JPS62104238A - Key distribution method for line ciphering equipment - Google Patents

Abstract

PURPOSE:To eliminate the collision of transmission by setting the 1st mode where a signal ciphered by a master key KM and distributed and the 2nd mode using the masterkey KM as a data key KD and switching the 1st and 2nd modes depending on ON/OFF of the power at a terminal equipment. CONSTITUTION:When power is applied to each terminal ciphering equipment where a key distribution mode switch 17 of a terminal ciphering equipment 16 is set to the KM mode, a CPU 18 of the terminal ciphering equipment 16 reads a key distribution mode switch 17 so as to decide whether the mode is the distribution mode or the KM mode. In this case, the master key KM is set as the data key KD to enter the ciphering communication processing. When power is applied with a delay to other terminal ciphering equipment connected to a branch line, the master key KM is set to the ciphering processing section as the data key KD. In this case, since no key delivery procedure with the main station ciphering equipment is executed, the communication between the main station ciphering equipment and the other terminal equipment is not disturbed.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a line encryption device installed between a data processing device and a modem, and particularly to a data key distribution method.

[Conventional technology]

In the conventional line encryption device, when the main station encryption device is powered on, a data key KD for encrypting data is encrypted and delivered using a master key KM that is set in common with the main encryption device. This will be explained below using figures.

Figure 2 is a connection block diagram for branch line connection.
1 is the host computer, 2 is the master cryptographic device, 3.4.5 is terminal A1 terminal B, and terminals C16, 7, and 8 are each terminal A.
, B, and C. This terminal encryption device 6,
In contrast to 7.8, all data keys KD are distributed in accordance with the procedure shown in FIG. 3 when the main station cryptographic device 2 is powered on.

FIG. 3 is an explanatory diagram of a conventional key distribution method.

In the figure, 9 is a key setting command, A is the number of the terminal encryption device 6, and EKM (KD) represents data obtained by encrypting the data key KD with the master key KM.

Further, 10 is a key receipt confirmation response (hereinafter referred to as Ack) from the terminal encryption device 6.

First, the master cryptographic device 2, which has been powered on at point a in FIG. 3, transmits a key setting command 9 to the terminal cryptographic device 6. In the terminal encryption device 6, the received EKM (K
D) with its own master key KM to obtain the data key KD, and sends an Ack 10 k to the master cryptographic device.
Send it back. Similarly to the above, the main cryptographic device 2 also delivers the data key KD to all other terminal cryptographic devices γ and 8.

After these deliveries are completed, each terminal encryption device 6゜7.8
is in encrypted communication mode, and host computer 1 and terminal A,
Communication between B, C43, 4, and 5 becomes possible.

However, in this case, all the terminal cryptographic devices 6, 7.8 must be powered on when the key is delivered to the master cryptographic device. Therefore, you can turn the power ON/OFF on the terminal side as necessary.
In a system that performs F, a problem arises in that the above-mentioned terminal encryption device cannot be applied.

Therefore, the following method was devised to solve this problem. That is, key distribution is performed by skipping terminal encryption devices that do not return an Ack, and data communication is entered into encrypted communication mode only between terminals for which key distribution has been completed. After that, when the power is turned on to the terminal cryptographic device, the terminal cryptographic device issues a key delivery request to the master cryptographic device and sets the key again. This allows you to turn the power on/off as needed on the terminal side.
It can also be applied to systems that perform

This delivery procedure will be explained in detail based on FIG. 4. Fourth
In the figure, a key setting command 9 is sent to the terminal encryption device 6 at point a. In the terminal encryption device 6, EKM(K
D) and sends an Ack 10 to the master encryption device 2.
to be sent back. Here, with the power on the terminal B side in the OFF state,
If the confirmation response to the key distribution command 11 is not returned to the master cryptographic device 2, the master cryptographic device 2 detects a timeout of the return time at point b, and then transmits the key to the terminal cryptographic device 8 of the terminal C. A delivery command 12 is sent.

A confirmation response 13 in response to this is sent back from the terminal encryption device 8 to the master encryption device 2, and between the master encryption device 2 and the terminal encryption device 6.
, 8 enters encrypted communication. After this, all messages between the main station encryption device 2 and the terminals A and C are encrypted with the data key 'KD and transmitted.

