JP5988814B2 - Communication device, slave station device, control device, communication system, and communication control method - Google Patents

Description

  The present invention relates to a communication system that includes a plurality of communication devices including a standby communication device, and each communication device performs encrypted communication with an opposite device.

  For example, in a PON (Passive Optical Network) system, a communication device (OLT: Optical Line Terminal) on the station side and each communication device (ONU: Optical Network Unit) on the subscriber side encrypt various information and transmit / receive them. It has been studied to enhance the security and improve the reliability of the system by providing a spare OLT (see, for example, Patent Document 1). Non-Patent Document 1 and Non-Patent Document 2 below define control procedures applied to the PON system.

JP 2011-166758 A

IEEE Std 802.3 (TM) -2008 IEEE Standard for Information technology-Telecommunications and information exchange between systems-Local and metropolitan area networks-Specific requirements Part3: Carrier sense multiple access with Collision Detection (CSMA / CD) Access Method and Physical Layer Specifications IEEE P.I. 1904 (TM) /D2.4 Draft Standard for Service Interoperability in Ethernet Passive Optical Network (SIEPON)

  In a communication system that performs encrypted communication, generally, when switching from the active system to the standby system due to a failure or the like, security information (that is, an encryption key) used in the encryption / decryption process In order to update the password, the encryption key is updated by authentication. Therefore, there is a problem that communication is interrupted during the encryption key update process, and the time until normal conduction after switching becomes long.

  In the system described in Patent Document 1, the authentication process for key update after switching is not necessary by using the encryption key that was used one generation before. However, the invention of Patent Document 1 assumes a configuration in which an encryption key is issued on the ONU side, and when applied to a system in which an OLT issues an encryption key, an encryption key used after switching determination and after switching processing Is required from the active OLT to the standby OLT.

  The present invention has been made in view of the above, and obtains a communication device, a slave station device, a control device, a communication system, and a communication control method that can shorten the time required for normal conduction when switching to a standby system. For the purpose.

  In order to solve the above-described problems and achieve the object, the present invention provides an active parent station device and a standby parent station device that perform encrypted communication with a slave station device, and the active parent station device and the standby parent device. And a control unit that controls the station device, wherein the control unit encrypts the slave station device after switching the connection destination from the active master station device to the standby master station device. Manages the emergency encryption key that is the encryption key used in the process, and notifies the emergency encryption key to the active master station device when the active master station device is activated, and the emergency master key device when the standby master station device is activated. An information management unit for notifying the standby master station device of the emergency encryption key, and the active master station device holds the emergency encryption key notified from the control unit and has approved the connection to itself. An information tube for notifying the slave station device of the emergency encryption key Parts, comprises, characterized in that.

  According to the present invention, there is an effect that it is possible to realize a communication system that can complete the switching process to the standby system in a short time while ensuring confidentiality and can resume communication.

FIG. 1 is a diagram showing a configuration example of a first embodiment of a communication system according to the present invention. FIG. 2 is a diagram illustrating a configuration example of the OLT. FIG. 3 is a diagram illustrating an example of an information management table held by the OLT. FIG. 4 is a diagram illustrating a configuration example of the ONU. FIG. 5 is a diagram illustrating a configuration example of the control unit. FIG. 6 is a diagram illustrating an example of an information management table held by the control unit. FIG. 7 is a diagram illustrating a configuration example of the concentrator. FIG. 8 is a diagram showing a procedure for starting the OLT and the ONU. FIG. 9 is a diagram illustrating an example of an ONU authentication procedure. FIG. 10 is a diagram illustrating an example of a key management table held by the ONU. FIG. 11 is a diagram illustrating an example of a key management table held by the OLT. FIG. 12 is a diagram illustrating an example of a switching sequence to the standby OLT. FIG. 13 is a diagram illustrating an example of encryption keys held by each OLT, standby OLT, and each ONU according to the first embodiment. FIG. 14 is a diagram illustrating an example of an information management table held by the control unit according to the second embodiment. FIG. 15 is a diagram illustrating an example of an information management table held by the OLT and the standby OLT according to the second embodiment. FIG. 16 is a diagram illustrating an example of a key management table held by the ONU according to the second embodiment. FIG. 17 is a diagram illustrating an example of a key management table held by the OLT and the standby OLT according to the second embodiment. FIG. 18 is a diagram illustrating an example of a sequence in a case where the ONU connection destination according to the second embodiment is switched to the standby OLT. FIG. 19 is a diagram illustrating an example of encryption keys held by each OLT, standby OLT, and each ONU according to the second embodiment. FIG. 20 is a diagram illustrating an example of an information management table held by the control unit according to the third embodiment. FIG. 21 is a diagram illustrating an example of an information management table held by the OLT and the standby OLT according to the third embodiment. FIG. 22 is a diagram illustrating an example of a sequence when the ONU connection destination according to the third embodiment is switched to the standby OLT. FIG. 23 is a diagram illustrating an example of encryption keys held by each OLT, standby OLT, and each ONU according to the third embodiment.

  Hereinafter, embodiments of a communication device, a slave station device, a control device, a communication system, and a communication control method according to the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

Embodiment 1 FIG.
FIG. 1 is a diagram showing a configuration example of a first embodiment of a communication system according to the present invention. In the present embodiment, a case where the communication system is a PON system will be described. Note that the communication system is not limited to the PON system. The present invention can be applied to any communication system that includes a plurality of communication devices including a standby communication device and in which the communication devices encrypt and transmit data. The communication system according to the present embodiment includes a station-side device 1, a plurality of ONUs 2 (ONUs 2 ₁₁ , 2 ₁₂ , 2 ₂₁ , 2 ₂₂ ,..., 2 _N1 , 2 _N2 ) and an optical switch 3. . Each ONU 2 has the same configuration. FIG. 1 shows an N: 1 redundant configuration of the PON system. N: 1 redundant configuration means that one standby system is prepared for an active system (active system communication device, OLT in the present embodiment) of N systems (N is an integer of 1 or more), and at the time of failure or operator At the time of instruction, the operation is switched from one of the N active systems to the standby system.

The station side device 1 includes an active master station device 10 (OLTs 10 ₁ , 10 ₂ ,..., 10 _N ), a standby master station device 20 (standby OLT 20), a control unit 30, and a concentrator 40. It has. Although FIG. 1 shows a plurality of active systems, a single configuration may be used.

The OLT 10 _n (n = 1, 2,..., N) includes an information management unit 10A that manages information related to operation switching to the standby system. Further, ONUs 2 _n1 and 2 _n2 which are slave station devices are accommodated via the optical fiber 4 _n and the optical couplers 5 _n and 6 _n . In FIG. 1, two ONUs 2 are accommodated in one OLT 10, but one ONU 2 may be accommodated in each OLT 10 or may be three or more. The OLT 10 and the ONU 2 transmit / receive data after encrypting the data.

