JP2007192844A - Encryption label network - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the following problem that virtual networks using a VLAN tag or a label path are widely spread but, as for the security of the virtual networks, link-by-link encryption is carried out between adjacent nodes and, as a result, all the relay nodes require the function in order to secure end-to-end security. <P>SOLUTION: In an encryption label network, encryption processing is carried out, except for a header section necessary for relaying, only at an edge node in a label path or a VLAN with an encryption key corresponding to a label. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

Detailed Description of the Invention

The present invention relates to an encryption system in a VLAN tag network or a label path network.

Virtual networks using VLAN tags and label paths are widely used. However, with regard to security of virtual networks, IPsec 101 and MAC encryption technology are used for links 101, 102, and 103 between adjacent nodes, that is, links 101, 102, and 103 shown by dotted lines in FIG. Some are realized in link-by-link format.

Problems to be solved by the invention

However, in order to ensure end-to-end security, all relay nodes need to have the function.

Also, when a new encryption system is to be introduced, there is a problem that all nodes including the relay system must be replaced.

An object of the present invention is to provide an end-to-end secure path without depending on a relay node.

Means for solving the problem

In the encrypted label network according to the present invention, in a network in which a path or a virtual network is specified by a label, a transmission / reception end belonging to the path or virtual group specified by the label has a correspondence table of label values and encryption keys. The encryption key associated with the label is shared, and at the transmission end, all or part of the signal except the label with the label is encrypted using the encryption key, and the reception end In this case, the encrypted signal is decrypted using the encryption key or an encryption key paired therewith.

The encrypted label network according to the present invention is characterized in that, in a network in which a path or a virtual network is designated by a label, a transmission / reception end belonging to the path or virtual group specified by the label has a label value and an initial vector value. And the initial vector value associated with the label is shared, and at the transmitting end, encryption is performed using the initial vector value for all or part of the signal except the label. At the receiving end, the encrypted signal is decrypted using the initial vector value.

Furthermore, the encrypted label network according to the present invention performs encryption at a node to which a label is attached and decrypts at a node to remove the label.

The encryption label network according to the present invention provides authentication information at the node to be encrypted, checks authentication information at the node to decrypt the cipher, and discards an unauthenticated signal.

The encryption label network according to the present invention includes a server that manages the correspondence between the encryption key and the label and distributes the encryption key to the node, and the server uses the public key of each node. , The encryption key associated with the label is encrypted and distributed.

An encryption label network according to the present invention includes a table that inputs a label value, converts it into a code string, and outputs it; a pseudo-random number generator that inputs the output of the table as an encryption key and outputs a stream key; and the stream key It consists of an exclusive OR circuit as one input and has an encryptor. At the time of encryption, the exclusive OR circuit inputs a plaintext to be transmitted as the other input, outputs a ciphertext, and decrypts it. At this time, the exclusive OR circuit inputs the ciphertext received as the other input and restores the plaintext.

An encryption label network according to the present invention includes a table that inputs a label value, converts it into a code string and outputs it, a pseudo-random number generator that inputs an encryption key and an initial vector value, and inputs the output of the table as an initial vector value; And an exclusive OR circuit that has a stream key output from the pseudo random number generator as one input, and has an encryptor, and the exclusive OR circuit transmits it as the other input for encryption. The power plaintext is input and the ciphertext is output. When decrypting, the exclusive OR circuit inputs the ciphertext received as the other input and restores the plaintext.

Embodiment of the present invention

A first embodiment of the present invention will be described with reference to FIGS. FIG. 1A is composed of a network 25 and a server 20 including nodes 11, 12, 13, 14, 15, 16 as edge nodes and nodes 17, 18, 19, 21 as relay nodes.

Each edge node, for example, the node 12 accommodates users 22, 23, and 24. For example, in the path between the node 12 and the node 15, in the conventional technology, the encryption processing is performed for each of the encrypted links 101, 102, and 103 indicated by the dotted line in FIG. On the other hand, in the present embodiment, the encryption section is realized by the encryption path 100 as indicated by a solid line, not a link. That is, the encryption process is performed at the nodes 12 and 15 which are edge nodes, and the encryption process is not performed at the nodes 19 and 17.

FIG. 2 shows a configuration of a node that performs encryption processing. The node includes a control unit 1, a switch unit 2, and line interface circuits 4, 5, 6, and 7, and the line interface circuits 4 and 5 on the user side perform encryption processing.

