JP2007028260A - Communication terminal device and data transmission system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide secure transmission between arbitrary communication terminals on ring optical transmission lines. <P>SOLUTION: An encryption unit 26 encrypts transmit data. A dividing unit 28 divides an encrypted frame from the unit 26 into two. Each divided frame is output to ring optical transmission lines 12 and 14, through serial number appending units 30 and 32, destination number appending units 34 and 36, buffers 38 and 40, and electric/optic transducers 42 and 44. The units 30 and 32 append a same serial number to the divided frame for synthesizing. The units 34 and 36 append a destination number. Destination number discriminating units 50 and 52 supply an output signal of optic/electric transducers 46 and 48 to buffers 54 and 56 if the signal is addressed to themselves, and forward to the buffers 38 and 40 if the signal is not addressed to themselves. A synthesizer 60 synthesizes data of a same serial number stored in the buffers 54 and 56 into one. A decoding unit 62 decodes the synthesized data from the synthesizer 60. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a communication terminal device and a data transmission system.

  Conventionally, communication means with increased security has been used for electronic commerce and exchange of secret information. In general, a method is used in which a transmitting device encrypts data with an encryption key, and a receiving device decrypts the encrypted data with a decryption key to obtain the original plaintext. However, with this method, there is a risk that the data may be decrypted due to the decryption key being stolen or the like.

Patent Document 1 discloses a divided transmission system that improves confidentiality by dividing data to be transmitted into two parts and transmitting them through different paths. A method in which encryption is used together with the configuration described in Patent Document 1 is described in Patent Document 2.
Japanese Patent Laid-Open No. 10-70531 JP 2000-115162 A

  As a data transmission system, attention is focused on a ring network in which a plurality of communication terminal devices or nodes are arranged in a ring shape. Even in such a ring network, it is necessary to realize confidentiality and prevent data leakage by data transmission between a plurality of communication terminal apparatuses on the ring.

  An object of this invention is to show the communication terminal device which implement | achieves highly confidential communication by a ring network, and a data transmission system using the same.

  A communication terminal apparatus according to the present invention is a communication terminal apparatus disposed on first and second ring transmission lines that transmit signals in opposite directions, and encrypts transmission data and outputs an encrypted signal. , A dividing device that divides the encrypted signal into two and outputs the first and second divided signals, and a first addition that adds a first pair identifier and a destination identifier to the first divided signal A device, a second additional device that adds the second pair identifier corresponding to the first pair identifier and the destination identifier to the second divided signal, and a signal from the first ring transmission line A first input device that receives the signal from the second ring transmission line, and a first destination determination device that determines whether the destination of the signal input from the first input device is the local terminal or another terminal. The second input device and the signal input from the second input device. The second destination discriminating device for discriminating whether the destination is the own terminal or another terminal, the output signal of the first additional device, and the signal discriminated to be addressed to the other terminal by the first destination discriminating device A first output device that outputs to the downstream side of one ring transmission line, an output signal of the second additional device, and a signal that is determined to be addressed to another terminal by the second destination determination device A second output device that outputs to the downstream side of the ring transmission line, a signal that is determined to be addressed to the terminal by the first destination determination device, and a signal that is determined to be addressed to the terminal by the second destination determination device The signal processing apparatus includes a combining device that compares the pair identifiers of the signals and combines the signals determined to be a pair, and a decoding device that decodes the signal combined by the combining device.

  The data transmission system according to the present invention includes first and second ring transmission lines that transmit signals in opposite directions, and a plurality of communication terminal devices that are arranged on the first and second ring transmission lines. It is characterized by comprising.

  According to the present invention, in a data transmission system using the first and second ring transmission lines that transmit signals in directions opposite to each other, it is possible to realize data transmission that is highly confidential and hardly leaks data.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 shows a schematic block diagram of a communication terminal apparatus according to an embodiment of the present invention, and FIG. 2 shows a configuration example of a ring network of this embodiment.