The standby OLT 20 includes an information management unit 20A that manages information related to operation switching to the standby system. Further, it is connected via an optical switch 3 to an optical coupler 5 (optical couplers 5 ₁ , 5 ₂ ,..., 5 _N ) disposed between each OLT 10 and each ONU 2 under the OLT ₁₀ . The optical switch 3 is a 1: N switch, and can be connected to one of the plurality of optical couplers 5 and the standby OLT 20. When a communication failure occurs between the OLT 10 and the ONU 2 under its control, the standby OLT 20 communicates with the ONU 2 instead of the OLT 10. For example, when a communication failure occurs between the OLT _{10 1} and the ONUs 2 ₁₁ and 2 ₁₂ , the standby OLT 20 starts communication with the ONUs 2 ₁₁ and 2 ₁₂ . Although details will be described later, the standby OLT 20 and the active OLTs 10 have the same configuration and have the same functions. Therefore, encryption is also performed in communication between the standby OLT 20 and the ONU 2.

  The control unit 30 includes an information management unit 30A that manages information related to operation switching to the standby system. Further, it controls each part (OLT 10, standby OLT 20, concentrator 40) and the optical switch 3 in the station side apparatus 1. For example, when it is detected that a communication failure has occurred between the OLT 10 and its ONU 2, the OLT 10, the standby OLT 20, the concentrator 40, and the OLT 10 communicate with the ONU 2 instead of the OLT 10. The optical switch 3 is controlled.

  The concentrator 40 distributes a downstream signal (downstream signal) received from a host device (not shown) to each OLT 10 and the standby OLT 20, and transmits an upstream signal (upstream) received from each OLT 10 and the standby OLT 20. Signal) to the host device.

  The ONU 2 includes an information management unit 2A that manages information related to operation switching to the standby system. Also, various information communication devices can be connected, and when a downlink signal addressed to the connected device is received from the OLT 10 or the standby OLT 20, it is transferred to the destination device, and from the connected device When the upstream signal is received, the upstream signal is transferred to the OLT 10 or the standby OLT 20 of the station side apparatus 1.

The optical switch 3 is connected to the standby system OLT 20 and is connected to each of the optical couplers 5 _{1 to} 5 _N via an optical fiber. The optical switch 3 is connected to the standby system OLT 20 according to an instruction from the control unit 30 of the station side device 1. Connect one of the couplers 5 _{1 to} 5 _N.

  Next, the configuration and basic operation of the OLT 10 and the standby OLT 20 will be described. Note that the OLT 10 and the standby OLT 20 have the same configuration.

  FIG. 2 is a diagram illustrating a configuration example of the OLT (OLT 10, standby OLT 20). The OLT 10 and the standby OLT 20 are the information management unit 10A or 20A shown in FIG. 1, the OLT management unit 101, the upstream bandwidth control unit 102, the multiplexing unit 103, the encryption unit 104, the key management unit 105, and the electrical / optical conversion unit. 106, a WDM unit 107, an optical / electrical conversion unit 108, a decoding unit 109, a separation unit 110, and a failure detection unit 111.

  The OLT management unit 101 manages various types of information regarding each subordinate ONU 2 and generates an encryption key used for communication with each ONU 2. The upstream bandwidth control unit 102 assigns an upstream bandwidth to each ONU 2 connected to itself. The multiplexing unit 103 multiplexes (time division multiplexing) the downlink data received from the line concentrating unit 40 and the control information to be transmitted to the ONU 2. The encryption unit 104 encrypts the downlink data output from the multiplexing unit 103 using the encryption key managed by the key management unit 105. The key management unit 105 manages encryption keys used in the encryption process in the encryption unit 104 and the decryption process in the decryption unit 109. The electrical / optical converter 106 converts the downstream electrical signal output from the encryption unit 104 into an optical signal. The WDM unit 107 transmits the downstream optical signal output from the electrical / optical conversion unit 106 toward the ONU 2 and receives the upstream optical signal transmitted from the ONU 2. The optical / electrical converter 108 converts the upstream optical signal received from the ONU 2 by the WDM unit 107 into an electrical signal. The decryption unit 109 decrypts the encrypted electrical signal output from the optical / electrical conversion unit 108 using the encryption key managed by the key management unit 105. The demultiplexing unit 110 receives a management message such as a multipoint control protocol (MPCP) message, an operation administration and maintenance (OAM), an authentication message, and the like from the output signal of the decoding unit 109 as a message frame for PON time division multiplexing control. To separate. The failure detection unit 111 communicates with the ONU 2 based on a signal before being decoded by the decoding unit 109 (an input signal to the decoding unit 109) and a decoding result (an output signal from the decoding unit 109). Determine whether a failure has occurred.

An example of information managed by the OLT management unit 101 is shown in FIG. FIG. 3 shows an information management table which is information managed by the OLT management unit 101 of each of the OLTs 10 ₁ to 10 _N and the standby OLT 20 shown in FIG. OLT # 1 to #N correspond to OLTs 10 ₁ to 10 _N. As shown in FIG. 3, in the information management table, the PON logical link ID, ONU MAC address, service information (maximum bandwidth), emergency encryption key, and emergency encryption key plane are associated with the ONU 2 connected to each OLT. Manage. FIG. 3 shows four information management tables. Each OLT shown in FIG. 1 manages one of these information management tables. Among the information management table shown in FIG. 3, OLT # 1 in the information management table is managed in the OLT 10 ₁ table, table OLT # 2 in the information management table managed in the OLT 10 _2, OLT # N The internal information management table is a table managed in the OLT 10 _N , and the backup OLT information management table is a table managed in the backup OLT 20.

  The PON logical link ID is identification information of a logical link established between the OLT and each subordinate ONU. When a new logical link is established, the OLT assigns, for example, the minimum value among the values not assigned at that time as the value of the PON logical link ID. The ONU MAC address is the MAC address of each ONU under the OLT. The service information is information on the maximum bandwidth that can be allocated to the corresponding ONU, and is referred to when the bandwidth is allocated to the ONU. The emergency encryption key is an encryption key (encryption key used in encryption / decryption processing) used when processing for switching the OLT 10 to the standby OLT 20 occurs due to a communication failure or the like. The emergency encryption key plane is information indicating a location where the emergency encryption key is stored. When the standby OLT 20 is not used (when all the active OLTs 10 are normally communicating with the subordinate ONU 2), the ONU MAC address and service information of the information management table corresponding to the standby OLT 20 Is in a state where information is not registered (indicated as “-” in FIG. 3). In this embodiment, the emergency encryption key has a value corresponding to the PON logical link ID assigned to the ONU regardless of the combination of the OLT and the ONU (the PON logical link ID corresponds to the same logical link). Each emergency encryption key is the same encryption key). Thereby, it is possible to prevent the information amount of the emergency encryption key managed by the standby OLT 20 from increasing. The configuration of the information management table is not limited to that shown in FIG.

  FIG. 4 is a diagram illustrating a configuration example of the ONU 2. The ONU 2 includes a WDM unit 201, an optical / electrical conversion unit 202, a decryption unit 203, a key management unit 204, a separation unit 205, an uplink communication control unit 206, an encryption unit 207, an electrical / optical conversion unit 208, and a failure detection unit 209. And an ONU management unit 210 which is the information management unit 2A shown in FIG.

