JPWO2003094419A1 - Encryption / decryption method and apparatus in media converter - Google Patents

Abstract

An encryption / decryption unit is provided in the media converter. The remainder data length r when the input n-byte variable length data 201 is divided into the fixed length m is calculated, and the difference between the fixed length m and the remainder data length r is determined as the additional data length k. The k-byte additional data 202 is added to the end of the n-byte variable length data 201, and reference data for determining the additional data length is arranged at the end of the (n + k) byte data 205. Encryption is performed on the (n + k) byte data 205. In decryption of encrypted data, the additional data length is determined from the reference data, and the original variable length data is restored by deleting the corresponding data.

Description

TECHNICAL FIELD The present invention relates to a media converter for connecting different types of transmission media, and more particularly to an encryption / decryption method and apparatus in a media converter.
BACKGROUND ART In recent years, FTTH (Fiber To The Home) has been attracting attention because it can extend an optical fiber line to each home and freely exchange music, moving images, medical data, etc. via a high-speed line. When such FTTH is realized, a media converter for connecting an optical fiber line to a computer in an office or home becomes indispensable.
In general, a media converter is provided with a port for connecting an optical cable and a port for connecting a UTP cable, and a physical layer device is connected to each port. Each physical layer device supports MII (Media Independent Interface) defined by the IEEE 802.3 standard. Also, due to the nature of the media converter, it is common to have a missing ring function that automatically disconnects the other link when one link is disconnected.
By using such a media converter, long-distance transmission via an optical cable becomes possible. For example, a LAN (Local Area Network) management switch is connected to one port of a media converter using a UTP (Unshielded Twisted Pair) cable, and an optical cable is connected to the other port. Similarly, the other party also converts the optical cable into a UTP cable using a media converter and connects it to the management switch. Thus, the LANs can form a single domain through the optical communication line.
In such a communication system, security in an optical communication line or a LAN is one of important problems. Thus, it is considered to incorporate a data encryption / decryption function into a media converter.
However, when data of variable length n bytes is encrypted using DES (Data Encryption Standard) encryption, which is one of encryption techniques, the input to DES must be divided into units of 8 bytes. In this case, a remainder of less than 8 bytes occurs when dividing depending on the value of n. For this purpose, a technique for extending the remainder to 8 bytes capable of DES input is required.
Conventionally, various techniques for converting variable length data into fixed length data have been proposed. For example, Japanese Patent Application Laid-Open No. 08-030437 discloses a computer that divides variable-length data into optimum fixed-length data and performs parallel processing using a plurality of arithmetic processing units. In addition, in the data stream conversion method disclosed in Japanese Patent Laid-Open No. 2001-332978, variable length data is transferred to a register, and when the amount of data in the register exceeds a predetermined bit, it is sequentially output for each fixed length bit number. To generate fixed-length data. Finally, the data remaining in the register is combined with the next input data and output as the next fixed length data.
However, in the computer disclosed in the above-mentioned Japanese Patent Application Laid-Open No. 08-030437, it is assumed that the length of the variable length data is set to an integral multiple of the fixed length data, and a remainder is generated when the variable length data is divided. It has not been.
On the other hand, Japanese Patent Laid-Open No. 2001-332978 mentions processing of data (residue) remaining in a register after variable length data is divided and output for each fixed length data.
However, this conventional method is intended to output variable-length data as a stream of fixed-length data. The variable-length data is divided into fixed-length data as a set, and each fixed-length data is processed. is not. Therefore, the last data remaining in the register can be combined with the next input data, and can be output as the next fixed length data.
An object of the present invention is to provide an encryption / decryption method and apparatus in a media converter that performs encryption processing by converting variable-length data into fixed-length data.
Another object of the present invention is to provide an encryption method and apparatus that enables efficient encryption processing of each fixed-length data even when a remainder occurs when variable-length data is divided into fixed-length data. is there.
Furthermore, another object of the present invention is to provide a decryption method and apparatus capable of easily decrypting data obtained by encryption processing of variable length data into original variable length data.
