JP2001086114A - Communication controller and communication control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication controller and a communication control method where deterioration in a data communication efficiency due to redundant data is prevented to cope with a high speed channel. SOLUTION: The communication controller sends/receives data such as encryption data and is provided with a frame check sequence encryption section 3 that encrypts a frame check sequence configuring a frame format of the encryption data and with a frame check sequence decoding section 7 that decodes the encrypted frame check sequence.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication control apparatus and a communication control method for preventing data tapping during data communication using a frame check sequence for detecting a transmission error.

[0002]

2. Description of the Related Art Conventionally, various proposals have been made as methods for confidential communication, but most of them involve encrypting data to be communicated by a program and communicating. However, in such a method, since the entire transmission data is encrypted, there is a problem that a device and a program become complicated, and when a large amount of data processing needs to be performed, the There is a problem that it takes a long time for the encryption processing and the decryption processing, and efficient processing cannot be performed.

As a method for not encrypting the entire data, there is a packet switching method described in Japanese Patent Publication No. 6-83262, for example. However, the packet switching method as a communication control method for encryption described in the above-mentioned publication is a method of encrypting a synchronization flag indicating the start and end positions of a transmission data packet, and the encrypted synchronization flag bit is encrypted. The need for memory to store the pattern, the need for redundant bits to prevent the encrypted synchronization flag bit pattern from overlapping with the bit pattern of the transmitted data, and the need for regular synchronization Since a redundant bit is required to prevent the flag bit pattern from overlapping with the bit pattern of the data to be transmitted, there has been a problem that the efficiency of data communication is reduced.

On the other hand, it is considered that the speed of data communication will be increased considerably rapidly due to the development of satellite communication and communication using optical fibers, and accordingly, high-speed data communication which is difficult with the conventional technology can be supported. The need for secure data communication is expected to increase.

[0005]

However, in the conventional communication control method, as described above, processing by a complicated encryption algorithm is required, and the transmission efficiency is deteriorated by redundant bits. Was.

[0006] The communication control device and the communication control method eliminate the need for complicated encryption algorithm processing.
Also, to suppress the deterioration of transmission efficiency due to redundant bits,
There is a demand for specifying a data bit to be encrypted so as to prevent a reduction in data communication efficiency due to redundant data and to be able to adapt to a high-speed line.

The present invention is directed to a communication control device capable of preventing a decrease in data communication efficiency due to redundant data and adapting to a high-speed line, and a communication control device capable of preventing a decrease in data communication efficiency due to redundant data and adapting to a high-speed line. An object of the present invention is to provide a communication control method.

[0008]

According to the present invention, there is provided a communication control apparatus for transmitting and receiving data such as confidential data, comprising a frame check sequence constituting a frame format of confidential data. , And a frame check sequence decryption unit that decrypts the encrypted frame check sequence.

As a result, there is provided a communication control apparatus capable of preventing a reduction in data communication efficiency due to redundant data and adapting to a high-speed line.

In order to solve the above-mentioned problem, a communication control method according to the present invention is a communication control method for transmitting and receiving data such as secret data, and encrypts a frame check sequence constituting a frame format of secret data. The configuration includes a frame check sequence encryption step and a frame check sequence decryption step of decrypting the encrypted frame check sequence.

Thus, a communication control method for preventing a reduction in data communication efficiency due to redundant data and adapting to a high-speed line can be obtained.

[0012]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A communication control device according to a first aspect of the present invention is a communication control device for transmitting and receiving data such as confidential data, and encrypts a frame check sequence forming a frame format of confidential data. And a frame check sequence decryption unit that decrypts the encrypted frame check sequence.

With this configuration, only the frame check sequence is encrypted and no redundant bits are generated, so that high-speed data communication is possible. In addition, an unauthorized receiver receives only an error frame. Each time, the frame is discarded, and as a result, an unauthorized receiver cannot receive data at all, which has an effect that data confidentiality is realized.

According to a second aspect of the present invention, there is provided a communication control device according to the first aspect, further comprising a storage device storing a plurality of algorithms for encryption and decryption, and performing frame check sequence encryption. The unit selects any one of a plurality of algorithms and transmits the selected algorithm to the other party before transmitting the secret data.

This configuration has the effect that the encryption method can be set for each communication and each connection destination.

According to a third aspect of the present invention, there is provided the communication control apparatus according to the first or second aspect, wherein the communication control apparatus has a decryption function in the frame check sequence decryption section and an encryption function in the frame check sequence encryption section. Is provided with a concealment control unit for controlling the security by hardware or software.

With this configuration, when there is no danger of eavesdropping and tampering and there is no need for encryption, as in a network using a dedicated line, etc., the encryption of the frame check sequence is not performed, so that normal packet communication is performed. And the communication can be set according to the necessity of secrecy.

