procedure opposite to the sorting procedure performed by the communication terminal 10 on the transmission side, and the original data series shown in FIG. 6A is restored.
[0042]
Note that the arrival order of each physical unit data to the communication terminal 11 may vary depending on the difference in physical length (propagation distance) of each line 131 to 133 and the difference in traffic density (for example, In the case where the physical unit data D2 may arrive earlier than the physical unit data D1, for example, a sequence number indicating the transmission / reception order (corresponding to the normal reception order) is given as physical unit data in advance. In addition, the received physical unit data (D1 and the like) is once stored in the communication terminal 11, and then a rearrangement function or the like for taking out in accordance with the order of the sequence numbers is required. It is realized at a higher hierarchy than the physical layer.
[0043]
Data that receives the original data series shown in FIG. 6A from the disassembling / assembling unit 121 via the input / output terminal 101 (however, this is a data series before rearrangement) via the input / output terminal 101 inside the receiving communication terminal 11 In the layers above the link layer, the processing in each layer is performed, and finally the contents of communication can be transmitted to the authorized user U2.
[0044]
(A-3) Effects of the first embodiment
According to the present embodiment, it is possible to improve the confidentiality of communication without using a conventional encryption technique.
[0045]
(B) Second embodiment
Below, only the point from which this embodiment is different from 1st Embodiment is demonstrated.
[0046]
Although the first embodiment mainly uses the physical layer, this embodiment mainly uses the data link layer.
[0047]
The data link layer is a layer that performs transmission control between adjacent nodes via a line. When the network 12 is a dedicated line, the adjacent node of the communication terminal 10 becomes the communication terminal 11, so that end-to-end transmission control (error detection and retransmission) can be executed in this hierarchy.
[0048]
As an example, basic procedures, HDLC (High-level Data Link Control) procedures, and the like are also classified into this hierarchy.
[0049]
(B-1) Configuration and operation of the second embodiment
Basically, FIGS. 5 and 6 can be used as they are in this embodiment. However, the meaning of each part in the figure is different from that of the first embodiment corresponding to the difference between the physical layer and the data link layer.
[0050]
FIG. 2 shows a configuration example of main parts of the communication terminals 10 and 11 of the present embodiment. Since the configurations of the communication terminals 10 and 11 may be the same, the description will be given mainly assuming that the communication terminal 10 is shown in FIG.
[0051]
2, the communication terminal 10 includes a frame generation / decomposition unit 221, a route determination / sort unit 222, and Layer 1 units 231 to 23N that are components corresponding to the physical layer of the OSI reference model. .
[0052]
Among them, the frame generation / disassembly unit 221 is a component corresponding to the disassembly / assembly unit 121, but generates (assembles) data link unit data belonging to the data link layer instead of the physical unit data belonging to the physical layer. Or disassembling / disassembling part 121 is different from disassembling / assembling part 121. Unlike the physical layer, this data link layer has a function of distinguishing data series as a group having a structure such as a frame or a cell. Depending on the function of the data link layer, the frame size can be made variable.
[0053]
Here, for the sake of simplicity, the data link unit data is a frame.
[0054]
The frame generation / assembly unit 221 belonging to the data link layer is a part for disassembling and assembling frames as unit data used in the data link layer, and an assembling function for assembling frames when transmitting to the lines 131 to 13N. And a disassembling function for disassembling the frames when received from the lines 131 to 13N.
[0055]
When transmitting to the lines 131 to 13N, the frame is assembled so as to accommodate the network unit data, which is the unit data of the upper layer (here, the network layer) received via the input / output terminal 201. The assembled frame is sent to the route determination / sorting unit 222. Conversely, when receiving from the lines 131 to 13N, the frame input from the route determination / sorting unit 222 is disassembled to extract network unit data. The extracted network unit data is output from the input / output terminal 201.
[0056]
These functions are almost the same as those of the first embodiment except that the frame and physical unit data (bits), the network unit data and the data link unit data are respectively replaced.
[0057]
If one network unit data cannot be accommodated in one frame, the network unit data is divided at the time of assembly, and each part of the divided network unit data is accommodated in a plurality of frames. As described above, when one network unit data is accommodated by being divided into a plurality of frames, the receiving communication terminal 11 that has received the frame receives the frame decomposition performed by the frame generation / decomposition unit 221 in the communication terminal 11. After that, it is possible to restore one network unit data by joining the divided parts.
