JP2004064652A - Communication equipment - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make compatible secrecy of data and communication quality while taking into account quality information or the like associated with a real communication status. <P>SOLUTION: The communication equipment is provided with: a communication part for transmitting-receiving data with one or a plurality of communication medium; a communication status detecting part for monitoring a status of the communication part to acquire the quality information specifying the present communication status; an encryption level determining part for determining an encryption level based upon the acquired quality information; and a cipher part for encrypting the transmitting data based upon the determined encryption level. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a communication device, and more particularly to a communication device capable of achieving both confidentiality of information and communication quality.
[0002]
[Prior art]
Due to the recent spread of the Internet and the spread of wireless communication devices, it is not possible to encrypt and transmit information transmitted by communication devices in order to maintain confidentiality against eavesdropping by third parties. , Has become essential.
[0003]
On the other hand, there are various types of information to be transmitted, and the required confidentiality differs depending on the information. For example, information such as a password necessary for authentication needs to be strictly encrypted, but data that is generally disclosed on a homepage on the Internet need not be encrypted. It would be inefficient to uniformly encrypt and transmit such various data. Further, when encrypting and transmitting data, the processing capability required for encryption differs depending on the encryption level, and as a result, the maximum communication capability that can be encrypted and transmitted differs.
[0004]
To solve such a problem, Japanese Patent Application Laid-Open No. 7-295892 proposes a secure system that automatically obtains optimal security control according to the secrecy of a file.
FIG. 13 is a block diagram showing the entire structure of the conventional secure system, and FIG. 14 is a flowchart of one embodiment thereof.
[0005]
In FIG. 13, reference numeral 51 denotes a data transfer management unit on the transmission side that manages the transfer of encrypted data; 52, data to be transferred; 53, a data transfer determination unit that determines whether data is transferred; and 54, an encryption level is determined. 55 is an encryption level determining means for determining the data encryption level using the parameter information 54, and 56 is a level-specific encryption means for encrypting data according to the determined encryption level. , 57 are encrypted data, 58 is data transfer means for transferring data, 59 is a key and encryption level information for data encryption, and 60 is data on the receiving side which manages reception of the transferred data. A transfer management unit, 61 is a data receiving means for receiving the transferred data, and 62 is a level-specific decoding means for decoding the data.
[0006]
Next, the operation of this secure system will be described with reference to the flowchart of FIG. First, the data transfer determination means 53 of the transmission side 51 determines whether there is a transfer request for the data 52 (step S62). If there is no request, do nothing. If there is a request, the encryption level determining means 55 collects parameter information 54 for transfer (step S63).
[0007]
The parameter information 54 includes a data transfer speed, a data transfer medium, and a data transfer destination computer. The type of parameter information to be collected is set in advance by the user.
Next, the encryption level determining means 55 determines an encryption level using, for example, information of a data transfer medium among the parameter information (step S64). The correspondence between the transfer medium and the encryption level is set in advance by the user.
[0008]
According to the encryption level determined by the encryption level determining means 55 in this way, the level-specific encryption means 56 encrypts the data 52 (step S65). When the data has been encrypted, the data transfer means 58 uses a double encryption method to encrypt the encryption level and the key 59 used for the encryption to a person other than the sender and the receiver. (Step 66). Thereafter, the data transfer means 58 similarly transfers the encrypted data 57 to the receiving side 60 (step S67). The transferred data is taken into the receiving side by the data receiving means 61 together with the encryption level and the key 59 which have been transferred in advance, and is decoded by the level-specific decoding means 62.
[0009]
[Problems to be solved by the invention]
However, in such a conventional secure system, the encryption level is determined using the data transfer speed, the data transfer medium, and the computer to which the data is transferred as parameter information. I cannot judge it alone.
The actual transfer capability and quality change every moment depending on various factors of the communication state, such as the noise state of the communication medium and the operation rate. In addition, the data transferred via the communication port is not limited to a single data, and a plurality of various types of data are often transferred in parallel. If the control factor is used, inconsistency with the actual communication state occurs.
[0010]
That is, for example, during transmission of streaming data such as moving images and voices published on the Internet, where real-time properties are required but confidentiality is not much required, other real-time properties are not required. When transmitting data in response to a data transmission request, since the data is encrypted at a high encryption level, it exceeds the communication capability limit, and as a result, the communication quality is degraded due to data delay and loss. Can not cope with the possibility of occurrence.
[0011]
On the other hand, it is impossible for a certain encryption method to permanently guarantee complete security against attacks from malicious third parties, so that communication quality is not impaired. In some cases, it may be desirable to make the encryption as strong as possible.
[0012]
The present invention has been made in view of such circumstances, and it is an object of the present invention to provide a communication device that can achieve both confidentiality of transmitted and received data and communication quality.
[0013]
[Means for Solving the Problems]
The present invention provides a communication unit that transmits and receives data to and from one or more communication media, a communication state detection unit that monitors the state of the communication unit and obtains quality information that specifies a current communication state, A communication device comprising: an encryption level determining unit that determines an encryption level based on quality information; and an encryption unit that encrypts transmission data based on the determined encryption level. It is.
According to this, it is possible to achieve both confidentiality of transmitted / received data and communication quality in accordance with various quality information in the current communication environment.
[0014]
In addition, the communication state detection unit, as the quality information, the amount of data transmitted and received per unit time of the communication unit, the current link speed of the communication unit, the communication error rate of the communication unit, and the communication unit is a predetermined data At least one of the times from when the data is transmitted to when the response data corresponding to the data is received may be acquired.
These four pieces of quality information are information that changes every moment. If the encryption level is changed by acquiring the value of these pieces of quality information at the time of data transmission, it is more suitable for the actual communication state. Confidentiality and communication quality can be ensured.
[0015]
Furthermore, when the communication unit transmits and receives data wirelessly, the communication state detection unit may acquire the received radio wave intensity as quality information.
The encryption level determined by the encryption level determination unit is determined by the key length of the encryption key, the encryption method, the number of times the encryption process is applied, and the data amount of the initialization vector added to the encrypted data. , Or at least one of them.
[0016]
Here, the key length of the encryption key is represented by a data length such as 8 bits or 16 bits. The longer the key length, the higher the degree of encryption and the higher the confidentiality.
The encryption method is information indicating which encryption method among various available encryption methods is used. For example, DES, IDEA, RC2, RC4, RC5 (above, a common key method), RSA, D -Hellman (above, public key system), hybrid system, and the like.
