JP2003198530A - Packet communication device and encryption algorithm setting method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a packet communication device and an encryption algorithm setting method in which an encryption algorithm can be easily added or changed. <P>SOLUTION: A packet communication device 21 incorporates a setting part 37 for setting the circuit configuration date of reconfigurable circuits 33 and 34. Thus, there is an effect that the encryption algorithm can be easily added or changed. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a packet communication device and a cryptographic algorithm setting method capable of adding or changing a cryptographic algorithm.

[0002]

2. Description of the Related Art With the development of communication infrastructures such as the Internet, VPN (Virtual Private Net) has been used in place of private line communication within a company or between companies.
work) is drawing attention. VPN is a technology that enables the Internet to be used as a virtual leased line by means of encryption technology. IPSEC (Security Ar)
story for Internet P
rotocol) has become the current standard. IPSE
In C, the cryptographic algorithm used is not fixed, and the required cryptographic algorithm DES (Data Enc)
It is possible to support an arbitrary algorithm in addition to the configuration standard.

FIG. 9 is a block diagram showing a conventional packet communication device. In FIG. 9, 1 is a packet communication device which is, for example, a network security LSI, and 11 is a storage device for storing information indicating an encryption algorithm executable by a communication partner. SAD (Security Association D)
and a controller 12 for transmitting and receiving packets and controlling the cryptographic processing circuits 13 and 14,
13 is a cryptographic processing circuit that executes the cryptographic algorithm A to perform encryption processing or decryption processing on the packet;
Reference numeral 14 is a cryptographic processing circuit that executes the cryptographic algorithm B to execute encryption processing or decryption processing for the packet. Note that, in the example of FIG. 9, the packet communication device has two cryptographic processing circuits, but the present invention is not limited to this, and only one cryptographic processing circuit may be built in, or 3 The above cryptographic processing circuit may be incorporated.

Next, the operation will be described. Here, as shown in FIG. 10, the packet communication device 1a capable of executing the encryption algorithms A and B encrypts and transmits the packet, and the packet communication device 1b capable of executing the encryption algorithm A receives the packet. What is decrypted will be described.

First, the control unit 12 of the packet communication device 1a
Is a packet communication device 1 on the receiving side that is capable of executing an encryption algorithm when starting the packet encrypted communication.
The identifiers assigned to the encryption algorithms A and B are transmitted to the packet communication device 1b in order to be recognized by b.

When the control unit 12 of the packet communication device 1b receives the identifier of the cryptographic algorithm A and the identifier of the cryptographic algorithm B from the packet communication device 1a, the cryptographic algorithms that can be executed by the packet communication device 1a are the cryptographic algorithms A and B. Recognize that there is. Then, the control unit 12 of the packet communication device 1b sends the determination information for permitting the use of the cryptographic algorithm A to the packet communication device 1a because the cryptographic algorithm that can be executed by the control unit 12 is the cryptographic algorithm A. And the decision information is stored in the SAD 11 in association with the address of the packet communication device 1a.

When the control unit 12 of the packet communication device 1a receives the decision information permitting the use of the cryptographic algorithm A from the packet communication device 1b, the control unit 12 stores the decision information in the SAD 11 in association with the address of the packet communication device 1b. . Then, the control unit 12 of the packet communication device 1a
When a plaintext packet to be transmitted to the packet communication device 1b is input, the key acquires the decision information from the SAD 11 using the address or the like added to the packet as a key, and recognizes the encryption algorithm to be used from the decision information. In this example, it is recognized that the encryption algorithm A is used.

The control unit 12 of the packet communication device 1a uses the encryption algorithm A as the encryption algorithm to be used, and therefore the encryption processing circuit 1 incorporating the encryption algorithm A is used.
A plaintext packet is output to 3. As a result, the cryptographic processing circuit 13 executes the cryptographic algorithm A, performs the cryptographic processing on the plaintext packet, and outputs the encrypted packet to the control unit 12. Packet communication device 1
The control unit 12 of a transmits the encrypted packet to the packet communication device 1b.

