JP4043860B2 - Encrypted communication device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an encrypted communication device that encrypts call voice and communication data from a communication terminal device and transmits the encrypted data to a counter device.
[0002]
[Prior art]
Conventionally, as such an encrypted communication device, one disclosed in JP 2001-36518 A is known.
[0003]
The encrypted communication device includes a caller-side encrypted communication device connected to the caller-side communication terminal device, and a counter-device-side encrypted communication device connected to the counter-device-side communication terminal device. The device and the counter device side encrypted communication device are respectively arranged between the transmission side communication terminal device and the counter device side communication terminal device, and realize encrypted communication between these communication terminal devices.
[0004]
The calling-side encrypted communication device has an encryption processing function that encrypts data from the calling-side communication terminal device and a decryption processing function that decrypts data from the opposite device-side encrypted communication device. The opposite device side encrypted communication device also has an encryption processing function for encrypting data from the opposite device side communication terminal device, and a decryption processing function for decrypting data from the outgoing side encrypted communication device. ing.
[0005]
The encrypted communication device includes destination information that is user identification information used in advance, encryption algorithm information used by each user, a management table that stores an encryption key corresponding to the encryption algorithm information, and an opposite device When the destination information is detected, the encryption algorithm information corresponding to the destination information is searched from the management table, the search unit for searching the encryption key corresponding to the searched encryption algorithm information from the management table, and the searched encryption And an encryption unit that encrypts or decrypts the data based on the algorithm information and the encryption key.
[0006]
According to this conventional encrypted communication device, the encryption algorithm information and the encryption key associated with the respective destination information are managed in the calling side encrypted communication device and the opposite device side encrypted communication device, By using the encryption algorithm information and the encryption key corresponding to this destination information, respectively, the encrypted communication between the calling side encrypted communication device and the opposite device side encrypted communication device is established. Data communication can be performed between the terminal device and the opposite device side communication terminal device.
[0007]
[Problems to be solved by the invention]
However, according to the above-described conventional encrypted communication device, the encryption algorithm information and the encryption key associated with each destination information are managed in the management table of the transmitting-side encrypted communication device and the opposite-side encrypted communication device. In addition, by using the encryption algorithm information and the encryption key corresponding to each destination information, respectively, the encrypted communication between the transmitting side encrypted communication device and the opposite device side encrypted communication device was established. In other words, since the encryption communication device recognizes the encryption algorithm information to be used based on the contents of each management table, communication between the encryption communication devices has been established only by encryption communication from the beginning. Therefore, for example, when there is a change in the contents of the management table of the transmitting side encrypted communication apparatus, the contents of the management table of the opposite side apparatus encrypted communication apparatus are also changed along with this change Unless following changes, since it is not possible to recognize the encryption algorithm information to be used between the encryption communication device can not be establishing communication between the encryption communication device.
[0008]
In addition, according to the conventional encrypted communication device, communication between encrypted communication devices must be established in order to establish data communication between the originating communication terminal device and the opposite device communication terminal device. In addition, since communication is established between encrypted communication devices only by encrypted communication, for example, if the opposite device side is not an encrypted communication device but a terminal connection device, the terminal connection device has an encrypted communication function. For this reason, it is impossible to establish encrypted communication between the calling-side encrypted communication device and the terminal connection device, and thus it is not possible to establish data communication between the communication terminal devices.
[0009]
The present invention has been made in view of the above points. The object of the present invention is to provide data with the opposite device even if the encryption algorithm information is changed or the opposite device does not have the encryption communication function. An object of the present invention is to provide an encrypted communication device capable of ensuring communication.
[0010]
[Means for Solving the Problems]
  In order to achieve the above object, an encrypted communication apparatus of the present invention comprises a communication terminal connection means for communication connection with a communication terminal apparatus, a counter apparatus connection means for communication connection with a counter apparatus, and a storage means for storing encryption algorithm information And an algorithm selection unit that selects arbitrary encryption algorithm information from a plurality of encryption algorithm information stored in the storage unit, and the communication terminal device based on the encryption algorithm information selected by the algorithm selection unit The encryption processing means for encrypting the communication data from the communication terminal, and when the communication data from the communication terminal apparatus is received, the encrypted communication is encrypted by the encryption communication for encrypting the communication data by the encryption processing means. Data transmitting means for transmitting data to the opposite device;,When transmitting destination information, the algorithm selection unit selects arbitrary encryption algorithm information from the storage unit and notifies the opposite device of the selected encryption algorithm information by non-encrypted communication.WhenHaveAn encryption communication apparatus, comprising: a priority table storing a priority for selecting encryption algorithm information by the algorithm selection unit for each destination information, wherein the algorithm selection unit detects the destination information Then, encryption algorithm information is selected from the storage means based on the priority corresponding to the destination information in the priority table.I did it.
[0011]
Therefore, according to the encrypted communication device of the present invention, when the destination information of the opposite device is detected, any encryption algorithm information is selected from the storage means, and the selected encryption algorithm information is transferred to the opposite device by non-encrypted communication. In other words, after setting communication with the opposite device to non-encrypted communication before transmission of communication data to the opposite device, the selected encryption algorithm information is transmitted to the opposite device with non-encrypted communication. Therefore, even if there is a change in the encryption algorithm information in the storage means or the opposite device side does not have the encryption communication function, it is possible to communicate with the opposite device by non-encrypted communication. Further, the encryption algorithm information selected by the calling-side encrypted communication device can be sequentially recognized on the opposite device side.