A communication control method according to a fourth aspect of the present invention is a communication control method for transmitting and receiving data such as confidential data, wherein a frame check sequence encryption for encrypting a frame check sequence constituting a frame format of confidential data. And a frame check sequence decrypting step of decrypting the encrypted frame check sequence.

According to this configuration, only the frame check sequence is encrypted and no redundant bits are generated, so that high-speed data communication is possible. In addition, an unauthorized receiver receives only an error frame. Each time, the frame is discarded, and as a result, an unauthorized receiver cannot receive data at all, which has an effect that data confidentiality is realized.

FIG. 1 shows an embodiment of the present invention.
This will be described with reference to FIG.

(Embodiment 1) FIG. 1 is a block diagram showing a packet communication system as a communication control system having a communication control device according to Embodiment 1 of the present invention.

In FIG. 1, reference numerals 10 and 20 denote communication devices, channels, and terminal devices connected to a public network during communication.
40 is a data line terminator, 50 is a line network, 60 and 70
Is a communication control device, 80 and 90 are communication lines, 100 and 11
0 is a data transmission cable.

The operation of the thus configured packet communication system will be described.

The information of the terminal devices 10 and 20 is divided into appropriate block units (packets) by the communication control devices 60 and 70 at the time of communication.
Input to 40. The data line terminating devices 30 and 40
This is for converting and transmitting signals from the terminal devices 10 and 20. The packet data is transmitted by the communication lines 80 and 90 and the line network 50 through the data line terminating devices 30 and 40, and the communication is completed.

It should be noted that in FIG.
Is a computer, and the data transmission cables 100, 110
Is a baseband cable, data line terminator 3
It is assumed that 0 and 40 are terminal adapters, communication lines 80 and 90 are subscriber lines, and line network 50 is a digital network.

The basic idea of the communication control method according to the present embodiment is that, in data communication, a frame check sequence (FCS), which is a bit string for detecting a transmission error of data bits of the frame, is encrypted. In order to prevent eavesdropping of information, a third party generates a frame check sequence error on the receiving side, discards the packet, and makes it impossible to receive the frame in which the frame check sequence error has occurred. . Here, the case of the HDLC procedure will be considered, but the basic concept can be applied to other schemes.

FIG. 2 is a format diagram showing a frame format for transmitting and receiving secret data, and data communication is performed in accordance with this frame format. The frame format includes a flag sequence 200, an address sequence 210, a control sequence 220, an information sequence 230, a frame check sequence 240,
It is configured by a flag sequence 250.

Here, in order to facilitate the explanation, HDLC
The transmission and reception of frames in the procedure will be briefly described. In HDLC, a delimiter of a frame is a specific bit pattern (0111111) called a flag sequence.
0). Since the receiving side recognizes the frame delimiter only by the flag bit pattern, five consecutive “1” s are detected during transmission so that the same bit pattern as the flag does not appear in the frame. Is forcibly inserted with "0" and transmitted.
For example, the data "11111111" in the transmission buffer is transmitted as "111011111" at the time of data transmission. Also, upon reception, if "0" following five "1" is detected, this "0" is deleted and received. Also, a frame check sequence is added to the end of the frame data to determine whether the transmitted / received data is correct data. The frame check sequence generally uses 16 bits and 32 bits. Here, the description will be made with 16 bits. The frame check sequence is obtained by taking the one's complement of the sum (modulo 2) of FCS1 and FCS2 described below.

First, the FCS1 is set to Xk (X15 + X14 +
X13 +... + X2 + X1 + 1) to generate a polynomial X16
+ X12 + X5 + 1 is the remainder. Here, k is the number of bits sandwiched between the last bit of the start flag and the first bit of the frame check sequence, excluding bits inserted for transparency.

The FCS 2 multiplies the frame content obtained by subtracting the number of bits inserted for transparency from the number of bits between the last bit of the start flag and the first bit of the frame check sequence by X16. Generator polynomial X1
6 + X12 + Remainder divided by X5 + 1.

According to the above method, the information frame is not particularly defined, and any bit pattern can be transmitted transparently. However, since the start and end of a frame are evident with a specific bit pattern, anyone can eavesdrop on data by monitoring that pattern. Therefore, in the present embodiment, a frame check sequence, which is data for detecting a transmission error of a frame in the HDLC procedure, is used, and the frame check sequence itself is encrypted. By making it impossible to receive as a frame, network security is realized.

FIG. 3 is a block diagram showing a communication control device according to the first embodiment of the present invention, and shows communication control devices 60 and 70 in the communication control system of FIG.