Thereafter, when the terminal cryptographic device T is powered on, for example at point 0, the terminal cryptographic device 7 transmits a key distribution request RBQ14 to the master cryptographic device. In response to this key distribution request 14, the master cryptographic device sends the key distribution command 1 again to terminal B.
1 is sent, and in response to Ack15 from the terminal encryption device 7, the encrypted communication mode is set again.

[Problem that the invention seeks to solve]

However, in such a case, when the terminal cryptographic device 7 takes the timing to send the key distribution request 14, even if it tries to detect the polling of its own terminal B, the master cryptographic device 7 has already detected the polling of its own terminal B.
Since the communication between the terminal A and the other terminals A and C is encrypted using the data key KD, the terminal encryption device 7 that started up later does not have the data key KD. Therefore, the terminal encryption device 7 is unable to decode the polling message, and there is a problem that it becomes impossible to determine the sending timing based on the polling message.

Furthermore, this transmission timing is determined by the end of the transmission message from the main station encryption device 2, and this end occurs when the carrier of the main station encryption device 2 in the terminal encryption device 7 is turned off, that is, when the carrier detection signal (CD) is turned off. If so, it cannot be determined whether the terminal cryptographic device child is being polled.

For example, if the terminal encryption device 7, which started up late, detects the carrier detection signal (cD)' of the message that the main station encryption device 2 polled for the terminal person, the terminal encryption device 6. A problem arises in that the transmissions of the terminal encryption device 7 collide and normal communication is not possible.

The present invention has been made to solve the above-mentioned problems, and its purpose is to enable the same terminal encryption device to be used even in a system in which the terminal side of the terminal encryption device turns on/off the power as needed. The purpose is to enable quick data communication.

[Failure to solve the problem]

In order to achieve the above object, the present invention enables the terminal side of a terminal encryption device to turn on/off the power at any time as necessary.
In this system, there are two modes: a first mode in which a data key KD for encrypting data is encrypted and delivered using a master key KM that is commonly set in each terminal encryption device, and a second mode in which the master key KM is used as a data key KD. The mode is set in advance, and the key is delivered by switching to the first mode or the second mode depending on the ON/OFF state of the power supply.

[Effect]

In the present invention having the above-described characteristics, when the terminal side of each terminal encryption device is in the ON state, the terminal encryption device is set to the first mode, and a key reception confirmation response is sent from the terminal encryption device to the master encryption device. When the data key KD is returned to
is encrypted with master key KM and delivered. In addition, if the terminal side of the terminal encryption device is in the OFF state, all terminal encryption devices are set to the second mode, and the master key KM
is used as the data key KD to enable data communication without key distribution with the master cryptographic device.

This prevents transmission collisions as in the conventional case.

〔Example〕

Hereinafter, one embodiment of the present invention will be described based on FIGS. 1 and 5.

First, FIG. 5 is a block diagram showing an example of a terminal encryption device used in an embodiment of the present invention. In the 50th, 16
1 is a terminal encryption device, 17 is a key distribution mode switch, 18 is a microprocessor unit, and 19 is a control program (hereinafter referred to as
It is written as ROM. ), 20 is a cryptographic processing unit, 21 is a line interface unit (hereinafter referred to as line I/F), and 22 is a master key setting unit.

Incidentally, the line I/F 21 is connected to a master cryptographic device (not shown) and other terminal cryptographic devices.

FIG. 1 is a flow chart of an embodiment of the present invention showing the key distribution operation executed by the CPU 12 and ROM 19 of FIG. Note that EKM(KD) in FIG. 1 represents data obtained by encrypting data key KD with master key KM.

Based on this FIG. 1 and FIG. 5, the CPU 12 and ROM
The key distribution operation performed by No. 19 will be described below. First, when the key distribution mode switch 17 is set to the distribution mode, when the system is powered on, 8
1. The CPU 12 of the terminal encryption device 16 reads the key distribution mode switch 17, S2, and determines whether it is the distribution mode or the KM mode. Since this is the mode for delivering J, the master station/terminal encryption device is determined separately.