The line interface circuit 5 includes an encryption circuit 8 provided on the input line side, a decryption circuit 9 provided on the output line side, a label reading circuit 10, and a control table 3. Note that the part where the label is attached and detached is omitted from the drawing for the sake of simplicity.

The control table 3 is a table indicating the correspondence between the label value on the signal frame and the corresponding encryption key.

A case where the Ethernet frame shown in FIG. 3 is used as the signal frame will be described. A label value is recorded in the VLAN-ID in the VLAN tag field.

A signal input to the line interface circuit 5 is added with a VLAN tag, and a signal frame having the configuration shown in FIG. 3A is supplied to the encryption circuit 8.

The label reading circuit 10 reads the VLAN-ID, refers to the control table 3, and obtains the corresponding encryption key. For example, if the VLAN-ID, that is, the label value is ABC, KEY1 is obtained, and if it is OPQ, KEY2 is obtained. The payload part is encrypted with the obtained encryption key as shown in FIG. Since only the payload portion is encrypted, the switch portion 2 does not need to be switched in consideration of the encrypted signal frame.

Decoding processing for a signal supplied from the switch unit 2 to the interface circuit 5 will be described.
The label reading circuit 10 reads the label value and refers to the control table 3. As a result, the corresponding encryption key is read out, supplied to the decryption circuit 9, and decryption processing is performed.

As shown in FIG. 3B, the payload portion is encrypted with the obtained key, and for example, a label value is encrypted as authentication information and added as encrypted authentication information.

Since the MAC address information and the VLAN tag are added as plain text to this signal frame, it is switched at the relay node in the same manner as other packets.

Next, authentication control will be described. The encryption circuit 10 encrypts a virtual network or path-specific value as an authentication code and adds it to the signal frame as encrypted authentication information. Although not shown, the processing of the authentication code can be realized by extending the function of the control table 3 to include the authentication code in addition to the encryption key.

The decryption circuit 9 compares the obtained authentication code with the authentication code corresponding to the label value in the control table 3 after decrypting the encrypted authentication information, and discards it if it does not match. From the received signal frame, the VLAN tag is removed and the line interface circuit 5 supplies the signal frame to the user.

The control table 3 is configured based on a notification from the server 20, but the encryption key associated with the label from the server 20 to each node is distributed using a public key method. The server 20 encrypts it with the public key of each node and transmits it to each node, and each node decrypts it with its private key in the control unit 1 to form the control table 3.

A payload hash value (plain text) may be added as encryption authentication information. In this case, the receiving side calculates the hash value of the decrypted payload part, compares it with the hash value of the added plaintext, and if they match, authenticates the signal frame from the correct source.

In the present invention, the encryption node is not limited to the node with the VLAN tag attached / detached, and the encryption node may be assigned according to the system design. Also in this case, the encryption key is assigned to the node for which the server 20 is specified.

As a label network, the present invention is applied to all labels using a label indicating a path between virtual nodes or a virtual network, such as label information in an MPLS shim header, as shown in FIG. 4, in addition to a VLAN network. Further, the target indicated by the label may be not only a packet signal but also a time division multiplexing based path.

In the case of an MPLS label, the label value is changed for each node, and the value changes. However, even if the label value at the encryption side edge node and the label value at the decryption side edge node are different from each other, The present invention can be applied.

Note that the encryption method for the signal frame may be a common key encryption method or a public key encryption method in which a public key and a secret key are shared within a group.

Referring to FIG. 5, a system using a vector stream encryption technique is shown. On the transmission side 30, the encryption circuit 8 connected to the control table 33 includes a pseudo random number generator 31 and an exclusive OR circuit 32. The pseudo random number generator 31 includes an encryption key and an initialization vector value for a label value. And the stream key is output, and the exclusive OR circuit 32 inputs the plaintext to be transmitted and the stream key, and outputs the ciphertext to be transmitted.

On the receiving side 40, the decryption circuit 9 connected to the control table 43 includes a pseudo random number generator 41 and an exclusive OR circuit 42. The pseudo random number generator 41 includes an encryption key for the label value and an initialization vector. The exclusive OR circuit 42 inputs the received ciphertext and the stream key, and restores the plaintext.

Next, a second embodiment of the present invention will be described. As an encryption technique, a vector streaming encryption technique is used, and an initialization vector value is given instead of an encryption key in correspondence with a label value. The configuration of the transmission side 30 and the reception side 40 at this time is shown in FIG.

