JPH01152831A - Cryptographic communication processing unit - Google Patents

Abstract

PURPOSE:To sent and receive a cryptographic data with priority and high reliability surely by using its own station address of a terminal equipment sending/ receiving a cryptographic data and a cryptographic data having a cryptographic token so as to apply communication processing of the said cryptographic data. CONSTITUTION:A data received via a communication line 1 is received at first while bit period is taken by a line interface circuit 5n. The identification management of cryptographic token and address identification management are applied by an access control circuit 6n and a plane data transmission/reception access of other station and its own station is inhibited till the transmission/reception of the cryptographic data with a communication opposite terminal equipment in the cryptographic mode. Thus, the cryptographic data is surely received to only the terminal equipment of the designated address by decoding the address AD of its own station and the cryptographic token TK. Thus, the cryptographic data communcation or its multiple address communication processing is applied surely with priority quickly.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a cryptographic communication processing device that communicates cryptographic data within a terminal device connected to a bus-type network.

[Conventional technology]

Conventionally, communication of ciphertext data in information communication networks or communication between terminals has been carried out over LAN (Local Area).
It was often applied in fields with a wide area and strong public nature, such as public communication networks such as A Network.

In this case, since a wide range of unspecified numbers of network users become network users, the procedures for transmitting and receiving ciphertext data between computers or terminals have become extremely complicated in terms of system protection and security protection.

Management of public keys related to ciphertext data.

The operation procedures and controls for delivery, switching between ciphertext mode and plaintext mode, and password authentication are complicated, and the efficiency and operability of the system and devices are poor, making it difficult to apply them easily.

FIG. 4 is a diagram showing a conventional ciphertext communication system described in, for example, Japanese Patent Application Laid-Open No. 61-81043, the title of the invention being "Cryptographic Processing System in Packet Communication." A conventional encrypted communication processing device will be explained in more detail with reference to this figure. In the figure, 41.42 is a communication line, 43.
44 is a terminal that communicates via communication lines 41 and 42;
5.46 is an adapter circuit having information assembly and disassembly and line interface functions for each terminal 43 and 44, respectively;
47 and 48 are the control processors of each terminal 43 and 44, respectively, and 49 and 50 are the encryption/encryption processors of each terminal 43 and 44, respectively.
Decryption circuits, 51 and 52 are encryption key tables of each terminal 43 and 44, respectively, and 53 and 54 are each terminal 43.
44 internal path.

Next, the operation of the conventional encrypted communication processing device shown in Fig. 4 is as follows.
This will be explained with reference to the information communication format shown in FIG. now,
The operation and information communication format when the terminal devices 43, 44 communicate encrypted information via the communication lines 41, 42 will be explained. When the terminal device 43 transmits a ciphertext to the other party's terminal device 44, first, the control processor 47
According to the control procedure, the line 41.
42 and the other party's terminal device 44.

Make logical connections. Next, the transmission data in the control processor 47 is sequentially read out to the encryption/decryption circuit 49 and the adapter circuit 45 via the internal path 53 of the device.
Sent to the line. FIG. 5 shows an information communication format that is a block of transmitted information (hereinafter referred to as a packet) at this time.

That is, in FIG. 5, F is a flag sequence, Fe2
is a frame check sequence, A is an address field, C is a control # field, H is a header field indicating data length 2, caller identification code, key identification code, etc.
TA is encrypted data.

The terminal device 43 on the sending side encrypts the data contained in such a transmission packet using the encryption/decryption circuit 49, and the terminal device 44 on the other side encrypts the data necessary for decrypting and processing the data. It is sent as a packet with added information to the other party's terminal equipment [44] through the line.

The terminal device 44 identifies the terminal device 43 that is the source of the arriving received packet, retrieves the drawn key from its own key table 52 based on the information identification code of the header field included in the received packet, and decrypts it. The decoding circuit 50 is provided with function parameters for decoding processing.

Received address identification 2 The adapter circuit 46 and control processor 48 perform subscriber identification, key identification, data length identification, etc., and if the self address and each of the above identifiers are correctly recognized, the received encrypted data is sent to the encryption/decryption circuit. The data is sequentially converted to plain text data at 50 and imported into memory in the control processor 48 via an internal path 54.

If the self address and the identifier are not correctly recognized, the control processor 48 stops the data receiving operation and ends the process.

Next, the sending terminal device 43 simultaneously sends multiple terminal devices 4
The operation when transmitting data to 4 will be explained.

When the terminal device 43 on the sending side is in the ciphertext transmission mode and the relay communication function for simultaneously transmitting ciphertext data to multiple terminal devices is activated (by instructions from an operator or a program), the ciphertext is entered in the destination address field. A transmission packet with a common address set for a plurality of terminal devices on the other side that should receive the message is sent to the line and the terminal device on the other side.

The terminal devices that have identified the common address perform sender identification, key identification, and data length identification, as in the case of one-to-one communication, and then import the encrypted data into each terminal.

