JPS61236238A - Method for transferring key - Google Patents

Abstract

PURPOSE:To prevent interception of ciphered talking information by transferring the ciphered communication information through a channel, transferring a key required for decoding through a common line signal line to separate the transfer route for a message and the key. CONSTITUTION:A sender exchange 1 ciphers the communication information and the result is transferred to an incoming exchange 7 via channels 18, 19 set by link by link. Further, the key required for decoding is transferred from the exchange 1 to the exchange 7 in a way of end-to-end via common line signal paths 15-17 and a signal relay station 12. Then the talking information from a terminal device 13 is ciphered at a deciphering device 2i by using the key and transferred to the exchange 7 via a channel switch 3, the channel 18, an exchange 6 and the channel 19. The ciphered communication information is decoded by a deciphering device 9i via the channel switch 8 by using the key and the result is transferred to a terminal 14. Further, the talking information from the terminal 14 is ciphered by the deciphering device 9i by using the key, transferred to the exchange 1 and decoded by a deciphering device 2i by the key and the result is transferred to the terminal device 13.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Application of the Invention] The present invention relates to a key transfer method in encrypted communication for protecting communication information.

[Background of the invention]

When encrypting communication information, it is important to manage the encryption key for encrypting communication information and the decryption key for decoding ciphertext. The encryption method is described in Nikkei Electronics Magazine, October 1, 1982.
As detailed in ``Exploring the effectiveness of encryption against computer crimes'' on pages 117 to 155 of the Japanese issue, there are common key cryptosystems in which the encryption key and decryption key are the same, and symmetric key cryptography in which the encryption key and decryption key are There are different public key cryptosystems.

If communication information within the network is to be encrypted at the entrance and decrypted at the exit to prevent wiretapping and falsification of communication information within the network, it is preferable for safety to use a common key encryption method that changes the key for each call. However, with common key cryptography, it is necessary to transfer the key required for decryption, and protection of this key is an important issue.

Key transfer methods include in-channel transfer via a communication path in the same way as communication information, and methods in which communication information is transferred via a communication path and keys are transferred as part of address information via a common line signal path. There are possible ways.

However, in the former case, both the encrypted communication information and the key can be obtained by observing a single communication path, so there is a high risk of eavesdropping. In the latter case, the encrypted communication information and the key are sent through respective routes, so eavesdropping is thought to be more difficult than in the former case. However, since the address information is transferred link-by-link, the encrypted communication information and key are transferred to each exchange that relays the communication information.

Therefore, there is an inconvenience that there are many opportunities for eavesdropping at each relay exchange.

[Purpose of the invention]

An object of the present invention is to provide a key transfer method that safely transfers a key in a common key cryptosystem within a communication network and prevents eavesdropping on encrypted communication information.

[Summary of the invention]

In the present invention, encrypted communication information is transferred over a communication path,
By transmitting the key necessary for decryption over a common signal path,
Separate message and key transfer routes. Then, the call path between the originating exchange and the destination exchange is set to link-to-link, and the key is transferred end-to-end to the destination exchange.

[Embodiments of the invention]

Hereinafter, one embodiment of the present invention will be described with reference to the drawings.

The figure is a block diagram of a communication system to which an embodiment of the method of the present invention is applied, in which 1 and 6.7 are exchanges, 2.9 is a group of night alarms,
3 and 8 are communication path switches, and 4 and 10 are central control units 5.
11 is a common line signaling device, 12 is a signal relay station, 13.14
is a terminal, 15 to 17 are common signal paths, and 18 and 19 are speech paths.

Next, an example in which exchange 1 and exchange 7 perform encrypted communication via exchange 6 will be described.

The night code device group 2 and the night code device group 9 are composed of a plurality of night code devices, and each night code device is installed corresponding to the subscriber line of each terminal. In the figure, the terminal 13 is connected to the night code machine 21, and the terminal 14 is connected to the night code machine 91.

A call from a terminal 13 connected to the exchange 1 to a terminal 14 is recognized by the central control device 4, and according to instructions from the central control device 4, the cryptographic device 21 independently uses a common key encryption system using random numbers. Determine the key. The key is protected by a protection function that cannot be read by anyone including the central control unit 4.

In response to this call, the path of the communication path switch 3 is set according to the instructions from the central control device 4, and the path of the communication path 18 and the cipher 2 are set.
1 is connected and the number of call path 18.