In the control tables 34 and 44, the initial vector value is recorded in association with the label value instead of the encryption key. The initial vector value obtained by referring to the label value is supplied to the pseudo random number generators 31 and 41. The subsequent processing is the same as that in FIG.

As described above, even when the initial vector value is associated with the label, the same effect as when the encryption key is associated with the label can be obtained.

The present invention can be applied not only to a VLAN network and an MPLS network, but also to label-based or tag-based encryption in a network such as Ethernet Over MPLS and Ethernet Over IP.

The invention's effect

According to the present invention, since it is not necessary to install an encryption function in the relay node, a low-cost encryption network can be realized.

Further, according to the present invention, when the relay node and the edge node are different administrators, a secure path network can be established only by the policy of the edge node administrator without depending on the policy of the administrator of the relay node. Can be realized.

Since the label path shared by a large number of terminals is encrypted with one common key or a pair of public / private keys, operation management is simplified.

Since the correspondence between labels and keys is managed by a centralized control server, stable operation can be obtained.

A high-speed encryption network can be realized by using a vector streaming encryption technique characterized by high speed.

In addition to the encryption key, an initial vector value can be used to provide a virtual network-compatible encryption network, so that the required number of keys can be reduced and a more stable encryption system can be realized.

It is a figure which shows the network of this invention. It is a figure which shows the Example of this invention. It is a figure which shows the signal frame used for a present Example. It is a figure which shows another signal frame used for a present Example. It is a figure which shows the structure of the encryption system using a vector encryption technique. It is a figure which shows the structure of another encryption system using a vector encryption technique.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Control part 2 Switch part 3 Control table 4, 5, 6, 7 Line interface circuit 8 Encryption circuit 9 Decryption circuit 10 Label read-out circuit 11, 12, 13, 14, 15, 16, 17, 18, 19, 21 Node 22 , 23, 24 User 25 Network 30 Transmission side 40 Reception side 31, 41 Pseudorandom number generator 32, 42 Exclusive OR circuit 33, 34, 43, 44 Control table 100 Encryption path 101, 102, 103 Encryption link

Claims (11)

In a network in which a path or virtual network is specified by a label, the transmitting and receiving ends belonging to the path or virtual group specified by the label have a correspondence table of label values and code strings for encryption, and are associated with the labels. The transmission end is used to encrypt all or part of the signal excluding the label using the code sequence, and the reception end is configured to use the code sequence or An encrypted label network, wherein the encrypted signal is decrypted using a code string paired therewith. 2. The encryption label network according to claim 1, wherein the code string is an encryption key. 2. The encryption label network according to claim 1, wherein a vector type encryption method that also uses an initial vector value is adopted as an encryption method, and an initial vector value is used as the code string. 4. The encrypted label network according to claim 1, wherein encryption is performed at a node to which a label is attached. 5. The encrypted label network according to claim 1, wherein decryption is performed at a node from which the label is removed. 6. The authentication information is given at the node to be encrypted, the authentication information is checked at the node to decrypt the cipher, and an unauthenticated signal is discarded. The encryption label network described in 1. The encryption label network according to claim 1, further comprising a server that manages correspondence between the encryption key and the label and distributes the encryption key to a node. 8. The encrypted label network according to claim 7, wherein the server encrypts and distributes the encryption key associated with the label using a public key of each node. 7. The encryption label network according to claim 1, wherein a vector type encryption method is used as the method for encryption corresponding to the label. A table that inputs a label value, converts it into a code string and outputs it, a pseudo-random number generator that inputs the output of the table as an encryption key and outputs a stream key, and an exclusive OR circuit that uses the stream key as one input In the encryption, the exclusive OR circuit inputs a plaintext to be transmitted as the other input and outputs a ciphertext, and in the decryption, the exclusive OR circuit 3. The encrypted label network according to claim 2, wherein the ciphertext received as the other input is input to restore the plaintext. A table that inputs a label value, converts it into a code string and outputs it, a pseudo random number generator that inputs an encryption key and an initial vector value and inputs the output of the table as an initial vector value, and is output from a pseudo random number generator The encryption key is composed of an exclusive OR that has a stream key as one input, and has an encryptor. When encrypting, the exclusive OR circuit inputs the plaintext to be transmitted as the other input and outputs the ciphertext. 4. The encrypted label network according to claim 3, wherein, when decrypting, the exclusive OR circuit inputs the ciphertext received as the other input and restores the plaintext.

Images