JPS60156153A - Communication controlling device - Google Patents

Abstract

PURPOSE:To keep assuredly secrecy of secret information by setting the range of address for the area of a main memory section in which the secret information is stored, and checking whether inputted main memory section address exists in the range of address or not. CONSTITUTION:An operating section 25 consists of an inputting section formed of a device that sets address and write data of a main memory section 24 to be accessed and sets distinction between read/write, an outputting section that displays content read out from the main memory section 24 and an operation controlling section that controls these inputting/outputting sections and controls interface with a main controlling section 24. Further, the operation controlling section checks whether the address corresponds to address range of a cipher key list area 241 or not when the operation to access the main memory section 24 is executed, and permits access to the main memory section 24 only when the address does not correspond to the range.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Application of the Invention] The present invention relates to a communication control device, and particularly to a communication control device that conceals confidential information.

[Background of the invention]

Conventionally, when performing cryptographic transmission, it has been common to provide cryptographic devices on both the center side and the terminal side, as shown in Figure 1. , i'1 In the diagram, 1 is a computer on the center side, 2 is a communication control device, 3 is an encryption device, 4 is a modem, 5 is a terminal that performs encrypted transmission, 6 is a terminal that does not perform encrypted transmission, and 7 is a recycler. However, in this case, two encryption devices are required for each WM, so the number of WMs is large. Ta.

One possible solution to these problems is to provide the communication control device on the center side with a cryptographic processing function. In this case, 5IC is shown in Figure 2.

The encryption device is installed only on the terminal side.
The cost of equipment can be cut in half. However, when providing a communication system @ iron #KN processing machine nhi,
There was a problem in that it was difficult to conceal the encryption key.

The main function of the communication control device is to control data transmission between the center computer and the terminal, but it also usually performs various line test functions and maintenance functions for the cover itself. It also has In order to realize these functions, the contents of the main memory and registers inside the communication control unit can be easily read out and replaced by operator operations from a panel installed in the device. It has become. The encryption key is stored in main memory iK.
If stored, there was a risk that the encryption key could be easily read out by panel operations or the like, and that it could be replaced.

[Purpose of the invention]

SUMMARY OF THE INVENTION An object of the present invention is to solve the problems of the prior art as described above and to provide a communication control device that ensures confidentiality of confidential information.

rSummary of the Invention] The present invention provides a storage means in which an address range of an area of a main storage section in which confidential information is stored, and an address in the main storage section inputted by an operator's operation is stored in the storage means. The communication control device is characterized by having a control means that checks whether the address falls within the address range and permits reading from the main storage unit only when the address does not fall within the address range.

[Embodiments of the invention]

Hereinafter, one embodiment of the present invention will be explained according to the drawings.

, 1'F5 is a configuration diagram of the communication control device.

21 is a channel interface control unit that controls communication with a computer (CPU) via a channel, 22 is a line fee part that controls the interface with a line, and 26 is a built-in cryptographic processing unit 24 that performs cryptographic processing. A main memory section 25 stores control programs and buffers transmitted and received data; 25 is an operating section controlling the interface with the operator; 26 reads out and executes commands from the main memory section 24; 25 is a main control section which centrally controls the operation of each unit, and 27 is a register for storing the start address and length of the cryptographic key I-list.

The built-in control program may be a CPU channel.

When the loading is completed, control is passed to the execution start address of the built-in control program under the control of the main control section 26. The built-in control program includes an encryption key list area 241 as shown in FIG.
1 and its length are stored in advance at the first address.

The built-in control program stores the contents of the specific area 242 in the register 27 according to a special command under control. This special command is, for example, when transferring data from the communication control device to the CPU, by setting the data in the main memory section 24 to the channel interface control section 21 by activating the main control section 26. It can be easily achieved.

The operation s25 includes an input section that sets the address and loading data of the main memory section 24 to be accessed, and a means for setting read/write distinction, and an output section that displays the contents read from the main memory section 24. , and an operation control section that controls these input/output sections and controls the interface with the main control section 24. Furthermore, the operation control unit is connected to the main storage unit 24.
When an operation to access is performed, it is checked whether the address corresponds to the address range of the encryption key 0 list area 241, and only if it does not correspond, the above -g
Allow access to 24.