[0058]
In addition, the distribution function included in the assembly function and the collection function included in the disassembly function in the first embodiment are the frame generation / decomposition unit 221 in this embodiment. The route determination / sorting unit 222, which is a separate component, is assigned. Accordingly, when the route determination / sorting unit 222 sorts the frames, the round robin method, the random method, the evaluation value method, and the like described above can be used as in the first embodiment.
[0059]
If each unit data D1, D2, D3,... In FIG. 6A is a frame, and each frame is distributed to each Layer 1 unit 231 to 23N according to a round robin method similar to that of the first embodiment, for example, 6A and 6B are also explanatory diagrams of the present embodiment as they are.
[0060]
Each Layer 1 part (for example, 231) of this embodiment is physically different from the disassembly / assembly part 121 of FIG. 1 showing the structure of Layer 1 (ie, physical layer) of the first embodiment. In the case of the Layer 1 unit 231, it is connected only to the line 131).
[0061]
That is, the line 131 is connected to the Layer 1 unit 231, the line 132 is connected to the Layer 1 unit 232,..., And the line 13 N is connected to the Layer 1 unit 23 N.
[0062]
When these Layer 1 units 231 to 23N transmit to the lines 131 to 13N, each line connected after the physical layer processing of the OSI reference model is performed on the frame received from the route determination / sort unit 222 When the physical unit data is transmitted to 131 to 13N and received from the lines 131 to 13N, the opposite process is performed.
[0063]
As described above, the value of N is at least as long as N = 2, and the effect of this embodiment can be obtained.
[0064]
Each frame, which is unit data of the data link layer, includes information such as a transmission destination address indicating the destination of each frame and a transmission source address indicating the transmission source in addition to the sequence number described in the first embodiment. Since it can also be given, it becomes possible to perform flexible processing that could not be executed in the physical layer.
[0065]
Thereby, for example, even when the number of physical lines 131 to 13N connected to the communication terminal 10 that is the transmission source of the frame is different from that of the communication terminal 11 that is the transmission destination, the communication can be performed flexibly.
[0066]
However, the processing of the sequence number and the like is mainly a function of a higher layer than the data link layer.
[0067]
As described above, even in the present embodiment, even if the third party UX attempts to intercept communication at the point PX on the line 131, the information obtained therefrom is the frames D1, D4 corresponding to the frame sequence DS11. , D7,..., And frames D2, D5, D8,... Corresponding to the frame sequence DS12 and frames D3, D6, D9,. It is almost impossible to know the contents of communication between the communication terminals 10 and 11.
[0068]
Note that the frame, which is unit data of this embodiment, is larger in size than the physical unit data (bits) of the first embodiment and contains more information, so the frame size (particularly the highest level application) It is preferable from the viewpoint of improving the confidentiality that the amount of user data brought from the layer in one frame is as small as possible. If the user data accommodated in one frame is large, for example, assuming a communication application with a small amount of information such as an e-mail containing only plain text, the entire contents of one e-mail (or most contents) This is because there is a high possibility that the secrecy is weakened by being completely accommodated in one frame.
[0069]
Therefore, it is desirable to determine how much frame size to use (in particular, setting of the upper limit value of the frame size) according to the communication application used in the upper layer.
[0070]
(B-2) Effects of the second embodiment
As described above, in this embodiment, an effect equivalent to the effect of the first embodiment can be obtained.
[0071]
In addition, in this embodiment, it is possible to increase the flexibility of communication.
[0072]
Thus, for example, even when the number of physical lines (131 to 13N) connected to the communication terminal (10) that is the transmission source of the frame is different from that of the communication terminal (11) that is the transmission destination, the communication can be performed flexibly. Is possible.
[0073]
(C) Third embodiment
In the following, only the differences of the present embodiment from the (first and second) embodiments will be described.
[0074]
This embodiment mainly uses a network layer.
[0075]
(C-1) Configuration and operation of the third embodiment
Basically, FIGS. 5 and 6 can be used as they are in this embodiment. However, the meaning of each part in the figure is different from that of the second embodiment in correspondence with the difference between the data link layer and the network layer.
[0076]
A configuration example of the main part of the communication terminals 10 and 11 of the present embodiment is shown in FIG. Since the configurations of the communication terminals 10 and 11 may be the same, the description will be given mainly assuming that the communication terminal 10 is shown in FIG.