If this determination is made by the master encryption device, an arbitrary random number is set as the data key KD, it is encrypted with the master key KM, and transmitted to the terminal encryption device 16 over the line I/1; Waiting for Ack from the device 16 S6゜ Upon reception of this Ack, the delivery of the data key KD to the terminal encryption device 16 is completed S6゜ Here, the delivery of the data key KD to all the terminal encryption devices 16 is completed. If it is completed, the data key KD is set in the cryptographic processing unit 20 in S8. After that, the cryptographic communication process starts in S9, and the data between the master cryptographic device and the terminal is stored in the data key K.
D is encrypted and communicated.

On the other hand, if the main station/terminal encryption device is determined to be a terminal encryption device, the E
Waits for KM (KD) 5IO1 When this EKM (KD) is received, it sends an Ack to the main station encryption device and also sends 81
1. Decrypt with the master key KM set in the master key setting unit 22 and obtain the data key KDi 812° This data key KD is set in the cryptographic processing unit 20 S8, the above-mentioned encrypted communication process begins S9° Next, Terminal encryption device 16
A case will be described in which the key distribution mode switch 17 is set to KM mode and each terminal encryption device is powered on.

First, when the power is turned on to the system 81, the CPU 12 of the terminal encryption device 16 reads the key distribution mode switch 17, S2, and determines whether it is the distribution mode or the KM mode. In this case, the KM mode is set, so the master key KMi is set as the data key KD, and in S13, the encrypted communication process begins.9゜Here, the other terminal encryption devices connected to the branch line are powered on after a delay. Then, the master key KM is set as the data key KD in the cryptographic processing unit in the same way as above.At this time, since the key distribution procedure with the master cryptographic device is not performed, there is no key distribution between the master cryptographic device and other terminals. No interference with communication.

〔Effect of the invention〕

As described above, according to the key distribution method for a line cryptographic device according to the present invention, the first key is to encrypt the data key KD for encrypting data with the master key KM that is commonly set to each terminal cryptographic device and then distribute it. mode and a second mode in which the master key KM is used as the data key KD are set in advance, and the power is turned ON/OFF on the terminal side of the terminal encryption device.
By switching between the first and second modes according to the F state, the following effects are achieved.

That is, even in a system where the terminal side of the terminal encryption device turns on/off the power at any time as necessary, there is an effect that data communication can be performed without conflicting transmissions as in the conventional example. 1

[Brief explanation of drawings]

FIG. 1 is a flowchart showing one embodiment of the present invention, and FIG.
The figure is a wiring block diagram of a branch line, FIG. 3 is an explanatory diagram of a conventional key distribution method, FIG. 4 is an explanatory diagram of another conventional key distribution method, and FIG. 5 is an embodiment of the present invention. FIG. 2 is a block diagram of an encryption device used for. 16...Terminal encryption device 17...Key distribution mode switch 18...CPU 19...ROM 20
... Encryption processing unit 21 ... Line I/F 22 ...
・Master key setting section KD...Data key KM...
・Master key. Patent Applicant Oki Electric Industry Co., Ltd. Agent Patent Attorney Takashi Kanakura Engraving of the two drawings (
No change in content) Flowchart showing an example of ``Zero Departure'' 1 Wiring block diagram of branch line @ 2 Diagram explanatory diagram of conventional key delivery method 3 Country terminal Terminal Terminal Other conventional examples Keys shown Explanatory diagram of delivery method 4 B Procedure amendment (j5 Clause February 4, 1988 Patent Office Officer Uga Michibu 1, Indication of the case 1985 Patent Application No. 241666 2,
Title of the invention Key distribution method for line encryption device 3, relationship with the person making the amendment = l; I'l = Patent amount (registration address
1-7-12 Toramon, Minato-ku, Tokyo Name (029)
) Oki Electric Industry Co., Ltd. Representative Nankai Hashimoto 4, Agent 6, Subject of amendment Drawing.・′°：〕、'
6i,,",,-1 Horn l・, f-εゝ～ 17. Contents of correction 1 Figures 1, 2, 3, 11, and 5 will be corrected as shown in the attached sheet.

Claims (1)

[Claims] 1. A first mode in which a data key for encrypting data is encrypted and delivered using a master key commonly set in each terminal encryption device, and a second mode in which the master key is used as a data key. The mode is set in advance, and the mode is set to 1st mode or 2nd mode depending on the power ON/OFF state.
1. A key distribution method for a line encryption device, characterized in that the key distribution method is performed by switching to a mode and transmitting a key.