JPH04213241A - Cipher communication equipment for isdn - Google Patents

Abstract

PURPOSE:To attain cipher communication without insertion of any control device to a data to be ciphered of other channel by adding a cipher communication synchronization establishment function utilizing the other channel. CONSTITUTION:When a cipher communication request is sent, a D channel request code from a cipher communication synchronization establishment control section 12 is sent to an opposite equipment via a layer 1, 2 control section 3 through a DSU 2, an ISDN 1 through the depression of a cipher button. Moreover, when the opposite equipment accepts the cipher communication request, a cipher communication accept code of the D channel is returned and transferred to a control section 12 via the ISDN 1, the DSU 2 and layers 1, 2. After a pointer address 15 is pointed out to a B channel data buffer 19 storing a cipher communication data, the B channel data and a cipher signal of cipher processing sections 8,10 are exclusively ORed 6 and the cipher communication with the opposite party is implemented via the layer 1, 2 control section 3, the DSU 2 and the ISDN 1.

Description

[Detailed description of the invention]

0001

[Industrial Application Field] The present invention relates to an integrated digital service network (ISDN).
The present invention relates to an ISDN encrypted communication device that can apply encrypted communication to the CES Digital Network.

0002

[Prior Art] There are two types of encryption that are processed by computers: public algorithm (common encryption) and public key encryption (public key encryption).In public algorithm, the same key is always used for assembly and translation. In contrast, public key systems use different keys for assembly and translation. In the public algorithm method, the data components are divided into groups of characters in units of basic characters or spelling units and are encrypted as basic units, but in this case, the character strings (bit strings) of the data are assembled character by character. It can be divided into stream type and block type, which is assembled by grouping several characters together. When processing on a computer, it is more efficient to perform operations in bytes or words than in bits, so DES (
Data Encryption Standard
d) This block cipher method is used for encryption. On the other hand, with ISDN, telephone, facsimile, videotex, data communication, etc. can be integrated and used in a unified manner on one subscriber line, and image communication such as videophone is also possible. To summarize the services, (a) digital public networks have extremely low communication costs, especially for non-voice communications such as data, images, and images. (b) High-speed, high-quality communication such as high-definition facsimile communication and video with compressed bandwidth is possible. (c) Multimedia communication using multiple media with multiple parties at the same time is possible over a single line. (d) Circuit switching and packet switching can be selected and used as desired. (E) In the basic interface 2B+D, the information channel (B) and the signal channel (D) are separated and independent, and various additional services such as caller ID notification and user-to-user information notification are possible. be.

Conventionally, cryptographic processing devices for digital communication (ISO 9160 Information P
rocessing-Data encipherm
ent-Physical layer inte
performance requirements
s) is considered. The encryption processing method used in this device is a stream encryption method. A feature of the stream cryptosystem is that unless the encryption start data and the decryption start data completely match, decryption cannot be performed almost forever.

0004

[Problem to be Solved by the Invention] However, the above-mentioned cryptographic processing device cannot be used to store voice data, etc. using the INS net service (for example, by the Telecommunications Association of Japan, Telephone Business Support, Nippon Telegraph and Telephone Corporation). Edited by Headquarters ISDN Promotion Department
If you try to apply it to the INS Net Service Interface Volume 4 Layer 3 Circuit Switching Additional Services Edition), the encryption start data is It was extremely difficult to identify the decryption start data and the decryption start data (establish synchronization of encrypted communication). Therefore, in circuit switching supplementary services that require the start, interruption, and restart of encrypted communications, establishing synchronization of encrypted communications becomes a problem, and the scope of application is limited. As an improvement measure, a method of intentionally interrupting the synchronization establishment signal of B channel encrypted communication in order to establish synchronization of encrypted communication can be considered. However, with this method, there is a loss of data that should originally be transmitted on the B channel, although it is small.

SUMMARY OF THE INVENTION It is an object of the present invention to provide an ISDN encrypted communication device capable of solving the conventional problems and establishing synchronization of encrypted communication without data loss.

