JPH04301944A - Transmission system - Google Patents

Abstract

PURPOSE:To obtain the transmission system which can change and transfer ciphered keys with simple configuration. CONSTITUTION:In the transmission system to execute communication between a station equipment 1 and a network terminating equipment 2 in a point-to- multiform, the change request of the ciphered key is transmitted through a transmission line 12 to the network terminal equipment 2 together with a plane data and the new ciphered keys are generated by a ciphered key generation circuit 21 of the network terminal equipment 2. Among the generated keys, the ciphered keys are transferred through a transmission line 15 to the station equipment 1 together with up signals, it is collated by a key management circuit 17 whether the generated ciphered key is used or not and when it is not used, the conventional ciphered key is changed into the new ciphered key.

Description

[Detailed description of the invention]

0001

[Field of Industrial Application] The present invention relates to a transmission system that performs point-to-multipoint communication between a station device and a network termination device, and in particular, it relates to a transmission system that performs communication between a station device and a network terminal device in a point-to-multipoint manner, and in particular, it relates to a transmission system that performs communication between a station device and a network terminal device in a point-to-multipoint manner. It concerns transfer technology.

0002

2. Description of the Related Art Conventionally, there has been a transmission system as shown in FIG. 3, for example, as a transmission system having a security measure for communicating between a station device and a network terminal device in a point-to-multiple format. In FIG. 3, 1 is a station device, 2 is the first (#1) network termination device of a plurality of network termination devices accommodated in the station device 1, and the station device 1 has an encryption key generation circuit 3 and , an encryption key holding circuit 4 that holds an encryption key ka#1 for encrypting plaintext to the network termination device 2, and an encryption key ka#1 from the encryption key holding circuit 4 to the network termination device 2. plaintext md#1
An encryption circuit 5 that performs encryption, a multiplexing circuit 6 that time-division multiplexes downlink data signals cd#1 to cd#n to a plurality of network termination devices 2, and a time-division multiplexing circuit 6 that performs time-division multiplexing of downlink data signals cd#1 to cd#n to a plurality of network termination devices 2. A separation circuit 7 is provided for separating signals from a predetermined network termination device from the connected signal string mu.

[0003] The network termination device 2 also includes a separation circuit 8 that separates a signal to the network termination device 2 from the signal sequence CD time-division multiplexed between a plurality of network termination devices 2, and a separation circuit 8 that decrypts the ciphertext. a decryption key holding circuit 9 that holds a decryption key for decryption; a decryption circuit 10 that decrypts a ciphertext sent to the network termination device 2 using the decryption key from the decryption key holding circuit 9; and an uplink data signal mu#. 1 to a specific time slot position of the signal train mu.

Furthermore, 12 and 13 are transmission lines, 14 is a branching device that branches the signal train CD from the station equipment 1 into a plurality of transmission lines between the network terminal equipment, and 15 is a branching device that branches the signals on the plurality of transmission lines into one.
A coupler 16 coupled to the book transmission path is a communication path that transfers the decryption key kb#1 from the encryption key generation circuit 3 to the decryption key holding circuit 9. The configuration of the n-th (#n: n=1, 2, . . . ) network termination device accommodated in the station device 1 is also similar to the configuration of the network termination device 2 described above. In addition, the station device 1 also has an nth (#n: n=1, 2 There are encryption key holding circuits and encryption circuits corresponding to the network termination devices ( , . . . ).

Next, the operation will be explained. The encryption key generation circuit 3 receives an encryption key change request kr.
When #(n=1,2,...) is input, an encryption key ka#n(n=1,2, ...) and a decryption key kb#n (n=1, 2, ...) for decryption. The encryption circuit 5 encrypts the plaintext md#1 sent to the network terminal device 2 with the encryption key ka#1 held in the encryption key holding circuit 4, and generates the downlink data signal cd#1.

The multiplexing circuit 6 time-division multiplexes downlink data signals cd#n (n=1, 2, . . . ) sent to a plurality of network terminal devices to generate a downlink data signal cd. The separation circuit 8 of the network termination device 2 converts the time-division multiplexed down data signal cd sent from the station device 1 into a signal cd#1 from the station device 1 to the network termination device 2 at a predetermined time slot position. Separate.

The decryption circuit 10 decrypts the encrypted downstream data signal cd#1 from the separation circuit 8 using the decryption key kb#1 held in the decryption key holding circuit 9, and converts it into plaintext md#.
Take out 1. The transmitting circuit 6 sends the uplink data signal mu#1 to a specific time slot position of the uplink signal train. The uplink data signal mu#1 is sent to the station device 1 via the coupling circuit 15.