The number of times the encryption processing is applied indicates how many times the basic encryption processing is repeated, and the degree of confidentiality also differs depending on the number of times. As the basic encryption processing, the same encryption scheme may be applied a plurality of times, or different encryption schemes may be applied in order.
The initialization vector is redundant data that is added to the encryption key in order to increase the secrecy of the encryption, and is predetermined fixed data of several bits.
[0017]
In order to enhance confidentiality, it is preferable that the key length of the encryption key is generated by a one-way hash function.
Each information of the encryption level determined by the encryption level determination unit may be added to the data encrypted by the encryption unit and transmitted by the communication unit. According to this, the data itself and the information of the encryption level are transmitted simultaneously in one packet.
[0018]
The encryption key itself used by the encryption unit is encrypted by a predetermined encryption method, and is transmitted by the communication unit as data different from transmission data encrypted using the encryption key. You may. According to this, the data itself and the encryption key are transmitted separately.
The communication device may further include a decryption unit that decrypts the received data based on information on an encryption level included in the data received by the communication unit.
[0019]
The apparatus further includes a confidentiality information detection unit configured to detect confidentiality information added in advance to the transmission data or confidentiality information set from specific information included in the transmission data; However, the encryption level may be determined using the acquired quality information and the detected confidentiality information.
Here, the confidential information indicates the degree of confidentiality given to each data to be transmitted, and may be, for example, two-stage information indicating high confidentiality or low confidentiality, and is classified into n paragraphs. It may be information. Details will be described later.
[0020]
The apparatus further includes a priority information detecting unit that detects priority information of data transfer added in advance in the transmission data or priority information set from specific information included in the transmission data, The determining unit may determine an encryption level using the acquired quality information and the detected priority information.
Here, the priority information is information that determines the transmission order when there is a large amount of data to be transmitted, and may be two-stage information indicating high priority or low priority, or information classified into n stages. It may be. When there is a large number of transmission data, data having a higher priority is transferred first, regardless of the order in which the data was created.
[0021]
A confidentiality / priority detecting unit for detecting confidentiality information and priority information given in advance in the transmission data, or confidentiality information and priority information set from specific information included in the transmission data; An information setting unit for setting which of the quality information, the confidentiality information, and the priority information is to be used to determine the encryption level, wherein the encryption level determination unit includes the information setting unit. The encryption level may be determined using the information set by the user.
[0022]
Factors that determine the encryption level include quality information, confidentiality information, and priority information. The user may be able to set which information to use based on his or her own intention or experience.
The information setting unit can use a key input, a switch, and the like.
[0023]
In the above communication device, the communication unit means a communication port in the following embodiment, and when there is one communication port, performs one-to-one communication with another communication device via the communication port. When there are two or more communication ports, one-to-n communication is performed with other n communication devices.
[0024]
Each component of the communication device may be constituted by hardware logic. However, in order to flexibly cope with function expansion and change, a microcomputer including a CPU, a ROM, a RAM, an I / O controller, a timer, and the like is used. And a program indicating a processing procedure.
In addition, each component may be realized as physically separate hardware elements, but may be realized as an integrated hardware element when there is a common part or for miniaturization and cost reduction. Good.
For example, the encryption unit and the decryption unit may be formed as hardware fixed inside a communication unit (communication port).
[0025]
Further, the present invention provides a plurality of communication units for respectively transmitting and receiving relay data to and from a plurality of communication media, quality information for monitoring a state of the communication unit and specifying a current communication state, and relaying the communication unit. A communication state detecting unit for acquiring relay information on data to be transmitted, an encryption level determining unit for determining an encryption level based on the obtained quality information and the relay information, and relay data based on the determined encryption level. And a decryption unit that decrypts the relay data based on the determined encryption level. The communication unit decrypts the relay data received by the decryption unit, and then encrypts the relay data received by the encryption unit. A communication unit that transmits the encrypted relay data from a communication unit different from the communication unit that has received the relay data. According to this, it is possible to achieve both appropriate confidentiality of information and communication quality for relay data.
[0026]
For example, this communication device is disposed between two communication devices and relays data transmitted and received between the two communication devices. The two communication devices use different communication protocols, different communication speeds, and different encryptions. In this case, data communication between the two communication apparatuses is performed while maintaining appropriate confidentiality and communication quality even when the encryption scheme is used.
[0027]
The relay information may include at least one of communication port type information of a communication unit, a total amount of data relayed by a predetermined communication unit per unit time, and encryption information in an upper protocol layer. it can.
[0028]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, the present invention will be described in detail based on an embodiment shown in the drawings. Note that the present invention is not limited by this.
[0029]
<Example 1>
FIG. 1 is a block diagram showing the overall configuration of a communication apparatus according to a first embodiment of the present invention.
In the communication device 21 shown in FIG. 1, reference numeral 2 denotes a communication port for transmitting and receiving physical data to and from a communication partner. The communication port is mainly composed of hardware, specifically, a LAN controller chip for Ethernet communication, a baseband processor and a wireless module for wireless LAN communication, and a digital signal for ADSL communication. A processor (DSP) and an analog front end are used.
[0030]
Depending on the actual hardware configuration, the communication port may not be clearly separated into hardware and software, for example, part of the processing of the communication port is performed by software using a CPU. Here, the part that establishes the communication path necessary for physically transferring to the communication partner using the communication medium, adds the header / footer to the packet, and performs the electrical conversion is called the communication port. I do.
[0031]
Reference numeral 3 denotes a communication state detection unit that acquires the communication state of the communication port 2, 4 denotes an encryptor that encrypts transmission data, 5 denotes an encryption level determination unit that determines an encryption level according to the communication state, and 6 denotes an encryption algorithm. , An encryption database for storing encryption keys and the like, 7 a transmission data queue for temporarily storing transmission data, 8 a data storage medium (specifically, a memory, a hard disk, etc.) for storing data to be transmitted and received, 9a, 9b is transmission data stored in the data storage medium 8 and transmitted from the communication port 2, 10 is reception data received by the communication port 2 and stored in the data storage medium 8, and 11 is received by the communication port 2. A decoder 12 decodes the data. Reference numeral 12 denotes a reception data buffer for temporarily storing the decoded data.
In a communication device dedicated to transmission, the decoder 11 and the reception data buffer 12 may not be provided.
[0032]
Here, the encryption database 6, the transmission data queue 7, the data storage medium 8, and the reception data buffer 12 use rewritable storage elements and storage media such as a RAM and a hard disk.
The communication state detector 3, the encryptor 4, the encryption level determiner 5, and the decoder 11 are not only hardware logic, but also a RAM, ROM, timer, I / O controller, It can also be realized by software processing using a microcomputer constituted by registers and the like.