[0006]

[Means for Solving the Problems] In order to achieve the above object, the ISDN cryptographic communication device of the present invention uses a channel other than the information channel as a control channel, and encrypts unencrypted digital data of the information channel. an encryption means (8, 10 in Figure 1) that converts the encrypted data into encrypted data; and a decryption means (8, 10) that converts the cipher text encrypted by the encryption means back into digital data. ) and an encrypted communication consent means (Fig. 17, 18), a data storage means (19 in FIG. 1) that stores information channel data on the transmitting side and the receiving side, and a control channel from the transmitting side to the receiving side. A cryptographic communication synchronization establishment header sending means (12, 3 in FIG. 1) that transmits a consecutive data blocks (encrypted communication synchronization establishment headers) from the stored data, and on the receiving side, Encrypted communication synchronization establishment header search means (Fig. 1
12, 19) and the cryptographic communication synchronization establishment header search result returning means (see Fig. 1 12, 3), on the transmitting side, after confirming the return from the search result return means for header for establishing cryptographic communication synchronization, the header for establishing cryptographic communication synchronization with data length d is sent in the cryptographic communication n times every b pieces. A sending means (12, 3 in FIG. 1) that sends out data for establishing communication synchronization, and a header searching means for establishing encrypted communication synchronization and a header search means for establishing encrypted communication synchronization that transmits the data for establishing encrypted communication synchronization on the receiving side. A data confirmation result return means (12, 3 in Figure 1) for establishing encrypted communication synchronization that checks the header in the same manner as the header search result return means and returns the result. It is characterized in that it includes means (10) (12, 8, 10 in FIG. 1) for starting encryption on the sending side and starting decryption on the receiving side after e pieces of data length d that have been transmitted and received. be.

[0007]

[Operation] In order to establish synchronization of encrypted communication for INS net service, in addition to the conventional cryptographic processing device, a function for establishing encrypted communication synchronization using other channels such as D channel or B channel is added. do. As a result, without losing any data on the B channel,
A cryptographic communication processing device can be realized. Therefore, it becomes possible to apply encrypted communication to communications in which control information for encrypted communication cannot be inserted into the channel to be encrypted.

[0008]

Embodiment FIG. 5 is a block diagram of an ISDN cryptographic communication system to which the present invention is applied. As shown in FIG. 5, handsets 43 and 49 are connected to ISDN encrypted communication devices 41 and 42, and these handsets 43 and 49 are connected to
, 49, mutual communication is performed. handset 43
The audio input from the microphone is sent to the transmitter 44, D
SU (Digital Service Unit)
: line termination device) 45, ISDN 46, DSU 47, and receiver 48, and is output as sound from the speaker of the handset 49. These routes are indicated by thick lines. Note that from the microphone of the handset 49 to the speaker of the handset 43, although in the opposite direction,
Pass in exactly the same way. These routes are shown by thin lines. Transmitting sections 44 and 51, receiving sections 50 and 4
No. 8 is the same device. Therefore, in the following:
A description will be given of how to establish encrypted communication between the transmitter 44 and the receiver 48.