DISCLOSURE OF THE INVENTION According to a first aspect of the present invention, in a data conversion method for processing variable length data to a fixed length, a remainder data length when the variable length data is divided into a predetermined fixed length is calculated. The difference between the fixed length and the remainder data length is determined as an additional data length, additional data including reference data for determining the additional data length is generated, and the additional data is added to the variable length data. In this way, expanded data that can execute the fixed-length processing is generated.
The reference data is preferably arranged at a predetermined position of the expanded data. In particular, it is desirable to place the reference data at the end of the expanded data.
According to a second aspect of the present invention, in a method for converting data obtained by fixed length processing of variable length data into the variable length data, the variable length data is divided into a predetermined fixed length. Calculating a remainder data length, determining a difference between the fixed length and the remainder data length as an additional data length, and generating additional data of the additional data length including reference data for determining the additional data length; Fixed processing result data by adding the additional data to the variable length data, generating expanded data in which the reference data exists at a predetermined position, and executing the fixed length processing on the expanded data And generating the reception data corresponding to the expanded data by executing a fixed process opposite to the fixed process on the fixed process result data, and generating the received data Reading the reference data from a fixed position, determining the additional data length from the reference data, and removing the data corresponding to the additional data length from the received data, thereby restoring the original variable length data; Features.
The fixed-length processing is characterized in that the extended data is divided into fixed lengths and fixed-length data is processed. Preferably, the fixed length process is an encryption process, and the reverse fixed process is a decryption process corresponding to the encryption process.
BEST MODE FOR CARRYING OUT THE INVENTION FIG. 1 is a block diagram showing an example of a media converter to which an encryption / decryption method according to the present invention is applied. A pair of ports of the media converter 10 are provided with physical layer devices (PHY) 11 and 12, respectively. One physical layer device 11 is connected to a UTP cable, and the other physical layer device 12 is connected to an optical cable. As described above, each of the physical layer devices 11 and 12 supports MII (Media Independent Interface) defined by IEEE802.3.
An encryption / decryption unit 13 including a FIFO (First in First Out) memory is provided between the physical layer device 11 and the physical layer device 12, and as described later, the transmission / reception data is encrypted / decrypted. Done. Further, the frequency deviation between transmission and reception can be absorbed by the FIFO memory. For example, variable length data received by one physical layer device is sequentially written into a FIFO memory, read in the order written, encrypted with fixed length data, and then sent to the other physical layer device. . Conversely, the encrypted data received by the other physical layer device is sequentially written into the FIFO memory, read out in the written order, decrypted, and then sent as variable length data to the other physical layer device. Is done.
Note that the encryption / decryption unit 13 according to the present embodiment is configured by an application specific integrated circuit (ASIC), and also performs operation control of the entire media converter including generation of encryption / decryption keys.
2. Configuration of Encryption / Decryption System FIG. 2 is a schematic block diagram of a data processing system employing an encryption / decryption technique according to an embodiment of the present invention.
In FIG. 2, the transmission side has an extended data addition unit 101, an additional byte length calculation unit 102, and an encryption processing unit 103, and the reception side has a decryption processing unit 104, an extended data removal unit 105, and an additional byte length. A calculation unit 106 is included. Here, it is assumed that the length of the variable-length data is n bytes (n is a natural number), and the encryption processing unit 103 can encrypt only data of a fixed length m bytes (m is a natural number of 1 or more).
When the variable length n-byte data is input, the extension data adding unit 101 extends the data so that the variable length n-byte data is processed by the encryption processing unit 103 without excess or deficiency. First, the extension data adding unit 101 passes the data length n of variable length n byte data to the additional byte length calculating unit 102. The additional byte length calculation unit 102 calculates the number of remaining bytes r and the additional byte length k and returns them to the extended data addition unit 101 (details will be described later).