  The WDM unit 201 receives a downstream optical signal transmitted from the OLT, and transmits an upstream optical signal, which is a signal output from the electrical / optical conversion unit 208, to the OLT. The optical / electrical converter 202 converts the downstream optical signal received from the OLT by the WDM unit 201 into an electrical signal. The decryption unit 203 decrypts the encrypted electrical signal, which is a signal output from the optical / electrical conversion unit 202, using the encryption key managed by the key management unit 204. The key management unit 204 manages encryption keys used in the encryption process in the encryption unit 207 and the decryption process in the decryption unit 203. Separating section 205 separates MPCP messages, management messages such as OAM, authentication messages, and the like from the output signal of decoding section 203. The uplink communication control unit 206 transmits and receives various messages for communication control with the OLT, and transmits an uplink signal received from the connected device to the OLT. The encryption unit 207 encrypts the uplink data output from the uplink communication control unit 206 using the encryption key managed by the key management unit 204. The electrical / optical conversion unit 208 converts the upstream electrical signal that is the signal output from the encryption unit 207 into an optical signal. The failure detection unit 209 communicates with the OLT based on a signal before being decoded by the decoding unit 203 (an input signal to the decoding unit 203) and a decoding result (an output signal from the decoding unit 203). Determine whether a failure has occurred. The ONU management unit 210 manages the information acquired from the OLT in the information on the own device and the connection processing to the OLT.

  FIG. 5 is a diagram illustrating a configuration example of the control unit 30. The control unit 30 includes an information communication termination unit 301, a station side device management unit 302 that is the information management unit 30A shown in FIG. 1, a switching determination unit 303, and a switching control unit 304.

  The information communication termination unit 301 terminates information communication with the OLT management unit 101 (see FIG. 2) of each OLT (OLT 10, standby OLT 20) provided in the station side device 1. The station-side apparatus management unit 302 manages information on each OLT 10 included in the station-side apparatus 1 and ONUs connected to each OLT 10. The switching determination unit 303 determines whether it is necessary to switch the active OLT 10 to the standby OLT 20. When the switching determination unit 303 determines that switching to the standby OLT 20 is necessary, the switching control unit 304 controls the switching target OLT 10, the standby OLT 20, the concentrator 40, and the optical switch 3 to perform switching processing. Let

  An example of an information management table, which is information managed by the station side apparatus management unit 302, is shown in FIG. As shown in FIG. 6, in the information management table managed by the station side device management unit 302, the OLT 10, the PON logical link ID, the ONU MAC as the related information of the active OLT 10 and the ONU 2 connected to the OLT 10. Manage addresses, service information (maximum bandwidth), emergency encryption keys, and emergency encryption key planes.

The OLT number is identification information of the OLT 10. In the example shown in FIG. 6, the number of the OLT _{10 1} is 1, the number of the OLT 10 ₂ is 2, and the number of the OLT 10 _N is N. The PON logical link ID, ONU MAC address, service information (maximum bandwidth), emergency encryption key, and emergency encryption key plane are the same as each information in the information management table (see FIG. 3) managed by the OLT management unit 101 of the OLT 10. Information. That is, the station side device management unit 302 manages the same information as the information managed by the OLT management unit 101 of each OLT 10. In addition, each piece of information managed by the station side apparatus management unit 302 and each piece of information managed by the OLT management unit 101 of each OLT 10 are synchronized.

FIG. 7 is a diagram illustrating a configuration example of the concentrator 40. The line concentrator 40 includes a line concentrator function manager 401, a plurality of ports 402 (ports 402 ₁ , 402 ₂ ,..., 402 _N ), a standby system port 403, a port distribution unit 404, and a host device interface 405.

The line concentration function management unit 401 manages information such as OLT port connection information and data frame distribution information, and controls the port distribution unit 404. The port 402 is connected to the OLT 10 and outputs a data frame to the OLT 10 and also receives a data frame from the OLT 10. A spare OLT 20 is connected to the spare port 403, and a data frame is output to the spare OLT 20 and a data frame from the spare OLT 20 is input. The port distribution unit 404 distributes the data frame (downlink data frame) received from the higher-level device via the higher-level device interface 405 to each port (ports 402 _{1 to} 402 _N , the standby system port 403) and is input from each port The data frame (upstream data frame) is output to the host device via the host device interface 405. The host device interface 405 is a connection interface with the host device.

  Next, the operation of the communication system according to the present embodiment will be described. First, the starting operation of the station side device 1 will be described. In the station side apparatus 1, the control part 30 starts first. Next, each active OLT 10, the standby OLT 20, and the concentrator 40 are activated. As already described, the station side device management unit 302 of the control unit 30 holds the information management table shown in FIG. Information in the information management table is stored in a nonvolatile memory or the like. When the OLT 10 and the standby OLT 20 are activated, the station-side device management unit 302 of the control unit 30 sends an information management table (FIG. 6) to the OLT management unit 101 of each OLT 10 and the standby OLT 20 via the information communication termination unit 301. ) Information. Receiving this notification, each OLT management unit 101 extracts necessary information from the notified information, and generates and manages the information management table shown in FIG. Specifically, the OLT management unit 101 of each OLT 10 includes each piece of information (PON logical link ID, ONU MAC address, service information (maximum bandwidth), emergency encryption key, and emergency encryption corresponding to the OLT number indicating the own OLT. Key) is extracted and registered in the information management table. The OLT management unit 101 of the standby OLT 20 extracts all combinations of the PON logical link ID, the emergency encryption key, and the emergency encryption key surface, and registers them in the information management table. In this embodiment, it is assumed that two ONUs 2 are connected to each OLT 10 and the PON logical link ID is 1 or 2. For example, the ONU 2 is connected to the OLT 10 with the OLT number N. Are connected, and the PON logical link ID of the logical link between each ONU 2 is 1 to 3, the OLT management unit 101 of the standby OLT 20 uses the emergency encryption used for the logical link with the PON logical link ID 3 The key and the emergency encryption key surface are also extracted and registered in the information management table.

  Next, a connection establishment operation that is a startup operation between the OLT 10 and the ONU 2 will be described. In the present embodiment, it is assumed that the PON activation process defined in Non-Patent Document 1 (IEEE Std 802.3-2008) is followed. The procedure is shown in FIG.

  In the connection establishment operation, first, in the OLT 10, the upstream bandwidth control unit 102 generates a Discovery Gate message in order to find an ONU 2 that can be activated. The multiplexing unit 103 and the encryption unit 104 that perform time division multiplexing with the data frame pass the Discovery Gate message because there is no data frame to be encrypted at this point. This message is converted into an optical signal by the electrical / optical conversion unit 106, multiplexed with the upstream optical signal by the WDM unit 107, and output to the optical fiber (step S11).