FIG. 1 shows an ISDN system according to an embodiment of the present invention.
FIG. 6 is a block configuration diagram of the cryptographic communication device for use in the Internet, and is a detailed diagram of the transmitter 44 of FIG. 5. When making a normal call using a digital telephone, that is, when not encrypted communication, the ISDN 1, DSU 2, layer 1, 2 control unit 3,
A call is made through a route using a voice codec 4 and a handset 5. Here, the layer 1, 2 control unit 3
The audio codec 4 has the function of separating B channel and D channel, and can digitize sounds such as voices, or conversely, convert data such as digitized sounds into audible sounds. It has the function of In Figure 1,
6 is exclusive OR, 8 is Encipher/
Decryption unit (Decipher), 10 is encryption key (KEY)
and initializing value
It is. These exclusive ORs 6, encryption/decryption unit 8,
The part that integrates the cryptographic key 10 and the cryptographic key 10 is a cryptographic processing unit. Regarding the encryption/decryption unit 8 and the encryption key 10, for example, "
“Cryptography and Information Security” co-authored by Tsujii and Kasahara (Shokodo) P.
．． 32~P. It is described in 35. 12 is a cryptographic communication synchronization establishment control unit; 17 and 18 are cryptographic communication synchronization establishment control units 1
2, a cryptographic communication request lamp and a cryptographic communication lamp; 16, a cryptographic button; 19, a B channel data buffer; 15, a pointer address within the B channel data buffer 19; and 20, a clock input terminal. In this embodiment, when an encrypted communication request is sent, by pressing the encrypted button, the encrypted communication synchronization establishment control unit 12 sends a D channel request code to the DSU 2 via the layer 1, 2 control unit 3.
It passes through ISDN1 and is sent to the other party's device. Additionally, if the other party's device accepts the encrypted communication request, the encrypted communication consent code for the D channel is returned, and ISDN1, D
It is transferred to the encrypted communication synchronization establishment control unit 12 via the SU2 and the layer 1, 2 control unit 3. Next, the data for encrypted communication is
After setting the pointer address 15 in the B channel data buffer 19 in which the data is stored, the exclusive OR 6 of the B channel data and the encrypted parts of the cryptographic processing units 8 and 10 is taken, and layer 1 and 2 control is performed. Part 3, DSU2, and ISDN
Encrypted communication is performed with the other party's device via 1. As described above, in this embodiment, when encrypted communication is performed on the D channel, encrypted communication synchronization is established using another B channel, and when encrypted communication is performed on the B channel, other D
Since encrypted communication synchronization is established using the channel,
There is no need to interrupt communication data with control information for encrypted communication, and it is possible to reliably synchronize encrypted communications. In addition, regarding the layer 1, 2 control unit 3, for example,
Ohmsha's "ISDN Picture Reading Book" supervised by P. Akiyama. 22~P
．． 25.

[0010] When performing cryptographic processing on digital data, generally known cryptographic algorithms are often used. As described above, the cryptographic algorithms include the public algorithm (private key) method and the public key method. Here, the public algorithm method FEAL (F
ast data Encipherment
(For example, "For Information Security - Basic Cryptography 2" by Masataka Kato, 1989, Co., Ltd.)
Science Publishing, pp. 641-646) is used. FEAL is one of the current cryptographic algorithms that is most difficult for third parties to break. In the public algorithm system, a 64-bit block cipher algorithm is standardized (ISO 8372
Information processing-M
odes of operation for
a 64-bit blockcipher
algorithm 1987First edi
tion). There are various encryption modes in FEAL, but they can be roughly divided into four types. Among these, (1) E
The CB mode is a mode in which an encryption key having the same length as the data text to be transmitted is used. Note that if the encryption key is completely random data, decryption is impossible. However, it requires the length of the encryption key to be the same as the data text, and in reality it is used only for very short messages. (2) The next CBC mode is a mode that compensates for the weaknesses of the ECB mode. Furthermore, (3) CFB mode is a mode in which encrypted output data is fed back. moreover,(
4) OFB mode is a mode in which scrambling is performed using only the encryption key and initial value. Output or input data
If there is an error in the data, the error data and encryption key
Since the initial value is scrambled and decoding becomes impossible for a while, it is not suitable for communications where there are many transmission errors. I
When using SDN, there are almost no transmission errors, so there is no problem in using CFB mode, but in this example, OFB mode, which does not provide output feedback, is used.
Use the code. Encryption key and initial value (KEY・I shown in Figure 1)
V10) must be registered in advance before performing encrypted communication. Therefore, the encryption key/initial value 10 is stored in the register section of the encryption communication synchronization establishment control section 12 from the user data, and then set in the KEY/IV 10 as necessary. A secondary battery is connected to the register, so even if a call is interrupted, the communication can be temporarily interrupted and the communication device can be moved. 64K on both digital phones
A byte (approximately 8 seconds) B channel data buffer 19 is maintained and always stores the input/output data of the audio codec 4, that is, the latest B channel data to be encrypted. When the B channel data buffer 19 is filled with the data of the audio codec 4, the oldest data
They are being discarded from the beginning. The latest data is '0000'
It has an address called h', and this is assumed to be pointer address 15. Although only one input/output B channel data buffer 19 is shown in FIG. 1, two are provided, one for input and one for output.