In FIG. 3, reference numeral 1 denotes a data transmission unit for transmitting transmission data from the terminal devices 10 and 20, 2 a frame check sequence operation unit for generating a frame check sequence, and 3 a frame check for encrypting the frame check sequence. The sequence encryption unit 4 is a concealment control unit that enables (enables) and disables (disables) the encryption function of the frame check sequence encryption unit 3, and 5 receives data from the data line terminating devices 30 and 40. A data receiving unit, 6 is a frame check sequence operation unit for generating a frame check sequence from received data, 7 is a frame check sequence decoding unit for decoding the frame check sequence generated by the frame check sequence operation unit 6, and 8 is a frame check sequence Sequence Enable the function of the decoding in the decoding section 7 (enable), encryption control unit to disable (the disable), 9 is a storage device for storing the encryption method and decryption method. The control of encryption / non-encryption (the presence / absence of encryption or the validity / invalidity of encryption) by the concealment control units 4 and 8 may be realized by hardware or software.

The communication control device 60 configured as above,
The operation of 70 will be described with reference to FIGS. 4 is a flowchart showing a data transmission operation, FIG. 5 is a flowchart showing a data reception operation, and FIG.
9 is a flowchart showing data processing when a third party who is not permitted receives the data.

First, data transmission will be described with reference to FIG. Note that the communication control device 60 is a transmission side, and the communication control device 70 is a reception side.

First, the frame check sequence encrypting section 3 of the transmission-side communication control device 60 has information (encryption method information) indicating which encryption method should be used to encrypt the frame check sequence of the data frame to be transmitted.
At the time of call establishment. A plurality of encryption and decryption method algorithms are stored in the recording device 9, and one of them is selected. The encryption method information is received by the data receiving unit 5, and the frame check sequence decoding unit 7 in the receiving side communication control device 70 selects a decoding algorithm corresponding to the transmitting side stored in the storage device 9. Thereafter, the data transmission unit 1 of the transmission-side communication control device 60 transmits an opening flag sequence indicating the start of the frame (S1). Next, the data transmission unit 1 sends out the address sequence and the control sequence (S2), and subsequently sends out transmission data (S3). Thereafter, the frame check sequence calculation unit 2 calculates and generates a frame check sequence which is data for detecting a transmission data error (S4), and the frame check sequence encryption unit 3 establishes a call with the frame check sequence generated in step S4. The encryption is performed according to the encryption method (algorithm for encryption) set at the time and transmitted (S5, S6, S7). Finally, the data transmitting unit 1 sends out a closing flag sequence indicating the end of the frame (S8). Further, the encryption / decryption of the frame check sequence can be set by the security control unit 4 for controlling the presence or absence of the security.

Next, the data receiving operation will be described with reference to FIG. The frame check sequence decrypting unit 7 of the receiving side communication control device 70 reads the decryption method from the storage device 9 in which the frame check sequence encryption method and the decryption method set at the time of establishing the call are stored. 5 receives data after detecting a start flag sequence (opening flag sequence), an address sequence, and a control sequence (S11, S12).
13) After further receiving the FCS (S14), the frame check sequence decoding unit 7 decodes the frame check sequence 240 in FIG. 2 (S15,
S16) The data from the data receiving unit 5 is received as a normal frame (S17). Finally, the data receiving unit 5 receives a closing flag sequence indicating the end of the frame (S18).

Finally, data processing in the case where an unauthorized third party receives the data will be described with reference to FIG. It starts with data reception and enters a flag waiting state (S2
1). When the start flag is detected, the process shifts to character wait (S22), starts data reception, and performs an address check (S23). Basically, the address here should be different from the address of the third party, so that the address becomes NG here and returns to the wait for flag (S21). Even if the address check is passed (S24), Since the correct operation result is not obtained due to the encryption of the frame check sequence, the frame is recognized as an error frame (S25), and immediately waits for a flag (S21), and the frame is not received (S26).

As described above, according to the present embodiment, the frame check sequence encrypting section 3 for encrypting the frame check sequence constituting the frame format of the confidential data, and decrypts the encrypted frame check sequence. By providing the frame check sequence decoding unit 7, only the frame check sequence is encrypted and no redundant bit is generated, so that it is possible to prevent a reduction in data communication efficiency due to redundant data and adapt to a high-speed line. High-speed data communication becomes possible, and unauthorized receivers receive only error frames. Each time, the frames are discarded, and as a result, unauthorized receivers receive no data. It becomes impossible to receive, and the confidentiality of data can be realized.

Further, a storage device 9 for storing a plurality of algorithms for encryption and decryption is provided, and the frame check sequence encryption unit 3 transmits any one of the plurality of algorithms before transmitting the secret data. By selecting one and transmitting it to the other party, an encryption method can be set for each communication and each connection destination.

Further, a dedicated control line is provided by providing a concealment control unit for controlling the decryption function of the frame check sequence decryption unit and the encryption function of the frame check sequence encryption unit by hardware or software. Eavesdropping like a network,
When there is no risk of tampering and there is no need for encryption, normal packet communication becomes possible by not encrypting the frame check sequence, and communication can be set according to the necessity of concealment. .