The extension data adding unit 101 generates k-byte extension data including the remaining number of bytes r at a predetermined position, adds it to a predetermined position of variable-length n-byte data, and encrypts the processing unit 103 as (n + k) byte data. Output to. The extension data is preferably added to the end of the variable length n-byte data. At that time, it is necessary to specify at which position the data representing the remaining number of bytes r exists from the end of the (n + k) byte data. Therefore, it is desirable to arrange data representing the number of remaining bytes r at the end of (n + k) byte data.
The encryption processing unit 103 divides (n + k) byte data into fixed length m bytes, and executes encryption processing for each of the divided fixed length m byte data. The resultant data processed in this way is sent to the receiving side through a transmission path, for example.
The decryption processing unit 104 on the receiving side performs processing reverse to the processing of the encryption processing unit 103 on the received data, decrypts the fixed-length m-byte data, combines them, and forms (n + k) byte data. The data is output to the extended data removal unit 105.
The extended data removal unit 105 reads the number of remaining bytes r from a predetermined position of the input (n + k) byte data and passes it to the additional byte length calculation unit 106. The additional byte length calculation unit 106 calculates the added byte length k from the surplus number of bytes r and returns it to the extended data removal unit 105. The extended data removing unit 105 removes k-byte extended data from a predetermined position of (n + k) byte data, and outputs the original variable length n-byte data.
3. Generation and Addition of Extension Data FIG. 3 is a flowchart showing an example of an extension data addition operation according to an embodiment of the present invention, and FIG. 4 is a format diagram for explaining generation of extension data.
As shown in FIG. 3, when the number of bytes n of the variable-length n-byte data 201 is input, the additional byte length calculation unit 102 calculates a remainder r (= nMODm) obtained by dividing n by m, and the encryption processing unit 103 A value obtained by subtracting the remainder r from the fixed length m is calculated as an additional byte length k (step S20).
The relationship among the fixed length m, the extra byte length r, and the additional byte length k will be described with reference to FIG. As already described, since the encryption processing unit 103 accepts only fixed length m bytes, the variable length n byte data 201 must be divided into fixed length m bytes. At that time, there may be r bytes (0 ≦ r <m) of extra data.
In order to process the remaining r bytes of data by the encryption processing unit 103, k (= m−r) bytes of extension data 202 are added to a predetermined position (here, the end) of the n bytes of data 201. As a result, data 205 having a byte length (n + k) divisible by the fixed length m is obtained.
Since the extended data 202 is finally removed, it is necessary to write reference data that allows calculation of the length of the extended data 202 to the extended data 202. In this embodiment, the value of the remainder data length r is written as a reference data at a predetermined position (here, the tail) of the extended data 202.
For example, if the range of the fixed length m is 1 <m <256, then r <m. Therefore, it is sufficient to secure a data area of 1 byte (≦ 255) to represent the remainder data length r. .
In this way, the additional data length calculation unit 102 calculates the remainder data length r and the additional byte length k and returns them to the extension data addition unit 101. As shown in FIG. 3, the extension data adding unit 101 generates k-byte extension data 202 including a (k−1) -byte paddle 203 and 1-byte reference data 204, and converts it into n-byte data 201. It is added to a predetermined position (here, the tail) (step S21).
As a result, byte length (n + k) data 205 divisible by the fixed length m is given to the encryption processing unit 103, and division processing is performed on (n + k) / m fixed length m byte data (step S22). As described above, the fixed length processing of the variable length data 201 can be performed only by adding a small amount of extension data 202.
4). Extension Data Deletion FIG. 5 is a flowchart showing an example of an extension data deletion operation according to an embodiment of the present invention. First, the decryption processing unit 104 performs processing opposite to the processing of the encryption processing unit 103 on the received data, decrypts the fixed-length m-byte data, and expands the (n + k) byte data 205 obtained by combining them. The data is output to the data removal unit 105.
As described above, the surplus number of bytes r is written as reference data at a predetermined position (here, the last one byte) of the input (n + k) byte data 205. Therefore, the extended data removal unit 105 reads the last one byte of data and passes it to the additional byte length calculation unit 106. The additional byte length calculation unit 106 calculates the additional byte length k = m−r by subtracting the number of surplus bytes r from the fixed length m (step S23), and returns the value k to the extended data removal unit 105.