<<Encryption Communication Synchronization Establishment Method>> FIG. 4 is a model diagram of the reception data buffer (B channel data buffer) in FIG. 1. In this example, a
=4, α=512, β=4, δ=1000, n=256
It is said that As for other channels, the user information of the D channel is used. The reception data buffer 19 is a layer 1
, 2, all the data flowing from the control section 3 to the audio codec 4 are also taken into the reception data buffer 19 at the same time. This operation is started after a request to establish synchronization for encrypted communication is made, and continues until the encrypted communication ends. The procedure for synchronizing operations for starting encrypted communication will be described below. - The side requesting encrypted communication sends a 4-octet (4-byte) encrypted communication synchronization establishment header. (2) Search for the same data as the received encrypted communication synchronization establishment header from FFFFh with the largest pointer address toward 0000h. (2) Assume that the same data as the header is found at pointer address k. To report the finding to the sender, the first octet of the 4-octet data is returned for confirmation. ■The sender receives the returned data.
If you check the data and it matches the data you sent, then
Data of 1 octet every 512 times 255 times (=2
56-1) Send. ■Receive side pointer address 51
While proceeding step by step, matching is performed with the data sent from the transmitting side, and each time it is reported to the transmitting side whether or not a match has been achieved. ■If only normal reports continue from the receiving side, 1 from the receive data buffer when n=0.
Encryption starts after 000 octets. By performing the above procedure, synchronization for starting encrypted communication is established. Note that although each channel of ISDN is full-duplex communication, in order to simplify the explanation, only one of the full-duplex channels will be described in detail. Therefore, by applying the same method to the other side, full-duplex encrypted communication is established.

