JPH06350597A - Synchronization establishing method for ciphering communication - Google Patents

Abstract

PURPOSE:To easily establish the synchronization of start/end of ciphering communication when the ciphering communication is executed between terminal equipments. CONSTITUTION:Terminal equipments 1 are connected by a subscriber line 2 and an exchange 3. When an equipment #1 starts ciphering communication with an equipment #2, the equipment #1 generates a random number and sends ciphered data to the equipment #2, then compares the received data from the equipment #2 with a ciphered random number and when they are equal to each other, the equipment #2 discriminates the state to be in the ciphering communication state and when not equal, the equipment #1 sends the random number again to the equipment #2. Upon the receipt of the data from the equipment #1, the equipment #2 sends ciphered received data to the equipment #1 when the state has already been in the ciphering communication state and sends the received data to the equipment #1 without any modification in the case of the plain text communication state. Upon the receipt of succeeding data, the equipment #2 compares the received data with preceding received data and when they are equal to each other, the ciphering communication state is set. When the ciphering communication is finished, the processing is almost similar to above.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for establishing synchronization when confidential communication is performed between terminal devices using a digital transmission path, and more specifically, when data information is transferred using the digital transmission path. In connection with this, the present invention relates to a method of establishing synchronization of the start and end of confidential communication, which is preferable.

[0002]

2. Description of the Related Art There is confidential communication as a security measure for digital communication. In confidential communication, the encryption algorithm used by the sender and the receiver is set to be the same in advance, the encryption key used for confidential communication is shared with each other, and the confidential communication is started or ended at a certain time. Is common.

Conventionally, in secret communication, there are FEAL, DES, etc. as an encryption algorithm to be used, and as an encryption key sharing method, a terminal-terminal key sharing method for exchanging keys between terminals and a center using a center are used. A key distribution method has been proposed (for details, refer to [1]: "Revised"
text of CD 9798-2 "Entity authenticationme
chanisms, Part 2: Entity authentication using sy
mmetric techniques "ISO / IEC / DP9798-
2: 1990 (E) ”). Further, as a method for establishing synchronization of start / end of confidential communication in communication of stream data such as voice using a digital transmission path, for example, at the start of confidential communication, the transmitting side transmits a specific bit pattern indicating the start of confidential communication, and then transmits the confidential communication. There is a method of setting the communication state, and the receiving side is set to the secret communication state if a specific bit pattern indicating the start of the secret communication transmitted from the transmitting side is detected (for example, see Japanese Patent Application No. 2-192514 “Secret communication device”). ).

On the other hand, as a method of establishing synchronization of start / end of confidential communication of data information, the unit of encryption processing of data information is a physical layer as in the case of voice information and is regarded as stream data, and the above voice information is used. A similar method of establishing synchronization has been considered.

[0005]

In the method for establishing the synchronization of the start / end of the confidential communication of the data information as described above, since the digital information itself in the physical layer is encrypted / decrypted, a bit error occurs on the transmission line. If the error occurs, it may not be possible to perform synchronization processing or error correction in the data link layer. For example, when the HDLC procedure is adopted as the data link layer protocol, frame synchronization is performed by the F pattern forming the frame.
When FEAL is used as the encryption algorithm, a 1-bit error on the transmission path expands to 64 bits as the decryption result depending on the encryption mode, and therefore the F pattern itself may be erroneous and synchronization processing at layer 2 may not be possible. . Further, when an ISDN line is used as a digital transmission line, if encryption / decryption processing is performed on the information of the physical layer of the data information, the exchange needs to interpret the contents of the information channel (for example, by packet exchange). Communication), this method is not applicable. Therefore, it is necessary to target the encryption processing of the data information to the information section of the data link layer or more (for details, refer to [2]: [Tanaka et al., ISDN.
PC expansion board for multimedia cryptographic communication, IEICE Technical Research Report, OS 91-64, 1992 "), in which case a method of establishing synchronization of cryptographic processing for stream data such as voice information cannot be adopted. Have.

The present invention is intended to solve the above problems, and an object thereof is to establish synchronization of start / end of secret communication suitable for transferring data information using a digital transmission line. It provides a method.