[0012]
  Further, according to the encrypted communication device of the present invention, the encryption algorithm information is not managed for each destination information, but arbitrary encryption algorithm information is selected from a plurality of encryption algorithm information stored in the storage means. As a result, there is more room for selection of encryption algorithm information, and further changes occur in the encryption algorithm information in the storage means. If the encryption algorithm information is used, encrypted communication with the opposite apparatus can be established.Furthermore, according to the encrypted communication apparatus of the present invention, each destination information has a priority table that stores the priority for selecting the encryption algorithm information, and when this destination information is detected, the destination information corresponds to the destination information. Since the encryption algorithm information is selected based on the priority order, the selection operation related to the encryption algorithm information for each destination information can be improved.
[0013]
The encrypted communication device of the present invention includes an algorithm receiving unit that receives the encryption algorithm information selected by the opposite device from the opposite device through the non-encrypted communication, and an encryption algorithm received by the algorithm receiving unit. It is determined that there is encryption algorithm information by an algorithm presence / absence determination unit that determines whether information is in the storage unit, a data reception unit that receives communication data from the opposite device, and the algorithm presence / absence determination unit Then, the same encryption algorithm information is selected from the storage means by the algorithm selection means, and the communication from the opposite device received by the data reception means based on the selected encryption algorithm information. And a decryption processing means for decrypting the data.
[0014]
Therefore, according to the encrypted communication apparatus of the present invention, when it is determined that the encryption algorithm information received from the opposite apparatus is in the storage means, the same encryption algorithm information is selected from the storage means, and this selection is performed. Since the communication data is decrypted based on the encrypted algorithm information, any encryption algorithm information is selected from the opposite device side, and it is determined that the encrypted communication device side has the same encryption algorithm information. Then, encrypted communication can be realized based on the encryption algorithm information, and further, communication data encrypted from the opposite device side can be decrypted.
[0015]
In the encrypted communication apparatus according to the present invention, when the algorithm transmission unit determines that there is no encryption algorithm information by the algorithm presence / absence determination unit, the algorithm selection unit stores arbitrary encryption algorithm information from the storage unit. And the selected encryption algorithm information is notified to the opposite apparatus by the non-encrypted communication.
[0016]
Therefore, according to the encrypted communication device of the present invention, when it is determined that the encryption algorithm information received from the opposite device is not in the storage means, the arbitrary encryption algorithm information is selected from the storage means, and this selected Since the encryption algorithm information is notified to the opposite device by non-encrypted communication, the encryption algorithm information is mutually notified with the opposite device, so that it is finally stored in each storage means. The same encryption algorithm information can be selected.
[0019]
The encrypted communication device of the present invention determines whether or not the encryption algorithm information from the opposite device has been received within a predetermined time after notifying the opposite device of the encryption algorithm information by the algorithm transmitting means. A reception determination unit for determining, and when the reception determination unit determines that the encryption algorithm information is not received, the communication terminal is connected to the opposite device in the non-encrypted communication. The communication data from the device was transmitted.
[0020]
Therefore, according to the encrypted communication device of the present invention, after the encryption algorithm information is notified to the opposite device, it is determined that the encryption algorithm information from the opposite device has not been received within a predetermined time. Since communication data is transmitted to the opposite device using non-encrypted communication, data communication with the opposite device can be realized using non-encrypted communication even if the opposite device does not have the encryption communication function. Can do.
[0027]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an encrypted communication system showing an embodiment of the encrypted communication apparatus of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a schematic configuration of the entire encrypted communication system according to the present embodiment.
[0028]
The encryption communication system 1 shown in FIG. 1 is an encryption that controls an integrated digital communication line 2, for example, four communication terminal apparatuses 3, and an interface for communication connection between these communication terminal apparatuses 3 and the integrated digital communication line 2. The communication device 10 or the terminal connection device 4 is included.
[0029]
It is assumed that the encrypted communication device 10 has an encrypted communication function, whereas the terminal connection device 4 does not have an encrypted communication function.
[0030]
For the convenience of explanation, the encryption communication device 10 is 10A for the encryption communication device on the transmission side, 10B for the encryption communication device on the opposite device side, and the communication terminal device 3 is for communication on the transmission side for convenience of explanation. The terminal device is 3A, and the communication terminal device on the opposite device side is 3B.
[0031]
FIG. 2 is a block diagram showing a schematic configuration inside the encrypted communication apparatus 10 according to the present embodiment.
[0032]
The encrypted communication device 10 shown in FIG. 2 includes a communication terminal device connection unit 11 that controls an interface with the communication terminal device 3, an integrated digital communication line connection unit 12 that controls an interface with the integrated digital communication line 2, and a plurality of ciphers. A memory unit 13 for storing various information such as encryption algorithm information, an encryption processing unit 14 for encrypting communication data from the communication terminal device 3, and communication data encrypted by the encryption processing unit 14; A data transmission unit 15 that transmits to the opposite device side through the integrated digital communication line connection unit 12, a data reception unit 16 that receives communication data from the opposite device side through the integrated digital communication line connection unit 12, and the received communication data The decryption processing unit 17 for decryption and the encryption algorithm information set by the encryption processing unit 14 and the decryption processing unit 17 are set. An encryption algorithm setting section 18, and a control unit 19 which controls the entire encrypted communication system 10.