That is, the functions of the communication state detection unit 3 and the encryptor 4 are realized by the CPU operating based on the programs stored in the ROM, the RAM, and the like.
[0033]
FIG. 7 shows an operation flowchart at the time of transmission of the communication apparatus according to the first embodiment of the present invention. The data transmission is started when the CPU of the communication device 21 executes a data transmission instruction in response to a data transmission request from a communication partner or a command input via an I / O controller (step S1).
Next, the CPU divides the transmission data (9a, 9b, etc.) stored in the data storage medium 8 into units called packets in association with the communication protocol applied to the transmission, and further divides the data into packets. Header information corresponding to the communication protocol is added, and the header information is transferred to the transmission data queue 7 (step S2).
[0034]
In some cases, the transmission data has a small data amount and does not need to be divided, or may be already divided in an upper protocol layer. When the packet is divided, the header information indicates whether the packet is a divided packet, information indicating whether the packet is in the middle of transmission data or the last packet, and information on the serial number of the packet. Is included.
[0035]
When the packet is transferred to the transmission data queue 7, the communication state detector 3 acquires the communication state of the communication port 2 (Step S3). Here, it is assumed that the acquisition of the communication state is started each time a packet is transferred to the transmission data queue 7. However, it may be started each time the data amount of packets temporarily stored in the transmission data queue 7 reaches a certain amount, or may be started every predetermined unit time.
[0036]
The acquired “communication state” means quality information such as “the amount of data transmitted / received per unit time of the communication port (the number of bytes)” as described later, and the encryption level determination unit 5 determines the encryption level. Is a control factor when determining the
[0037]
Next, the encryption level determination unit 5 determines an encryption level based on the acquired communication state (Step S4). The details of the algorithm for determining the encryption level according to the communication state will be described later. This algorithm may be stored in a fixed memory such as a ROM, or may be an algorithm that allows the administrator or the user of the device to change the processing content by setting predetermined parameters.
[0038]
Next, the encryption level determination unit 5 acquires an encryption algorithm (encryption method) and an encryption key corresponding to the encryption level determined in step S4 from the encryption database 6 and transfers them to the encryptor 4. (Step S5).
The encryptor 4 sequentially encrypts the packets temporarily stored in the transmission data queue 7 using the encryption algorithm and the encryption key obtained in step S5 (step S6).
[0039]
Further, the CPU adds information indicating the encryption level (encryption level information) to the header portion of each encrypted packet and transfers the packet to the communication port 2 (step S7). Although not shown in the flowchart, if it is determined in step S4 that encryption is not to be performed, the processing from step S5 to step S7 is not performed, and the same as the normal non-encrypted transmission / reception processing Works.
[0040]
The communication port 2 establishes a communication path necessary for transferring the transferred packet to a communication partner using a physical communication medium, adds a header / footer to the packet, and performs electrical conversion. Then, the encrypted packets are sequentially transferred to the communication partner (step S8). At this time, it is determined from the header information of the packet whether or not the packet is the last packet divided from the transmission data (9a, 9b, etc.) (step S9). If completed, the data transmission is completed (step S10).
[0041]
Next, FIG. 8 shows a flowchart at the time of data reception in the first embodiment. First, when the CPU detects that data once received at the communication port 2 is addressed to itself, data reception is started (step S11).
[0042]
Next, the communication port 2 separates the header / footer information added to the packet from the received data for transfer by the physical communication medium and transfers it to the decoder 11 (step S12). The decryptor 11 reads the information of the encryption level added to the header information of the encrypted packet and recognizes the encryption level of the received packet (Step S13). Then, from this encryption level, information on the encryption method necessary for decryption and the corresponding encryption key is obtained from the encryption database 6 (step S14). However, the search of the encryption database may be performed only when the encryption level has changed from the previous decryption.
[0043]
Next, the decryptor 11 decrypts the packet using the encryption method and the encryption key obtained in step S14, and transfers the packet to the reception data buffer 12 (step S15). In step S16, it is determined whether or not the currently processed packet is final. If not, the decoding process from step S12 to S15 is repeated for the next received packet.
If the packet is final, the received data is restored according to the serial number of the received packet (step S17). Then, the restored received data is stored in the data storage medium 8, and the data reception is completed (step S18).
[0044]
If transmission and reception are performed according to such a procedure, communication encrypted at an optimal encryption level corresponding to a communication state that changes in real time can be performed. Further, according to the first embodiment, even when transmission of another transmission data 9b is started while transmission data 9a is being transmitted, all packets to be transmitted are temporarily stored in the transmission data queue 7 and then transmitted to the communication port 2. , It is possible to obtain accurate information on the current communication state.
[0045]
Next, the specific contents of the “communication state” acquired by the communication state detection unit will be described.
As the “communication state”, for example, the following five pieces of information can be considered.
(A) Data amount (bytes) transmitted / received per unit time via communication port
(B) Link speed of communication port
(C) Communication error rate of communication port
(D) Response time from transmission of data from the communication port to reception of response data for that data
(E) Radio field intensity received by the communication port for wireless communication
[0046]
Such information on the “communication state” is used as a control factor when the encryption level determination unit 5 determines the encryption level. As the control factor to be used, only one of the above information (a) to (e) may be used, but from the viewpoint of reliability or the like, a plurality of “communication state” information may be used in combination as necessary. You may.
The information is not limited to these five pieces of information, and other information may be used as a determinant of the encryption level.
[0047]
The data amount (a) to be transmitted / received per unit time is a factor for knowing the current actual communication capability, that is, the throughput. A large data amount means that the communication capability is high.
However, since data transmission and data reception are not always performed, simply obtaining the amount of data to be transmitted / received per unit time cannot be accurate information. For this purpose, transmission / reception data per unit time when data is continuously transmitted or received is used as the current throughput. Also, if the control factor for determining the encryption level fluctuates frequently, the processing load increases, which may cause a decrease in the overall communication performance.Therefore, an average value of the throughput values may be employed, or within a certain interval. It is preferable to obtain and adjust the maximum value.
[0048]
The link speed (b) of the communication port is a communication speed determined according to the line condition at the initial stage of the line connection.