When the encrypted packet is received from the packet communication device 1a, the control unit 12 of the packet communication device 1b acquires the decision information from the SAD 11 using the address added to the packet as a key and makes the decision. Recognize the cryptographic algorithm used from the information. In this example,
It is recognized that the cryptographic algorithm A is used.

The control unit 12 of the packet communication device 1b uses the cryptographic algorithm A as the cryptographic algorithm to be used. Therefore, the cryptographic processing circuit 1 incorporating the cryptographic algorithm A is used.
The encrypted packet is output to No. 3. As a result, the cryptographic processing circuit 13 executes the cryptographic algorithm A to perform the decryption process on the encrypted packet,
The plaintext packet is output to the control unit 12. The control unit 12 of the packet communication device 1b outputs a plaintext packet to the outside.

[0011]

Since the conventional packet communication apparatus is constructed as described above, it is impossible to use any encryption algorithm other than the built-in encryption algorithm on both the transmitting side and the receiving side, and a stronger encryption is possible. Even if the algorithm is newly devised, there is a problem that it cannot be used unless a new LSI, which is hardware, is designed and manufactured.

In Japanese Patent Laid-Open No. 10-257120, when a packet communication device executes packet encrypted communication, a script corresponding to an encryption algorithm is acquired from a database connected to a network, and the packet communication device is acquired. The technology of executing the script by the script execution engine of is disclosed. However, in this case, since a highly confidential encryption algorithm that should be used only between specific packet communication devices is registered in the database, a high morale of the server management organization is required, and at the same time, the encryption algorithm may be changed due to an internal crime. There are problems such as possible leakage. In addition, since the script execution engine needs to perform the encryption process and the like while interpreting the meaning of the script, there is a problem that the speed of the encryption process and the like becomes slower than that of the packet communication device in which the hardware is mounted.

The present invention has been made to solve the above problems, and an object of the present invention is to obtain a packet communication device and a cryptographic algorithm setting method that can easily add or change a cryptographic algorithm.

[0014]

A packet communication apparatus according to the present invention, when encrypting and transmitting a packet,
A setting means for setting the circuit configuration data of the reconfigurable circuit is provided.

The packet communication apparatus according to the present invention is provided with setting means for setting the circuit configuration data of the reconfigurable circuit when receiving and decoding the packet.

In the packet communication device according to the present invention, when setting the circuit configuration data of the reconfigurable circuit,
The key length of the encryption key and the number of bits of the encryption or decryption block are registered.

The packet communication apparatus according to the present invention is provided with a process executing means composed of a fixed hardware circuit for executing a predetermined cryptographic algorithm, in addition to the process executing means composed of a reconfigurable circuit. It is a thing.

In the packet communication device according to the present invention, when the processing execution means is composed of a plurality of reconfigurable circuits, the unconfigured reconfigurable circuit is selected to set the circuit configuration data. It is a thing.

The packet communication device according to the present invention exchanges information regarding a cryptographic algorithm with a communication partner of a packet and sets circuit configuration data corresponding to the cryptographic algorithm to be executed in the reconfigurable circuit. .

In the packet communication device according to the present invention, an identifier indicating that the setting means on the packet transmitting side has a reconfigurable circuit is transmitted to the setting means on the packet receiving side, and the setting means on the packet receiving side transmits the identifier. Upon receiving the notification that the reconfigurable circuit is provided, the circuit configuration data corresponding to the encryption algorithm to be executed is transmitted to the setting means on the packet receiving side.

In the packet communication device according to the present invention, the setting means on the packet receiving side receives the circuit configuration data transmitted from the setting means on the packet transmitting side and sets the circuit configuration data in the reconfigurable circuit. It is the one.

In the cryptographic algorithm setting method according to the present invention, the packet transmitting side transmits an identifier indicating that the packet transmitting side is provided with the reconfigurable circuit to the packet receiving side, and the packet receiving side receives the identifier and reconfigurable. When the notification that the circuit is provided is returned, the circuit configuration data corresponding to the encryption algorithm executed by the packet transmission side is transmitted to the packet reception side, and the packet reception side receives the circuit configuration data and sends it to the reconfigurable circuit. This is set.