The separation circuit 7 separates the signal mu#n from a predetermined network termination device from the uplink data signal mu subjected to time division multiple access between a plurality of network termination devices. The communication path 16 is a path for transferring the decryption key kb#1 generated by the encryption key generation circuit 3 to the decryption key holding circuit 9, and is, for example, a path through which the decryption key is delivered manually by a delivery person. .

Note that the downlink data signal cd is transmitted to the branch circuit 14.
The same signal is transmitted to multiple network termination devices via the network. Therefore, for the transfer of the decryption key kb#n, a communication path is provided that is independent of the transmission path 12 that transmits the same downlink data signal cd.

0010

[Problem to be Solved by the Invention] Since the conventional transmission system is configured as described above, when the encryption key is changed due to increasing the confidentiality strength, etc., a transmission line is used to send a data signal every time the encryption key is changed. It is necessary to secure a communication channel to transfer a decryption key separate from the decryption key, which poses a problem in that the simplicity and maintainability of the system are significantly reduced.

The present invention has been made to solve the above-mentioned problems, and an object of the present invention is to provide a transmission system that can change and transfer encryption keys with a simple configuration.

0012

[Means for Solving the Problems] A transmission system according to the present invention branches a transmission line using a brancher and a coupler,
In a transmission system that performs point-to-multipoint communication between a station device and a network termination device, the station device includes an encryption key holding circuit that holds an encryption key for encrypting plaintext to the network termination device. , an encryption circuit that encrypts plaintext to the network termination device using the encryption key, a key management circuit that manages the usage status of multiple encryption keys, and a control that adds a signal indicating a change in the encryption key to the signal string. A signal insertion circuit, a multiplexing circuit that time-division multiplexes signals to multiple network termination devices and sends them out, and a separation circuit that separates a predetermined signal from a signal stream time-division multiplexed between multiple network termination devices. and an encryption key separation circuit for extracting the new encryption key from the signal sequence from the network termination device, and the network termination device is provided with a signal that is time-division multiplexed between the plurality of network termination devices sent from the station device. a separation circuit of a network termination device that separates a predetermined signal from the sequence; a decryption key holding circuit that holds a decryption key for decrypting an encrypted text separated from the separation circuit; a decryption circuit that decrypts the ciphertext sent to the network terminal device, an encryption key generation circuit that generates a new encryption key in response to an encryption key change request from the station device, and a This includes a transmitting circuit that adds the encryption key to the signal sequence to the station equipment and sends it out.

[0013]

[Operation] In the present invention, a request to change an encryption key is sent to a network termination device along with plain text data via a transmission path, an encryption key is generated by an encryption key generation circuit of the network termination device, and the generated encryption The key is transferred to the station equipment along with the uplink signal via the transmission path.

[0014]

DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing an embodiment of a transmission system according to the present invention, and 1, 2, 4-8, 10, 12-15 are the same as the conventional device shown in FIG. Reference numeral 1 indicates a station device, and 2 indicates the first (#1) network termination device of a plurality of network termination devices accommodated in the station device 1. The station device 1 encrypts plaintext to the network termination device 2. an encryption key holding circuit 4 that holds an encryption key ka#1 for performing the above-mentioned encryption key holding circuit 4;
plaintext m to the network terminal device 2 using the encryption key ka#1 from
between an encryption circuit 5 that performs encryption of cd#1, a multiplexing circuit 6 that time-division multiplexes downlink data signals cd#1 to cd#n to a plurality of network termination devices 2, and a plurality of network termination devices 2. It includes a separation circuit 2 that separates a signal from a predetermined network termination device 2 from a time-division multiple-connected signal string mu, and an encryption key separation circuit 16 that extracts an encryption key from a signal from the separation circuit 7; Key management circuit 17 that manages the usage status of the encryption key
and the encryption key change request signal kr#1 or the encryption key change signal kc#1 from the key management circuit 17 as plain text md.
Control signal insertion circuit 1 sent to encryption circuit 5 together with #1
It has 8. Note that 19 is an OVER gate circuit that takes the logical sum of two inputs and outputs the result.