As shown in FIG. 2, each communication terminal device 10 (10 ₁ to 10 ₈ ) of this embodiment is disposed on two ring optical transmission lines 12 and 14. The communication terminal device 10 (10 ₁ to 10 ₈ ) is, for example, an optical termination device (ONU). The signal light is transmitted in the counterclockwise direction on the ring optical transmission line 12 and is transmitted in the clockwise direction on the ring optical transmission line 14. Each communication terminal apparatus 10 (10 ₁ to 10 ₈ ) takes in data addressed to itself among data from upstream and outputs data addressed to other terminals to the downstream side.

  The ring optical transmission lines 12 and 14 may be set on the same optical fiber or may be set on different optical fibers. In the former case, for example, the wavelength of the clockwise signal light may be different from the wavelength or polarization of the counterclockwise signal light. Then, a WDM (wavelength division multiplexing) optical filter or a polarization beam splitter (PBS) that separates the clockwise signal light and the counterclockwise signal light at a portion connected to the ring optical transmissions 12 and 14 of each communication terminal device. Should be arranged. Here, for easy understanding, it is assumed that the ring optical transmission lines 12 and 14 are set on different optical fibers.

  The configuration and basic operation of the transmission system of the communication terminal device 10 will be described with reference to FIG. Each communication terminal apparatus 10 holds information specifying other communication terminal apparatuses installed on the ring optical transmission lines 12 and 14, for example, a terminal number or a terminal address in the destination information table 20. These pieces of information are collected by known means and stored in the destination information table 20 by the control device 22 that controls the entire communication terminal device 10. The destination information table 20 includes encryption setting information that defines the number (destination number) of a communication terminal device that is a destination (including via), a destination address, and an encryption key or an encryption method according to the destination. . When the destination address indicates a communication device connected to any one of the communication terminal devices, the destination information table 20 also stores the relationship between the communication device and the communication terminal device to which the communication device is connected.

  A data frame 70 to be transmitted to another communication terminal device is input to the destination determination device 24. In this embodiment, the data frame 70 has an Ethernet (registered trademark) frame structure as shown in FIG. The Ethernet (registered trademark) frame structure has a 7-byte preamble, a 1-byte SFD (Start Frame Delimiter), a 6-byte destination address, a 6-byte transmission source address, a 46 to 1500-byte data part, and a 4-byte error. It consists of CRC (Cyclic Redundancy Check) for detection and correction. Data to be transmitted is stored in the data portion. The preamble consists of alternating repetitions of 1 and 0. The SFD is “10101011”.

  The destination discriminating device 24 outputs the data frame 70 shown in FIG. 3A as it is to the encryption device 26, extracts the destination address from the data frame 70, and supplies it to the control device 22. The control device value 22 collates the destination address from the destination discriminating device 24 with the destination information table 20, reads the encryption setting information of the data frame 70, and sets it in the encryption device 26. The encryption device 26 encrypts the data frame 70 from the destination determination device 24 with the encryption key and the encryption method according to the encryption setting information set by the control device 22, and the encrypted frame 72 shown in FIG. Is output to the dividing device 28. When encryption is unnecessary, the encryption device 26 outputs the data frame from the destination determination device 24 as it is in accordance with an instruction from the control device 22.

  When highly secure communication is required, the control device 22 divides the encrypted frame from the encryption device 26 into two, one of the divided frames 74 to the serial number adding device 30, and the other of the divided frames 76 to the serial number. The dividing device 28 is instructed to supply to the adding device 32.

  In this embodiment, two-stage secure communication can be realized. The highest is the combination of encryption and split transmission using two ring optical transmission lines 14 and 12, and the next highest is encryption and only one of the optical ring transmission lines 12 and 14 is used. Transmission (single transmission line transmission) is used together. In the latter case, the control device 22 instructs the dividing device 28 to supply the encrypted frame to the serial number adding device 30 or 32 connected to the ring optical transmission line to be used.

  The two divided frames divided by the dividing device 28 are combined on the receiving side. For this purpose, the receiving side needs to be able to identify that the two divided frames are a pair. For identification, the serial number adding device 30 adds a serial number to the head of the divided frame 74 from the dividing device 28, and the serial number adding device 32 is also added to the head of the divided frame 74 from the dividing device 28. The same serial number as the serial number adding device 30 is added. The serial number added by the serial number adding devices 30 and 32 is a pair identifier indicating that each divided frame is divided from the same encrypted frame. The serial number added by the addition devices 30 and 32 is an example, and may not be a serial number as long as it indicates that each divided frame is a pair of frames to be combined on the receiving side.