  Next, in the ONU 2, the WDM unit 201 separates the downstream optical signal (the signal including the Discovery Gate message) from the optical signal multiplexed with the upstream optical signal and outputs the separated optical signal to the optical / electrical conversion unit 202. The optical / electrical converter 202 converts the downstream optical signal input from the WDM unit 201 into an electrical signal. When transmitting the Discovery Gate message, since the OLT 10 has not performed the encryption process, the decryption unit 203 outputs the signal input from the optical / electrical conversion unit 202 to the separation unit 205 as it is. The separation unit 205 extracts the Discovery Gate message and outputs it to the uplink communication control unit 206. The uplink communication control unit 206 analyzes the Discovery Gate message, and returns a Register Request message to the OLT 10 at the instructed timing. At this point, encryption is not performed, and the encryption unit 207 passes the signal (Register Request message) input from the uplink communication control unit 206. This message is converted into an optical signal by the electrical / optical conversion unit 208, multiplexed with the downstream optical signal by the WDM unit 201, and output to the optical fiber (step S12).

  Next, in the OLT 10, the WDM unit 107 separates the upstream optical signal (the signal including the Register Request message) from the optical signal multiplexed with the downstream signal, and outputs the separated optical signal to the optical / electrical converter 108. The optical / electrical conversion unit 108 converts the upstream optical signal input from the WDM unit 107 into an electrical signal. Since this signal is not encrypted, it passes through the decryption unit 109 and is input to the separation unit 110. Separation section 110 extracts the Register Request message and outputs it to uplink bandwidth control section 102. The uplink bandwidth control unit 102 generates a Register message that is a registration message and transmits it to the ONU 2 (step S13). Further, a Gate message is generated and transmitted to the ONU 2 (step S14). Since the operation of transmitting the Register message and the Gate message is the same as the operation of transmitting the Discovery Gate message in step S11 described above, detailed description thereof is omitted.

  Next, when the ONU 2 receives the Register message and the Gate message, the uplink communication control unit 206 returns a Register Ack message to the OLT 10 at the timing instructed by the Gate message (step S15). Note that the detailed operation when receiving the Register message and the Gate message is the same as the above-described operation of receiving the Discovery Gate message. The detailed operation when the Register Ack message is returned is the same as the return operation of the Register Request message described above.

  Finally, in the OLT 10, when the upstream bandwidth control unit 102 receives the Register Ack message returned from the ONU 2, the connection establishment procedure is completed, and the PON connection is established. At this time, the uplink bandwidth control unit 102 notifies the OLT management unit 101 of the PON connection establishment and the logical link ID for managing the ONU. Note that the detailed operation when receiving the Register Ack message is the same as the operation for receiving the Register Request message described above.

  When the connection establishment procedure shown in FIG. 8 is completed, next, the OLT management unit 101 that has received the notification of the logical link ID starts authentication processing of the connected ONU 2. Although the authentication process depends on the system, in the present embodiment, simple authentication is performed simply by confirming the MAC address of the ONU 2 based on the contents described in the document IEEE 802.1X. The procedure of this authentication process is shown in FIG.

  In the authentication procedure shown in FIG. 9, first, in the OLT 10, the OLT management unit 101 generates an EAP-RequestID message and transmits it to the ONU 2 that has established the PON connection (step S21). Next, in the ONU 2, the uplink communication control unit 206 receives the EAP-RequestID message and returns an EAP-ResponseID message (step S22). Next, in the OLT 1, the OLT management unit 101 receives the EAP-Response ID message, and obtains the MAC address of the ONU 2 described in this message and the ONU MAC address of the held information management table (see FIG. 3). If they match, the authentication is successful and an EAP-Success message is sent to the ONU (step S23). Note that the transmission / reception operation of each message shown in FIG. 9 is the same as the transmission / reception operation of various messages in the connection establishment operation shown in FIG. However, in the OLT 10, the OLT management unit 101 outputs the generated EAP-RequestID message and EAP-Success message to the multiplexing unit 103. When the separation unit 110 extracts the EAP-Response ID message transmitted from the ONU 2, the separation unit 110 outputs the message to the OLT management unit 101. The connection establishment procedure and the authentication procedure shown in FIGS. 8 and 9 are examples, and other procedures may be used as long as the connection and authentication of the ONU 2 can be performed.

  After transmitting the EAP-Success message, the OLT 10 starts encryption for the downlink data frame. Further, after receiving the EAP-Success message, the ONU 2 starts encryption for the upstream data frame. Thus, the OLT 10 and the ONU 2 start the encryption process when the authentication process is completed. In the encryption process immediately after the completion of the authentication process, a pre-shared key shared in advance between the OLT 10 and the ONU 2 is used. For example, the pre-shared key is notified from the OLT 10 to the ONU 2 by an EAP-Success message transmitted from the OLT 10 to the ONU 2 when authentication is successful. The pre-shared key may be set in the OLT 10 and the ONU 2 by other methods. The encryption in the present embodiment is based on the encryption specified in the document IEEE 802.1AE.

  In addition, it is desirable that the encryption key to be used is replaced with a new one periodically or irregularly to maintain high confidentiality. For this reason, in the communication system according to the present embodiment, the OLT 10 and the ONU 2 perform re-authentication processing to exchange the encryption key held by both of them with a new encryption key. The re-authentication processing sequence is the same as the authentication sequence shown in FIG. 9, but in the re-authentication sequence, the OLT management unit 101 of the OLT 10 generates a new encryption key and notifies it to the ONU 2 using an EAP-Success message. . The OLT management unit 101 of the OLT 10 and the ONU management unit 210 of the ONU 2 that share the new encryption key notify the key management unit 105 of the OLT 10 and the key management unit 204 of the ONU 2 of the new encryption key, respectively. Updates the managed encryption key.

Here, an encryption key management method in the key management units 105 and 204 will be described. For example, the key management unit 204 of the ONU 2 holds the key management table having the configuration shown in FIG. 10, and uses one of the encryption keys registered in the key management table to use the encryption unit 207 and the decryption unit. 203 performs encryption processing and decryption processing. One of the plurality of encryption keys is handled as an emergency encryption key used when the connection destination is switched to the standby OLT 20, and is not used in communication with the OLT 10. In the present embodiment, the key surface 3 is an emergency encryption key surface. Of the encryption keys other than the emergency encryption key, which key side is to be used for the encryption key is determined / changed appropriately with the OLT 10. Which key face to use when changing the encryption key to be used may be determined on the OLT 10 side or on the ONU 2 side. When the self ONU 2 performs re-authentication processing with the OLT 10 and receives a notification of a new encryption key, the key management unit 204 notifies the encryption key other than the encryption key currently in use and the emergency encryption key. Update to a new encryption key. On the other hand, the key management unit 105 of the OLT 10 holds a key management table having the configuration shown in FIG. As shown in the figure, the key management unit 105 manages the encryption key for each connected ONU 2. In the present embodiment, since two ONUs 2 are connected to the OLT 10, two encryption keys are registered in the key table. If the key table OLT 10 ₁ holds, ONU # 1 corresponds to ONU2 _11, ONU # 2 corresponds to the ONU 2 _12. The configuration of the key management table held by the key management unit 105 of the standby OLT 20 is the same. When updating the encryption key, an encryption key other than the encryption key being used and the emergency encryption key is exchanged for a new encryption key.