[0015] The network terminating device 2 also processes a signal sequence cd that is time-division multiplexed between a plurality of network terminating devices.
a decryption circuit 10 that decrypts the ciphertext sent to the network termination device 2 using the decryption key; and a decryption key that decrypts the ciphertext with the decryption circuit 10. A decryption key holding circuit 19 that holds kb#1 and a control signal that separates the encryption key change request signal kr#1 or the encryption key change signal kc#1 from the signal sequence decrypted by the decryption circuit 10. Separation circuit 20 and encryption key generation circuit 21
and a transmitting circuit 22 that transmits the upstream data signal mu#1 and the encryption key from the encryption key generation circuit 21 to a specific time slot position of the signal sequence mu.

Note that 12 and 13 are transmission lines, 14 is a branching device for branching the signal train CD from the station equipment 1 into a plurality of transmission lines to and from the network terminal equipment, and 15 is a brancher for branching signals on the plurality of transmission lines into one. It shows the n-th coupler (#n: n=1, 2, . . .
) is also similar to the configuration of the network termination device 2 described above. Furthermore, the station device 1 includes an encryption key holding circuit 4, an encryption circuit 5, an overgate circuit 19, a control signal insertion circuit 18, and an encryption key separation circuit 16 corresponding to the first (#1) network termination device 2. Similarly, the nth (#n:n=1
, 2, . . .), there are an encryption key holding circuit, an encryption circuit, an overgate circuit, a control signal insertion circuit, and an encryption key separation circuit corresponding to the network termination device.

Next, the operation of the above embodiment will be explained using FIGS. 1 and 2. In the following explanation, the encryption key ka#1 used to prevent confidential communication between the station device 1 and the network terminal device 2 will be described.
, a case will be described in which the decryption key kb #1 is changed.
n: n=1, 2, . . .) Encryption key ka#n (n= 1, 2, . . .) used to prevent confidential communication with the network terminal device;
The same applies to the case where the decryption key kb#n (n=1, 2, . . . ) is changed.

FIG. 2 is a timing chart showing the encryption key change and transfer operation in the configuration shown in FIG. The signal train cd on the transmission line 12 and the signal train mu on the transmission line 13 are transmitted periodically. Until time ta, data is exchanged between the station device 1 and the network terminating device 2 by encrypting plain text md#1 in the station device 1 using the encryption key ka#1 in the encryption circuit 5, and transmitting the data between the station device 1 and the network terminating device 2. Then, the plaintext md#1 is decrypted by the decryption circuit 10 using the decryption key kb#1 to reproduce the plaintext md#1. The signal string cd on the transmission line 12 contains the encryption key ka#.
The downlink signal CD#1 encrypted with 1 is stored. The encryption key ka#1 is the encryption key holding circuit 4, and the decryption key kb
#1 is held in the decryption key holding circuit 19.

Now, suppose that a request to change the encryption key for the ciphertext between the station device 1 and the network terminal device 2 occurs at time ta, and a signal kr#1 indicating the request to change the encryption key is input. The control signal insertion circuit 18 inserts the signal kr#1 into the plaintext md#1 and sends it to the network termination device 2. The downlink signal cd#1 at this time is encrypted with the encryption key ka#1 up to time ta. The encryption key generation circuit 21 has a plurality of encryption keys, and when the signal kr#1 separated by the control signal separation circuit 20 is input to the encryption key generation circuit 21, an encryption key is randomly selected from among them. Then, a new encryption key ka#1s and a new decryption key kb#1s are generated.

The new decryption key kb#1s is stored in the decryption key holding circuit 19, but the decryption key holding circuit 19 stores the new decryption key from the station device 1 via the control signal separation circuit 20. Decryption key change signal kc#1 indicating change
Until then, the previous decryption key kb#1 is used as decryption circuit 1.
Continue sending to 0.

The transmission circuit 22 receives the new encryption key ka#1s generated by the encryption key generation circuit 21 and the upstream data signal mu.
#1 is sent to a specific time slot position of the upstream signal sequence mu starting at time tb. This signal is sent to the station device 1 via the coupler 15. The encryption key separation circuit 23 extracts a new encryption key ka#1s from the upstream data signal from the network termination device 2 separated from the multiplexed signal mu that is time-division multiple-connected between a plurality of network termination devices in the separation circuit 7. The key management circuit 17 verifies whether the new encryption key ka#1s generated by the encryption key generation circuit 21 is the encryption key in use.
If the encryption key is not currently in use, a decryption key change signal kc#1 indicating a change to a new decryption key is generated.