  For example, the serial number adding apparatuses 30 and 32 use different series serial transmissions in the case of split transmission using both the ring optical transmission lines 12 and 14 and the transmission using only one of the ring optical transmission lines 12 and 14. A number or a serial number with a specific flag is added to the frame. Thereby, the receiving side can identify whether the frame is divided and transmitted or transmitted through one ring optical transmission line.

  The control device 22 reads the destination number corresponding to the destination address from the destination information table 20 and supplies it to the destination number adding devices 34 and 36. The destination number adding devices 34 and 36 add the destination numbers to the heads of the divided frames with serial numbers from the serial number adding devices 30 and 32, respectively, and frames 78 and 80 shown in FIGS. Output. The frame 78 output from the destination number adding device 34 is applied to the electrical / optical converter 42 via the buffer 38. Similarly, the frame 80 output from the destination number adding device 36 is applied to the electrical / optical converter 44 via the buffer 40.

  The buffer 38 also serves to return the data that is not addressed to the data input from the ring optical transmission line 12 to the downstream side of the ring optical transmission line 12, and the buffer 40 is the data that is input from the ring optical transmission line 14. Among these, it plays a role of returning data not addressed to itself to the downstream side of the ring optical transmission line 14. The details will be described later together with the reception function of the communication terminal device 10.

  The electrical / optical converter 42 converts the data frame from the buffer 38 into an optical signal and outputs the optical signal to the ring optical transmission line 12. This optical signal propagates counterclockwise on the ring optical transmission line 12 and is received by the destination communication terminal device. Similarly, the electrical / optical converter 44 converts the data frame from the buffer 40 into an optical signal and outputs the optical signal to the ring optical transmission line 14. This optical signal propagates clockwise through the ring optical transmission line 14 and is received by the destination communication terminal apparatus.

  The configuration and basic operation of the reception system of the communication terminal apparatus 10 will be described. The optical signal propagating counterclockwise through the ring optical transmission line 12 enters the optical / electrical converter 46, and the optical signal propagating clockwise through the ring optical transmission line 14 enters the optical / electrical converter 48. . The optical / electrical converter 46 converts the incident optical signal into an electrical signal and applies it to the destination number discrimination device 50. The optical / electrical converter 48 converts the incident optical signal into an electrical signal and applies it to the destination number discriminating device 52.

  The destination discriminating device 50 discriminates whether or not this data frame is addressed to itself from the destination number included in the data frame from the optical / electrical converter 46, and if it is addressed to itself, the destination number is removed from this data frame. The data frame is supplied to the buffer 54, and if it is not addressed to itself, the data frame from the optical / electrical converter 46 is transferred to the buffer 40 as it is. Similarly, the destination discriminating device 52 discriminates whether or not this data frame is addressed to itself from the destination number included in the data frame from the optical / electrical converter 48. The data frame except for is supplied to the buffer 56, and if not addressed to itself, the data frame from the optical / electrical converter 48 is transferred to the buffer 38 as it is. As a result, the data addressed to itself is stored in the buffers 54 and 56, and the data not addressed to itself is transmitted to the downstream communication terminal device via the buffers 38 and 40 and the optical / electrical converters 42 and 44. . The removal of the destination number may be performed on the buffers 54 and 56.

  The serial number discriminating device 58 compares the serial numbers ahead of the data frames stored in the buffers 54 and 56 and causes the synthesizing device 60 to read out the data frames having the same serial number from the buffers 54 and 56. The synthesizing device 60 is notified of the reading of the data frame with the serial number. Data frames having the same serial number that propagate through the ring optical transmission lines 12 and 14 are input to the buffers 54 and 56 with a time difference corresponding to the propagation delay time difference between the ring optical transmission lines 12 and 14. Accordingly, the buffers 54 and 56 have at least a storage capacity that can cope with the propagation delay time difference between the ring optical transmission lines 12 and 14.