[0007]

In order to achieve the above object, the present invention provides a random number in the first terminal device when a secret communication is started between the first terminal device and the second terminal device. The first terminal device generates and holds the random number and its encrypted data, sets the communication state with the second terminal device to the confidential communication state, and sets the random number to the second When the received data from the second terminal device is equal to the encrypted data of the random number, the confidential communication is started, and when the data is not equal, the random number is again transmitted to the second terminal device. When the second terminal device receives the data from the first terminal device, the second terminal device determines whether the communication state with the first terminal device is a confidential communication state,
In the confidential communication state, the received data is encrypted and transmitted to the first terminal device to start the confidential communication, and when not in the confidential communication state, the received data is held and the first terminal device is kept as it is. When the data is received from the first terminal device, the received data is compared with the previous received data, and if they are equal, the communication state with the first terminal device is changed to the confidential communication state. That is, the confidential communication is started by setting to, and if they are not equal, the received data is held and transmitted to the first terminal device as it is.

Further, when the confidential communication is finished between the first terminal device and the second terminal device, a random number is generated and held in the first terminal device, and the first terminal device is held. Sets the communication state with the second terminal device to a plaintext communication state, transmits the random number to the second terminal device, and then the received data from the second terminal device is the random number. When they are equal, the confidential communication is ended, and when they are not equal, the random number is transmitted again to the second terminal device, and when the second terminal device receives the data from the first terminal device, the first terminal device receives the data. Determines whether the communication state with the terminal device is a plaintext communication state, and if it is a plaintext communication state, the received data is directly transmitted to the first terminal device to end the confidential communication.
When not in the plaintext communication state, the received data is held and the encrypted data is transmitted to the first terminal device, and thereafter, when the data is received from the first terminal device, the received data and the previous data are transmitted. The received data are compared, and if they are equal, the communication state with the first terminal device is set to a plaintext communication state to end confidential communication, and if they are not equal, the received data is held and its encrypted data Is transmitted to the first terminal device.

[0009]

When the confidential communication of the data information is started between the terminal devices, the random number A is generated in one terminal device # 1 and stored in the memory, and the random number A is encrypted and also stored in the memory. Keep it. After setting the confidential communication state, the one terminal device # 1 transmits the random number A stored in the memory to the other terminal device # 2. When the terminal device # 2 receives the data from the terminal device # 1, if the device itself is already set to the confidential communication state, the terminal device # 2 encrypts the received data and stores the encrypted data in the memory, and also stores the encrypted data. It is transmitted to the terminal device # 1. If it is still in the plaintext communication state, the terminal device # 2 stores the received data in the memory and transmits it to the terminal device # 1 as it is.

The terminal device # 1 compares the data received from the terminal device # 2 with the encrypted data of the random number A stored in the memory, and if they are equal, the terminal device # 2 enters the secret communication state. It is determined that there is, and the confidential communication starts. If they are not equal, the terminal device # 2 determines that it is in the plaintext communication state, and again transmits the random number A stored in the memory to the terminal device # 2. After that, the terminal device # 1 transmits the random number A to the terminal device # 2 until the encrypted data of the random number A becomes equal to the received data.
Repeatedly send to.

When the terminal device # 2 receives the data from the terminal device # 1, if it is already set to the confidential communication state,
The received data is encrypted and stored in the memory, and the encrypted data is transmitted to the terminal device # 2, and if it is still in the plaintext communication state as before, it is stored in the received data and the memory. The previously received data are compared, and if they are equal, it is determined that the terminal device # 1 requests confidential communication, the plaintext communication state is changed to the confidential communication state, and the received data is encrypted and stored in the memory. At the same time, the encrypted data is transmitted to the terminal device # 1. If they are not equal, the received data is transmitted to the terminal device # 1 as it is, and the process enters the loop for receiving the next data again.

When the confidential communication is ended, the random number B is generated and stored in the memory in the terminal device # 1 as well as when the confidential communication is started. After the terminal device # 1 is set to the plaintext communication state, The random number B stored in the memory is transmitted to the terminal device # 2. When the terminal device # 2 receives the data from the terminal device # 1, if the plaintext communication state is already set, the terminal device # 2 directly transmits the received data to the terminal device # 1.
When the confidential communication is still in progress, the received data is stored in the memory and the encrypted data of the received data is transmitted to the terminal device # 1.