In the encryption algorithm setting method according to the present invention, the packet transmitting side transmits the identifier indicating the reconfigurable cipher to the packet receiving side, while the packet receiving side receives the identifier and can use the reconfigurable cipher. When the notification indicating that is sent back, the encryption algorithm executed by the packet transmission side is transmitted to the packet reception side, and the packet reception side receives and sets the encryption algorithm.

In the encryption algorithm setting method according to the present invention, the encryption algorithm transmitted from the packet transmitting side is a script executed by the script executing engine on the packet receiving side.

The cryptographic algorithm setting method according to the present invention is such that the cryptographic algorithm transmitted from the packet transmitting side is software executed by the microprocessor on the packet receiving side.

[0026]

BEST MODE FOR CARRYING OUT THE INVENTION An embodiment of the present invention will be described below. Embodiment 1. 1 is a block diagram showing a packet communication device according to a first embodiment of the present invention. In FIG.
Is a packet communication device which is, for example, a network security LSI, 31 is a SAD that stores information indicating an encryption algorithm that can be executed by a communication partner, 32 is a packet that is transmitted and received, and the destination or source of the packet is confirmed. A control unit (transmitting means, receiving means) that determines an encryption algorithm according to the destination or the sender. The SAD 31 and the control unit 32 constitute an algorithm determining means.

Reference numerals 33 and 34 denote reconfigurable circuits (processing execution means) that execute the encryption algorithm determined by the control unit 32 to perform encryption processing or decryption processing on the packet. , 34 are configured using a technique such as FPGA or CPLD. Reference numerals 35 and 36 denote the key length of the encryption key, the number of bits of the encryption block, and the reconfigurable circuit 3.
A memory for storing the circuit configuration data of 3, 34, 37 is a setting unit (setting means) for setting the circuit configuration data of the reconfigurable circuits 33, 34, and 38 is between the control unit 32 and the reconfigurable circuits 33, 34. An encryption circuit bus for connecting and transmitting a packet to be encrypted, 39 is connected between the control unit 32, the reconfigurable circuits 33, 34, the setting unit 37, and the memories 35, 36, and the reconfigurable circuit 33 is connected. , 34 for transmitting circuit configuration data and the like.

As the memories 35 and 36, for example, a non-volatile memory such as a flash memory, an EEPROM or a mask ROM, or a volatile memory such as a RAM can be used. L like memory 35 to save area
It may be built in the SI or may be externally attached like the memory 36 in order to select and implement many encryption algorithms. Further, by implementing both of them, for example, a standard cryptographic algorithm can be used as an internal mask RO.
It is fixedly held by M and the optional encryption algorithm is attached to external flash memory or compact flash (R).
It is also possible to provide with a memory card such as. Further, in the example of FIG. 1, the packet communication device includes two reconfigurable circuits. However, the packet communication device is not limited to this, and may include only one reconfigurable circuit. Three or more reconfigurable circuits may be incorporated.

Next, the operation will be described. First, when the encryption algorithm executed by the packet communication device 21 is changed or added, the setting unit 37 sets the circuit configuration data of the reconfigurable circuit stored in the memory 35 or the memory 36 when the LSI is reset. get. As shown in FIG. 2, the circuit configuration data is stored together with attribute information such as an identifier indicating the corresponding encryption algorithm, the key length of the encryption key, and the number of bits of the encrypted block.

When the setting unit 37 acquires the circuit configuration data of the reconfigurable circuit, it sets the circuit configuration data in the reconfigurable circuit 33, for example. As a result, if the circuit configuration data is, for example, the circuit configuration data of the encryption algorithm B, the reconfigurable circuit 33 can thereafter execute the encryption algorithm B.