  The synthesizing device 60 synthesizes the data frames from the buffers 54 and 56 into one frame in accordance with the notification from the serial number discriminating device 58 and supplies the synthesized frame to the decoding device 62. The data frames supplied from the buffers 54 and 56 to the synthesizing device 60 correspond to the divided frames shown in FIGS. 3C and 3D, and the synthesized frame by the synthesizing device 60 is the encrypted frame shown in FIG. Corresponding to The decryption device 62 decrypts the composite frame (encrypted frame) from the composite device 60 using a preset decryption key. The output data of the decryption device 62 is output to the outside as received data.

Next, a data transmission procedure for secure communication combining encryption and divided transmission will be described. A is added to the code | symbol of each element of the communication terminal device 10 (for example, communication terminal device 10 ₁ ) used as a transmitting device, and the code | symbol of each element of the communication terminal device 10 (for example, communication terminal device 10 ₅ ) used as a receiving device Add b to distinguish each element. Here, it is assumed to transmit data to the communication terminal apparatus ₁₀₅ from the communication terminal apparatus 10 ₁ of FIG.

In the communication terminal apparatus 10 _1, as described above, the control unit 22a is, reads the encrypted setting information from the destination information table 20a is set in the encryption apparatus 26a according to the communication terminal apparatus ₁₀₅ as a destination, The encryption device 26a encrypts the data frame 70 from the destination determination device 24a with an encryption key and an encryption method according to the encryption setting information.

  The dividing device 28a divides the encrypted frame from the encrypting device 26a into two in accordance with the instruction from the control device 22a, one divided frame 74 for the serial number adding device 30a, and the other divided frame 76 for the serial number adding device. 32a. The serial number adding device 30a adds a serial number to the head of the divided frame 74 from the dividing device 28a, and the serial number adding device 32a is the same as the serial number adding device 30a at the head of the divided frame 74 from the dividing device 28a. Add a serial number.

Controller 22a supplies the destination number of the communication terminal device ₁₀₅ from the destination information table 20a read, the destination number addition device 34a, to 36a. The destination number adding devices 34a and 36a add the destination numbers to the heads of the divided frames with serial numbers from the serial number adding devices 30a and 32a, and output frames 78 and 80, respectively. The frame 78 output from the destination number adding device 34a is applied to the electrical / optical converter 42a via the buffer 38a. Similarly, the frame 80 output from the destination number adding device 36a is applied to the electrical / optical converter 44a via the buffer 40a.

The electrical / optical converter 42 a converts the data frame from the buffer 38 a into an optical signal and outputs the optical signal to the ring optical transmission line 12. The optical signal propagates through the ring optical transmission path 12 in a counterclockwise direction, and inputs the communication terminal device 10 _2. The communication terminal apparatus 10 _2, as described above, converts the optical signal from the ring optical transmission line 12 into an electric signal, to determine whether self-addressed. Since we are not addressed to itself, the communication terminal apparatus 10 ₂ converts the electrical signal into an optical signal, and outputs the ring optical transmission path 12. The communication terminal devices 10 ₃ and 10 ₄ up to the communication terminal device 10 ₅ output the input data from the ring optical transmission line 12 as it is to the ring optical transmission line 12 as in the communication terminal device 10 ₂ .

The communication terminal apparatus _105, since the input data from the ring optical transmission line 12 is self-addressed, receives it. That is, the optical signal output from the communication terminal apparatus ₁₀₄ to the ring optical transmission line 12 enters the communication terminal device ₁₀₅ optical / electrical converter 46b. The optical / electrical converter 46b converts the incident optical signal into an electrical signal and applies it to the destination number discriminating device 50b.

  The destination discriminating device 50b discriminates whether or not this data frame is addressed to itself from the destination number included in the data frame from the optical / electrical converter 46b, and if it is addressed to itself, the destination number is removed from this data frame. The data frame is supplied to the buffer 54b, and if it is not addressed to itself, the data frame from the optical / electrical converter 46b is transferred to the buffer 38b as it is. Here, since it is data addressed to itself, the destination discriminating apparatus 50b supplies the data frame obtained by removing the destination number from the data frame from the optical / electrical converter 46b to the buffer 54b.

