JPS62143536A - Inter-line cipher device communication system - Google Patents

Abstract

PURPOSE:To reduce the volume of data to be transferred by constituting a species data, a data key enciphered with a master key, and a master key authorizing data enciphered with the data key as a telegram having a communication frame format. CONSTITUTION:A CPU11 at a line cipher device 42 generates species data of two bytes SV1 and SV2 with a random number generation algorithm, furthermore, the data is expanded to an initial value data of eight bytes with a common algorithm at line cipher devices 42 and 46. Next, a data key K is generated with the random number algorithm, and the data key is enciphered with a CIP13 based on a master key KM and the initial value data set manually in advance at an SW14 in the line cipher device 42 using the cipher feed back mode of a DES algorithm, and an EKMK (eight bytes) can be obtained. Furthermore, an authorizing data CKCD is similarly enciphered with the data key K, and an EK(CKCD) can be obtained. The communication frame format is generated using the data generated with the above processing.

Description

Detailed Description of the Invention [Field of Industrial Application] The present invention relates to a communication method using a line encryption device installed between a data terminal device DTE and a data line termination device DCE to encrypt data on a communication line. .

[Conventional technology]

FIG. 4 is a diagram of a cryptographic communication system showing an example of application of the line encryption device, in which 42 and 46 are line encryption devices, 41 and 47 are terminal devices, 43 and 45 are modems, and 44 is a communication line.

FIG. 5 is a communication frame format diagram showing an example of a conventional message when keys are distributed between the above-mentioned line encryption devices, where F is a flag sequence, A is an address field, C is a control field, and ■ is a data field. , Fe
2 is a frame check sequence.

4 and 5, a case will be described in which key distribution is performed through communication using a conventional cryptographic system. It is assumed that the same secret master key KM is set in the line cryptographic devices 42 and 46.

The procedure for delivering the data key K for encrypting data from the line encryption device 42 to the line encryption device 4-6 will be described. The line encryption device 42 sends a DE to the line encryption device 46.
S (Data encryption standard: established by the U.S. Department of Commerce Bureau of Standards) In order to transmit the initial value data IV for algorithm processing, the address AI of the line encryption device 46 and the control field are set in the address field A in FIG. Set initial value data IV setting command C to C, initial value data IV (8 bytes in DES system) ff: to data field, create the communication frame format shown in Figure 5(b), and connect modem 43. Send the main message via .

If the line encryption device 46 successfully receives the above message, the 5th line encryption device 46
The address 80 of the line encryption device 42 is set in the address field A in FIG. 5(a), the response response C2 is set in the controller/I/field C, and a response is made in the communication frame format shown in FIG. 5(c).

The line encryption device 42, which has received the response from the line encryption device 46, encrypts the data key K with the master key KM to create encrypted data EKM(6) (8 bytes in the DES method), sets it in the information field E, and further , a key distribution command C3 is set in the control field C, an address A of the line encryption device 46 is set in the address field A, and the data is transmitted to the line encryption device 46 in the communication frame format shown in FIG. 5(d).

When the line encryption device 46 normally receives the message in the communication frame format shown in FIG. 5(d),
The response is in the same communication frame format.

The above sequence completes key distribution between the line cryptographic devices.

[Problem that the invention seeks to solve]

However, the communication frame format and communication procedure between line encryption devices using conventional encryption systems require a large amount of data to be transmitted for key distribution, and communication between line encryption devices that are not directly related to data transmission from terminals requires long lines. There is a problem that the master key KM is monopolized, and even if the master key KM is different between the line cryptographic devices, the key distribution ends normally.

[Means for solving problems]

This invention provides seed data for generating initial value data necessary for cryptographic algorithm processing, a data key encrypted with a master key, and master key authentication data encrypted with the data key in a communication system between line cryptographic devices. It is configured as a message in one communication frame format.

In addition, in a multi-drop encrypted communication system, a global address is set in the address field of the communication frame format, and the master station line encryption device transmits the communication frame format to multiple slave station line encryption devices, and the key distribution from the slave stations is performed. The normal end responses are received sequentially with time differences, depending on the time values set to different values in each slave station line encryption device.

[Effect]

This invention performs key distribution by configuring a plurality of pieces of data necessary for key distribution as a message in one communication frame format, and transmitting and receiving the data between line cryptographic devices. Furthermore, in a multi-drop encrypted communication system, a global address is set and messages are received sequentially with a time difference.

〔Example〕

An embodiment of the invention will be described with reference to the drawings. Note that common elements are designated by the same reference numerals throughout the drawings.

FIG. 1 is a block diagram of a line encryption device showing one embodiment of the present invention, and the line encryption device 4 shown in FIG.
2.46 applies. 1 is a central processing unit CPU that performs various calculation controls, 12 is a memory ROM/RAM for programs and working, 13 is a cryptographic processing unit CIP, and 14 is a device function setting unit S such as setting a master key.
W, 15 is a data terminal device side interface control unit D
TEIF, 76 is a data line terminal device side interface control section DCEIF, and these sections are connected by an internal path 17.