Address information including the own address, the number of the terminal 13, and the number of the terminal 140 is transmitted to the common line signal device 5, the common line signal path 15,
The signal is transferred to the exchange 6 via the signal relay station 12 and the common line signal path 16. In the exchange 6, a call path between the call path 18 and the call path 19 is set, and address information including the number of the call path 19, the address of the exchange 1, the terminal 130 number, and the number of the terminal 14 is transferred to the common line signal path 16 and the signal relay. It is transferred to the exchange 7 via the station 12 and the common line signal path 17.

The central control unit ji1o, which has received the address information via the common line signaling device 11, sets a path for the communication path switch 4, connects the communication path 19 and the dark signal device 91, and connects the communication path 19 to the dark signal device 91.
In order to obtain the key set in , the address information exchanger 1
A key transfer request with the own address and the number of the terminal 15 attached to the exchange 1 is transferred to the common line signal path 17 via the common line signal device 11. This key transfer request is sent to the exchange 1 via the signal relay station 12 and the common line signal path 15.
will be forwarded to.

Upon receiving the key transfer request, the common line signaling device 5 retrieves the previously determined key from the encryptor/decoder 21 using the received number of the terminal 16, and transfers the key from the central processing unit 4 to the terminal 14 using the number of the terminal 13.
0 number is obtained, and the key and the number of the terminal 14 are transferred to the common line signal path 15 to the exchange 7 that received the call. The key and the number of the terminal 14 are transferred to the exchange 7 via the signal relay station 12 and the common line signal path 17. Common line signaling device 17 that received the key
sets a key in the encryptor/decryptor 91 based on the received number of the terminal 14. The key set in the secret code device 91 is protected by a protection function that prevents it from being read by anyone including the central processing unit 10.

After the communication path is set link-by-link and the key is transferred end-to-end, the communication information from the terminal 13 is encrypted with the key by the encryptor 21, and then sent to the communication path switch 3. 18, exchange 6, and is transferred to exchange 7 via communication path 19. The encrypted communication information is decrypted using a key by an encryptor 91 via the communication path switch 8 and transferred to the terminal 14. Further, communication information issued from the terminal 14 is encrypted with a key in the encryptor 9j and transferred to the exchange 1, decrypted with the key in the encryptor 21, and transferred to the terminal 13.

Although this embodiment shows an example in which one exchange 6 is provided between the exchange 1 and the exchange 7, a plurality of exchanges may be interposed between them. Further, although a night code device is provided corresponding to the subscriber line, a function may be provided to selectively connect to the night code device according to a subscriber's designation. Further, in this embodiment, the key is transferred without being encrypted, but a key encrypted using a public key may be transferred. In addition, the key for encrypting the message from terminal 13 and the key for encrypting the message from terminal 14 were made the same, but the same key was used to encrypt the message from terminal 13, but the same key was used to encrypt the message from exchange 7 and exchange 1 using the same method as in the embodiment. Encryption and decryption may be performed by determining another key.

〔Effect of the invention〕

According to the present invention, since the communication information route (call route) and the key route (signal route) are different, eavesdropping requires observing the call route and signal route at completely different locations, making wiretapping difficult. become. In addition, since the key is transferred end-to-end between the originating exchange and the destination exchange, wiretapping is impossible at the multiple exchanges and transmission lines intervening between the two exchanges. The key processing in both exchanges is done by hardware by the common line signal device and the cipher device, and there is no central processing device involved.
Eavesdropping on both exchanges is also impossible, which has the effect of preventing eavesdropping within the exchange network including both exchanges.

[Brief explanation of the drawing]

The figure is a configuration diagram of a communication system that implements an example of the method of the present invention. 1゜6.7... Exchange 2.9... Black code group 3.8... Call path switch 4.10... Central control unit 5 .11...Common line signal device 12...
...Signal relay station 13.14...Terminal

Claims (1)

[Claims] 1. In a communication system in which the originating exchange encrypts and transmits communication information using a common encryption key, and the destination exchange receives and decrypts the encrypted communication information, the encrypted communication information is transmitted. The key transfer is characterized in that the key is transferred link-by-link from an originating exchange to a destination exchange via a common line signal path, and the key is transferred end-to-end from the originating exchange to the destination exchange via a common line signal path. Method.