The terminal device # 1 compares the data received from the terminal device # 2 with the random number B stored in the memory, and if they are equal, determines that the terminal device # 2 is in the plaintext communication state and ends the confidential communication. And If they are not equal, the terminal device # 2 determines that it is still in the confidential communication state, and again transmits the random number B stored in the memory to the terminal device # 2.

When the terminal device # 2 receives the data from the terminal device # 1, and is already set to the plaintext communication state,
The received data is transmitted to the terminal device 1 as it is, and if it is still in the confidential communication state as in the previous time, the received data is compared with the previously received data stored in the memory, and if they are equal, the confidential communication state is plaintext. After changing to the communication state, the received data is directly transmitted to the terminal device # 1. If they are not equal, the terminal device #
Send to 1.

According to the above-mentioned method, when the confidential communication of the data information is performed between the terminal device # 1 on one side and the terminal device # 2 on the other side using the digital transmission line, the confidential communication of the data information can be easily performed. The start / end synchronization of can be established.

[0016]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. Although ISDN is used as the digital transmission line in the description of the embodiment, it goes without saying that it can be applied to digital transmission lines other than ISDN.

FIG. 1 is a block diagram of an embodiment to which the confidential communication method of the present invention is applied. In FIG. 1, each terminal device 1 is connected to a subscriber line 2 of an ISDN basic interface, and a switching device 3 (ISDN switching device) has a plurality of I.
It accommodates the SDN basic interface subscriber line 2.
Each terminal device 1 includes an information input / output unit 11 for voice and the like, an information encryption / decryption unit 12, a synchronization establishment control unit 13, and an ISDN.
Layer 1 to layer 3 control and layer 4 of subscriber line 2
From the communication control unit 14 for performing network control of upper layers.

Here, a case will be described in which the terminal device # 1 calls the terminal device # 2 to perform confidential communication between the both terminal devices.

FIG. 2 shows a procedure (call connection procedure) in which the terminal device # 1 connected to the ISDN subscriber line 2 calls the terminal device # 2 of the communication partner to perform the circuit connection call connection. (For details, see Document [3]: “Supervised by Akiyama, IS
DN Picture and Book, pages 92-101, Ohmsha, 1988
Yearly issue "). The call connection is started by sending a message of "SETUP" (request for call setup) from the terminal device # 1 of the caller to the switching device 3. The switching apparatus 2 holds the B channel and sends the received "SETUP" message from the terminal apparatus # 1 to the terminal apparatus # 2 on the called side, which has a meaning of "CALL PRO" during the call setup process.
C "(Call Proceeding: notification during processing for call setup) is sent to the terminal device # 1 on the calling side. When calling of the called party starts," ALERT "(Alerting: notification of calling of called party) The message is sent to the caller.
Next, when the called party responds (CONN), the switching device 2 makes a "CONNACK" (Connec Acknowledge: CON).
Confirm) message corresponding to N is sent to the called party. This completes the connection of the B channel.

In plaintext communication (normal communication), if the call setup is completed in the sequence shown in FIG. 2, the terminal devices # 1 and # 2 can communicate with each other. It is necessary to synchronize the start / end of confidential communication between the terminal device # 1 and the terminal device # 2. The synchronization establishment control unit 13 of the terminal device # 1 is responsible for this control.

First, the procedure for establishing synchronization at the start of confidential communication according to the present invention will be described with reference to FIGS. In addition,
In the following description, it is assumed that the session key used for confidential communication has been delivered.

The synchronization establishment control unit 13 of the terminal device # 1 generates a random number A at the start of the confidential communication and stores it in the memory (step 301), and instructs the information encryption / decryption unit 12 to generate the random number. A is encrypted with the session key and similarly stored in the memory (step 302). Next, after instructing the communication control unit 14 to set the communication with the terminal device # 2 to the confidential communication state (step 303), the random number A stored in the memory is transmitted to the terminal device # 2 (step). 304).
After transmitting the random number A, the synchronization establishment control unit 1 of the terminal device # 1
3 monitors the reception of data from the terminal device # 2 through the communication control unit 14 (step 305).