, 115 shows details of the operation section 25. 101 is a group of operation switches for instructing the address and read/write of the main memory section 24; 102 is a group of lamps for displaying data in the main memory section 24; 103 is an address signal; 104 is a chatter prevention circuit for the address signal; A read instruction signal, 106 is a read instruction holding circuit, 107 is an adder circuit, 108, 109 and 110 are comparison circuits, 111 is a Nant gate, 112 is an AND circuit, 113 is a NOT circuit, 114 is a read request signal for the main storage section 24 ,
115 is an address signal sent to the main storage unit 24, 116
117 is a data signal from the main storage section, 118 is an OR circuit, and 119 is a register that holds data from the main storage section 24.

Note that writing from the operation unit 25 to the main memory unit 24 is performed by reading out the data once from the main memory unit 24n), displaying it on the lamp group 102, and then issuing a write instruction.

When the operator operates the operation switch group 101 to instruct the main storage unit 24 to read, the address signal 103
is sent to the chatter prevention circuit 104, and is sent to the comparison circuit 108.
．． Sent to 109. The other comparators 108 and 109 each have an output of 10! , or the output k of register 27 is sent. This indicates the maximum address and minimum address of the encryption key list area 241, respectively. The output of register 27 is sent to comparator 110. The outputs of comparators 108-110 are sent to NAND gate 111K. In this way, the NAND gate 111 opens when the address a sent from the operation switch group 101 is within the range of k <, a (k+) and when the address is 0. The output of the read instruction holding circuit 106 and the output of the Nantes gate 111 are ANDed by an AND gate 112, and a read request signal 114 is generated.
is made. - That is, the read request signal 114 is
It is turned on only when the address specified by the operation switch group 101 is outside the encryption key list area 241. The output of the chatter circuit 104 is also sent to the main storage section 24 as an address signal 115. In response to the read request signal 114, data in the main storage section 24 is read out as a data signal 117. At the timing when the data signal is determined, the main storage unit 24 sends a read completion signal 1.
Turn on 16. As a result, data from the main memory section 24 is set in the register 119, and the data from the rung group 102 is set in the register 119.
lights up. The output of the OR circuit 118 is sent to the reset input of the read instruction holding circuit 106, and when the address specified by the operation switch group 101 indicates the inside of the encryption key list area 241, or when the read completion signal is turned on. When this occurs, the read instruction holding circuit 106 is reset.

As described above, according to the present embodiment, it is possible to prevent the encryption key stored in the main storage unit 24 from being easily read out by the operator's operation.

Note that the specific area 242 can be accessed via the operator or the operation unit 25.
If you change the contents of the encryption key list area 241
(For this reason, for the United States, the specific area 242 may be included and protected by placing the specific area 242 at the beginning of the encryption key list area 241. Or Instead of providing the specific area 242 in the main memory section 24, the specific area 242 may be read from a non-volatile storage device such as OM and stored in the register 27.

Furthermore, although the above embodiment has been explained using an example of a cryptographic key list, it is clear that any secret information that should be kept secret may be used.

〔Effect of the invention〕

According to the present invention, a special area of the main memory of a communication control device in which secret information is stored can be protected from operator operations, so that secret information can be reliably kept secret.

[Brief explanation of the drawing]

Figure 1 is a configuration diagram showing an example of the configuration of a conventional cryptographic transmission system. Figure 4 is a configuration diagram of a communication system (ill device).
A memory map of the main storage section inside the device. Figure 5 is a circuit diagram of the operation section of a communication control device according to an embodiment of the present invention. 24...Main storage unit 25...Operation unit 27...Register 241...Encryption key list Q area 242...Specific area. 1st n 4th η

Claims (1)

[Scope of Claims] It has a main memory 5fjt in which a built-in control program is stored and secret information accessed by the program is stored, and the main memory can be read/written by an operator's operation. A communication control device that performs the operation includes a storage means in which an address range of an area of the main storage section in which the confidential information is stored, and an address in the main storage section inputted by the operation of the operator is set in the area of the main storage section in which the secret information is stored. 1. A communication control device comprising: a control means for checking whether or not an address falls within a range of an address in a storage means, and permitting only an address that does not fall within the range to be read from the main memory.