[0033]
In the encryption processing unit 14, a function for executing encryption processing or non-encryption processing based on the encryption algorithm information set by the encryption algorithm setting unit 18 and encryption processing based on a common key described later are executed. It has the function to do.
[0034]
Similarly, the decryption processing unit 17 performs decryption processing or non-decryption processing based on the encryption algorithm information set by the encryption algorithm setting unit 18 and decryption based on a common key described later. And a function of executing the digitization process.
[0035]
Note that the encryption algorithm information set by the encryption algorithm setting unit 18 includes encryption algorithm information for executing non-encrypted communication of non-encryption processing and non-decryption processing. .
[0036]
The encrypted communication device 10 also includes a secret key storage unit 20 that stores a secret key common to the opposite device, a public key generation unit 21 that randomly generates a public key, and a common key based on the opposite device side public key. And a common key generation unit 22 for generating.
[0037]
The public key generated by the public key generation unit 21 of the originating encrypted communication device 10A is transmitted to the opposite device side encrypted communication device 10B through the data transmission unit 15, and the opposite device side encrypted communication device 10B. The public key generated by the public key generation unit 21 is transmitted to the caller-side encrypted communication device 10A through the data transmission unit 15. That is, the common key generation unit 22 of the encrypted communication device 10 generates a common key based on the public key exchanged with the opposite device.
[0038]
The common key is an encryption key used for performing data communication between the communication terminal devices 3 by encrypted communication.
[0039]
The encrypted communication device 10 includes an encryption algorithm information transmission unit 23 that transmits encrypted algorithm information selected by an algorithm selection unit 31 (described later) inside the control unit 19 to the opposite device by non-encrypted communication, And an encryption algorithm information receiving unit 24 for receiving the encryption algorithm information selected by the algorithm selection means 31 on the side by non-encrypted communication.
[0040]
FIG. 3 is a block diagram showing a schematic configuration inside the control unit 19 which is a main part of the encrypted communication device 10 according to the present embodiment.
[0041]
When the control unit 19 detects the destination information from the communication terminal device 3 through the communication terminal device connection unit 11, the algorithm selection unit 31 that selects the encryption algorithm information corresponding to the destination information from the memory unit 13, and the algorithm The algorithm transmission means 32 for transmitting the encryption algorithm information selected by the selection means 31 to the opposite apparatus by non-encrypted communication through the encryption algorithm information transmission section 23 and the encryption algorithm information reception section 24 from the opposite apparatus. Algorithm receiving means 33 for receiving the selected encryption algorithm information, algorithm presence / absence determining means 34 for determining whether or not the encryption algorithm information received by the algorithm receiving means 33 is in the memory unit 13, and algorithm transmission The encryption algorithm information is sent to the opposite device by means 32. After, within a predetermined time, and a reception determination unit 35 determines whether it has received the encryption algorithm information from the opposite device.
[0042]
When the algorithm presence / absence determination unit 34 determines that the encryption algorithm information is in the memory unit 13, the algorithm selection unit 31 selects the same encryption algorithm information from the memory unit 13 and selects the selected encryption algorithm. The algorithm information is set in the encryption processing unit 14 and the decryption processing unit 17 through the encryption algorithm setting unit 18.
[0043]
In addition, if the reception determination unit 35 does not receive the encryption algorithm information from the opposite device within a predetermined time, the algorithm selection unit 31 performs non-encryption so as to execute data communication with the opposite device by non-encrypted communication. Encryption algorithm information related to communication is selected, and the selected encryption algorithm information is set in the encryption processing unit 14 and the decryption processing unit 17 through the encryption algorithm setting unit 18.
[0044]
The counter device described in claims is the terminal connection device 4 and the counter device side encrypted communication device 10B, the communication terminal connection means is the communication terminal device connection unit 11, the counter device connection means is the integrated digital communication line connection unit 12, and the storage. The means is a memory unit 13, the encryption processing unit is an encryption processing unit 14, the data transmission unit is a data transmission unit 15, the data reception unit is a data reception unit 16, the decryption processing unit is a decryption processing unit 17, and a secret key storage unit. Is a secret key storage unit 20, a public key generation unit is a public key generation unit 21, a common key generation unit is a common key generation unit 22, and a public key transmission unit is a data transmission unit 15 and a data reception unit 16.
[0045]
Next, the operation of the encrypted communication system 1 showing this embodiment will be described. FIG. 4 is a sequence showing a data communication setting operation between the communication terminal apparatuses 3A and 3B between the encrypted communication apparatuses 10A and 10B.
[0046]
In FIG. 4, the calling-side encrypted communication device 10A detects a call from the calling-side communication terminal device 3A (step S11), and further detects destination information indicating a communication partner from the calling-side communication terminal device 3A (step S12). ) And the opposite device side encrypted communication device 10B is requested through the integrated digital communication line 2 (step S13).