This signal kc#1 is supplied to the control signal insertion circuit 18.
It is inserted into the plaintext md#1 at the time tc and sent to the network termination device 2 by the downlink signal sequence cd starting at time tc. The downlink data signal cd#1 at this time is encrypted with the encryption key ka#1 up to time ta. Further, the new encryption key ka#1s is sent to the encryption key holding circuit 4. The encryption key holding circuit 4 updates the encryption key ka#1 and updates the signal sequence cd after time td.
The downlink signal cd#1 accommodated in the updated encryption key ka
Encrypted with #1.

The control signal separation circuit 20 extracts the signal kc#1 sent by the downstream signal train cd starting at time tc. When the signal kc#1 is input to the decryption key holding circuit 19, the decryption key kb#1 is updated to the stored new decryption key kb#1s, and is stored in the signal sequence cd after time td. The downlink data signal cd#1 is decrypted using the updated decryption key kb#1.

Therefore, data is exchanged between the station device 1 and the network terminal device 2 after time td by transmitting the plain text md#1 to the encryption circuit 5 using the encryption key ka#1 updated in the station device 1.
The decryption key kb# encrypted with
1, the decryption circuit 10 can decrypt it and reproduce the plaintext md#1. Also, the new encryption key ka#1s generated by the encryption key generation circuit 21 is sent to the encryption key management circuit 1.
As a result of the verification in step 7, if it is found that the encryption key is in use, the encryption key management circuit 17 generates a signal kr#1 indicating a request to change the encryption key, and the control is performed via the OVER gate circuit 19. The signal is sent to the signal insertion circuit 18.

The control signal insertion circuit 18 inserts a new signal kr#1 into the plain text md#1, and sends it to the network termination device 2 in accordance with the downlink signal sequence cd starting at time tc. The subsequent operation is the same as the encryption key change operation when a request to change the encryption key for the cipher text between the station device 1 and the network terminal device 2 is made at time ta.

[0026]

As described above, according to the present invention, a request to change an encryption key is sent to a network termination device along with plaintext data through a transmission path, and the encryption key generation circuit of the network termination device generates an encryption key. Since the generated encryption key is transferred to the station device along with the uplink signal via the transmission path, the encryption key can be changed and transferred with a simple configuration.

[Brief explanation of drawings]

FIG. 1 is a configuration diagram of an embodiment of a transmission system according to the present invention.

FIG. 2 is a timing chart showing encryption key change and transfer operations in the configuration shown in FIG. 1;

FIG. 3 is a configuration diagram of a conventional transmission system.

[Explanation of symbols]

1. Station equipment 2　　　　Network termination device 4 Encryption key holding circuit 5 Encryption circuit 6 Time division multiplex circuit 7 Separation circuit 8 Separation circuit 10 Decoding circuit 12 Transmission line 13 Transmission line 14 Turnout 15 Combiner 17 Key management circuit 18 Control signal intrusion circuit 19 Decryption key holding circuit 20 Control signal separation circuit 21 Encryption key signal separation circuit 22 Transmission circuit 23 Encryption key separation circuit

Claims (1)

[Claims] Claim 1: The transmission line is branched using a branching device and a coupler, and communication between the station equipment and the network termination equipment is connected to a point.
In a two-to-multiple transmission system, the station equipment includes an encryption key holding circuit that holds an encryption key for encrypting plaintext to a network termination device, and a circuit for holding an encryption key for encrypting plaintext to a network termination device using the encryption key. An encryption circuit that performs encryption, a key management circuit that manages the usage status of multiple encryption keys, a control signal insertion circuit that adds a signal indicating a change in the encryption key to a signal string, and a signal to multiple network termination devices. a multiplexing circuit that time-division multiplexes and sends out a predetermined signal from a signal stream connected in a time-division multiplex manner between a plurality of network termination devices; Separation of a network termination device, which is equipped with an encryption key separation circuit for extracting an encryption key, and separates a predetermined signal from a signal sequence time-division multiplexed between a plurality of network termination devices sent from a station device to the network termination device. a decryption key holding circuit that holds a decryption key that decrypts the encrypted text separated from the separation circuit, and a decryption key holding circuit that decrypts the encrypted text to the network terminal device using the decryption key. a decryption circuit, an encryption key generation circuit that generates a new encryption key in response to a request to change the encryption key from the station device, and an encryption key generated by the encryption key generation circuit that is added to the signal string and sent to the station device. A transmission system comprising a transmission circuit.