In this way, broadcast communication in which ciphertext data is simultaneously transmitted to a plurality of terminal devices is possible.

[Problem that the invention seeks to solve]

As explained above, in the conventional system, especially when broadcasting ciphertext data, the transmitting terminal transmits the common address of a group of receiving terminals, as in the case of regular plaintext data. This is executed by each terminal device on the receiving side that has identified the common address activating a reception processing function.

However, in this case, the common address may be received by a terminal that does not need to be transmitted due to the occurrence of an error.
Additionally, there was a problem in that it was not possible to confirm whether the terminal expecting to receive the encrypted data had received the encrypted data.

In addition, in the conventional system, when carrying out one-to-one communication of encrypted data, priority control of plain text data and encrypted data cannot be performed, so there is a problem that transmission of confidential data at a high management level is delayed.

This invention has been made to solve the above-mentioned problems, and aims to provide a cryptographic communication processing device that can realize highly reliable and efficient cryptographic data communication. purpose.

[Means for solving problems]

The encrypted communication processing device according to the present invention 'identifies and manages settings of the address (own address) and encrypted token of the terminal device in a branch type (bus type) network in which one line is shared by a plurality of terminal devices. It is equipped with an access control circuit and a mode control circuit that sets and manages ciphertext modes identified and managed by the access control circuit.

[For production]

In the encrypted communication processing device of the present invention, when a terminal sends and receives encrypted data to and from another terminal, free line access like when sending and receiving normal plaintext data is suppressed,
Perform priority control of ciphertext data.

In other words, only the terminal that receives the own station address and the additional cryptographic token (ciphertext transmission/reception mode flag) activates the cryptographic communication processing mode, and then receives the encrypted key and cipher for decryption that are subsequently sent. It is capable of receiving and processing encrypted data and controlling the priority of ciphertext communication. Therefore, while the ciphertext data communication between the terminals continues, the plaintext data transmission/reception operations by other terminals are suppressed, and only when the cipher token release flag is received is the plaintext data transmission enabled by free line access for all terminals. Sending and receiving becomes possible.

Furthermore, priority communication of encrypted text can be performed by transmitting and receiving a common destination address prior to transmitting an encrypted token.

〔Example〕

An embodiment of the present invention will be described below with reference to the drawings. 1st
The figure shows the configuration of a cryptographic communication processing device according to this embodiment.

1 is a communication line as a transmission path, 2゜3 is a line termination device,
41 to 4n are n terminal devices that are connected to each other by the one communication line 1 and communicate by forming a branch type (bus type) network, and 51 to 5n are each terminal device 41 to 4.
This is a line interface circuit within n, which connects the communication line 1 and each of the terminal devices 41 to 4n to execute data transmission and reception.

Further, 61 to 6n are access control circuits that manage and control address identification and cryptographic tokens, and 71 to 7n are terminal devices 41.
~4n is plaintext mode and ciphertext mode.

A mode control circuit that sets, manages, and controls a communication control mode depending on the communication partner, such as a broadcast communication mode that transmits ciphertext data to multiple terminal devices at the same time; 81 to 8n are terminal control processors; 91 to 9n are terminal control processors; A cryptographic processing processor converts plaintext into ciphertext according to a certain algorithm, and conversely, a cryptographic processing processor converts ciphertext into plaintext. Numerals 101 to 10n are key tables for identifying, setting, and managing cryptographic keys. 11
．． 1 to 11n are internal buses of the terminal device.

FIG. 2 shows a data frame format on a line in the ciphertext data communication system according to the present invention.

P is a signal to establish a bit period, SFD is a code indicating the start of a frame, AD is a destination address and a source address, L is a data length, TK is a cryptographic token that is the main point of the present invention, K is a cryptographic key, and DATA is a transmission/reception. information data, F
e2 is a 7-frame check sequence for detecting transmission errors.

Next, the operation of the above embodiment will be explained with reference to the flowchart shown in FIG. Now, the operation of the receiving terminal device when a terminal connected to a branch type (bus type) line transmits and receives encrypted data to and from another terminal will be explained.

A terminal device in normal reception mode, for example 4n, receives an address from another terminal device, for example 41, and in step 8T
21, when the own station address designation is recognized, the flag code sent subsequently is received and identified.

That is, when the cryptographic token flag, which is the main point of the present invention, is recognized in step 5T22, the mode of the local terminal device 4n is set to the cryptographic data reception mode in step 5T23. Accordingly, in the case of the present invention, the terminal 4
N is in a state where it does not accept plaintext reception from other stations or plaintext transmission from its own station, and thereafter executes the operation of ciphertext data reception processing. Steps 5T24 to 26 show each of the above processes.