The OLT 10 performs the connection establishment operation shown in FIG. 8 to connect the ONU 2, and further executes the authentication sequence shown in FIG. 9 to complete (success) the authentication of the ONU 2. Performs processing for sharing the encryption key. Specifically, the OLT 10 notifies the ONU 2 of the held emergency encryption key. For example, after the authentication sequence shown in FIG. 9 is completed, the OLT 10 notifies the emergency encryption key using a predetermined message encrypted with the pre-shared key. You may notify an emergency encryption key using the above-mentioned EAP-Success message for notifying ONU2 of successful authentication. By configuring the emergency encryption key to be notified after successful authentication, it is possible to prevent the emergency encryption key from being notified unnecessarily to the ONU 2 (notifying the ONU 2 that has failed authentication). The emergency encryption key to be notified is an emergency encryption key used by the ONU 2 that is the notification destination. For example, if the OLT _{10 1} holds the key management table of FIG. 11 and the connection establishment and authentication of the ONU 2 ₁₂ are completed, the OLT _{10 1} notifies the ONU 2 ₁₂ of “BBB” as an emergency encryption key.

  Next, a control sequence for switching the connection destination of the ONU 2 from the active OLT 10 to the standby OLT 20 will be described. FIG. 12 is a diagram illustrating an example of a control sequence for switching to the standby OLT 20. In the present embodiment, the switching control sequence defined in the non-patent document (IEEE P.1904.1) is used, but other sequences may be used.

Here, as an example, an operation when a communication failure occurs between the active OLT _{10 1} and the ONUs 2 ₁₁ and 2 ₁₂ under its control and the operation is switched to the standby OLT 20 will be described.

In the active OLT _{10 1} , the failure detection unit 111 detects whether or not a communication failure (for example, occurrence of an FCS error) occurs in the transmission path (logical link) with the ONU 2 ₁₁ and communication on the transmission path with the ONU 2 _12. Whether or not a failure has occurred is monitored, and when a failure has been detected, the OLT management unit 101 is notified of the fact. The detection of the occurrence of a failure may be performed by other methods. For example, failure detection may be performed based on the reception level of the optical signal. In addition, any method may be used as long as the failure occurrence can be detected. The OLT management unit 101 that has received the notification of the occurrence of the failure notifies the control unit 30 of the error occurrence status. In the notification of the error occurrence status, for example, the logical link ID of the transmission path in which the failure has occurred is notified (step S31). In the control unit 30, the notification from the OLT management unit 101 is input to the switching determination unit 303 via the information communication termination unit 301. If the switching determination unit 303 detects that a communication failure has occurred in the transmission path between the active OLT _{10 1} and all of the ONUs 2 under it, there is a problem in communication via the OLT _{10 1} (OLT 10 ₁ , failure of the optical fiber connected to the OLT _{10 1} , etc.), and it is decided to switch from the active OLT _{10 1} to the standby OLT 20. Then, this is notified to the switching control unit 304.

Here, an example has been described of the case where OLT 10 ₁ of the failure detection unit 111 detects the failure (upstream communication failure), the communication failure is also likely to occur only in the downstream direction. Therefore, ONU 2 ₁₁ or 2 ₁₂ failure detection unit 209, when detecting a failure (downstream communication failure), and notifies the communication failure to OLT 10 ₁ via the ONU management unit 210, receives the notification in OLT 10 _1, OLT managing unit 101 notifies the error occurrence to the control unit 30.

The switching control unit 304 that has received the above notification (notification of switching determination to the standby OLT 20) sends the PON logical link ID, ONU MAC address, and service information (maximum bandwidth) to the standby OLT 20 as setting information of the switching source OLT _1. ) Is notified via the information communication termination unit 301 (step S32). The information to be notified is information registered in the information management table (see FIG. 6) held by the station side device management unit 302. When the switch to the standby OLT 20 occurs, communication is performed using the emergency encryption key immediately after the switch. However, since the backup OLT 20 has already acquired the emergency encryption key at the time of startup, Notification is unnecessary for the encryption key and the emergency encryption key surface.

The switching control unit 304 also notifies the OLT ₁ of the start of switching (step S33). In the OLT ₁ that has received the notification of switching start, the OLT management unit 101 generates a switching preparation notification message (described in Section 9.3.7.2 of Non-Patent Document 2 above) and transmits it to the ONU 2. (Step S34). Specifically, the OLT management unit 101 outputs the generated switching preparation notification message to the multiplexing unit 103, and the multiplexing unit 103 time-division-multiplexes the switching preparation notification message received from the OLT management unit 101 with the downlink data frame. To the encryption unit 104. When receiving an input from the multiplexing unit 103, the encryption unit 104 inquires of the key management unit 204 about the encryption key to be used, obtains the encryption key used for encryption, and encrypts the downlink data frame. The encrypted signal is output to the electrical / optical conversion unit 106, converted into an optical signal, and then transmitted from the WDM unit 107 to the ONU 2. The OLT ₁ transmits a switch preparation notification message to all the ONUs 2 (ONUs 2 ₁₁ and 2 ₁₂ ) under its control. This switching preparation notification message transmission may be transmitted to a subordinate ONU using a broadcast logical link ID that can be transmitted to all ONUs at once.

In each ONU 2 under OLT ₁ , the WDM unit 201 separates the downstream optical signal from the optical signal in which the upstream and downstream optical signals are multiplexed and outputs the separated optical signal to the optical / electrical converter 202. The optical / electrical conversion unit 202 converts the downstream optical signal input from the WDM unit 201 into an electrical signal and outputs the electrical signal to the decoding unit 203. When receiving an input from the optical / electrical conversion unit 202, the decryption unit 203 queries the key management unit 204 for the encryption key to be used, obtains the encryption key used for decryption, and decrypts the downlink data frame. The separation unit 205 extracts a switching preparation notification message from the downlink data frame obtained by decoding in the decoding unit 203 and a frame group time-division multiplexed with this, and the uplink communication control unit 206 and the ONU management unit Output to 210.

When receiving the switch preparation notification message, the ONU management unit 210 transitions to the Hold Over state. Here, the Hold Over state is a state in which a connection is not disconnected even when a Time Stamp Drift alarm occurs. In PON, since the OLT and the ONU are synchronized, time information (Time Stamp) is transmitted from the OLT to the ONU using the Gate message. However, the time and the ONU transmitted to the ONU were assumed. A state in which the deviation from the time is large is referred to as Time Stamp Drift. When switching from the active OLT _{10 1} to the standby OLT 20, the time changes due to a change in the length of the connecting optical fiber between the OLT (OLT _{10 1} or the standby OLT 20) and each ONU 2 before and after switching. However, the transition to the Hold Over state does not cause a disconnection even if a Time Stamp Drift alarm occurs with a change in time. The ONU management unit 210 also instructs the key management unit 204 to use the emergency encryption key. Thereafter, the key management unit 204 sets the encryption key used in the encryption process and the decryption process as the emergency encryption key.