The control unit 32 of the packet communication device 21
Is performing the communication operation, when the setting unit 37 acquires the circuit configuration data from the memory 35 or the memory 36,
Of the reconfigurable circuits 33 and 34, the reconfigurable circuit that is not being executed at present is selected, and the circuit configuration data is set for the reconfigurable circuit.

Here, when the control unit 32 requests the reconfigurable circuit 33 to perform the encryption process or the decryption process of the packet, the control unit 32 sends the packet to the reconfigurable circuit 33 via the encryption circuit bus 38. Although transferred, the key length of the encryption key and the number of bits of the encrypted block stored in the memory 35 or the memory 36 are read. Then, if the key length of the encryption key or the number of bits of the encryption block is larger than the bit width of the encryption circuit bus 38, the transfer is performed in plural times. For example, if the bit width of the encryption circuit bus 38 is 64 bits and the key length is 128 bits, the encryption key is transferred twice. As a result, it is possible to implement an arbitrary cryptographic algorithm having a different key length or block bit number in the reconfigurable circuit.

Next, as shown in FIG. 3, the packet communication device 21a capable of executing the standard encryption algorithm A (for example, DES) sends the packet to the packet communication device 21b capable of executing the encryption algorithm A. The operation of transmitting will be described (hereinafter, referred to as operation example 1).

First, the control unit 3 of the packet communication device 21a
The packet communication device 2 uses the identifier A assigned to the encryption algorithm A in order to make the packet communication device 21b on the reception side recognize an executable encryption algorithm.
Send to 1b. Control unit 32 of packet communication device 21b
When receiving the identifier A of the cryptographic algorithm A from the packet communication device 21a, the device itself can execute the cryptographic algorithm A, and therefore transmits the determination information permitting the use of the cryptographic algorithm A to the packet communication device 21a. The determination information is stored in the SAD 31 in association with the address of the packet communication device 21a.

The control unit 32 of the packet communication device 21a is
When the decision information for permitting the use of the encryption algorithm A is received from the packet communication device 21b, the packet communication device 2
SAD3 of the decision information in association with the address etc. of 1b.
Store in 1. Then, when the plaintext packet to be transmitted to the packet communication device 21b is input, the control unit 32 of the packet communication device 21a acquires the decision information from the SAD 31 using the address or the like added to the packet as a key, and the decision information Recognize the cryptographic algorithm used from. In this example, it is recognized that the encryption algorithm A is used.

The control unit 32 of the packet communication device 21a is
Since the cryptographic algorithm used is the cryptographic algorithm A, the reconfigurable circuit capable of executing the cryptographic algorithm A (here, for convenience of description, the reconfigurable circuit 33 can execute the cryptographic algorithm A). ) To a plaintext packet. As a result, the reconfigurable circuit 33 executes the encryption algorithm A to perform the encryption process on the plaintext packet, and the encrypted packet is transferred to the control unit 32.
Output to. The control unit 32 of the packet communication device 21a
The encrypted packet is transmitted to the packet communication device 21b.

The control unit 32 of the packet communication device 21b is
When the encrypted packet is received from the packet communication device 21a, the decision information is acquired from the SAD 31 using the address or the like added to the packet as a key, and the encryption algorithm to be used is recognized from the decision information. In this example, it is recognized that the encryption algorithm A is used.

The control unit 32 of the packet communication device 21b is
Since the cryptographic algorithm used is the cryptographic algorithm A, the reconfigurable circuit capable of executing the cryptographic algorithm A (here, for convenience of description, the reconfigurable circuit 33 can execute the cryptographic algorithm A). ) Output the encrypted packet. As a result, the reconfigurable circuit 33
Executes the encryption algorithm A, performs the decryption process on the encrypted packet, and outputs the plaintext packet to the control unit 32. Control unit 3 of packet communication device 21b
2 outputs a plaintext packet to the outside.