[0047]
When detecting the call setting request, the opposite apparatus side encrypted communication apparatus 10B notifies the caller side encrypted communication apparatus 10A of the call setting reception for accepting the call setting request (step S14), and the call is encrypted on the caller side. The communication device 10A is notified (step S15).
[0048]
Further, the opposite device side encrypted communication device 10B notifies the opposite device side communication terminal device 3B of an incoming call (step S16).
[0049]
When the opposite device-side encrypted communication device 10B detects reception of an incoming call from the opposite device-side communication terminal device 3B (step S17), the opposite device-side encrypted communication device 10B notifies the caller-side encrypted communication device 10A of a response (step S18).
[0050]
Further, when detecting a response from the opposite device-side encrypted communication device 10B, the originating encrypted communication device 10A notifies the opposite device-side encrypted communication device 10B of a response confirmation for confirming this response (step S19). Thus, unencrypted communication is established with the opposite device side encrypted communication device 10B (step S20).
[0051]
Further, when the non-encrypted communication is established, the calling-side encrypted communication device 10A selects the encryption algorithm information corresponding to the destination information in step S12 from the memory unit 13, and uses the selected encryption algorithm information as the designated algorithm. As a non-encrypted communication to the opposite device side encrypted communication device 10B (step S21).
[0052]
When the opposite device side encrypted communication device 10B receives the designated algorithm, the opposite device side encrypted communication device 10B determines whether or not the same encryption algorithm information as the designated algorithm exists in the memory unit 13, and if there is the same encryption algorithm information. If determined, the encryption algorithm information is selected, and the selected encryption algorithm information is transmitted as a response algorithm to the transmission-side encrypted communication device 10A (step S22).
[0053]
Upon receiving the response algorithm from the opposite device side encrypted communication device 10B, the transmitting side encrypted communication device 10A performs an algorithm response check for confirming the response as the selected encryption algorithm information as common encryption algorithm information. To the communication device 10B (step S23).
[0054]
At this time, the same encryption algorithm information is selected by the algorithm selection means 31 of the transmitting side encrypted communication device 10A and the opposite device side encrypted communication device 10B (steps S24 and S25). Therefore, the first encrypted communication based on the same encryption algorithm information is established in the originating encrypted communication device 10A and the opposite device encrypted communication device 10B (step S26).
[0055]
Note that the first encrypted communication is used for exchanging public keys between the transmitting-side encrypted communication device 10A and the opposing device-side encrypted communication device 10B.
[0056]
When the first encrypted communication is established, the public key generation unit 21 of the transmitting-side encrypted communication device 10A generates a public key based on the encryption algorithm information and the secret key, and uses the public key as the first encryption key. Is transmitted to the opposite device-side encrypted communication device 10B by encrypted communication (step S27).
[0057]
Similarly, when the first encrypted communication is established, the public key generation unit 21 of the opposite device side encrypted communication device 10B generates a public key based on the encryption algorithm information and the secret key, and uses this public key. The first encrypted communication is transmitted to the caller-side encrypted communication device 10A (step S28). That is, the public key is exchanged between the originating encrypted communication device 10A and the opposing device encrypted communication device 10B.
[0058]
The common key generation unit 22 of the encrypted communication device 10A generates a common key based on the public key received from the opposite device-side encrypted communication device 10B (step S29), and enables communication with the communication terminal device ( Step S30).
[0059]
Similarly, the common key generation unit 22 of the opposite device side encrypted communication device 10B generates a common key based on the public key received from the outgoing side encrypted communication device 10A (step S31), and the opposite device side communication terminal device 3B. Can be communicated with (step S32).
[0060]
Then, the originating encrypted communication device 10A and the opposing device encrypted communication device 10B set the respective common keys in the encryption processing unit 14 and the decryption processing unit 17 through the encryption algorithm setting unit 18, thereby The second encrypted communication is established based on the common key (step S33).
[0061]
The second encrypted communication is used for data communication between the originating communication terminal device 3A and the opposing device communication terminal device 3B.
[0062]
Therefore, when the second encrypted communication is established, the originating side encrypted communication device 10A and the opposing device side encrypted communication device 10B use the second encrypted communication to transmit the originating side communication terminal device 3A and the opposing device side communication terminal device. Data communication between 3B is executed. Note that the encryption key sharing method of the second encrypted communication employs a general method such as the Diffe-Helman method and the RSA method.
[0063]
What should be noted here is that it is necessary to select the same encryption algorithm information in order to establish the first encrypted communication between the transmitting-side encrypted communication device 10A and the opposing device-side encrypted communication device 10B. However, the negotiation between the transmitting-side encrypted communication device 10A and the opposite-side encrypted communication device 10B when selecting the same encryption algorithm information is performed by unencrypted communication from step S20 to step S25. That's what it means.
[0064]
FIG. 5 is a sequence showing a data communication setting operation between the communication terminal apparatuses 3A and 3B between the caller-side encrypted communication apparatus 10A and the terminal connection apparatus 4.
[0065]
In FIG. 5, the calling-side encrypted communication device 10 </ b> A executes the communication preparation negotiation from step S <b> 11 to step S <b> 19 described above with the terminal connection device 4.
[0066]
When the terminal connection device 4 detects a response confirmation from the calling-side encrypted communication device 10A in step S19, the terminal-connecting device 4 notifies the opposite device-side communication terminal device 3B that communication is possible (step S41).