When preparation for switching is completed in the OLT _{10 1} and the ONUs 2 ₁₁ and 2 ₁₂ under its control, the switching control unit 304 of the control unit 30 instructs the OLT _{10 1} , the standby OLT 20, the optical switch 3, and the concentrator 40 to execute switching. To do.

Specifically, the switching control unit 304, with respect to the optical switch 3, an instruction to connect the ONU 2 ₁₁ and 2 ₁₂ and a standby system OLT20 under OLT 10 _1.

In addition, the switching control unit 304, for the standby OLT 20, sets all the ONUs 2 (ONUs 2 ₁₁ and 2 ₁₂ connected to the OLT _{10 1} ) set in the information management table held in the standby OLT 20. For each ONU, an instruction is sent to send a Gate message (step S35). Thereby, the times of the standby OLT 20 and the ONUs 2 ₁₁ and 2 ₁₂ are synchronized. At this time, the standby OLT 20 performs encryption using an emergency encryption key (emergency encryption key surface). The ONUs 2 ₁₁ and 2 ₁₂ also perform decryption using the emergency encryption key (emergency encryption key surface). When the upstream frames from all of the subordinate ONUs (ONUs 2 ₁₁ and 2 ₁₂ ) can be normally received, the upstream bandwidth control unit 102 of the standby OLT 20 determines that the switching process has been completed, and sends a switching completion notification message to all the subordinates. It transmits to ONU2 (step S36). Each ONU 2 that has received the switching completion notification message cancels the Hold Over state and completes the switching. Further, the upstream bandwidth control unit 102 notifies the OLT management unit 101 of the completion of switching, and the OLT management unit 101 notifies the control unit 30 of the completion of switching (step S37). In the control unit 30, a switching completion notification from the OLT management unit 101 of the standby OLT 20 is notified to the station side device management unit 302 via the information communication termination unit 301, and the switching is completed.

The switching control unit 304, for the OLT 10 _1, instructs to stop communication operation with the ONU 2 _11, 2 _12.

The switching control unit 304, with respect to the concentration section 40, the port used to instruct to change from the port 402 ₁ to the backup port 403. Specifically, it performs an instruction to the port distribution unit 404 via the concentration function management unit 401 of the information communication terminal portion 301 and the concentrator unit 40 causes a signal that has been distributed to the port 402 ₁ to it like distributed to a spare port 403 .

It is desirable that the switching execution instruction from the switching control unit 304 to each unit (OLT _{10 1} , standby OLT 20, optical switch 3, and concentrator 40) is performed simultaneously and in parallel.

  After completion of the switching, the standby OLT 20 and the subordinate ONUs 2 change the encryption key to be used from the emergency encryption key to another encryption key (normal key) at a predetermined timing in order to ensure confidentiality. The normal key is updated by appropriately performing the above-described re-authentication process (the process similar to the process in which the OLT 10 re-authenticates the ONU 2 and updates the encryption key).

  FIG. 13 is a diagram illustrating an example of encryption keys held by each OLT 10 and backup OLT 20 in the station side apparatus 1 of the present embodiment and encryption keys held by each ONU 2. As shown in FIG. 13, the active OLT 10 holds an encryption key (operation key) used for communication with each subordinate ONU 2. The standby OLT 20 holds an emergency encryption key (emergency key) for each logical link. Further, the ONU 2 holds an encryption key (operation key) used in communication with the active OLT 10 and an emergency encryption key (emergency key) used in communication immediately after the connection destination is switched to the standby OLT 20.

  As described above, in the communication system according to the present embodiment, each ONU 2 acquires and holds the emergency encryption key assigned to the ONU 2 via the OLT 10 in advance. The standby OLT 20 holds an emergency encryption key assigned to each ONU 2 in the system. When the transmission path is switched to the standby system due to the occurrence of a communication failure or the like, the ONU 2 whose transmission path is switched performs data encryption and decryption using the stored emergency encryption key. The OLT 20 encrypts and decrypts data using the emergency encryption key assigned to the ONU 2 that is the target of switching the transmission path. This eliminates the need for exchanging encryption keys between the standby OLT 20 and the ONU 2 when switching to the standby system, so that switching to the standby system can be completed in a short time while ensuring confidentiality. The time required for recovery can be shortened.

Embodiment 2. FIG.
Next, the communication system according to the second embodiment will be described. In the present embodiment, parts different from those of the first embodiment will be described.

  The overall configuration of the communication system of the present embodiment is the same as that of the first embodiment (see FIG. 1). The configurations of the OLT 10, the standby OLT 20, the control unit 30 and the concentrator 40, and the ONU 2 included in the station side device 1 are the same as those in the first embodiment (see FIGS. 2, 4, 5, and 7). . However, the configuration (information management table configuration data) of the information management table (information management table in the control unit) held by the station side device management unit 302 of the control unit 30, and the OLT management unit 101 of the OLT 10 and the standby OLT 20 The configuration (information management table configuration data) of the held information management table (information management table within OLT) is different from that of the first embodiment.

  FIG. 14 is a diagram illustrating an example of an information management table held by the station-side apparatus management unit 302 of the control unit 30 according to the second embodiment. FIG. 15 illustrates OLT management of the OLT 10 and the standby OLT 20 according to the second embodiment. 3 is a diagram illustrating an example of an information management table held by a unit 101. FIG.

  As shown in FIGS. 14 and 15, in this embodiment, a pre-shared key is registered in the information management table instead of the emergency encryption key used in the first embodiment. As described in the first embodiment, the pre-shared key is an encryption key used when transmitting (receiving) a data frame after the authentication process illustrated in FIG. 9 is completed. The standby OLT 20 and the ONU 2 according to this embodiment perform encryption and decryption of a data frame using a pre-shared key in communication immediately after switching the connection destination of the ONU 2 from the active OLT 10 to the standby OLT 20. Note that the ONU 2 of the present embodiment holds the key management table having the configuration shown in FIG. 16 in the key management unit 204, and the OLT 10 and the standby OLT 20 have the key management table having the configuration shown in FIG. 105. A pre-shared key is registered on the key surface of the emergency key. The operation in which the OLT 10 and the standby OLT 20 generate the information management table is the same as that in the first embodiment. That is, in the start-up operation of the station-side device 1, the control unit 30 notifies each information registered in the control unit information management table to the OLT 10 and the standby OLT 20, and the OLT 10 and the standby OLT 20 notify the notified information. The information management table is generated by extracting necessary information from the list.

  The difference between the operation of the present embodiment and the operation of the first embodiment (see FIG. 12) when switching the connection destination of the ONU 2 to the standby OLT 20 will be described. FIG. 18 is a diagram illustrating an example of a control sequence in a case where the connection destination of the ONU 2 according to the second embodiment is switched from the OLT 10 to the standby OLT 20. Step S32 in the control sequence of the first embodiment shown in FIG. 12 is replaced with step S41.