Next, as shown in FIG. 4, the packet communication device 21a capable of executing the standard cryptographic algorithm A.
However, the packet communication device 21 in which the circuit configuration data of the encryption algorithm A is not set in the reconfigurable circuit 21
The operation when a packet is transmitted to b will be described (hereinafter,
Operation example 2). However, the encryption algorithm A is
Memory 3 as standard encryption (eg DES)
It is assumed that the circuit configuration data of the encryption algorithm A is stored in advance in 5.

First, the control unit 3 of the packet communication device 21a
The packet communication device 2 uses the identifier A assigned to the encryption algorithm A in order to make the packet communication device 21b on the reception side recognize an executable encryption algorithm.
Send to 1b. Control unit 32 of packet communication device 21b
When the identifier A of the encryption algorithm A is received from the packet communication device 21a, the circuit configuration data of the encryption algorithm A is not set in the built-in reconfigurable circuit 33. Therefore, the setting of the circuit configuration data of the encryption algorithm A is set. Request to section 37.

As a result, the setting unit 37 of the packet communication device 21b acquires the circuit configuration data of the encryption algorithm A from the memory 35 and sets the circuit configuration data in the reconfigurable circuit 33. Packet communication device 21
When the setting of the circuit configuration data by the setting unit 37 is completed, the control unit 32 of b transmits the determination information permitting the use of the encryption algorithm A to the packet communication device 21a, and associates it with the address of the packet communication device 21a. The decision information is stored in the SAD 31.

The control unit 32 of the packet communication device 21a is
When the decision information for permitting the use of the encryption algorithm A is received from the packet communication device 21b, the packet communication device 2
SAD3 of the decision information in association with the address etc. of 1b.
Store in 1. The subsequent communication operation is the same as that of the operation example 1 described above, and thus the description thereof is omitted.

Next, as shown in FIG. 5, the packet communication device 21a capable of executing the standard encryption algorithm A and the newly devised encryption algorithm B is a packet communication device capable of executing the encryption algorithm A. The operation of transmitting a packet to 21b will be described (hereinafter, referred to as operation example 3). However, since the encryption algorithm B is a newly devised encryption, it is assumed that the circuit configuration data of the encryption algorithm B is not stored in the memory 35.

First, the control unit 3 of the packet communication device 21a
In order to make the packet communication device 21b on the receiving side recognize an executable cryptographic algorithm, the identifier 2 assigns the identifier A assigned to the cryptographic algorithm A and the identifier R (indicating that the self-configurable circuit is provided. Alternatively, an identifier indicating that the reconfigurable encryption can be used is transmitted to the packet communication device 21b. Upon receiving the identifier R in addition to the identifier A of the cryptographic algorithm A from the packet communication device 21a, the control unit 32 of the packet communication device 21b responds to the fact that the control unit 32 itself also includes the reconfigurable circuit (or the reconfigurable circuit itself). A response indicating that the figurable cipher can be used) is transmitted to the packet communication device 21a.

However, if the packet communication device 21b does not have a reconfigurable circuit, the decision information permitting the use of the encryption algorithm A is transmitted to the packet communication device 21a. In this case, the following communication operation is the same as that of the operation example 1 described above, and thus the description thereof is omitted.

The control unit 32 of the packet communication device 21a is
When receiving a response R from the packet communication device 21b indicating that the packet communication device 21b itself has a reconfigurable circuit, the circuit configuration data of the encryption algorithm B is sent to the packet communication device 21b to enable the use of the newly devised cipher. Send. When the control unit 32 of the packet communication device 21b receives the circuit configuration data of the encryption algorithm B from the packet communication device 21a, the reconfigurable circuit that has the circuit configuration data of the encryption algorithm B empty (for example, the reconfigurable circuit 34). Set to.

When there is no free reconfigurable circuit, it is generally considered that the reconfigurable circuit that implements the circuit configuration data of the cryptographic algorithm that is least frequently used is invalidated. One of the reconfigurable circuits is forcibly emptied to be used according to the conversion algorithm.

The control unit 32 of the packet communication device 21b is
When the setting of the circuit configuration data is completed, the decision information for permitting the use of the encryption algorithm B is sent to the packet communication device 21a
And the decision information is stored in the SAD 31 in association with the address of the packet communication device 21a and the like.