On the other hand, the electrical / optical converter 44 a converts the data frame from the buffer 40 a into an optical signal and outputs this optical signal to the ring optical transmission line 14. The optical signal propagates through the ring optical transmission line 14 in the clockwise direction is input to the communication terminal apparatus _108. Communication terminal apparatus _108, as described above, converts the optical signal from the ring optical transmission line 14 into an electric signal, to determine whether self-addressed. Since we are not addressed to itself, the communication terminal apparatus ₁₀₈ converts the electrical signal into an optical signal, and outputs the ring optical transmission path 14. The communication terminal devices 10 ₇ and 10 ₆ up to the communication terminal device 10 ₅ output the input data from the ring optical transmission line 14 to the ring optical transmission line 14 as it is, like the communication terminal device 10 ₈ .

The communication terminal apparatus _105, since the input data from the ring optical transmission line 14 is self-addressed, receives it. That is, the optical signal output from the communication terminal device ₁₀₆ to the ring optical transmission line 14 enters the communication terminal device ₁₀₅ optical / electrical converter 48b. The optical / electrical converter 48b converts the incident optical signal into an electrical signal and applies it to the destination number discriminating device 52b.

  The destination discriminating device 52b discriminates whether or not this data frame is destined for itself from the destination number included in the data frame from the optical / electrical converter 48b, and if it is destined for itself, the destination number is removed from this data frame. The data frame is supplied to the buffer 56b, and if not addressed to itself, the data frame from the optical / electrical converter 48b is transferred to the buffer 40b as it is. Here, since it is data addressed to itself, the destination discriminating device 52b supplies the data frame obtained by removing the destination number from the data frame from the optical / electrical converter 48b to the buffer 56b.

  The serial number discriminating device 58b compares the serial numbers at the heads of the data frames stored in the buffers 54b and 56b, reads the data frames with the same serial number from the buffers 54b and 56b to the synthesizing device 60b, and the same Read of the data frame with the serial number is notified to the synthesizing device 60b. The synthesizing device 60b synthesizes the data frames from the buffers 54b and 56b into one frame in accordance with the notification from the serial number discriminating device 58b, and supplies the synthesized frame to the decoding device 62b. The decrypting device 62b decrypts the composite frame (encrypted frame) from the composite device 60b with a preset decryption key. The output data of the decryption device 62b is output to the outside as received data.

In this embodiment, the communication terminal devices 10 ₁ to 10 ₈ take in only data addressed to themselves, and transfer the data addressed to other terminals as they are to the downstream side. Thus, the communication terminal apparatus ₁₀₅ is to not output toward the data from the ring optical transmission line 12 to the communication terminal apparatus ₁₀₆ does not output toward the data from the ring optical transmission line 14 to the communication terminal apparatus _104. The communication terminal apparatus _{10 2,} 10 _{3, 10} 4, 10 _6, 10 7, 10 ₈ located between the communication terminal apparatus 10 ₁ and the communication terminal apparatus ₁₀₅ is assumed, to sniff data destined for the other terminal even if they are changed, you can eavesdrop on half of the data from the communication terminal apparatus 10 ₁ to the communication terminal apparatus ₁₀₅ can not eavesdrop on remaining half of the data.

Therefore, even if the communication terminal devices 10 ₂ , 10 ₃ , 10 ₄ , 10 ₆ , 10 ₇ , 10 ₈ improperly take in the data that should have been transferred, the data will not leak. That is, in this embodiment, even if the encryption by the encryption device 26a is omitted, a certain level of security can be ensured. If the dividing device 28a divides the data frame that has passed through the encryption device 26a into two divided frames whose contents cannot be understood alone (for example, an even bit frame and an odd bit frame), The whole data can be understood only by stealing the divided frames.

Even if the encryption is used and the communication terminal devices 10 ₂ , 10 ₃ , 10 ₄ , 10 ₆ , 10 ₇ , and 10 ₈ obtain the decryption key, it is possible to decrypt only by obtaining half of the encrypted frame. Is impossible. Even if it can be partially decoded, the entire data cannot be grasped. For example, if the dividing device 28a divides the encrypted frame into two divided frames whose contents cannot be understood even if the decryption key is obtained, data stealing becomes even more difficult.