[0067]
When the sending-side encrypted communication device 10A notifies the terminal connection device 4 of the response confirmation, unencrypted communication is established with the terminal connection device 4 (step S42). Note that at the time of step S42, the calling-side encrypted communication device 10A does not recognize whether the opposite device is the terminal connection device 4.
[0068]
When the non-encrypted communication is established, the algorithm selection unit 31 of the transmitting-side encrypted communication device 10A selects arbitrary encryption algorithm information from the memory unit 13, and uses the selected encryption algorithm information as a designated algorithm. It transmits to the terminal connection apparatus 4 by encrypted communication (step S43).
[0069]
Further, the reception determination means 35 of the originating encrypted communication device 10A starts a timer for a predetermined time after transmitting the specified algorithm to the terminal connection device 4 in step S43, and within the predetermined time, the opposite device side (terminal connection device) If it is determined that a timeout has occurred without receiving the response algorithm or the designated algorithm from 4) (step S44), the algorithm selection means 31 selects encryption algorithm information corresponding to unencrypted communication (step S45). ).
[0070]
When selecting the encryption algorithm information corresponding to the non-encrypted communication, the transmitting-side encrypted communication device 10A notifies the transmitting-side communication terminal device 3A that communication is possible (step S46). Therefore, the data communication of the non-encrypted communication is established between the transmission side communication terminal device 3A and the counter device side communication terminal device 3B via the transmission side encrypted communication device 10A and the terminal connection device 4 (step S47). ).
[0071]
As described above, according to the encrypted communication system 1 shown in FIG. 5, even if the opposite device is the terminal connection device 4 that does not have the encrypted communication function, the caller side communication terminal device 3 </ b> A and the opposite device side Data communication between the communication terminal devices 3B cannot be performed, but data communication between the transmission side communication terminal device 3A and the counter device side communication terminal device 3B can be performed by unencrypted communication.
[0072]
Next, the data communication setting operation between the communication terminal apparatuses 3A and 3B shown in FIGS. 4 and 5 will be described in detail from the viewpoint of the encrypted communication apparatus 10A. FIG. 6 is a flowchart showing the processing operation of the control unit 19 in the encrypted communication device 10A related to the data communication setting process between communication terminal devices.
[0073]
The inter-communication terminal apparatus data communication setting process shown in FIG. 6 is a process for establishing data communication between the originating communication terminal apparatus 3A and the opposing apparatus side communication terminal apparatus 3B.
[0074]
In FIG. 6, the control unit 19 of the calling-side encrypted communication device 10A determines whether or not destination information has been detected from the calling-side communication terminal device 3A (step S51).
[0075]
If the algorithm selection means 31 of the control unit 19 detects the destination information from the communication terminal device 3A, the algorithm selection means 31 communicates with the opposite device (the opposite device side encrypted communication device 3B or the terminal connection device 4) corresponding to this destination information. Unencrypted communication is established between them (step S52).
[0076]
When the algorithm selection unit 31 detects the destination information from the transmission side communication terminal device 3A, the algorithm selection unit 31 selects arbitrary encryption algorithm information from the memory unit 13 (step S53).
[0077]
The algorithm transmission unit 32 of the control unit 19 transmits the arbitrary encryption algorithm information selected by the algorithm selection unit 31 to the opposite device (the opposite device side encrypted communication device 3B or the terminal connection device 4) as a specified algorithm (step) S54).
[0078]
The reception determination unit 35 of the control unit 19 transmits a designated algorithm to the opposite device in step S54, and then starts a predetermined time timer therein (step S55), and determines whether or not the predetermined time timer has expired. Determination is made (step S56).
[0079]
Further, the algorithm selection unit 31 sends a response algorithm or a specified algorithm from the opposing device within a predetermined time after the predetermined time timer has expired in the reception determination unit 35, that is, after the designated algorithm is transmitted to the opposing device. If not received, the opposite device does not have the encrypted communication function, for example, it is determined as the terminal connection device 4, and the data communication between the originating communication terminal device 3A and the opposite device side communication terminal device 3B is not encrypted. By setting to communication (step S57), as shown in step S47 of FIG. 5, data communication between the originating communication terminal device 3A and the counter device communication terminal device 3B is established by unencrypted communication, and this processing operation Exit.
[0080]
The reception determination unit 35 determines whether or not a response algorithm has been received from the opposing device unless the timer has expired in step S56 (step S58).
[0081]
If the control unit 19 receives a response algorithm from the opposite device in step S58, the control unit 19 transmits a response confirmation to the opposite device by non-encrypted communication (step S59).
[0082]
Further, after transmitting a response confirmation to the opposite device in step S59, the algorithm selection means 31 selects encryption algorithm information related to the response algorithm from the memory unit 13 (step S60), and this selected encryption algorithm By setting the data communication between the outgoing side encrypted communication device 10A and the opposite side encrypted communication device 10B to encrypted communication by encrypted communication based on information (step S61), as shown in step S26 of FIG. Data communication between the encrypted communication devices 10A and 10B is established by the first encrypted communication.
[0083]
Further, when data communication between the encrypted communication devices 10A and 10B is established in step S61, the control unit 19 exchanges public keys between the encrypted communication devices 10A and 10B in the encrypted communication and A common key is generated through the key generation unit 22 based on the public key received from the opposite device side encrypted communication device 10B (step S62).