The control unit 32 of the packet communication device 21a is
When the decision information for permitting the use of the encryption algorithm B is received from the packet communication device 21b, the packet communication device 2
SAD3 of the decision information in association with the address etc. of 1b.
Store in 1. The subsequent communication operation is the same as that of the operation example 1 described above, and thus the description thereof is omitted.

As is clear from the above, the first embodiment
According to this configuration, since the setting unit 37 for setting the circuit configuration data of the reconfigurable circuits 33 and 34 is provided, there is an effect that the encryption algorithm can be easily added or changed. Further, since the transmitting side and the receiving side transmit the circuit configuration data of the cryptographic algorithm by one-to-one communication and do not need to register the cryptographic algorithm in the database as in the conventional example, the confidentiality of the cryptographic algorithm can be secured. effective. Since the reconfigurable circuits 33 and 34 are hardware,
The delay in processing speed unlike the conventional script execution engine does not pose a problem.

In the first embodiment, although not particularly mentioned, if a plurality of packet communication devices are connected to the network, IP addresses are assigned to the plurality of packet communication devices and the transmitting side IP to packet
When an address is added and transmitted, the packet includes the circuit configuration data of the encryption algorithm and is transmitted, and the receiving side stores the circuit configuration data in the memory 35. This allows one packet communication device to add an encryption algorithm to another packet communication device.

Embodiment 2. Although not particularly mentioned in the first embodiment, when transmitting the identifier indicating the executable encryption algorithm or the circuit configuration data of the encryption algorithm, the identifier and the circuit configuration data are transmitted by, for example, a standard encryption algorithm. It may be encrypted and transmitted. In the first embodiment, the circuit configuration data of the encryption algorithm is set. However, the transmitting side transmits attribute information such as the key length of the encryption key and the number of bits of the encrypted block to the receiving side, The attribute information may be stored in the memory 35 on the receiving side. As a result, the key length of the encryption key, the number of bits of the encryption block, etc. can be changed.

Embodiment 3. 6 is a configuration diagram showing a packet communication device according to a third embodiment of the present invention. In the figure, the same reference numerals as those in FIG. Reference numeral 40 denotes a cryptographic processing circuit (processing executing means) that is a fixed hardware circuit that executes a predetermined cryptographic algorithm.

Next, the operation will be described. In the above-described first embodiment, the case where a plurality of reconfigurable circuits are mounted has been described, but as shown in FIG. 6, the cryptographic processing circuit 40 may be mounted in addition to the reconfigurable circuit 34. As a result, it becomes possible to implement the cryptographic algorithm that is essential to be implemented in the standard such as IPSEC with the minimum amount of hardware (implement the cryptographic algorithm in the cryptographic processing circuit 40).
This has the effect of realizing cost reduction.

Fourth Embodiment In the first embodiment, the circuit configuration data of the cryptographic algorithm is transmitted, but as shown in FIG. 7, when the script execution engine of the packet communication device 21b on the receiving side executes the cryptographic algorithm. The encryption algorithm transmitted from the packet communication device 21a on the transmission side may be a script executed by the script execution engine. As a result, the same effect as that of the first embodiment can be achieved in the script-based packet communication device.

Embodiment 5. In the first embodiment, the circuit configuration data of the cryptographic algorithm is transmitted. However, as shown in FIG. 8, when the microprocessor of the packet communication device 21b on the receiving side executes the cryptographic algorithm, The cryptographic algorithm transmitted from the packet communication device 21a on the transmission side may be software executed by the microprocessor. As a result, even in a software-based packet communication device using a microprocessor, the same effects as those of the first embodiment can be obtained.

[0057]

As described above, according to the present invention, when the packet is encrypted and transmitted, the setting means for setting the circuit configuration data of the reconfigurable circuit is provided, so that the encryption algorithm is added. The effect is that you can easily make changes.