  When one of the ring optical transmission lines 12 and 14 cannot be used, the dividing device 28a of the communication terminal apparatus on the transmission side can use the ring transmission line (for example, an available frame transmission as it is without dividing the encrypted frame from the encryption apparatus 26a). , And supplied to the serial number adding device 30a on the transmission line 12) side. The serial number adding device 30a adds a number or identifier indicating data transmission using only one transmission path (single transmission path transmission) to the frame from the dividing device 28a. The output data of the adding device 30a is output to the ring optical transmission line 14 via the destination number adding device 34a, the buffer 38a, and the electric / optical converter 42a as in the case of the two-division transmission.

  On the receiving side, data from the ring optical transmission line 12 is stored in the buffer 54. When the serial number added to the data stored in the buffer 54b indicates a single transmission line transmission, the serial number discriminating device 58b causes the combining device 60b to read the corresponding data from the buffer 54b and The device 60b is instructed to directly pass the data from the buffer 54b to the decryption device 62b.

  By such an operation, data can be transmitted through a single transmission line even when the ring transmission lines 12 and 14 fail. Confidentiality is enhanced by intentionally using divided transmission and single transmission line transmission. In single transmission line transmission, there is a possibility of leakage in a communication terminal device that passes through, but there is no leakage in a communication terminal device that is ahead of the destination.

  Although the invention has been described with reference to specific illustrative embodiments, various modifications and alterations may be made to the above-described embodiments without departing from the scope of the invention as defined in the claims. This is obvious to an engineer in the field to which the present invention belongs, and such changes and modifications are also included in the technical scope of the present invention.

It is a schematic block diagram of a communication terminal device according to an embodiment of the present invention. It is a network block diagram of a present Example. It is a schematic diagram which shows the transition of the frame structure of a present Example.

Explanation of symbols

10 (10 ₁ to 10 ₈ ): Communication terminal device 12, 14: Ring optical transmission line 20: Destination information table 22: Control device 24: Destination determination device 26: Encryption device 28: Dividing device 30, 32: Serial number addition Devices 34, 36: Destination number adding device 38, 40: Buffer 42, 44: Electric / optical converter 46, 48: Optical / electrical converter 50, 52: Destination number discriminating device 54, 56: Buffer 58: Serial number comparison Device 60: Synthesizer 62: Decoding device

Claims (4)

A communication terminal device disposed on first and second ring transmission lines (12, 14) for transmitting signals in opposite directions,
An encryption device (26) for encrypting transmission data and outputting an encrypted signal;
A dividing device (28) for dividing the encrypted signal into two and outputting the first and second divided signals;
A first addition device (30, 34) for adding a first pair identifier and a destination identifier to the first divided signal;
A second addition device (32, 36) for adding the second pair identifier corresponding to the first pair identifier and the destination identifier to the second divided signal;
A first input device (46) for inputting a signal from the first ring transmission line (12);
A first destination discriminating device (50) for discriminating whether the destination of the signal input by the first input device (46) is its own terminal or another terminal;
A second input device (48) for inputting a signal from the second ring transmission line (14);
A second destination discriminating device (52) for discriminating whether the destination of the signal input by the second input device (48) is its own terminal or another terminal;
The output signal of the first additional device (30, 34) and the signal determined to be addressed to the other terminal by the first destination determination device (50) are downstream of the first ring transmission line (12). A first output device (38, 42) for outputting to
The output signal of the second additional device (32, 36) and the signal determined to be addressed to the other terminal by the second destination determination device (52) on the downstream side of the second ring transmission line (14) A second output device (40, 44) for outputting to
The pair identifier of the signal determined to be addressed to the terminal by the first destination determination device (50) and the signal determined to be addressed to the terminal by the second destination determination device (52) are compared, A synthesizing device (54, 56, 58, 60) for synthesizing signals determined to be
Decoding device (62) for decoding signals synthesized by the synthesizing device
A communication terminal device.   The communication terminal apparatus according to claim 1, wherein the first and second pair identifiers are the same identifier.   The communication terminal apparatus according to claim 1, wherein the first and second pair identifiers are made of the same serial number. First and second ring transmission lines (12, 14) for transmitting signals in opposite directions;
The plurality of communication terminal devices (10) according to any one of claims 1 to 3, arranged on the first and second ring transmission lines (12, 14).
A data transmission system comprising:

Images