For example, when the communication port is an ADSL modem, negotiation is performed between the ADSL modem and the office modem (DSLAM), and the link speed is determined according to the line condition. In the case of a wireless LAN compliant with the IEEE 802.11b standard, initial communication is performed at four link speeds of 1 Mbps, 2 Mbps, 5.5 Mbps, and 11 Mbps, and the speed determined to be most appropriate according to the current radio wave condition is the link speed. Is chosen as
[0049]
As the communication error rate (c) of the communication port, the ratio of the number of error occurrences to the number of transmitted and received packets or the number of error occurrences per unit time can be used. In any case, if the communication error rate increases, the number of packet retransmissions increases, resulting in a decrease in throughput. In addition, errors during communication include errors such as packet loss, checksum mismatch, and packet size difference.However, since the type of error and the frequency of occurrence of the error vary depending on the communication medium and the communication protocol, they are used as control factors. It is preferable to adjust the communication error rate based on what criteria to apply by adjustment.
[0050]
The response time (d) until the response data is received is information in consideration of the capability of the communication partner. In the case of communication that ensures the reliability of the communication path, response data indicating whether data has arrived correctly from the communication partner is received and the completion of data transmission is confirmed. The communication ability can be measured by the time until the data arrives. In addition, if the communication partner returns the response data after performing decryption processing instead of returning a response at the communication port, it will determine not only the communication capability but also the communication partner's capability including the encryption processing capability can do. For example, if the time until the response data is received is long, it is determined that the load of the decryption process is large, and the communication can be performed with the encryption level lowered.
[0051]
The radio wave intensity (e) is information used when performing wireless communication. In the case of performing wireless communication, the strength of radio waves changes due to the movement of the communication device, thereby changing the error rate and the like. As a result, the communication capability changes, so that it is preferable to use the radio wave intensity as a control factor for determining the encryption level.
[0052]
In addition, since the reliability and capability of communication differ depending on the communication medium and communication protocol, a more flexible and reliable determination of the encryption level can be determined by combining the above-mentioned “communication state” information of (a) to (e). It becomes possible. For example, if only the data transmission / reception amount per unit time is used as a control factor, the communication partner discards the received packet due to insufficient cryptographic processing capability, and even if retransmission occurs frequently, data transmission per unit time Since the amount does not change, it is determined that the encryption level is appropriate for the communication capability, and communication is performed while maintaining the encryption level. In such a case, by combining the information on the communication error occurrence rate, it is possible to detect the occurrence of many errors, and it is possible to perform communication at a lower encryption level.
[0053]
Next, specific processing contents (encryption level determination algorithm) of the encryption level determination unit will be described.
The encryption level determination unit 5 determines the encryption level by using the “communication state” information as described in the above (a) to (e). The encryption level is determined according to the determined encryption level as follows. Then, processing such as "change of key length of encryption key" and "change of encryption method" is performed.
First, the encryption level can be changed by “changing the key length of the encryption key”.
[0054]
For example, in a method using a common key, the number of bits of the common key used for data encryption is changed. The higher the number of bits of the common key, the more difficult it is to decipher and, on the other hand, the more time required for encryption and decryption, resulting in lower transfer capabilities. A plurality of common keys having different numbers of bits may be stored in the encryption database 6 in advance, or a necessary number of bits extracted from a certain master key may be used as the common key.
[0055]
However, it is inefficient to have a plurality of common keys with different numbers of bits, and it is inefficient to cut out the necessary number of bits and use it as a common key. There is a risk that all of the common keys will be leaked. Therefore, it is preferable to generate a key having an arbitrary number of bits by applying a one-way hash function to the master key. If a key is generated by a one-way hash function, even if a key having a certain number of bits is leaked, it is almost impossible to obtain a master key from the key. An example of a one-way hash function is MD5 defined by RFC (Request For Comment) 1321 and the like.
[0056]
As the encryption method, a public key method may be used in addition to the common key method.
However, since encryption using the public key method usually requires a larger amount of calculation than the common key method, it is preferable to use it for authentication and transfer of a common key rather than a large amount of data communication.
[0057]
Further, when changing the encryption level, the encryption method itself may be changed. Depending on the type of encryption method, confidentiality, that is, resistance to unauthorized encryption by a third party is different even if the encryption key used has the same key length, and processing speed and data are added for each data. This is because the amount of redundant data is also different. For example, when the amount of data transmitted per transmission is small, the common key method may be changed to the public key method.
[0058]
Further, as a method of changing the encryption level, the number of times of applying the same or different encryption processing steps may be changed. For example, data is encrypted using a DES (Data Encryption Standard) encryption method that is generally used as commercial encryption, and a wireless LAN encryption method WEP (Wired Equivalent Privacy) defined by the IEEE 802.11 standard is used. In the case where wireless communication is performed by using encryption, when the radio wave condition deteriorates and the required throughput cannot be obtained, the encryption by WEP is canceled and only the DES is encrypted. According to this, the throughput can be improved. In addition, the number of times DES is applied is not limited to one time, and may be applied plural times.
[0059]
Further, the data amount of the initialization vector transmitted by being added to the encrypted data may be changed. For example, the above-mentioned WEP performs encryption using a common key method. However, in order to make it difficult to analyze a common key from a plurality of data encrypted using the same common key, encryption is performed on a common key basis for each packet. A random number generated by adding a 24-bit initialization vector is used. At this time, since the initialization vector is required for decryption together with the common key, the packet is transmitted with the initialization vector added thereto. In addition to the processing required for encryption / decryption, the data of the initialization vector causes a decrease in throughput. Therefore, in order to improve the throughput, the data amount of the initialization vector may be reduced depending on the radio wave condition. On the other hand, since an initialization vector of about 24 bits is not sufficient in terms of encryption reliability, if there is sufficient communication capacity, the data amount of the initialization vector may be increased in order to increase the reliability.
[0060]
Further, the information of the encryption level changed as described above may be added to the header portion of the encrypted data and transmitted.
Further, information such as an encryption key used for encryption may be encrypted by a predetermined encryption method and transmitted immediately before or immediately after transmitting the encrypted data. More specifically, when performing encryption communication using a common key having a certain number of bits, the encryption level is changed, and when changing the number of bits of the common key to be applied, a predetermined public key encryption is performed. By transmitting a new common key to the communication destination by the method, the receiving side decrypts the new common key with the newly obtained common key.
[0061]
<Example 2>
FIG. 2 is a block diagram showing the overall configuration of a communication device 22 according to a second embodiment of the present invention. Here, the second embodiment is different from the first embodiment in that two communication ports (2a, 2b) are provided and a data transmission destination detection unit 13 is provided.
The connection destinations of the communication ports (2a, 2b) are different communication partners. The data transmission destination detecting unit 13 uses the transmission destination address information of the transmission data and the address information assigned to each of the communication ports (2a, 2b) to determine which communication port is connected to which data should be transmitted. Is determined.