  In step S41 shown in FIG. 18, the switching determination unit 303 of the control unit 30 is registered in the information management table (in-control unit information management table shown in FIG. 14) held in the station side device management unit 302. Among the existing pre-shared keys, the pre-shared key corresponding to the OLT 10 in which the failure has occurred is notified to the OLT management unit 101 of the standby OLT 20. There may be a plurality of pre-shared keys to be notified. The OLT management unit 101 of the standby OLT 20 corresponds to the emergency key surface (key surface of the emergency key) of the key management table (see FIG. 17) that holds the notified pre-shared key in the key management unit 105. Set to area. The portions other than step S41 are the same as those in the first embodiment.

  FIG. 19 is a diagram illustrating an example of encryption keys held by the OLTs 10 and the standby OLT 20 in the station-side apparatus 1 according to the second embodiment and encryption keys held by the ONUs 2. As shown in FIG. 19, the active OLT 10 holds an encryption key (operation key) used for communication with each subordinate ONU 2. Further, the ONU 2 holds an encryption key (operation key) used in communication with the active OLT 10 and an emergency encryption key (emergency key) used in communication immediately after the connection destination is switched to the standby OLT 20. As described above, the pre-shared key is used as the emergency encryption key. The standby OLT 20 does not hold an emergency encryption key (emergency key) in a state before switching to the standby system. Instead, the control unit 30 manages the emergency encryption key to be used after the switchover to the backup system. When the switchover occurs, the control unit 30 notifies the backup system OLT 20 of the emergency encryption key corresponding to the OLT 10 in which the communication failure has occurred.

  As described above, in the communication system according to the present embodiment, as an emergency encryption key used when switching to the standby OLT 20 occurs, communication immediately after the ONU 2 authentication processing by the OLT 10 is completed (data frame encryption). / Decryption) to use the pre-shared key. This eliminates the need to determine the emergency encryption key in advance and set it in the standby OLT 20. In addition, the number of encryption keys managed by the ONU 2 can be reduced.

Embodiment 3 FIG.
Next, the communication system according to the third embodiment will be described. In the present embodiment, parts different from the first and second embodiments will be described.

  The overall configuration of the communication system of the present embodiment is the same as that of the first embodiment (see FIG. 1). The configurations of the OLT 10, the standby OLT 20, the control unit 30 and the concentrator 40, and the ONU 2 included in the station side device 1 are the same as those in the first embodiment (see FIGS. 2, 4, 5, and 7). .

  Similar to the second embodiment, the pre-shared key is also used as the emergency encryption key in this embodiment. However, the configuration (information management table configuration data) of the information management table (intra-OLT information management table) held by the OLT management unit 101 of the OLT 10 and the standby OLT 20 is different from that of the second embodiment.

  FIG. 20 is a diagram illustrating an example of an information management table held by the station-side apparatus management unit 302 of the control unit 30 according to the third embodiment. FIG. 21 illustrates OLT management of the OLT 10 and the standby OLT 20 according to the third embodiment. 3 is a diagram illustrating an example of an information management table held by a unit 101. FIG. The intra-control unit information management table shown in FIG. 20 is the same as that in the second embodiment (see FIG. 14). Also, as shown in FIG. 21, the configuration of the information management table held by the OLT 10 and the information management table held by the standby OLT 20 are different. The configuration of the information management table held by the standby OLT 20 is the same as the configuration of the information management table (FIG. 20) held by the control unit 30. That is, the standby OLT 20 holds the emergency encryption keys (pre-shared keys) of all the ONUs 2 connected to the station side device 1 (each OLT 10). On the other hand, the information management table held by the OLT 10 does not include information related to the emergency encryption key (emergency encryption key, emergency encryption key surface). The operation in which the OLT 10 and the standby OLT 20 generate the information management table is the same as in the first and second embodiments.

  A difference between the operation of the present embodiment and the operation of the second embodiment (see FIG. 18) when the connection destination of the ONU 2 is switched to the standby OLT 20 will be described. FIG. 22 is a diagram illustrating an example of a control sequence in a case where the connection destination of the ONU 2 according to the third embodiment is switched from the OLT 10 to the standby OLT 20. Step S41 in the control sequence of the second embodiment shown in FIG. 18 is replaced with step S51.

  In step S51 shown in FIG. 22, the switching determination unit 303 of the control unit 30 notifies the OLT management unit 101 of the standby OLT 20 of the switching target OLT 10 (failed OLT 10). The OLT management unit 101 of the standby OLT 20 corresponds to the emergency key surface of the key management table (see FIG. 17) that holds the emergency encryption key (pre-shared key) corresponding to the notified OLT 10 in the key management unit 105. Set to the area to be used. Parts other than step S51 are the same as those in the second embodiment.

  FIG. 23 is a diagram illustrating an example of encryption keys held by the OLTs 10 and the standby OLT 20 in the station apparatus 1 according to the third embodiment, and encryption keys held by the ONUs 2. As shown in FIG. 23, the active OLT 10 holds an encryption key (operation key) used in communication with each subordinate ONU 2. Further, the ONU 2 holds an encryption key (operation key) used in communication with the active OLT 10 and an emergency encryption key (emergency key) used in communication immediately after the connection destination is switched to the standby OLT 20. The standby OLT 20 holds an emergency key management table which is the information management table shown in FIG. In the state before the switch to the standby system occurs, the emergency encryption key is not registered in the key management table of the standby OLT 20.

  As described above, in the communication system according to the present embodiment, immediately after the ONU 2 authentication processing by the OLT 10 is completed as an emergency encryption key to be used when switching to the standby OLT 20 occurs, as in the second embodiment. It was decided to use a pre-shared key used for communication (data frame encryption / decryption). This eliminates the need to determine the emergency encryption key in advance and set it in the standby OLT 20. In addition, the number of encryption keys managed by the ONU 2 can be reduced. Further, since the standby OLT 20 holds the emergency encryption keys (pre-shared keys) of all ONUs 2, when switching to the standby system occurs, the control unit 30 notifies the OLT 10 to be switched to the standby OLT 20 Just do it. Therefore, compared to the second embodiment, the amount of information notified from the control unit 30 to the standby OLT 20 when switching occurs can be reduced.

  In each of the embodiments, the control procedure in the case where the upper level (station side) communication device and the lower level (subscriber side) communication device configure the PON has been described. However, the present invention is also applicable to systems other than the PON. . That is, before the active communication device and the opposite device start communication, an emergency encryption key is set at least on the opposite device of the active communication device. It is only necessary that the emergency encryption key set in the opposite device can be obtained by some method before the connection destination is switched to itself.

  As described above, the present invention is useful for realizing a redundant communication system that is configured by a communication device that encrypts and transmits / receives information.