That is, data received via the communication line 1 is first subjected to a bit cycle by the line interface circuit 5n, and is then processed by a code SFD indicating the start of the data frame, an address AD, a code L indicating the data length, a cryptographic token TK, and a cryptogram. The ciphertext data DATA is received as an encryption key for decrypting the data into plaintext, and a 7-frame check sequence FC8 for detecting a transmission error is received in this order. Of these, address identification management and cryptographic token identification management are performed by the access control circuit 6n, and the plaintext data of other stations and the own station is maintained until the transmission and reception of ciphertext data with the communication partner terminal device in the encryption mode is completed. Prevent incoming and outgoing access. The reception process of the ciphertext data is performed through the internal bus i1n of the terminal device 4n, and its basic operation is managed and controlled by the terminal control processor 8n.

That is, when the terminal control processor 8n confirms the reception of the cryptographic token TK flag TKF indicating an instruction to receive cryptographic data (step 5T22), it sets the mode control circuit 7n of the own terminal device 4n to the cryptographic data reception mode in step 5T23. ), then identifies the encryption key K received via the line interface circuit 5n, and instructs the key table 10n and the encryption processor 9n to perform operations such as setting keys and parameters for decryption processing (step 8).
T25). Next, the ciphertext data received via the line interface circuit 5n is taken into the terminal control processor 8n, decrypts it based on a certain algorithm with the cryptographic processor 9n, and converts it into plaintext data to the own terminal. Display or output on 4n output device (
Step 5T26).

The ciphertext data reception processing operation in the ciphertext data reception mode is repeatedly executed in step 5T26, and the cipher token release code TK flag (TK
F), in step s'r"27, the terminal control processor 8n cooperates with the access control circuit 6n and determines in step 5T28 whether there is any transmitted ciphertext data from its own station, and if not, the ciphertext held up to then is The data reception mode is canceled (reset) at step 5T29, and the station becomes ready to receive plaintext data from another station or transmit plaintext data from its own station (step 5T30).

On the other hand, in step 8T2B, if the local station has ciphertext data to be transmitted to another terminal device, the mode control circuit 7n sets the ciphertext data transmission mode in step 8T3i based on the instruction from the terminal control processor 8n. However, the access control circuit 6n holds the cryptographic token. In this state, plaintext data transmission and reception by other stations and the local terminal device is prohibited. When the local station enters the ciphertext data transmission mode, it sends out the address and cipher token of the other party's terminal device that is to receive the ciphertext data using a data frame similar to that in the ciphertext data reception mode described above.

In addition, in the broadcast communication mode in which the terminal device 4n simultaneously transmits ciphertext data to a plurality of other terminal devices connected to the same line 1, the mode control circuit 7n- is operated based on instructions from the terminal control processor 8n. After setting the broadcast communication mode, the access control circuit 6n holds the cryptographic token, generates a broadcast communication address, and transmits the broadcast communication address with the cryptographic token attached via the line interface circuit 5n and the line 1 to the other party's terminal.

In this case, the communication of ciphertext data is carried out in the same way as described above, by decoding the address AD of the local station and the cipher token TK to ensure that the ciphertext data is received only by the terminal device at the specified address. Therefore, unspecified and unnecessary terminal devices will not receive the ciphertext data by mistake.

In this way, ciphertext data communication or its broadcast communication processing can be performed reliably and preferentially and quickly.

In the embodiment of the present invention, a branch type (bus type) network configuration in which terminal devices share one line,
In particular, this is a random access contention system in which all terminal devices always have free access to the line, but the same purpose and effect can be achieved in a token-passing network in which terminal devices sequentially transfer transmission rights to each other. can be achieved.

〔Effect of the invention〕

As explained above, according to the present invention, a cryptographic communication processing device can be used in a branch type (bus type) network by using cryptographic data having the local address and electronic token of a terminal device that transmits and receives cryptographic data. Since the configuration is configured to perform communication processing of the ciphertext data, there is an effect that the transmission and reception of the ciphertext data can be performed preferentially and reliably with high reliability. Furthermore, it is possible to realize efficient and highly reliable communication processing for broadcast communication of encrypted data.

[Brief explanation of the drawing]

Fig. 1 is a block diagram of a cryptographic communication processing device according to an embodiment of the present invention, Fig. 2 is a diagram of a data frame format on a line in the ciphertext data communication system according to the above embodiment, and Fig. 3 is a ciphertext data reception mode. 4 is a block diagram of a conventional encrypted communication processing device, and FIG. 5 is a data frame format diagram of the same. In the drawing, 1 is a communication line, 41 to 4n are terminal devices, and 51 to 4n are terminal devices.
5n is an interface circuit, 61 to 6n are access control circuits, 71 to 7n are mode control circuits, 81 to 8n are terminal control processors, 91 to 9n are cryptographic processing processors,
101 to 10n are encryption key tables, A in Fig. 2
D is an address and TK is a cryptographic token. Patent applicant Mitsubishi Electric Corporation Figure 4 Figure 6

Claims (1)

[Claims] In a cryptographic communication processing device that transmits and receives ciphertext data between multiple terminal devices connected to a branch type (bus type) network, an access control circuit that identifies and manages settings of the address and cryptographic token of the terminal device; A cryptographic communication processing device comprising: a mode control circuit that sets and manages a ciphertext mode identified and managed by an access control circuit.