[0084]
Furthermore, the control unit 19 sets data communication between the originating communication terminal device 3A and the opposing device communication terminal device 3B to encrypted communication based on the common key generated in step S62 (step S63). As shown in step S33 of FIG. 5, data communication between the communication terminal apparatuses 3A and 3B is established by the second encrypted communication, and this processing operation is terminated.
[0085]
In addition, the reception determination unit 35 determines whether or not a designated algorithm has been received from the opposite device unless it has received a response algorithm from the opposite device in step S58 (step S64).
[0086]
Furthermore, if the algorithm presence / absence determining means 34 of the control unit 19 receives the designated algorithm from the opposite device in step S64, it determines whether or not the same encryption algorithm information as the designated algorithm is present in the memory unit 13. Determination is made (step S65).
[0087]
If it is determined in step S63 that the same encryption algorithm information as the designated algorithm exists in the memory unit 13, the control unit 19 transmits a response algorithm corresponding to the designated algorithm to the opposing device (step S66).
[0088]
Further, after transmitting the response algorithm in step S66, the control unit 19 determines whether or not a response confirmation from the opposite device has been received (step S67).
[0089]
When receiving the response confirmation from the opposite device, the control unit 19 proceeds to Step S60 to select the encryption algorithm information corresponding to the response algorithm.
[0090]
If the designated algorithm is not received from the opposite device in step S64, the process proceeds to step S56 to determine whether or not the timer started in step S55 has expired.
[0091]
If the same encryption algorithm information as the designated algorithm is not in the memory unit 13 in step S65, another encryption algorithm information is selected from the memory unit 13 (step S68), and the selected encryption algorithm information is selected. Is transmitted to the opposite apparatus as a designated algorithm (step S69), and the process proceeds to step S56.
[0092]
As described above, according to the inter-communication terminal device data communication setting process shown in FIG. 6, before establishing the data communication between the originating communication terminal device 3A and the opposing device side communication terminal device 3B, the originating encrypted communication device 10A. Communication with the opposite device (encrypted communication device 3B or terminal connection device 4) is first set to non-encrypted communication. For example, the encryption algorithm information used in the opposite device-side encrypted communication device 10B is Even if it is not recognized in advance, the encryption communication device selects the encryption algorithm information common to the opposite device from the plurality of encryption algorithm information in the memory unit 13, and performs the encryption communication based on the encryption communication based on the common encryption algorithm information. After establishing data communication between 10A and 10B, a public key is exchanged by this encrypted communication to generate a common key, and a communication terminal device is obtained by encrypted communication based on this common key. It can be established A, the data communication between 3B.
[0093]
Even if the opposite device is the terminal connection device 4, data communication between the communication terminal devices 3A and 3B can be performed by establishing data communication between the communication terminal devices 3A and 3B by non-encrypted communication. .
[0094]
Similarly, even when the opposite device cannot select the common encryption algorithm information in the encrypted communication device 10B, the data communication between the communication terminal devices 3A and 3B is established by non-encrypted communication. Data communication between the communication terminal devices 3A and 3B can be performed.
[0095]
According to the present embodiment, when the transmission side encrypted communication device 10A detects the destination information of the opposite device (the opposite device side encrypted communication device 10B or the terminal connection device 4), any encryption algorithm information is stored from the memory unit 13. And the selected encryption algorithm information is notified to the opposite device by non-encrypted communication, that is, the communication with the opposite device is not encrypted before the data communication between the communication terminal devices 3A and 3B is established. Since the selected encryption algorithm information is notified to the opposite device by non-encrypted communication after setting to encrypted communication, the encryption algorithm information in the memory unit 13 is changed or the opposite device side performs encrypted communication. Even if the function is not provided, communication with the opposite apparatus can be performed by non-encrypted communication.
[0096]
According to the present embodiment, the encryption communication device 10A on the transmission side does not manage the encryption algorithm information for each destination information, but an arbitrary encryption algorithm from a plurality of encryption algorithm information stored in the memory unit 13. Since the information is selected, the scope for selecting the encryption algorithm information is widened, and further, the encryption algorithm information in the memory unit 13 is changed, and the management content is changed on the opposite device side in accordance with the change content. Even if it is not, encrypted communication with the opposite device can be established by using other encryption algorithm information.
[0097]
According to the present embodiment, the originating encrypted communication device 10A sets communication with the opposite device encrypted communication device 10B to non-encrypted communication, and the unencrypted communication causes the originating encrypted communication device 10A to Since the selected encryption algorithm information is notified to the opposite device side encrypted communication device 10B, the opposite device side can sequentially recognize the encryption algorithm information selected by the calling side encrypted communication device 10A.
[0098]
According to the present embodiment, when it is determined that the encryption algorithm information received from the opposite device is in the memory unit 13, the same encryption algorithm information is selected from the memory unit 13, and the selected encryption algorithm is selected. Since the communication data is decrypted based on the algorithm information, arbitrary encryption algorithm information is selected even from the opposite device side, and it is determined that the same encryption algorithm information exists in the transmitting side encrypted communication device 10A. Then, encrypted communication can be realized based on the encryption algorithm information, and further, communication data encrypted from the opposite device side can be decrypted.