According to the present invention, when the packet is received and decrypted, the setting means for setting the circuit configuration data of the reconfigurable circuit is provided, so that the encryption algorithm can be easily added or changed. There is an effect that can be.

According to the present invention, when the circuit configuration data of the reconfigurable circuit is set, the key length of the encryption key and the number of bits of the encryption or decryption block are registered, so that the key of the encryption key is registered. There is an effect that the length and the number of bits of the encryption or decryption block can be easily added or changed.

According to the present invention, in addition to the processing executing means composed of the reconfigurable circuit, the processing executing means composed of a fixed hardware circuit for executing a predetermined encryption algorithm is provided. There is an effect that the cost can be reduced.

According to the present invention, when the processing executing means is composed of a plurality of reconfigurable circuits, the reconfigurable circuit that has not been executed is selected and the circuit configuration data is set. Even during the packet communication operation, the circuit configuration data of the reconfigurable circuit can be set.

According to the present invention, the information about the encryption algorithm is exchanged with the communication partner of the packet, and the circuit configuration data corresponding to the encryption algorithm to be executed is set in the reconfigurable circuit. There is an effect that it is possible to execute a new cryptographic algorithm consensually.

According to the present invention, the identifier indicating that the setting means on the packet transmitting side has the reconfigurable circuit is transmitted to the setting means on the packet receiving side, and the setting means on the packet receiving side reconfigurable. When the notification that the circuit is provided is received, the circuit configuration data corresponding to the encryption algorithm to be executed is transmitted to the setting means on the packet receiving side, so that the new encryption algorithm can be executed. There is an effect that can be done.

According to the present invention, the setting means on the packet receiving side receives the circuit configuration data transmitted from the setting means on the packet transmitting side and sets the circuit configuration data in the reconfigurable circuit. Therefore, there is an effect that a new cryptographic algorithm can be executed.

According to the present invention, while the packet transmitting side transmits the identifier indicating that the packet transmitting side has the reconfigurable circuit to the packet receiving side, the packet receiving side receives the identifier and has the reconfigurable circuit. When the notification indicating that the packet is transmitted is returned, the circuit configuration data corresponding to the encryption algorithm executed by the packet transmission side is transmitted to the packet reception side, and the packet reception side receives the circuit configuration data and sets it in the reconfigurable circuit. Since it is configured, there is an effect that the encryption algorithm can be easily added or changed.

According to the present invention, the packet transmitting side transmits the identifier indicating the reconfigurable cipher to the packet receiving side, while the packet receiving side receives the identifier and can use the reconfigurable cipher. When the notification is sent back, the encryption algorithm executed by the packet sender is sent to the packet receiver, and the packet receiver receives and sets the encryption algorithm, so it is easy to add or change the encryption algorithm. There is an effect that can be.

According to the present invention, the encryption algorithm transmitted from the packet transmitting side is configured to be a script executed by the script executing engine on the packet receiving side. This has the effect of easily adding or changing the algorithm.

According to the present invention, since the encryption algorithm transmitted from the packet transmitting side is software executed by the microprocessor on the packet receiving side, even in the software type packet communication device by the microprocessor. , It is effective to easily add or change the encryption algorithm.

[Brief description of drawings]

FIG. 1 is a configuration diagram showing a packet communication device according to a first embodiment of the present invention.

FIG. 2 is an explanatory diagram showing storage contents of a memory.

FIG. 3 is a process flow diagram showing a protocol between packet communication devices.

FIG. 4 is a process flow diagram showing a protocol between packet communication devices.

FIG. 5 is a process flow diagram showing a protocol between packet communication devices.

FIG. 6 is a configuration diagram showing a packet communication device according to a third embodiment of the present invention.

FIG. 7 is a process flow diagram showing a protocol between packet communication devices.

FIG. 8 is a process flow diagram showing a protocol between packet communication devices.

FIG. 9 is a configuration diagram showing a conventional packet communication device.

FIG. 10 is a process flow diagram showing a protocol between packet communication devices.