In addition, the communication state detection unit 3, the encryption unit 4, the encryption level determination unit 5, the transmission data queue 7, the decryption unit 11, and the reception data buffer 12 are shown in a configuration provided one by one. They may be provided separately.
[0062]
FIG. 9 shows a flowchart at the time of transmission according to the second embodiment of the present invention. The operation at the time of reception is the same as that shown in FIG.
In step S21, when data transmission is started in the same manner as in the first embodiment, the data is divided into packets, each packet is added with a header corresponding to a communication protocol, and transferred to the transmission data queue 7 (step S2). .
[0063]
Next, when detecting that the packet is stored in the transmission data queue 7, the data transmission destination detecting unit 13 checks the header portion in the packet and determines the transmission destination of the packet, that is, where the transmission destination is. It recognizes which communication port it should go through, and recognizes which communication port it should go through, and gives information about the destination to the communication state detector 3 (step S22). Then, upon obtaining the information on the transmission destination, the communication state detection unit 3 acquires the communication state corresponding to the transmission destination of the packet (step S23).
[0064]
Next, similarly to the first embodiment, the encryption level is determined (step S4), the encryption method and the encryption key are obtained and transferred to the encryptor 4 (step S5), and the packet of the transmission data queue is encrypted. (Step S6) is sequentially performed.
Thereafter, the CPU adds encryption level information to the encrypted packet and transfers the packet to the communication port (either 2a or 2b) corresponding to the destination (step S24).
[0065]
Next, the communication port transfers the encrypted packet to the destination (Step S8). It is determined whether or not the transferred packet is the last packet (step S9). If not, the process returns to step S2 and repeats the processes from steps S2 to S8. If it is the last packet, the data transmission is completed (step S10). .
As described above, in the second embodiment, since two communication ports are provided, the transfer efficiency can be improved when data is transferred to a plurality of destinations. Although the communication states are different from each other, there is an effect that even in such a case, communication encrypted at an optimum encryption level corresponding to the communication state that changes in real time is possible.
[0066]
<Example 3>
FIG. 3 is a block diagram showing the overall configuration of a communication device 23 according to a third embodiment of the present invention. Here, as in the first embodiment, one communication port 24 is provided, but the communication port 24 is different from the first embodiment in that the communication port 24 includes an encryptor 25 and a decryptor 26 therein. .
[0067]
Here, the encryptor 25 and the decryptor 26 built in the communication port 24 may be configured as hardware, and may be realized as an LSI element integrated with other functional blocks of the communication port 24.
As described above, by making the encryptor 25 and the decryptor 26 into hardware, the speed of the encryption process and the decryption process can be increased, and the load on the CPU of the communication device can be reduced.
[0068]
The communication state detector 3, the encryption level determiner 5, the encryption database 6, the transmission data queue 7, the data storage medium 8, the transmission data 9, the reception data 10, and the reception data buffer 12 are the same as those in the first embodiment.
[0069]
FIG. 10 is a flowchart at the time of transmission according to the third embodiment of the present invention. In step S31, when data transmission is started in the same manner as in the first embodiment, the data is divided into packets, each packet is added with a header corresponding to a communication protocol, and transferred to the transmission data queue 7 (step S2). .
[0070]
Next, as in the first embodiment, the communication state is obtained (step S3) and the encryption level is determined (step S4), and the communication port 24 obtains the encryption method and the encryption key, and the communication port 24 The data is transferred to the encryptor 25 (step S32).
Next, the CPU transfers the packet in the transmission data queue 7 to the encryptor 25 of the communication port 24 (Step S33).
[0071]
Thereafter, the encryptor 25 encrypts the given packet and adds encryption level information (step S34).
Then, the communication port 24 transfers the encrypted packet to the communication partner (Step S8).
Finally, similarly to the first embodiment, it is determined whether or not the transferred packet is the last one (step S9). If not, the processes from steps S2 to S8 are repeated. If the last, the data transmission is completed (step S9). S10).
[0072]
FIG. 11 shows a flowchart at the time of data reception according to the third embodiment.
When the data reception is started (step S35), the decoder 26 of the communication port 2 reads the encryption level information added to the header information of the encrypted packet (step S13).
Then, the decryptor 26 obtains, from the encryption database 6, information on the encryption method necessary for decryption and the corresponding encryption key from the read encryption level (step S14).
[0073]
Next, the decryptor 26 decrypts the packet using the encryption method and the encryption key obtained in step S14 (step S36), and transfers the decrypted packet to the reception data buffer 12 (step S37).
Next, in step S16, it is determined whether the currently processed packet is final, and if not, the processes from steps S13 to S37 are repeated.
[0074]
If it is final, the received data is restored according to the serial number of the received packet, the restored received data is stored in the data storage medium 8, and the data reception is completed (step S18). According to this, since the encryption process and the decryption process are performed by hardware, it is possible to speed up these processes and reduce the load on the CPU.
[0075]
<Example 4>
In the above embodiment, the encryption level is determined based on the “communication state” information. However, in this case, in addition to the “communication state” information, the encryption level is determined using “information about the content of data to be transmitted”. The following describes an example of determining the value.
FIG. 4 is a block diagram showing the overall configuration of a communication device according to a fourth embodiment of the present invention. In FIG. 4, in addition to the configuration of the first embodiment, a data content analyzer 14 and a confidentiality / priority detector 15 are provided.
[0076]
The data content analysis unit 14 is a part that receives the transmission data 9a and 9b and reads and analyzes information of a specific position in the data. Information or information of a specific position to which "priority information" is set, or information that can be used when determining "confidentiality information" or "priority information" to a specific position. It is provided to the priority detection unit 15. On the other hand, the transmission data 9a and 9b themselves are given to the transmission data queue 7. The confidentiality / priority detecting unit 15 obtains confidentiality information and priority information, which are one of the information on the contents of the transmission data, and transfers them to the encryption level determining unit 5 as control factors for determining the encryption level. Part.
[0077]
The encryption level determination unit 5 uses the “communication state” information acquired by the communication state detection unit 3 and the “confidentiality information” or “priority information” given from the confidentiality / priority detection unit 15. , Determine the encryption level.
[0078]
Therefore, in the first to third embodiments, the encryption level is determined by using the “communication state” information. In the fourth embodiment, however, the encryption level is determined by the “communication state” and the “confidentiality or priority” information. Is determined, the encryption level determination algorithm of the encryption level determination unit 5 is different from those of the first to third embodiments.