[0077]
In FIG. 3, the communication terminal 10 includes an input / output terminal 301, a route determination / sort unit 321, a route selection unit 322, and a Layer 2 / component that is a component corresponding to the physical layer and the data link layer of the OSI reference model. 1 part 331-33N.
[0078]
Among these, the Layer 2/1 units 331 to 33N are portions corresponding to the Layer 1 units 231 to 23N of the second embodiment, but have not only a physical layer function but also a data link layer function.
[0079]
The route determining / sorting unit 321 is a part that executes the sorting and collecting for packets that are unit data of the network layer.
[0080]
Although it is possible to ensure confidentiality even if a method similar to the second embodiment (round robin or the like) is used for this distribution, in this embodiment, the network layer routing (communication path selection) function is provided. Perform the control used.
[0081]
That is, the route selection unit 322 also includes load information (for example, information indicating the size of the free bandwidth of each router on the route) input from the Layer 2/1 units 331 to 33N. The communication path is dynamically determined, and the one that can realize the communication path as determined from the Layer 2/1 units 331 to 33N is selected.
[0082]
For this selection, it is desirable to select at least two of the Layer 2/1 sections 331 to 33N, rather than selecting one. This is because if only one is selected, confidentiality is reduced.
[0083]
Therefore, for example, when there is a congested portion on the line 132 connected to the Layer 2/1 unit 322, the route determination / sort unit 321 performs the distribution so as to avoid the Layer 2/1 unit 322. Is executed. Even if it does not reach the congestion state, the same operation can be performed at a high frequency if it reacts to a slight load fluctuation. In order to execute such processing, in this embodiment, N is preferably 3 or more.
[0084]
Since the fluctuation of the load is a dynamic event that is difficult to predict, this makes it possible to obtain extremely high confidentiality.
[0085]
The fact that the load fluctuation is a dynamic event means that the selection performed by the route selection unit 322 is not reproducible, and therefore the receiving communication terminal 11 performs correct reception corresponding to the normal reception order. It is necessary to use the above-described sequence number or the like.
[0086]
In the present embodiment, when the route selection unit 322 performs route selection, for example, it is possible to utilize route information exchanged on the network 12 for OSPF (Open Shortest Path First).
[0087]
(C-2) Effects of the third embodiment
According to this embodiment, it is possible to obtain an effect equivalent to the effect of the second embodiment.
[0088]
In addition, in this embodiment, since the communication path is determined using the load information that is a dynamic event, it is possible to further improve confidentiality.
[0089]
Furthermore, if a communication path with a small load is selected using the load information, there is an advantage that the possibility that high-quality communication can be performed at high speed for the communication (communication between U1 and U2) increases. The network (12) as a whole also has an advantage that the occurrence of a congestion state can be prevented beforehand by load distribution.
[0090]
(D) Fourth embodiment
In the following, only the differences of the present embodiment from the (first, second) and third embodiments will be described.
[0091]
This embodiment mainly uses a transport layer.
[0092]
The transport layer is a layer that performs re-transmission control, flow control, and the like in an end-to-end manner in addition to the order control performed using the sequence numbers described above. That is, in the transport layer, it is possible to use a connection type communication form that could not be used below the network layer. As a communication form of the transport layer, for example, connectionless type communication such as UDP can be performed, but here, connection type communication such as TCP is performed.
[0093]
In connection-type communication, an overhead for establishing and releasing a connection is generated, so the communication speed is lower than that of connectionless communication, but high communication reliability is guaranteed.
[0094]
(D-1) Configuration and operation of the fourth embodiment
Basically, FIGS. 5 and 6 can be used as they are in this embodiment. However, the meaning of each part in the figure corresponding to the difference between the network layer and the transport layer is different from that of the third embodiment.
[0095]
FIG. 4 shows a configuration example of main parts of the communication terminals 10 and 11 of the present embodiment. Since the communication terminals 10 and 11 may have the same configuration, FIG. 4 will be described mainly assuming that the communication terminal 10 is shown.
[0096]
4, the communication terminal 10 includes an input / output terminal 401, a packet generation / decomposition unit 421, a route determination / sort unit 422, a link establishment unit 423, a physical layer of the OSI reference model, a data link layer, and Layer 3/2/1 units 431 to 43N which are components corresponding to the network layer.