On the other hand, the synchronization establishment control unit 13 of the terminal device # 2
Monitors the reception of data from the terminal device # 1 through the communication control unit 14 after setting up the call with the terminal device # (step 401). If data is received through the communication control unit 14, it is checked whether the communication state of the own terminal device # 2 is a confidential communication state (step 402).
Instruct the decryption unit 12 to encrypt the received data (random number A) with the delivered session key and store it in the memory,
The data is transmitted to the terminal device # 1 (step 40)
3). After that, confidential communication starts (step 404).
If the terminal device # 2 is in the plaintext communication state, the received data (random number A) is stored in the memory, and the data is transmitted to the terminal device # 1 as it is (step 405), and then the data from the terminal device # 1 is sent again. The reception of data is monitored (step 406).

When the synchronization establishment control unit 13 of the terminal device # 1 receives the data from the terminal device # 2 through the communication control unit 14 (step 305), the received data encrypts the random number A stored in the memory. It is checked whether it is equal to the converted data (step 306). If they are equal, the state of the terminal device # 2 is determined to be the confidential communication mode (step 30
7) The confidential communication is started (step 308). Also,
If they are not equal, the terminal device # 2 determines that the communication state is plaintext, and again transmits the random number A to the terminal device # 1 (step 30).
4) Monitor the reception of data from the terminal device # 2.

When the synchronization establishment control unit 13 of the terminal device # 2 receives the data from the terminal device # 1 through the communication control unit 14 (step 406), it again checks whether the communication state of the self terminal device # 2 is the confidential communication state (step 406). Step 407). In the confidential communication state, the information encryption / decryption unit 12 is instructed to encrypt the received data with the delivered session key and store it in the memory, and transmit the encrypted data to the terminal device # 1 ( Step 403). Then, the confidential communication is started (step 404). If plaintext communication is still in progress, compare the received data with the previously received data (step 4
08), if they are equal, it is determined that the terminal device # 1 requests confidential communication, and the communication state with the terminal device # 1 is set to the confidential communication state (step 409), and then the received data is set to the session key. In step S40, the data is encrypted and transmitted to the terminal device # 1 to start confidential communication (step 40).
3,404). If they are not equal, the received data is directly transmitted to the terminal device # 1 (step 410), and the process returns to step 401. That is, start over from the beginning.

Next, the procedure for establishing synchronization at the end of confidential communication according to the present invention will be described with reference to FIGS.

The synchronization establishment control unit 13 of the terminal device # 1 generates a random number B at the end of the confidential communication and stores it in the memory (step 501). Next, the communication with the terminal device # 2 is set to the plaintext communication state (step 502), and the random number B stored in the memory is passed through the communication control unit 14 to the terminal device # 2.
Send to 2. After that, the synchronization establishment control unit 13 of the terminal device # 1 that has transmitted this random number B monitors the reception of data from the terminal device # 2 (step 504).

On the other hand, the synchronization establishment control unit 13 of the terminal device # 2
Monitors the reception of data from the terminal device # 1 through the communication control unit 14 (step 601). When the data is received through the communication control unit 14, the own terminal device #
Check whether the communication state of 2 is a plaintext communication state (step 60
2) In the plaintext communication state, the received data (random number B) is directly transmitted to the terminal device # 1 (step 603), and the confidential communication is ended (step 604). In the confidential communication state, the received data (random number B) is encrypted with the delivered session key and stored in the memory, and the encrypted data is transmitted to the terminal device # 1 (step 605),
After that, the synchronization establishment control unit 13 of the terminal device # 2 enters a monitoring loop for receiving data from the terminal device # 1 (step 606).

When the synchronization establishment control unit 13 of the terminal device # 1 receives the data from the terminal device # 3 through the communication control unit 14 (step 504), the received data is the random number B stored in the memory. (Step 505). If they are equal, that is, if the received data is the random number B, it is determined that the state of the terminal device # 2 has returned to the plaintext communication mode (step 507), and the confidential communication is ended (step 508). If they are not equal, that is, if the received data is encrypted data, it is determined that the state of the terminal device # 2 is the confidential communication state, the random number B is transmitted again to the terminal device # 2 (step 503), and the terminal device # 2 is transmitted. The reception of data from the device is monitored (step 504). Thereafter, this is repeated until the received data matches the random number B.