<<Transition from normal communication to encrypted communication>> FIG. 2 is a flowchart showing a method of transition to encrypted communication according to the present invention. Here, it is assumed that the person who pressed the encryption button 16 is A, and the ISDN encrypted communication device that A is using is A machine. Also, let B be the other party for mutual communication, and let B be the digital telephone used by B. When transitioning from normal communication to encrypted communication, one of the speakers sends an encrypted communication request, so, for example, A presses the encryption button 16 (step a-1). When A presses the encryption button 16 of machine A, the encrypted communication request lamp 17 of machine A blinks (step a-2). At the same time as this operation, the encrypted signal request code determined as the D channel user information (in this case, 128 consecutive '00h
') to B (step a-3
). B interprets this encrypted signal request code as a request to start encrypted communication, and blinks the encrypted communication request lamp 17 (step a-4). If B agrees to encrypted communication, press Encryption Button 1 within a certain period of time to confirm the request to start encrypted communication.
Press 6 (step a-5). If machine B does not press the encryption button 16 within a certain period of time (10 seconds here), machine B understands that the encrypted communication is refused (step a).
-6), the cryptographic communication request lamp 17 is turned off (step a-7). In order to convey B's refusal to consent to encrypted communication to A, 128 'FFh's are sent consecutively using the D channel.
' is sent to machine A as an encrypted communication consent code (
Step a-8). Machine A receives this encrypted communication consent refusal code.
By receiving the code, the encrypted communication request lamp 1 of machine A
7 is turned off (step a-9), and A is informed that the encrypted communication has been discontinued (step a-10). On the other hand, if B presses the encryption button 16 within a certain period of time, it is understood that the encryption communication has been accepted, and the encryption communication request lamp 17 of the B machine changes from flashing to lit (step a-11). B machine is D
Transmit the encrypted communication consent code (here, 128 consecutive '00h's are sent) determined to confirm the encrypted communication start request to machine A as channel user information (
Step a-12). Upon receiving the encrypted communication consent code from machine B, machine A changes the encrypted communication request lamp 17 from flashing to lit (step a-13). (1) Machine A sets the initial value of the encrypted communication synchronization establishment counter n to 'FFh' (step a-14). When machine A receives confirmation of the encrypted communication start request from machine B, it sets the pointer address 15 to the latest data stored in the B channel data buffer 19 of machine A (step a-
15). Including this pointer address 15, 4 octets and the encrypted communication synchronization establishment counter n are sent to machine B as user information using the D channel through the encrypted communication synchronization establishment control section 12 (step a-16). B machine is A
When the 4-octet data sent by the machine is received, the data in the B-channel data buffer 19 of the B machine is traced back in time (in the increasing direction of the pointer address 15) and the first received 1 Search for data with the same value as the octet (step a-17). If no matching data is found, Aircraft B uses the exclusive OR of the first received data of the 4 octets sent by Aircraft A with 'FFh' and sends it to Aircraft A. (step a-18). Aircraft A is requesting a re-establishment of encrypted communication synchronization because the data indicated by pointer address 15 sent by Aircraft A itself to Aircraft B is different from the data returned from Aircraft B. Knowing this, return to (1). on the other hand,
If matching data is found, machine B returns the pointer data received from machine A to machine A (step a-19). Machine B, like machine A, sets the initial value of the encrypted communication synchronization establishment counter n to 'FFh' (step a-20). Next, aircraft B sets the first data of the data received from aircraft A (the same data indicated by pointer address 15 in aircraft A) to pointer address 1.
5 is determined (step a-21). (2) Machine B sends to machine A the data value indicated by the pointer address 15 in machine B and the value of the encrypted communication synchronization establishment counter n (step a-22). The B machine is
The value of pointer address 15 is decreased by 512 (200h) (step a-23). This operation is similar to k− in FIG.
Please refer to the pointer address of 200h. Next, A
After confirming that the data value indicated by pointer address 15 of machine B and the value of encrypted communication synchronization establishment counter n have been returned,
The value of the encrypted communication synchronization establishment counter n is decreased by 1 (step a-24). Machine A decreases the value of pointer address 15 by 512 (200h) (step a-25). Machine A sends the data value indicated by the pointer address 15 of machine A and the value of the encrypted communication synchronization establishment counter n to machine B (step a-26). Aircraft B determines whether the value of the data received from Aircraft A matches the data value indicated by the pointer address 15 indicated by Aircraft B (step a).
-27). If they do not match, aircraft B returns the exclusive OR of the pointer data of aircraft B and 'FFh' to aircraft A (step a-28). If they match, machine B returns the pointer data and the value of the encrypted communication synchronization establishment counter n to machine A (step a-
29). Machine A learns whether synchronization of encrypted communication has been established based on the data returned from machine B, and returns to (1) if synchronization is not established. In addition, if the encrypted communication synchronization has been established, check the value of the encrypted communication synchronization establishment counter n (step a-30), and if n is not 0, return to (2), and n=
If it is 0, machine A starts encrypting the 1000th B channel data from the current pointer address 15 (0.2 seconds later), and machine B starts decoding (step a-31). For example, if pointer address 15 is 200h, then 1000-200h=488. Therefore, CLK IN20, which is the synchronization clock of audio codec 4,
and starts encrypting and decoding from the 488th number. In machine A and machine B, the encrypted communication lamp 18 lights up (step a-32). B machine pointer address 15
Since the pointer address 15 of machine A always holds the same address value, it is guaranteed that machine B can decrypt the data encrypted by machine A. Taking into consideration the case where the machine B cannot decode the data, it is determined whether or not the machine B can decode the data (step a-33). Judgments are made by listening. In other words, if it cannot be decoded, it cannot be heard at all. If decryption is not possible, press the encryption button (step a-34). If decryption is possible, encrypted communication continues.