[0079]
The flow of the overall flowchart at the time of transmission by the communication device 27 of the fourth embodiment is the same as that of the processing of the first embodiment shown in FIG. 7, but the contents of the processing of steps S2 and S4 are different. In the fourth embodiment, in step S2, first, transmission data (9a, 9b) is read from the data storage medium 8 and transferred to the data content analysis unit 14. Then, the data content analysis unit 14 analyzes whether the data is data related to confidentiality or priority, sets a new confidentiality or priority if necessary, and divides the packet into packets. The transmission data (9a, 9b) is transferred to the transfer data queue 7.
[0080]
In step S4 of the fourth embodiment, first, the confidentiality / priority detection unit 15 performs a process of detecting information corresponding to confidentiality information or priority information at a specific position of a packet with respect to the transmission data transferred to the transmission data queue 7. After that, these pieces of information are transferred to the encryption level determination unit 5. Next, the encryption level determination unit 5 determines the encryption level using the “communication state” and the confidentiality information (or priority information). Other processes shown in FIG. 7 are the same as those in the first embodiment.
[0081]
Next, confidentiality information and priority information used as control factors in the fourth embodiment will be described.
The “confidentiality information” is information related to the reliability of communication. For example, when high reliability of communication is required, data indicating high confidentiality is set. Is set.
As the “confidentiality information”, one of the following two is used.
(A) Information preset in a specific position of transmission data (9a, 9b), for example, a header portion (information preset in data)
(B) New information that is set as a result of analyzing the specific contents of the transmission data (9a, 9b) and comprehensively determining the contents based on a certain standard
[0082]
First, additional information in a header portion of transmission data can be used as “information preset in data”.
For example, a ToS (Type of Service) field defined in IPv4 (Internet Protocol Version 4) defined in RFC794 can be used.
The ToS field is composed of 8 bits. Of these bits, a specific bit is related to reliability, so that the validity / invalidity of this bit may be used as confidentiality information.
[0083]
If this specific bit is valid, which means that high communication reliability is required, when the encryption level determination unit 5 determines the encryption level, even if the “communication state” is poor. The determination process is executed so that the encryption level is not lowered even when the throughput is low.
If the "communication state" is good when this bit is valid and the throughput is higher than a predetermined threshold level, the encryption level may be increased.
[0084]
Further, the data content analysis unit 14 may rewrite this specific bit of the ToS field to confidentiality information set in advance by the user.
In IPv4, an option field is prepared in addition to the ToS field. Therefore, this option field may be used as an area of confidentiality information. For example, if the communication device connected to the network sets arbitrary confidentiality information classified more finely in this option field, the confidentiality information set in the option field may be used.
[0085]
Next, the “new information set by analyzing the content of the transmission data” is the content itself of the information such as “authentication information”, “user name”, and “password” included in the content of the transmission data, and the information itself. Utilizing the presence or absence of information, it means newly created information.
The newly created information may be provided as it is to the encryption level determination unit 5 as a control factor, but the data content analysis unit 14 determines whether the specified bit corresponding to the “information preset in the data” You may write it.
[0086]
The “priority information” is information related to the transmission priority of the transmission data, and determines the level of the transmission priority by looking at this information.
As the “priority information”, similar to the “confidentiality information” described above, (a) “information preset in data” or (b) “new information set by analyzing transmission data contents” Can be used.
[0087]
As the “information preset in the data of the priority information”, for example, specific 3 bits defined as data indicating the priority in the ToS field of IPv4 can be directly used.
If the specific three bits are set to mean high priority, the encryption level is determined if the “communication state” is poor and the throughput is lower than a predetermined threshold when determining the encryption level. Decide the encryption level to lower the level. Then, data of a low encryption level is given to the encryptor 4 preferentially and transferred to the destination.
Further, the data content analysis unit 14 may rewrite the specific three bits into priority information set in advance by the user.
Furthermore, priority information may be set using the above-mentioned option field.
[0088]
As the “new information set by analyzing the contents of transmission data” of the priority information, for example, RTP (Real-time Transport Protocol) information defined in RFC1889 can be used.
This RTP is effective for transmission and reception of data requiring real-time properties such as voice communication using the Internet protocol. When RTP information exists, new information indicating high priority is set. .
[0089]
In this case, the data content analysis unit 14 detects whether or not the transmission data (9a, 9b) includes an RTP header. When the RTP header is detected, information indicating that the priority is high is set in a specific bit of the ToS field or the option field.
On the other hand, if no RTP header is detected, information indicating that the priority is low is set.
[0090]
When “high priority” is set as the priority information and the “communication state” is poor, the encryption level determination unit 5 sets a low encryption level in order to suppress a delay in data transfer. To do.
As described above, by using the “confidentiality information” or the “priority information”, data transmission more suitable for the current communication environment can be performed.
[0091]
Furthermore, both the confidentiality information and the priority information can be combined and used as a control factor for determining the encryption level.
By combining these two types of information, it is possible to achieve both confidentiality of information and communication quality depending on the content of information to be transmitted. For example, in the case of transmitting and receiving voice data, that is, two-way communication, if a delay in voice data occurs, smooth conversation cannot be performed, and communication quality deteriorates. Therefore, in order to have a smooth conversation, it is generally necessary to raise the priority even if the confidentiality is lowered.
[0092]
In the case of using only the priority information, setting a high priority lowers the encryption level to enable a smooth conversation, but may result in a state in which little confidentiality is provided. However, when making a voice call, there is a case where it is desired to keep confidentiality high depending on the content, and in this case, it is necessary to increase confidentiality.
[0093]
As described above, when confidentiality is also required after securing a certain level of smooth conversation, it is preferable to determine the encryption level in consideration of both confidentiality information and priority information.
For example, the algorithm for determining the encryption level is to first obtain an “communication state” and “priority information”, select an encryption level that does not cause a delay in voice data, and then select “confidential information”. , The encryption level may be changed so as to lower the selected encryption level by the number of ranks associated with the confidentiality information.
Further, the user may be able to set which of the quality information, the confidentiality information, and the priority information indicating the “communication state” is used for determining the encryption level. For example, it is only necessary to set and input which of the three pieces of information is used by key input and a switch.
[0094]
<Example 5>
Here, an embodiment of a communication device that changes the encryption level and relays data will be described.
FIG. 5 is a block diagram showing the overall configuration of a communication device according to a fifth embodiment of the present invention.
The communication device 31 of the fifth embodiment includes two communication ports (2a, 2b), and both data transmitted and received between a communication partner connected to the communication port 2a and a communication partner connected to the communication port 2b. It relays the direction.
[0095]
In FIG. 5, for relaying data to be sent from a communication partner connected to the communication port 2a to a communication partner connected to the communication port 2b, a decoder 11a, a data queue 32a, and an encryptor 4a are provided. A decoder 11b, a data queue 32b, and an encryptor 4b are provided for relaying data to be sent from a communication partner connected to the communication port 2b to a communication partner connected to the communication port 2b.