Further, a frame check sequence encrypting step (S5, S5) for encrypting the frame check sequence constituting the frame format of the secret data.
6) and a frame check sequence decrypting step (S16) for decrypting the encrypted frame check sequence, so that only the frame check sequence is encrypted and no redundant bit is generated. It is possible to adapt to a high-speed line by preventing a decrease in communication efficiency, enabling high-speed data communication.Also, an unauthorized receiver receives only an error frame, so each time the frame is The data is discarded, and as a result, an unauthorized recipient cannot receive any data at all, thereby realizing data confidentiality.

[0043]

As described above, according to the communication control apparatus according to the first aspect of the present invention, there is provided a communication control apparatus for transmitting and receiving data such as confidential data, wherein a frame constituting a frame format of confidential data is provided. A frame check sequence encryption unit for encrypting the check sequence;
By having a frame check sequence decryption unit for decrypting the encrypted frame check sequence, the simple process of encrypting and decrypting the frame check sequence indicating the validity of the data is performed without any redundant bits. Data can be confidentially communicated, preventing a reduction in data communication efficiency due to redundant data and adapting to high-speed lines, enabling high-speed data communication. Since only the frame is received, the frame is discarded each time, and as a result, an unauthorized receiver cannot receive data at all, which is advantageous in that data confidentiality can be realized. Effects can be obtained.

According to the communication control device of the second aspect,
2. The communication control device according to claim 1, further comprising a storage device storing a plurality of algorithms for encryption and decryption, wherein the frame check sequence encryption unit transmits the plurality of algorithms before transmitting the secret data. By selecting one of the algorithms and transmitting it to the other party, an advantageous effect is obtained in that the encryption method can be set for each communication and each connection destination.

According to the communication control device of the third aspect,
3. The communication control device according to claim 1, further comprising a concealment control unit that controls the presence or absence of a decryption function in the frame check sequence decryption unit and an encryption function in the frame check sequence encryption unit by hardware or software. Therefore, when there is no danger of eavesdropping and tampering such as in a network using a dedicated line, and there is no need for encryption, normal packet communication becomes possible by eliminating the encryption of the frame check sequence. This has an advantageous effect that communication can be set according to the necessity of secrecy.

According to the communication control method of the fourth aspect,
A communication control method for transmitting and receiving data such as confidential data, comprising: a frame check sequence encrypting step for encrypting a frame check sequence forming a frame format of confidential data; and a decrypting the encrypted frame check sequence. A frame check sequence decryption step to perform data encryption / decryption of the frame check sequence indicating the validity of the data. Since it is possible to prevent a reduction in data communication efficiency due to redundant data and adapt to a high-speed line, high-speed data communication becomes possible, and an unauthorized receiver receives only an error frame. Each time the frame is discarded, Which do not result recipient will not be able at all to data reception, advantageous effect that it is possible to realize the confidentiality of the data can be obtained.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a packet communication system as a communication control system having a communication control device according to a first embodiment of the present invention;

FIG. 2 is a format diagram showing a frame format for secret data transmission / reception.

FIG. 3 is a block diagram showing a communication control device according to the first embodiment of the present invention.

FIG. 4 is a flowchart showing a data transmission operation;

FIG. 5 is a flowchart showing a data receiving operation.

FIG. 6 is a flowchart showing data processing when a non-permitted third party receives the data;

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Data transmission part 2 Frame check sequence calculation part 3 Frame check sequence encryption part 4, 8 Security control part 5 Data reception part 6 Frame check sequence calculation part 7 Frame check sequence decryption part 9 Storage device 10, 20 Terminal device 30, 40 data line termination device 50 line network 60, 70 communication control device 80, 90 communication line 100, 110 data transmission cable

Claims (4)

[Claims] 1. A communication control apparatus for transmitting and receiving data such as confidential data, comprising: a frame check sequence encrypting section for encrypting a frame check sequence constituting a frame format of confidential data; and an encrypted frame check sequence. And a frame check sequence decoding unit for decoding the data. 2. The apparatus according to claim 1, further comprising a storage device storing a plurality of algorithms for encryption and decryption, wherein said frame check sequence encryption section performs any one of said plurality of algorithms prior to transmitting said secret data. Or 1
The communication control device according to claim 1, wherein one of the communication control devices is selected and transmitted to the other party. 3. A concealment control unit which controls the decryption function of the frame check sequence decryption unit and the presence or absence of the encryption function of the frame check sequence encryption unit by hardware or software. Item 3. The communication control device according to item 1 or 2. 4. A communication control method for transmitting and receiving data such as confidential data, comprising: a frame check sequence encrypting step for encrypting a frame check sequence constituting a frame format of confidential data; A frame check sequence decoding step of decoding the check sequence.