[0097]
Among these, the Layer 3/2/1 units 431 to 43N are portions corresponding to the Layer 1 units 331 to 33N of the third embodiment, but have not only the functions of the physical layer and the data link layer but also the function of the network layer. .
[0098]
The packet generation / decomposition unit 421 corresponds to the frame generation / decomposition unit 221 described in the second embodiment, but is different in that it generates and decomposes packets instead of frames. However, since the packet here is a packet as unit data in the transport layer, for example, when the segment concept is used in the transport layer, such as the TCP / IP protocol system, it is necessary to replace the packet with a segment. There is.
[0099]
The route determination / sorting unit 422 is a part corresponding to the route determination / sorting unit 321 of the third embodiment, and is a part that executes the sorting and collection for packets that are unit data of the transport layer. is there.
[0100]
The link establishment unit 423 connected to the route determination / sort unit 422 and the Layer 3/2/1 units 431 to 43N establishes the connection (that is, the logical link) between the communication terminal 10 and the communication terminal 11. The part that connects the release.
[0101]
The connection is established by assigning a port (logical communication port possessed by the transport layer) so that both communication terminals 10 and 11 can receive the data series DS11 to DS13 transmitted by the other party at any time. Freed by collecting. Since it is necessary for both communication terminals 10 and 11 to perform port assignment and release almost simultaneously, exchange of control signals is required.
[0102]
Furthermore, in the case of this embodiment, it is necessary to simultaneously establish a plurality of connections between the communication terminals 10 and 11 in order to improve confidentiality. In addition, since the connection (transport connection) established in the transport layer is logically inherent, when it is left to the network 12, there is no guarantee that a logically different connection is set using a physically different line. Absent. In many cases, when the same communication occurs at the transmission source communication terminal 10 and the transmission destination communication terminal 11 almost at the same time, it is considered that the router routes the communication to use the same physical line. Because.
[0103]
Therefore, here, in order to ensure that a plurality of connections to be established at the same time are established using physically different lines, the Layer 3/2/1 units 431 to 43N are provided, and the different connections are different Layer 3/2/1. It is made to establish via the part 431-43N.
[0104]
In this embodiment, since connection management is used, the number of connections can be changed during communication, and the number of connections used for each packet type can be changed. It becomes possible. However, in order to increase or decrease the number of connections, a new connection must be established or a connection in use must be released, and the above-described control signal needs to be exchanged between the communication terminals 10 and 11, which is necessary for exchange of control signals. It is necessary to execute it while taking into account the transition of time and data traffic volume.
[0105]
(D-2) Effects of the fourth embodiment
According to this embodiment, it is possible to obtain the same effect as that of the third embodiment.
[0106]
In addition, in the present embodiment, the number of connections can be changed during communication, and the secrecy can be further improved.
[0107]
(E) Other embodiments
As shown in the first to fourth embodiments, the present invention is realized in the lower functions (transmission control functions) of the OSI reference model, that is, in each layer of the physical layer, the data link layer, the network layer, and the transport layer. Is possible. When the functions of the present invention are realized in a certain hierarchy, the functional specifications in the hierarchy can be designed independently of the functional specifications in the other hierarchy as long as the interface between the hierarchies is provided as prescribed.
[0108]
For this reason, for example, the present invention can use all existing lines such as FDDI, Ethernet (registered trademark), ATM, ISDN, etc., as physically used lines (transmission methods). As a communication protocol, any protocol such as existing TCP / IP, PPP (Point to Point Protocol), and MP (Multilink Protocol) can be used.
[0109]
In addition, it is possible to freely determine whether to apply the present invention for each layer. For example, the present invention with high secrecy can be applied to the physical layer and the transport layer, and a normal program can be used for the data link layer and the network layer without considering secrecy.
[0110]
Furthermore, the present invention can be used in combination with existing encryption technology, compression technology, and the like. Although the present invention alone can sufficiently enhance the secrecy, a higher degree of secrecy can be expected by using an existing encryption technique together. In addition, when the compression technique cannot be normally decompressed until the original data series is gathered to some extent, a synergistic effect on the improvement of confidentiality can be expected in relation to the present invention.