[0096]
For example, when a packet is received from a communication partner connected to the communication port 2a, the packet is decrypted by the decoder 11a, temporarily stored in the data queue 32a, and the encryption level determined by the encryption level determination unit 5 is used. Then, the temporarily stored packet is encrypted by the encryptor 4a and transferred from the communication port 2b to another communication partner.
[0097]
Here, the CPU of the communication device 31 performs analysis or conversion of a protocol and a transmission / reception address, other filtering, and scheduling based on packet priority, as necessary, for the data stored in the data queue 32a.
[0098]
FIG. 12 shows an operation flowchart of the communication device according to the fifth embodiment of the present invention.
Here, a case will be described in which data received from a communication partner connected to the communication port 2a is relayed to another communication partner connected to the communication port 2b. However, the same applies when data is relayed from the communication port 2b to the communication port 2a.
[0099]
In step S41, when data reception is started at the communication port 2a, the communication port 2a first removes the header and the footer added for the transfer by the physical communication medium, and adds the encryption level information to the packet. Determines whether the packet is encrypted by detecting whether the packet is added, or by determining whether the source information added to the packet is the communication partner that is performing the encrypted communication. (Step S42).
[0100]
If it is encrypted, the packet data is transferred to the decoder 11a (step S43).
If not, the data packet is transferred to the data queue 32a, and the process proceeds to step S47.
In step S44, the decryptor 11a reads the encryption level information added to the header of the packet and determines the encryption level of the packet (step S44).
[0101]
Next, referring to the encryption database 6, information on an encryption method necessary for decrypting data and an encryption key corresponding to the encryption method is acquired (step S45).
Next, the received packet is decoded using the obtained information, and is transferred to the data queue 32a (step S46).
In step S47, the packet is analyzed in the data queue 32a, and the packet is processed based on the analyzed contents. Here, processing of a packet means detection of a data transmission destination address, setting of confidentiality and priority of a packet, analysis, detection, filtering, scheduling, division / combination of a packet, and the like.
[0102]
Next, in step S48, as in the first embodiment, the communication state detection unit 3 acquires the “communication state” of the data transmission destination.
In step S49, the encryption level determination unit 5 determines the encryption level using the acquired “communication state” and the confidentiality and priority of the packet.
In step S50, the encryption level determination unit 5 acquires an encryption algorithm and an encryption key corresponding to the determined encryption level from the encryption database 6, and transfers them to the encryptor 4a (step S50).
[0103]
In step S51, the encryptor 4a sequentially performs encryption on the packets stored in the data queue 32a.
In step S52, information indicating the encryption level is added to the header of the encrypted packet, and the packet is transferred to the communication port 2b.
Finally, in step S53, the communication port 2b performs processing for transferring the transferred packet to a communication partner using a physical communication medium, that is, establishing a communication path, header / footer to the packet. Is added, and electrical conversion is performed, and packets are sequentially transferred to the communication partner, and the process is completed.
[0104]
Next, an embodiment of a specific configuration of the data queue 32 will be described.
FIG. 6 is a block diagram illustrating a configuration of the data queue 32a according to the fifth embodiment. The data queue 32b in FIG. 5 has the same configuration.
6, the data queue 32a includes a memory element group including the reception data buffer 12 and the transmission data queue 7, and a functional block group such as the data transmission destination detection unit 13 and the schedule 37.
[0105]
The function block group is preferably configured by hardware logic from the viewpoint of high-speed processing, but may be realized by a microcomputer centered on a CPU and a program indicating a processing procedure of each function block. .
The reception data buffer 12, the transmission data queue 7, the data transmission destination detection unit 13 and the secrecy / priority detection unit 15 shown in FIG. 6 have the same functions as those described in the first, second and fourth embodiments. It is a functional block having.
[0106]
The packet filter 33 is a part for selecting a packet to be transferred. The packet filter 33 examines a packet in the reception data buffer 12, and determines a packet that does not need to be transmitted, a packet from a terminal that is not permitted to transmit, and a terminal that is not permitted to access. Discard the destination packets and transfer only the necessary packets.
[0107]
The address / protocol conversion unit 34 is a unit that performs an address conversion and a protocol conversion necessary in a case such as an Internet connection by a device on the LAN via the communication device 31. For example, it means converting an address between a global address and a local address, and the protocol conversion means, for example, converting a protocol between ATM and TCP / IP.
[0108]
The confidentiality / priority analysis unit 35 is a part that analyzes the contents of the packet that has passed through the packet filter 33 in order to set the confidentiality or the priority of the packet. The confidentiality / priority setting unit 36 is a part for setting confidentiality or priority to a packet.
For example, the confidentiality / priority analysis unit 35 checks the type of the upper protocol layer in the packet, and if this is RTP, the confidentiality / priority setting unit 36 sets a high priority.
[0109]
The scheduler 37 is a part that determines the transfer order by using the priority given to the packet. For example, a packet given a high priority has a transmission data queue prior to a packet given a low priority. 7 is transferred.
[0110]
Although FIG. 5 shows a configuration in which the encryptor 4 and the decryptor 11 are provided independently of the communication ports 2a and 2b, the encryptors and the decryptors may be built in the communication ports 2a and 2b. Good. According to this, the internal processing of the data queue 32 and the encryption / decryption processing can be distributed and parallelized to reduce the overall processing time.
[0111]
Next, a description will be given of a communication state to be acquired by the communication state detection unit 3 when relaying data of the fifth embodiment.
The fifth embodiment differs from the first to fourth embodiments in that the main function is to relay data, unlike the first to fourth embodiments.
That is, it is preferable to use information (relay information) on data to be relayed as information on the “communication state”, in addition to quality information such as a transmission data amount and a link speed of the communication port.
As information (relay information) on data to be relayed, the type of port, total measurement of relay data, encryption information of a higher protocol layer, and the like can be used.
[0112]
The “port type” refers to, for example, information for distinguishing between wired and wireless, and information for distinguishing a communication protocol for a communication port to perform physical communication. Since the communication port usually depends on the hardware of the communication port (2a, 2b), port information is set in advance for each communication port. For example, when one communication port 2a is connected to a wired communication medium and the other communication port 2b is connected to a wireless communication medium, data that is encrypted at the same encryption level is usually transmitted and received wirelessly. It can be said that the data to be transmitted has lower confidentiality than the wired data.