[0099]
According to the present embodiment, when it is determined that the encryption algorithm information received from the opposite device is not in the memory unit 13, arbitrary encryption algorithm information is selected from the memory unit 13, and the selected encryption algorithm is selected. Since the information is notified to the opposite device by non-encrypted communication, the encryption unit information is mutually notified between the encrypted communication device 10A and the opposite device. The same encryption algorithm information stored in 13 can be selected.
[0100]
According to the present embodiment, if it is determined that the encryption algorithm information from the opposite device has not been received within a predetermined time after the encryption algorithm information is notified to the opposite device, the encryption is not performed. Since data communication with the opposite device is executed by communication, data communication with the opposite device can be realized by non-encrypted communication even if the opposite device does not have the encryption communication function.
[0101]
According to the present embodiment, the public key is encrypted by the first encrypted communication based on the encryption algorithm information and the secret key, and the encrypted public key is transmitted to the opposite device, and is opposed by the first encrypted communication. The opposite device side public key from the device is decrypted, a common key is generated based on the opposite device side public key, the communication data is encrypted by the second encrypted communication based on the common key, and the encrypted communication data Is transmitted to the opposite device and the communication data from the opposite device is decrypted by the second encrypted communication. Therefore, the encrypted communication is performed by the two-stage configuration of the first encrypted communication and the second encrypted communication. Can be realized.
[0102]
In the above embodiment, as shown in FIG. 2, the encryption communication device 10 includes the encryption processing unit 14 and the decryption processing unit 17 in the encryption communication device 10 as an example. It goes without saying that the same effect can be obtained even with an encryption communication device that does not include the encryption processing unit 17 and includes only the encryption communication function of the encryption processing unit 14.
[0103]
In the above embodiment, the algorithm selection unit 31 selects arbitrary encryption algorithm information from the memory unit 13. For example, a priority is assigned to each destination information from the transmission side communication terminal device 3A. Then, a plurality of encryption algorithm information may be stored, and the encryption algorithm information may be selected based on the priority for each destination information. FIG. 7 is an explanatory diagram showing the memory contents of the memory unit 13 for storing the encryption algorithm information with priorities given to each destination information.
[0104]
In FIG. 7, the memory unit 13 stores a plurality of pieces of encryption algorithm information with priorities assigned to each piece of destination information. For example, the destination information 1 has the first place in the encryption algorithm information A and the second place. Encryption algorithm information B, the third place is not encrypted.
[0105]
For example, when detecting the destination information 1 from the communication terminal device 3, the control unit 19 of the encrypted communication device 10 selects the first encryption algorithm information A corresponding to the destination information 1, and this encryption algorithm information If A is transmitted to the opposite device and the encryption algorithm information A indicating the response cannot be received from the opposite device, then the second-ranked encryption algorithm information B is selected, and this encryption algorithm information B is selected as the opposite device. Transmit to.
[0106]
According to the encrypted communication device 10 as described above, for each destination information, a priority order table storing the priority order for selecting the encryption algorithm information is stored in the memory unit 13, and when this destination information is detected, Since the encryption algorithm information is selected based on the priority corresponding to the destination information, the selection operation related to the encryption algorithm information for each destination information can be improved.
[0107]
【The invention's effect】
According to the encrypted communication device of the present invention configured as described above, when the destination information of the opposite device is detected, arbitrary encryption algorithm information is selected from the storage means, and the selected encryption algorithm information is not encrypted. The opposite device is notified by encrypted communication, that is, the communication with the opposite device is set to non-encrypted communication before communication data transmission to the opposite device, and then the selected encryption algorithm information is not encrypted. Since the encryption device information in the storage means has changed or the opposite device side does not have the encryption communication function, the opposite device can be communicated with the opposite device by non-encrypted communication. In addition, communication can be performed, and the encryption algorithm information selected by the transmission-side encryption communication device can be sequentially recognized on the opposite device side.
[0108]
According to the encryption communication apparatus of the present invention, instead of managing encryption algorithm information for each destination information, arbitrary encryption algorithm information is selected from a plurality of encryption algorithm information stored in the storage means. As a result, there is more room for selection of encryption algorithm information, and there is a change in the encryption algorithm information in the storage means. If the encryption algorithm information is used, encrypted communication with the opposite device can be established.
[0109]
According to the encrypted communication device of the present invention, when it is determined that the encryption algorithm information received from the opposite device is in the storage means, the same encryption algorithm information is selected from the storage means, and the selected encryption Since the communication data is decrypted based on the encryption algorithm information, any encryption algorithm information is selected from the opposite device side, and it is determined that the same encryption algorithm information exists on the encryption communication device side. Then, encrypted communication can be realized based on the encryption algorithm information, and further, communication data encrypted from the opposite device side can be decrypted.
[0110]
According to the encrypted communication device of the present invention, when it is determined that the encryption algorithm information received from the opposite device is not in the storage means, the arbitrary encryption algorithm information is selected from the storage means, and the selected encryption Since the algorithm information is notified to the opposite device by non-encrypted communication, the same information stored in the mutual storage means is finally obtained by mutually communicating the encryption algorithm information with the opposite device. Encryption algorithm information can be selected.