[0111]
In general, in order to realize the function of each layer of the OSI reference model, it is basic to create a strictly independent program for each layer, and in fact, it is common in general-purpose machine systems. However, in the case of a personal computer or the like, at present, it is rare that a strictly independent program is created for each hierarchy mainly due to the spatial cost of the storage device.
[0112]
However, even in such a case, the present invention is applicable.
[0113]
In the first to fourth embodiments, the storage and switching network is mainly described as an example. However, the present invention can also be applied to a circuit switching network and the like.
[0114]
Moreover, in the said 1st-4th embodiment, FIGS. 1-4 was demonstrated as what is a structural example inside the communication terminals 10 and 11, However, These do not necessarily need to be the structure of a terminal. A relay device (for example, a bridge), an inter-LAN connection device (for example, a router, a gateway, or the like) may have a configuration as shown in FIGS.
[0115]
In the first to fourth embodiments, communication between the communication terminals 10 and 11 is performed using physically different lines. However, the present invention is not limited to this and is logically different. If so, the same line may be used physically.
[0116]
For example, when the connection type communication mode described above is adopted, different connections may be set on the same physical line. In this case, the secrecy is lower than that in the fourth embodiment, but normally the third party UX does not assume that the same communication is executed in parallel using different connections. Therefore, there is a possibility that sufficient confidentiality is obtained in practice.
[0117]
Further, when such a connection type communication mode is adopted, the network 12 can include a LAN.
[0118]
In general, in a LAN, CSMA / CD is used in order to take advantage of the high reliability that the transmission error is small due to a short transmission distance and the high speed (the overhead of connection establishment and release is omitted). In many cases, connectionless communication is performed using collision detection / prevention mechanisms such as (Carrier Sense Multiple Access with Collision Detection) and token passing. This is because some have a mechanism.
[0119]
In the above description, the present invention is realized mainly as software, but the present invention can also be realized as hardware.
[0120]
【The invention's effect】
As described above, according to the present invention, it is possible to improve the confidentiality of communication without using a conventional encryption technique or the like.
[0121]
Of course, if necessary, it is possible to use the present invention and a conventional encryption technique in combination, and in that case, further improvement in confidentiality can be expected.
[Brief description of the drawings]
FIG. 1 is a schematic diagram illustrating an internal configuration example of a main part of a communication terminal according to a first embodiment.
FIG. 2 is a schematic diagram illustrating an internal configuration example of a main part of a communication terminal according to a second embodiment.
FIG. 3 is a schematic diagram illustrating an internal configuration example of a main part of a communication terminal according to a third embodiment.
FIG. 4 is a schematic diagram illustrating an internal configuration example of a main part of a communication terminal according to a fourth embodiment.
FIG. 5 is a schematic diagram illustrating an example of the overall configuration of a communication system according to first to fourth embodiments.
FIG. 6 is an operation explanatory diagram of the first to fourth embodiments.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 10, 11 ... Communication terminal, 12 ... Network, 121 ... Disassembly / assembly part, 131-13N ... Communication line, 221 ... Frame generation / disassembly part, 222, 321, 421 ... Route determination / sort part, 322 ... Path selection part 421, packet generation / decomposition unit, 423, link establishment unit, D1 to DM, unit data.

Claims (2)

In a communication device for transmitting a signal sequence having a series of meanings for a higher layer to a plurality of lines,
Distributing means for dividing the signal sequence into each component signal that is a component thereof, and distributing each component signal obtained by the division to each line according to a predetermined distribution procedure,
The distributing means includes
Between a first communication terminal and the second communication terminal, it establishes a plurality of transport connection of the transport layer in the OSI (Open System Interconnection), based on the load information of each line, the transformer Dynamically determine the communication path so that each of the port connections uses the physically different lines ,
The communication device, wherein the element signals are distributed to the plurality of lines corresponding to the determined communication path by using a network layer communication path selection function in OSI . In a communication device for receiving each element signal constituting a signal series having a series of meanings that are continuous for the upper layer from a plurality of lines,
By synthesizing the received element signal according to a predetermined synthesis procedure, it comprises synthesis means for restoring the signal sequence,
The synthesis means includes
A plurality of transport connections in the transport layer in OSI are established between the first communication terminal and the second communication terminal, and the transformer in the network layer of OSI is based on the load information of each line. Each element signal distributed to a plurality of lines corresponding to a communication path dynamically determined so that each port connection uses each physically different line is received via the plurality of lines. A communication device.

Images