FIG. 2 is a diagram of a communication frame format between line encryption devices showing an embodiment of the present invention.

ST is a start bit (1 bit) that synchronizes communication between line encryption devices, SK is a key distribution command (5 bits),
A is the address field (3 bits) of the slave side line encryption device, SVI, SV2 are the seed data (2 bytes) for generating the initial value data IV.IEMK (6) is the data key K encrypted with the master key KM. Encrypted data (8 bytes), EK (CKCD) is encrypted data (1 byte) that is encrypted using authentication data (1 byte) set in advance in the encrypted communication system as a data key, RK is a key distribution request Response (5 bits), BCC is horizontal parity (1 byte), AK is key distribution normal completion response (
5 bits).

FIG. 3 is a sequence chart diagram when the present invention is applied to a cryptographic communication system. Note that this sequence is an application of the CCITT v.24 procedure to the procedure between the modem and the encryption device.

1 to 4, a communication system between line cryptographic devices when key distribution is performed between the line cryptographic devices will be described in detail below.

As shown in FIG.
After sending the ER-ON signal to 3, the data set ready DR-ON signal is received from the modem, and the process shifts to the key distribution sequence. At this time, the CPU of the line encryption device 42 controls the modem interface signals for the terminal 41 and modem 43.
11 under the control of DTEIF 25 and DCEI respectively.
F16 executes.

Now, let's explain about key distribution. C of line encryption device 42
The PU 11 generates 2 bytes of seed data for SVI and SV2 using a random number generation algorithm such as a multiplicative congruence method, and then converts these data into an 8-byte initial value using a common algorithm in the line encryption devices 42 and 46. Data rv,, rv2. ...Extend to IVs. (For example, I V 1 = S V l +a.

IV2=IV1-)-a, IV3=IV2+a l
1v4=IV3-1-a.

IV5=SV2+a 1IV6=IV5+a.

I V7 =: I V6 +a, T V6 =
TV7-1-a, a is a constant) Next, data key K
(8 bytes) using the above random number generation algorithm, handwritten by 8 people in advance, and 5W1 of the line encryption device 42.
Master key KM (8 bytes) set to 4 and the above initial value data IV, , IV2. - By IV8, DES
The data key K is encrypted with CIP 73 using the algorithm cipher feed pack mode, and the EKM
(6) Obtain (8 bytes). Furthermore, the data key is used to encrypt the authentication data CKCD in the same way as EK (CKCD).
get.

Using the data created in the above process, the communication frame format shown in FIG. 2(a) is created, and as shown in FIG. After receiving the ready-to-send CS ON signal, the DCEIF Z 6 of the line encryption device 46 transmits the DCEIF 16 of the multi-line encryption device 42 to the multi-line encryption device 46 in the communication frame format shown in FIG.
receives the message in the communication frame format shown in FIG. 2(a) by detecting the start bit ST. After that, the received message is checked by the CPU I of the line encryption device 46.
When the address field matches the local station address in the key distribution command SK, the following processing is performed.

If they do not match, separately determined processing is performed.

First, data from SK to EK (CKCD) in the communication frame format shown in FIG. When the result matches the horizontal IP IJ type BCC of the communication frame format shown in Figure 2 (a), the following processing is performed; however, if they do not match, it is assumed that an error has occurred on the transmission path, and a separately specified Perform processing.

That is, using the same algorithm as the line encryption device 42, 8 bytes of initial value data IV1 . IV2. ...Extend to IVs, and use this data and master key KM to perform EKM using the cipher feedback mode of the DES algorithm.
(6) is decrypted to obtain data key K.

Furthermore, by similarly decoding EK (CKCD) using the data key and obtaining the authentication data CKCD set in advance between the line encryption devices 42 and 46, the data key K is correctly received and the master key KM is also the same. I can see that this is true. If the data key is EK (CKCD)
) does not match the authentication data CKCD even after decoding, a burst error of 2 or more bits or more has occurred on the transmission path, or the master key KM is
6, it can be detected that there is no match. In this case as well, separately determined processing is performed.

When it is determined that the message in the communication frame format shown in FIG. 2(a) has been correctly received through the above processing, the line encryption device 46 sends a transmission request RS ON signal to the modem 45 as shown in FIG. Receiving a transmit enable CS on signal from the rear modem 45, the own station address is set in the address field of the communication frame format shown in FIG. The line encryption device 42 uses horizontal parity ncc r
, (If this message is checked and normally received, the key distribution ends normally. After that, the line encryption device 42.46 sends a data set ready DR on signal to the terminal 41.47, and shifts to the encrypted communication state. .

Next, a case where the present invention is applied to the multi-drop system shown in FIG. 6 will be explained in detail.