<<Transition from encrypted communication to normal communication (interruption of encrypted communication)
>> FIG. 3 is an operation flowchart for interrupting encrypted communication. When returning from encrypted communication to normal communication, one of the speakers sends a request to interrupt encrypted communication (presses encryption button 16) (step b-1). Hereinafter, the person who pressed the encryption button 16 will be referred to as A, and the ISDN encrypted communication device used by A will be referred to as A machine. When A presses the encryption button 16 of machine A, the encryption communication lamp 18 of machine A changes from lighting to blinking (step b-2). At the same time as this operation, the encrypted signal interruption request code determined as the D channel user information (in this case, 128 consecutive 'AAh's are sent) is sent to the other B (step b-3). Machine B interprets this encrypted signal request code as a request to start encrypted communication, and blinks the encrypted communication lamp 18 (step b-4). If B agrees to interrupt the encrypted communication, he presses the encryption button 16 to confirm the encrypted communication interrupt request (step b-5). If machine B does not press the encryption button 16 within a certain period of time (here, 10 seconds), machine B understands that the consent to interrupt the encrypted communication is refused (step b-6),
Turn on the encrypted communication lamp 18 again (step b-7)
). In order to convey B's intention to refuse consent to interrupt the encrypted communication to A, use the D channel to send 128 successive exclusive OR results of 'AAh' and 'FFh' as a code to refuse consent to interrupt the encrypted communication. (Step b-
8). When machine A receives this encrypted communication interruption consent refusal code, it lights up its encrypted communication lamp 18 again (step b-9) and notifies A that the encrypted communication interruption has been rejected. (Step b-10). On the other hand, if B presses the encryption button 16 within a certain period of time, it is understood that the interruption of the encryption communication is accepted, and the encryption communication request lamp 17 changes from lighting to blinking (step b-11). Machine B uses the encrypted communication consent code (here, 12 consecutive
8 'AAh') is transmitted to aircraft A (step b-12). By receiving the encrypted communication interruption consent code from aircraft B, the A machine turns on the encrypted communication request lamp 17.
from lighting to blinking (step b-13). (1) Machine A sets the initial value of the encrypted communication synchronization establishment counter n to 'FFh' (step b-14). When machine A receives confirmation of the encrypted communication interruption request from machine B, it sets the pointer address 15 to the latest data stored in the B channel data buffer 19 of machine A (step b).
-15). Including this pointer address 15, 4 octets of data are sent to D through the encrypted communication synchronization establishment control unit 12.
Send it to machine B as user information of channel data. B
The machine receives the 4 octets sent from machine A and the data block of counter n for establishing cryptographic communication synchronization (step b-16). Machine B has B channel data buffer 1.
Starting from the oldest data in 9, data with the same value as the 1 octet first received on the D channel is searched for, going back in time (in the increasing direction of pointer address 15) (step b-17). If no matching data is found, Aircraft B uses the exclusive OR of the first received data of the 4 octets sent by Aircraft A with 'FFh' and sends it to Aircraft A. (step b-18). Since the pointer data sent to machine B and the data returned from machine B are different, machine A learns that it is a request to reestablish encrypted communication synchronization, and returns to (1). On the other hand, if the matching data is found, Aircraft B will
The value of the pointer data received from the machine is returned (step b-19). Machine B, like machine A, sets the initial value of the encrypted communication synchronization establishment counter n to 'FFh' (
Step b-20). Then, aircraft B sets pointer address 15 to the first data of the data received from aircraft A (the same data indicated by pointer address 15 in aircraft A) (step b-21). . (2) Machine B returns the data value indicated by machine B and the value of the encrypted communication synchronization establishment counter n to machine A (step b-
22). Next, machine B changes the value of pointer address 15 to 5.
12 (step b-23). After confirming that the data value of the pointer address 15 indicated by the machine B and the value of the encrypted communication synchronization establishment counter n are returned, the machine A decreases the value of the encrypted communication synchronization establishment counter n by 1 (step b).
-24). Machine A sets the value of pointer address 15 to 512.
(200h) Decrease (step b-25). Aircraft A sends the data indicated by pointer address 15 of Aircraft A to Aircraft B.
and the value of the encrypted communication synchronization establishment counter n (step b-26). Machine B determines whether the value of the data received from machine A matches the data value indicated by the pointer address 15 of machine B (step b-27). If they do not match, aircraft B returns the exclusive OR of the pointer data and 'FFh' to aircraft A (step b-28). Also, if they match, aircraft B will
The pointer data and the value of the encrypted communication synchronization establishment counter n are returned to the device (step b-29). Machine A learns whether synchronization of encrypted communication has been established based on the data returned from machine B, and returns to (1) if synchronization is not established. Also,
If the encrypted communication synchronization has been established, the encrypted communication synchronization establishment counter n is checked (step b-30). If the value of the encrypted communication synchronization establishment counter n is not 0, the process returns to (2), and if it is 0, the 1000th B channel data from the currently indicated value of pointer address 15 (0.2 seconds later)
The encryption is then stopped (step b-31). From this state, normal communication (that is, non-encrypted communication) occurs, and both aircraft A and B turn off the encrypted communication lamp 18 and the encrypted communication request lamp 17 (step b-32).
). As a result of the above, encrypted communication is suspended (step b-33). At that time, both parties in the communication also store the encryption key and the changed value of the initial value. If the encryption is restarted, it is also possible to use a changed value from this initial value.