1 station side device, 2 ₁₁ , 2 ₁₂ , 2 ₂₁ , 2 ₂₂ , 2 _{N 1} , 2 _{N 2} ONU, 3 optical switch, 4 ₁ , 4 ₂ , 4 _N optical fiber, 5 ₁ , 5 ₂ , 5 _N , 6 ₁ , 6 ₂ , 6 _N optical coupler, 10 ₁ , 10 ₂ , 10 _N OLT, 20 standby system OLT, 30 control unit, 40 concentrator, 2A, 10A, 20A, 30A information management unit, 101 OLT management unit, 102 upstream Band control unit, 103 multiplexing unit, 104,207 encryption unit, 105,204 key management unit, 106,208 electrical / optical conversion unit, 107,201 WDM unit, 108,202 optical / electrical conversion unit, 109,203 decryption Conversion unit, 110, 205 separation unit, 111, 209 failure detection unit, 301 information communication termination unit, 302 station side device management unit, 303 switching determination unit, 304 switching control unit, 401 concentrator function management unit, 402 ₁ , 402 ₂ 402 _N port, 403 Standby port, 404 port distribution unit, 405 Host device interface.

Claims (13)

A communication device comprising an active master station device and a standby master station device that perform encrypted communication with a slave station device, and a control unit that controls the active master station device and the standby master station device,
The controller is
The slave station device manages an emergency encryption key that is an encryption key used in an encryption process after the connection destination is switched from the active master station device to the standby master station device, and the active master station device Is activated to notify the emergency encryption key to the active parent station device, and when the standby parent station device is activated, an information management unit that notifies the emergency encryption key to the standby parent station device,
With
The active master station device is
An information management unit that holds the emergency encryption key notified from the control unit and notifies the emergency encryption key to a slave station device that has approved connection to itself.
Comprising
A communication device. Provided with a plurality of active master station devices,
A common emergency encryption key is used as an emergency encryption key to be notified to each slave station device connected to a different active master station device via the same identification number transmission path.
The communication apparatus according to claim 1. As the emergency encryption key, a pre-shared key that is shared in advance between the active master station device and the slave station device and that is used in the initial encryption process after starting communication is used. ,
The communication apparatus according to claim 1. The pre-shared key is an encryption key that is different for each combination of an active master station device and a slave station device,
When the information management unit of the control unit detects the occurrence of the slave station device that switches the connection destination to the standby master station device, the information management unit obtains a pre-shared key corresponding to the active master station device of the original connection destination of the slave station device. Notify the standby master station device,
The communication apparatus according to claim 3. The pre-shared key is an encryption key that is different for each combination of an active master station device and a slave station device,
The standby master station device is
An information management unit that acquires and manages a pre-shared key of each combination of each active master station device and each slave station device from the control unit;
With
When the information management unit of the control unit detects the occurrence of the slave station device that switches the connection destination to the standby master station device, the information management unit of the slave station device changes the active master station device of the original connection destination of the slave station device to the standby master station device. Notify the information management department,
The communication apparatus according to claim 3. After starting communication with the slave station device, the information management unit of the active master station device regenerates an encryption key used for communication with the slave station device at a predetermined timing and notifies the slave station device Then start using the regenerated encryption key,
The communication apparatus according to any one of claims 1 to 5, wherein Manages an emergency encryption key that is an encryption key used for encryption processing after the active master station device and the standby master station device that perform encrypted communication, and the standby master station device starts communication. A communication device comprising a system master station device and a control unit for controlling the standby system master station device, and a slave station device for communicating with
An information management unit for acquiring an emergency encryption key assigned to itself from the control unit via the connected active master station device;
With
The emergency encryption key is used in the encryption process and the decryption process after switching the connection destination to the standby master station device.
A slave station device characterized by that. A control device that controls an active master station device and a standby master station device that perform encrypted communication with a slave station device,
The slave station device manages an emergency encryption key that is an encryption key used in an encryption process after the connection destination is switched from the active master station device to the standby master station device, and the active master station device Is activated, the emergency encryption key is to be notified to the slave station device that has approved the connection to the active master station device, and the slave station device switches the connection destination to the standby master station device. After that, when the backup master station device is activated and notified as the encryption key to be used by the slave station device, the emergency encryption key is encrypted in communication with the slave station device to the backup master station device. Information management unit to notify as the encryption key used in
A control device comprising: A control device that controls an active master station device and a standby master station device that perform encrypted communication with a slave station device,
An information management unit that manages an emergency encryption key that is an encryption key used in an encryption process after the slave station device switches the connection destination from the active master station device to the standby master station device;
A switch determination unit that collects information about the communication state from the active parent station device and determines whether it is necessary to switch the connection destination of the child station device under the active parent station device to the standby parent station device;
With
When the switching determination unit determines that the connection destination of the slave station device needs to be switched to the standby master station device, the information management unit uses the current connection destination of the slave station device that needs to switch the connection destination. Notifying the backup master station device of the emergency encryption key corresponding to the system master station device,
A control device characterized by that. A control device that controls an active master station device and a standby master station device that perform encrypted communication with a slave station device,
The slave station device manages an emergency encryption key that is an encryption key used in an encryption process after the connection destination is switched from the active master station device to the standby master station device, and the standby master station device Is activated, an information management unit that notifies the standby master station device of the emergency encryption key;
A switch determination unit that collects information about the communication state from each active parent station device and determines whether it is necessary to switch the connection destination of the slave station device under the active parent station device to the standby parent station device;
With
When the switching determination unit determines that the connection destination of the slave station device needs to be switched to the standby master station device, the information management unit uses the current connection destination of the slave station device that needs to switch the connection destination. Notifying the parent master station device to the standby master station device,
A control device characterized by that. As the emergency encryption key, a pre-shared key that is shared in advance between the active master station device and the slave station device and that is used in the initial encryption process after starting communication is used. ,
The control device according to claim 9 or 10, wherein: A communication device comprising an active parent station device and a standby parent station device, and a control unit that controls the active parent station device and the standby parent station device;
A slave station device that performs encrypted communication with the active master station device or the standby master station device;
With
The slave station device manages an emergency encryption key that is an encryption key used in an encryption process after the connection destination is switched from the active master station device to the standby master station device, and the active master station device Is activated to notify the emergency encryption key to the active parent station device, and when the standby parent station device is activated, an information management unit that notifies the emergency encryption key to the standby parent station device,
With
The active master station device is
An information management unit that holds the emergency encryption key notified from the control unit and notifies the emergency encryption key to a slave station device that has approved connection to itself.
With
The slave station device is
The emergency encryption key is retained, and the emergency encryption key is used in the encryption process and the decryption process after the connection destination is switched to the standby master station device.
A communication system characterized by the above. A communication device comprising an active parent station device and a standby parent station device, and a control unit that controls the active parent station device and the standby parent station device;
A slave station device that performs encrypted communication with the active master station device or the standby master station device;
A communication control method in a communication system comprising:
After the active master station device is activated, the control unit is configured to switch the connection destination from the active master station device to the standby master station device for the active master station device. An encryption key notification step of notifying the emergency encryption key that is an encryption key used in the encryption process, and notifying the emergency encryption key to the backup master station device when the backup master station device is activated;
An emergency encryption key notifying step in which the active master station device notifies the emergency encryption key to a slave station device that has approved connection to itself;
A connection destination switching step in which the slave station device switches the connection destination to the standby master station device; and
A communication start step in which the slave station device and the standby master station device that have switched connection destinations start encrypted communication using the emergency encryption key;
The communication control method characterized by including.

Images