[0113]
Therefore, when the information indicating the type of the port of wireless as the “communication state” is obtained, the data transmitted from the communication port is encrypted using the encryption level with the higher rank even in the communication state with low throughput. Should. That is, the “port type” is used as a reference for selecting the encryption level of the relay data.
[0114]
“Total measurement of relay data” refers to the total amount of data relayed per unit time of a communication port.
For example, by comparing the total weighing with a reference amount corresponding to the processing capacity of the relay, if the total weighing is larger than the reference amount, the encryption level is lowered, and if the total weighing is lower, the encryption level is raised.
This total measurement can be obtained by measuring the number of packets actually passing through the communication port. If the encryption level is selected in consideration of the processing capacity of the actual amount of relay data, more efficient and secure communication can be performed.
[0115]
The “encryption information of the upper protocol layer” means information as to whether or not the data content obtained by removing the header information of the protocol (lower protocol) applied for communication is encrypted. This information can be obtained from header information in the upper layer protocol. For example, if the data to be relayed is already encrypted by TLS (Transport Layer Security), which is information of an upper protocol layer defined by RFC2246, the confidentiality of the information to be transmitted exceeds a certain reference level. Only when communication capacity is available, the lower protocol layer performs encryption at a higher encryption level, and otherwise performs encryption at a lower encryption level or does not perform encryption processing.
As described above, by using the information of the upper protocol layer, a more appropriate encryption level can be selected from the viewpoint of processing speed and confidentiality.
[0116]
【The invention's effect】
According to the present invention, since the encryption level can be selected in consideration of the information related to the actual communication state, it is possible to achieve both confidentiality of transmitted and received data and communication quality.
[Brief description of the drawings]
FIG. 1 is an overall configuration block diagram of a communication device according to a first embodiment of the present invention.
FIG. 2 is an overall configuration block diagram of a communication device according to a second embodiment of the present invention;
FIG. 3 is an overall configuration block diagram of a communication device according to a third embodiment of the present invention.
FIG. 4 is an overall configuration block diagram of a communication device according to a fourth embodiment of the present invention.
FIG. 5 is an overall configuration block diagram of a communication device according to a fifth embodiment of the present invention.
FIG. 6 is a configuration block diagram of a data queue according to a fifth embodiment of the present invention.
FIG. 7 is an operation flowchart at the time of transmission of the communication device according to the first embodiment of the present invention.
FIG. 8 is an operation flowchart at the time of reception of the communication device according to the first embodiment of the present invention.
FIG. 9 is an operation flowchart at the time of transmission of the communication apparatus according to the second embodiment of the present invention.
FIG. 10 is an operation flowchart at the time of transmission of the communication device according to the third embodiment of the present invention.
FIG. 11 is an operation flowchart at the time of reception of a communication device according to a third embodiment of the present invention.
FIG. 12 is an operation flowchart of Embodiment 5 of the communication device of the present invention.
FIG. 13 is a block diagram showing the entire structure of a conventional secure system.
FIG. 14 is a flowchart of an example of a conventional secure system.
[Explanation of symbols]
2 Communication port
3 Communication status detector
4 Encryptor
5 Encryption level determination unit
6 Cryptographic database
7 Transmission data queue
8 Data storage media
9a Transmission data
9b Transmission data
10 Received data
11 Decoder
12 Receive data buffer
13 Data transmission destination detection unit
14 Data Content Analysis Section
15 Confidentiality / priority detector
21 Communication equipment

Claims (13)

A communication unit that transmits and receives data to and from one or more communication media; a communication state detection unit that monitors the state of the communication unit and acquires quality information that specifies a current communication state; A communication device comprising: an encryption level determination unit that determines an encryption level by using the encryption unit; and an encryption unit that encrypts transmission data based on the determined encryption level. The communication state detection unit, as the quality information, the amount of data transmitted and received per unit time of the communication unit, the current link speed of the communication unit, the communication error rate of the communication unit, and the communication unit has transmitted predetermined data 2. The communication device according to claim 1, wherein at least one of the time from when the response data corresponding to the data is received is acquired. The communication device according to claim 1, wherein when the communication unit performs wireless data transmission and reception, the communication state detection unit acquires a received radio wave intensity as the quality information. The encryption level determined by the encryption level determining unit is one of the key length of the encryption key, the encryption method, the number of times the encryption process is applied, and the data amount of the initialization vector added to the encrypted data. The communication device according to claim 1, wherein the communication device is configured by at least one of at least one. The communication device according to claim 4, wherein the key length of the encryption key is generated by a one-way hash function. The communication device according to claim 4, wherein the encryption level determined by the encryption level determination unit is added to data encrypted by the encryption unit and transmitted by a communication unit. The encryption key itself used by the encryption unit is encrypted by a predetermined encryption method, and transmitted by the communication unit as data different from transmission data encrypted using the encryption key. The communication device according to claim 4, wherein: The communication device according to claim 1, further comprising a decryption unit that decrypts the data received by the communication unit based on information on an encryption level included in the data received by the communication unit. The confidentiality information added in advance in the transmission data, or further includes a confidentiality information detection unit that detects confidentiality information set from specific information included in the transmission data, the encryption level determination unit, The communication device according to claim 1, wherein an encryption level is determined using the obtained quality information and the detected confidentiality information. The encryption level determination unit further includes a priority information detection unit that detects priority information of data transfer given in advance in the transmission data or priority information set from specific information included in the transmission data. The communication device according to claim 1, wherein the communication device determines an encryption level using the obtained quality information and the detected priority information. A confidentiality / priority detecting unit for detecting confidentiality information and priority information given in advance in the transmission data, or confidentiality information and priority information set from specific information included in the transmission data; An information setting unit for setting which of the quality information, the confidentiality information and the priority information is to be used to determine the encryption level, wherein the encryption level determination unit sets the encryption level by the information setting unit. 2. The communication device according to claim 1, wherein an encryption level is determined using the obtained information. A plurality of communication units for transmitting / receiving relay data to / from a plurality of communication media, quality information for monitoring the state of the communication unit and specifying a current communication state, and relay information for data relayed by the communication unit. A communication state detection unit to obtain, an encryption level determination unit to determine an encryption level based on the obtained quality information and relay information, and an encryption unit to encrypt relay data based on the determined encryption level. A decryption unit that decrypts the relay data based on the determined encryption level. A communication device for transmitting the encrypted relay data from a communication unit different from the communication unit. The relay information includes at least one of communication port type information of a communication unit, a total amount of data relayed by a predetermined communication unit per unit time, and encryption information in an upper protocol layer. 13. The communication device according to claim 12, wherein:

Images