[0014]

[Effects of the Invention] As explained above, according to the present invention,
In order to establish synchronization of encrypted communication for ISN net service, we have added a function to establish encrypted communication synchronization using other channels, so encrypted communication can be performed without inserting control information regarding B channel data. is possible. Therefore, it is extremely effective when introducing cryptographic processing to communications where data must not be lost.

[0015]

[Brief explanation of the drawing]

Figure 1 is Figure 2, Figure 3 is, Figure 4 is, Figure 5 is

FIG. 1 is a block diagram of an ISDN cryptographic communication device showing an embodiment of the present invention.

[Figure 2] Flowchart of encrypted communication start operation in Figure 1
It is.

[Figure 3] Operation flow of interrupting encrypted communication in Figure 1
It is.

FIG. 4 is a model diagram of the reception buffer (B channel data buffer) in FIG. 1;

FIG. 5 is an overall configuration diagram of an ISDN network to which the present invention is applied.

[Explanation of symbols]

1 ISDN 2 DSU 3 Layer 1, 2 control section 4 Audio codec 5 Handset 6 Exclusive OR circuit 7 Output to encrypted communication synchronization establishment control section 8 E/D (
Encryption/decryption) circuit 9 Output to encrypted communication synchronization establishment control section 10 KEY
(Encryption key)/IV (Initial value) 12 Encryption communication synchronization establishment control unit 15 Pointer address 16 Encryption button 17 Encryption communication request lamp 18 Encryption communication lamp 19 B channel data buffer 20 CLK (Audio codec frame synchronization signal Input terminal) 41, 42 ISDN encrypted communication device (A, B) 43
, 49 Handset 46 ISDN 45, 47 DSU 44, 51 Audio data transmitter 48, 50 Audio data receiver

Claims (1)

[Claims] Claim 1: A cryptographic communication device that performs cryptographic communication regarding an ISDN information channel (channel to be encrypted), comprising:
One channel other than the above-mentioned information channel is used as a control channel, an encryption means for converting unencrypted digital data of the above-mentioned information channel into encrypted data, and an encryption means for converting unencrypted digital data of the above-mentioned information channel into encrypted data; In order to start and stop encryption and decryption from the same data by using a decryption means that converts the encrypted ciphertext back into digital data and the control channel for the information channel, communication between the two is performed. an encrypted communication consent means for consenting to the start and interruption of encrypted communication; a data storage means for accumulating data of the information channel on the transmitting side and the receiving side; and a control channel from the transmitting side to the receiving side. , a from the above accumulated data
header sending means for establishing encrypted communication synchronization that sends out consecutive data blocks (headers for establishing encrypted communication synchronization);
On the receiving side, header searching means for establishing encrypted communication synchronization searches the stored data for the same header as the header for establishing encrypted communication synchronization transmitted from the header sending means for establishing encrypted communication synchronization; header search result return means for establishing encrypted communication synchronization that returns a result as to whether or not the header for establishing encrypted communication synchronization found by the header search means for establishing encrypted communication synchronization matches; After confirming the return from the means, sending means sends every b headers for establishing cryptographic communication synchronization having a data length d n times as data for establishing cryptographic communication synchronization; Confirming the data for establishing cryptographic communication synchronization by checking the data for establishing cryptographic communication synchronization in the same manner as the header search means for establishing cryptographic communication synchronization and the header search result return means for establishing cryptographic communication synchronization, and returning the result. If the conditions are met by the result return means and each of the above means, the last sent/received data length d to e
A cryptographic communication device for ISDN, comprising means for starting encryption on a transmitting side and starting decryption on a receiving side.