[Explanation of symbols]

1 packet communication device, 11 SAD, 12 control unit,
13 cryptographic processing circuit, 14 cryptographic processing circuit, 21, 21
a, 21b Packet communication device, 31 SAD (algorithm determining means), 32 Control unit (transmitting means, receiving means, algorithm determining means), 33, 34 Reconfigurable circuit (processing executing means), 35, 36 memory, 37 Setting Part (setting means), 38 encryption circuit bus, 39 setting bus, 40 encryption processing circuit (processing execution means).

Claims (12)

[Claims] 1. An encryption processing for a packet is performed by confirming a destination of a packet and executing an algorithm determining means for determining an encryption algorithm according to the destination, and an encryption algorithm determined by the algorithm determining means. In a packet communication device comprising a processing execution means and a transmission means for transmitting a packet after being encrypted by the processing execution means, the processing execution means is configured by using a reconfigurable circuit, and the reconfigurable circuit A packet communication device comprising a setting means for setting circuit configuration data. 2. A receiving means for receiving an encrypted packet, an algorithm determining means for confirming a sender of the packet received by the receiving means, and determining an encryption algorithm according to the sender, and the algorithm. In a packet communication device including a process executing unit that executes the encryption algorithm determined by the determining unit and performs a decryption process for the packet, the process executing unit is configured by using a reconfigurable circuit, and the reconfigurable unit is configured. A packet communication device comprising a setting means for setting circuit configuration data of a figurable circuit. 3. The setting means registers the key length of the encryption key and the number of bits of the encryption or decryption block when setting the circuit configuration data of the reconfigurable circuit. Item 2. The packet communication device according to item 2. 4. A process executing means composed of a fixed hardware circuit for executing a predetermined cryptographic algorithm in addition to the process executing means composed of a reconfigurable circuit. Or claim 2
The packet communication device described. 5. The setting means sets the circuit configuration data by selecting an unexecuted reconfigurable circuit when the processing execution means is composed of a plurality of reconfigurable circuits. Item 1 or claim 2
The packet communication device described. 6. The setting means exchanges information about a cryptographic algorithm with a communication partner of a packet, and sets circuit configuration data corresponding to the cryptographic algorithm to be executed in the reconfigurable circuit. The packet communication device according to claim 5. 7. The setting means on the packet transmitting side transmits an identifier indicating that the reconfigurable circuit is provided to the setting means on the packet receiving side, and the setting means on the packet receiving side is provided with the reconfigurable circuit. 7. The packet communication device according to claim 6, wherein when the notification indicating that the packet is transmitted is received, the circuit configuration data corresponding to the encryption algorithm to be executed is transmitted to the setting means on the packet receiving side. 8. The setting means on the packet receiving side receives the circuit configuration data transmitted from the setting means on the packet transmitting side, and sets the circuit configuration data in the reconfigurable circuit. The packet communication device described. 9. A notification that a packet transmitting side transmits an identifier indicating that it has a reconfigurable circuit to the packet receiving side, while the packet receiving side receives the identifier and has a reconfigurable circuit. In response to the above, the circuit configuration data corresponding to the encryption algorithm executed by the packet transmission side is transmitted to the packet reception side, and the packet reception side receives the circuit configuration data and sets it in the reconfigurable circuit. . 10. The packet transmitting side transmits an identifier indicating the reconfigurable cipher to the packet receiving side,
When the packet receiver receives the identifier and returns a notification that the reconfigurable cipher can be used, it sends the encryption algorithm executed by the packet sender to the packet receiver, and the packet receiver receives the cipher. Cryptographic algorithm setting method that receives and sets the algorithm. 11. The cryptographic algorithm setting method according to claim 10, wherein the cryptographic algorithm transmitted from the packet transmission side is a script executed by a script execution engine on the packet reception side. 12. The cryptographic algorithm setting method according to claim 10, wherein the cryptographic algorithm transmitted from the packet transmitting side is software executed by a microprocessor on the packet receiving side.