[0111]
According to the encrypted communication apparatus of the present invention, each destination information has a priority table that stores the priority order for selecting the encryption algorithm information. When this destination information is detected, the priority order corresponding to this destination information is stored. Since the encryption algorithm information is selected based on the above, the selection operation related to the encryption algorithm information for each destination information can be improved.
[0112]
According to the encrypted communication device of the present invention, after determining the encryption algorithm information from the opposing device within a predetermined time after notifying the encryption algorithm information to the opposing device, Since communication data is transmitted to the opposite device by non-encrypted communication, data communication with the opposite device can be realized by non-encrypted communication even if the opposite device does not have the encryption communication function. .
[0113]
According to the encrypted communication device of the present invention, after determining the encryption algorithm information from the opposing device within a predetermined time after notifying the encryption algorithm information to the opposing device, Since data communication with the opposite device is executed by non-encrypted communication, even if the opposite device does not have the encryption communication function, data communication with the opposite device can be realized by non-encrypted communication. it can.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an overall configuration of an encrypted communication system showing an embodiment of an encrypted communication apparatus of the present invention.
FIG. 2 is a block diagram showing a schematic configuration inside the encrypted communication device inside the encrypted communication system according to the present embodiment.
FIG. 3 is a block diagram showing a schematic configuration inside a control unit which is a main part inside the encrypted communication apparatus according to the present embodiment.
FIG. 4 is a sequence showing a data communication setting operation between communication terminal devices between encrypted communication devices of the encrypted communication system according to the present embodiment.
FIG. 5 is a sequence showing a data communication setting operation between communication terminal apparatuses between the encrypted communication apparatus and the terminal connection apparatus of the encrypted communication system according to the present embodiment.
FIG. 6 is a flowchart showing the processing operation of the control unit in the encrypted communication apparatus related to the data communication setting process between communication terminal apparatuses related to the present embodiment.
FIG. 7 is an explanatory diagram showing memory contents of a memory unit inside an encrypted communication apparatus according to another embodiment.
[Explanation of symbols]
3 Communication terminal equipment
4 Terminal connection device (opposite device)
10 (10A) encrypted communication device
10B Counter device side encrypted communication device (counter device)
11 Communication terminal device connection unit (communication terminal connection means)
12 Comprehensive digital communication line connection (opposite device connection means)
13 Memory part (storage means)
14 Encryption processing unit (encryption processing means)
15 Data transmission unit (data transmission means, public key transmission means)
16 Data receiving unit (data receiving means, public key transmitting means)
17 Decoding processing unit (decoding processing means)
19 Control unit
20 Private key storage (secret key storage means)
21 Public key generation unit (public key generation means)
22 Common key generation unit (common key generation means)
31 Algorithm selection means
32 Algorithm transmission means
33 Algorithm receiving means
34 Algorithm presence / absence judging means
35 Reception judging means

Claims (4)

From communication terminal connection means for communication connection with a communication terminal apparatus, counter apparatus connection means for communication connection with a counter apparatus, storage means for storing encryption algorithm information, and a plurality of encryption algorithm information stored in the storage means Algorithm selection means for selecting arbitrary encryption algorithm information, encryption processing means for encrypting communication data from the communication terminal device based on the encryption algorithm information selected by the algorithm selection means, and the communication When receiving communication data from the terminal device, the encrypted data is encrypted by the encryption processing means, the data transmission means for transmitting the encrypted communication data to the opposite device,
When the destination information is detected, the algorithm selection means selects arbitrary encryption algorithm information from the storage means, and sends the selected encryption algorithm information to the opposite apparatus by non-encrypted communication. An encrypted communication device comprising:
For each of the destination information, a priority order table storing a priority order for selecting encryption algorithm information by the algorithm selection means,
The algorithm selection means includes
When the destination information is detected, the encryption communication apparatus selects encryption algorithm information from the storage unit based on a priority corresponding to the destination information in the priority table. Algorithm receiving means for receiving the encryption algorithm information selected by the opposite device from the opposite device by the unencrypted communication,
Algorithm presence / absence determining means for determining whether or not the encryption algorithm information received by the algorithm receiving means is in the storage means;
Data receiving means for receiving communication data from the opposite device;
When it is determined that there is encryption algorithm information by the algorithm presence / absence determination means, the same encryption algorithm information is selected from the storage means by the algorithm selection means, and based on the selected encryption algorithm information 2. The encrypted communication device according to claim 1, further comprising: a decryption processing unit that decrypts the communication data received by the data receiving unit from the opposite device. The algorithm transmission means includes
If the algorithm presence / absence determining means determines that there is no encryption algorithm information, the algorithm selecting means selects arbitrary encryption algorithm information from the storage means, and the selected encryption algorithm information is stored in the non-encrypted information. 3. The encrypted communication apparatus according to claim 2, wherein the opposite apparatus is notified by encrypted communication. After receiving the encryption algorithm information to the opposite device in the algorithm transmission means, having a reception determination means for determining whether or not the encryption algorithm information from the opposite device has been received within a predetermined time,
The data transmission means includes
The communication data from the communication terminal device is transmitted to the opposite device by the non-encrypted communication when the reception determining means determines that the encryption algorithm information has not been received. 1. The encrypted communication device according to 1.

Images