When the synchronization establishment control unit 13 of the terminal device # 2 receives the data from the terminal device # 1 via the communication control unit 14 (step 606), the communication state of the own terminal device # 2 is again plain text communication. If it is in the plaintext communication state, the received data (random number B) is transmitted as it is to the terminal device # 1 and the confidential communication is ended (steps 603 and 604). If not in plain text communication, the received data is compared with the previously received data (step 60).
8) If they are equal, it is determined that the terminal device # 1 requests the end of confidential communication, the communication state is set to the plaintext communication state (step 609), and the received data is directly transmitted to the terminal device #.
1 to end the confidential communication (steps 603, 6).
04). If they are not equal, the received data is encrypted with the delivered session key and stored in the memory, and the data is transmitted to the terminal device # 1 (step 61).
0), and returns to step 601.

3 to 6 show the procedure in the case where the terminal device # 1 takes the initiative and establishes the synchronization of the start / end of confidential communication, but the terminal device # 2 takes the initiative at all. It is the same.

[0032]

As described above, according to the present invention, it is possible to easily establish the synchronization of the start / end of confidential communication when performing confidential communication of data information between terminal devices using a digital transmission line. You can

[Brief description of drawings]

FIG. 1 is a block diagram showing an embodiment of a communication system to which a confidential communication method of the present invention is applied.

FIG. 2 is a diagram showing an example of a call setting sequence between terminal devices.

FIG. 3 is a diagram showing a procedure example of one terminal device for establishing synchronization at the start of confidential communication according to the present invention.

FIG. 4 is a diagram showing a procedure example of the other terminal device for establishing synchronization at the start of confidential communication according to the present invention.

FIG. 5 is a diagram showing a procedure example of one terminal device for establishing synchronization at the end of confidential communication according to the present invention.

FIG. 6 is a diagram showing a procedure example of the other terminal device for establishing synchronization at the end of confidential communication according to the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Terminal device 2 Subscriber line 3 Switching device 11 Information input / output unit 12 Information encryption / decryption unit 13 Synchronization establishment control unit 14 Communication control unit 15 Voice information input unit

Claims (2)

[Claims] 1. A method for establishing synchronization when performing confidential communication between terminal devices, wherein when the confidential communication is started between the first terminal device and the second terminal device, a random number is generated in the first terminal device. Is generated and holds the random number and its encrypted data, the first terminal device sets the communication state with the second terminal device to the confidential communication state, and the random number is set to the second random number. When the received data from the second terminal device is equal to the encrypted data of the random number, confidential communication is started, and if not equal, the random number is again transmitted to the second terminal device. When the second terminal device receives the data from the first terminal device, the second terminal device determines whether the communication state with the first terminal device is a confidential communication state. Encrypt received data and send it to the first terminal device If you send it and start confidential communication, and it is not in confidential communication status,
The received data is held and transmitted to the first terminal device as it is, and when the data is received from the first terminal device after that, the received data and the previous received data are compared, and if they are equal, The confidential communication is set to the communication state with the first terminal device to start the confidential communication, and if they are not equal, the received data is held and transmitted to the first terminal device as it is. Method for establishing synchronization of confidential communication. 2. The method for establishing synchronization of confidential communication according to claim 1, wherein when the confidential communication is finished between the first terminal device and the second terminal device, a random number is generated in the first terminal device. The first terminal device holds the random number, sets the communication state with the second terminal device to a plaintext communication state, transmits the random number to the second terminal device, and then, If the received data from the second terminal device is equal to the random number, the confidential communication is terminated, and if the data is not equal, the random number is transmitted again to the second terminal device, and the second terminal device is When the data from the first terminal device is received, it is determined whether the communication state with the first terminal device is the plaintext communication state, and if it is the plaintext communication state, the received data is directly transmitted to the first terminal device. If confidential communication is terminated and plaintext communication is not available If the received data is held, the encrypted data is transmitted to the first terminal device, and then when the data is received from the first terminal device, the received data is compared with the previous received data. If they are equal, the communication state with the first terminal device is set to the plaintext communication state to end the confidential communication, and if they are not equal, the received data is held and the encrypted data is transferred to the first terminal device. The method for establishing synchronization of secret communication is characterized by transmitting to a terminal device of.