In FIG. 6, 601 is a host, 602 to 605 are terminals, 61) is a master line encryption device, 612 to 615 are slave line encryption devices, 621 to 625 are modems, and 631 is a communication line. Here, the line encryption devices 6-1 to 615 have the same configuration as shown in FIG. is shown in Figure 2 (
The time from receiving the message in the communication frame format of a) to responding in the communication frame format of FIG. 2(b) TM1 - TM4 (TMt < TM2 < T
M3 <TM4) are respectively set.

The main station line encryption device 611 uses the SVl, s
v2. Create E, M (K), EK (CKCD),
A so-called global address is set in the address field, and a message in the communication frame format shown in FIG. 2(a) is transmitted to all slave station line encryption devices 612-615.

The slave station line encryption devices 612 to 615 receive the main message almost simultaneously, and after processing the same as above, the slave station line encryption devices 612, 613, 614°615 according to the response times TM1 to TM4 set in the 5W14 of their own station. In this order, the host station responds by setting its own address in the address field of the communication frame format shown in FIG. 2(b).

The master station cryptographic device 611 can know which slave station line cryptographic device has successfully completed the key distribution by checking the address field of the messages in the communication frame format shown in FIG. 2(b) that are sequentially received. .

In addition, for a slave line encryption device that did not respond due to a transmission error, etc., set the address of that line encryption device in the address field again and send the communication frame format message shown in Figure 2 (a). good. In this case, since individual addresses are specified, the
) communication frame format.

Next, a case will be described in which the line encryption device 615 or the terminal 605 connected to the modem 625 is powered off.

In this case, the main station line encryption device 611 performs the steps described above.
Since there is no response even if the message in the communication frame format shown in FIG. The device 615 is assumed to be in a connection-disabled state, completes key distribution, and transitions to an encrypted communication state with respect to other devices that have successfully completed key distribution.

After that, the line encryption device 615 connected to the modem 625
, when all the terminals 605 start up normally, the slave line encryption device 615 enters a key delivery waiting state, but since the key distribution has already been completed, no key is delivered to the slave line encryption device 615.

Therefore, after a certain period of time has elapsed, the slave station line encryption device 6-5 detects the received carrier detection signal CD of the communication line 63.
At the off timing, it sets its own address in the address field of the communication frame format shown in FIG. 2(c) and transmits a message RK requesting key distribution to the main station line encryption device 611.

The main station line encryption device 611 that has received this message shifts to the above-mentioned key distribution state again, so that key distribution is also performed to the line encryption device that started up later.

〔Effect of the invention〕

As explained in detail above, the line encryption device communication method of the present invention compresses 8 bytes of initial value data into 2 bits, encrypts the data key with the mask key, and encrypts with the data key. Since the data for master key authentication is transmitted at once, the amount of data to be transmitted is small, and master key authentication and burst errors can be detected.

Furthermore, in a multi-drop system, if key distribution is performed using a global address and responses are received sequentially from each slave line encryption device, efficient key distribution can be expected. A highly reliable system can be constructed because a key distribution request response is provided so that key distribution is also performed.

[Brief explanation of drawings]

FIG. 1 is a block diagram of a line encryption device showing an embodiment of this invention, FIG. 2 is a communication frame format diagram between line encryption devices showing an embodiment of this invention, and FIG. 3 is a block diagram of a line encryption device showing an embodiment of this invention. A sequence chart diagram when applied to a system, FIG. 4 is a cryptographic communication system diagram showing an example of application of a line cryptographic device, FIG. 5 is a communication frame format diagram showing an example of a conventional message, and FIG. 6 is a diagram showing an example of a conventional message. FIG. 2 is a block diagram when applied to a multi-drop system. 11...CPU, 12...ROM/RAM,
73...CIP. 14...SW, 15...DTEIF, 1 (i
...DCEIF, 77...9 passes. Patent Applicant Oki Electric Industry Co., Ltd. Alert-hi 11 g-blind 3 device 42 tK Otsu 43
T-time 45 B-street 3 device 4
6 Kashima He 47 no small ＼ departure 8 Ruto J6 [1fii Hatake System Risi I Ceres Night Diagram 3 ■Includes 91 I divination System I Envy Rabbit. Look at 1 and see 7 and 7.

Claims (2)

[Claims] (1) In a communication method that performs communication between a line encryption device installed between a data terminal device and a data line termination device, seed data that generates initial value data necessary for encryption algorithm processing and encryption using a master key are used. encoded data key and
A communication method between line encryption devices characterized in that master key authentication data encrypted with a data key is configured in a message having the same communication frame format. (2) Set a global address in the address field of the communication frame format, send this message from the master line encryption device to multiple slave line encryption devices, and set a different response time value for each slave line encryption device. 2. A communication method between line encryption devices according to claim 1 in a multi-drop communication system in which the main station line encryption device sequentially receives the key distribution normal end response from the slave line encryption device at a time difference.