The extended data removing unit 105 removes the last k bytes of the (n + k) byte data 205, that is, the extended data 202 (step S24), and outputs the original variable length n byte data 201. Thus, the output data from the fixed length encryption processing system can be easily restored to the original variable length data.
5. Embodiments As a specific example, a media converter that transmits data to be transmitted after DES encryption and decrypts received data from the DES encrypted data will be described. In this case, the encryption processing unit 103 in FIG. 2 corresponds to the DES encryption module, and the decryption processing unit 104 corresponds to the DES decryption module.
FIG. 6 is a detailed block diagram of the encryption / decryption unit 13 of FIG. Transmission data of variable length bytes output from a data processing unit (not shown) is input to an input FIFO (First In First Out) memory 301 through the physical layer 300 a and sequentially output to the paddle addition module 302.
The paddle addition module 302 corresponds to the extension data addition unit 101 and the additional byte length calculation unit 102 in FIG. The paddle addition module 302 adds k-byte extension data to the input n-byte transmission data and outputs (n + k) byte data to the encryption module 303.
The encryption module 303 divides (n + k) byte data into fixed-length byte m data, and executes encryption processing according to the encryption key for each. The encrypted (n + k) byte data is sent to the physical layer 300b via the output FIFO memory 304.
The data received from the physical layer 300b is sequentially input to the decryption module 306 via the input FIFO memory 305. The decryption module 306 decrypts the fixed-length m-byte data from the received data according to the encryption key, combines them, and outputs them to the paddle removal module 307 as (n + k) byte data.
The paddle removal module 307 corresponds to the extended data removal unit 105 and the additional byte length calculation unit 106 in FIG. The paddle removal module 307 calculates the additional byte length k from the last 1 byte data, removes the last k byte data of the (n + k) byte data, generates variable length n byte data, and outputs FIFO memory. The data is output to the physical layer 300a through 308.
The input FIFO memory 301 of the transmission unit is provided to absorb a phase difference between the transmission clock on the physical layer 300a side and the clock of the encryption / decryption module, and the output FIFO memory 304 is provided on the other physical layer 300b. It is provided to absorb the phase difference between the transmission clock on the side and the clock of the encryption / decryption module. Similarly, the input FIFO memory 305 of the receiving unit is provided to absorb the phase difference between the reception clock on the physical layer 300b side and the clock of the encryption / decryption module, and the output FIFO memory 308 is on the physical layer 300a side. Are provided to absorb the phase difference between the received clock and the clock of the encryption / decryption module.
FIG. 7 is a diagram showing a flow of encryption / decryption of the transmission / reception unit shown in FIG. Here, a case will be described in which the fixed-length byte count m = 8 and 0 ≦ r <8 of the DES encryption module 303 and the variable-length byte count n = 67 data is transmitted / received.
First, when 67 bytes of transmission data is input (FIG. 7A), since 67 bytes / 8 bytes = remainder 3, r = 3 and k = m−r = 5 (FIG. 7 ( b)). Therefore, 5 bytes of paddle data (0x0000000003) including r = 3 in the last 1 byte is added to the 67 bytes of transmission data to extend the transmission data to 72 bytes (FIG. 7 (c)).
Subsequently, the 72-byte extended transmission data is divided into units of 8 bytes, and the divided 9 pieces of 8-byte data are respectively encrypted in the DES ECB mode (FIG. 7 (d)). Thus, 72-byte encrypted data is obtained (FIG. 7 (e)). In this way, variable length data DES encryption processing can be performed only by adding a small amount of paddle data.
On the other hand, when such encrypted data is received, the DES decryption module 306 decrypts each 8-byte data (FIG. 7 (f)). The decrypted 8-byte data is combined to obtain 72-byte data, and the additional paddle length k is calculated from the last 1 byte (0x03). Here, since k = 8-3 = 5 bytes, the last 5 bytes of paddle data (0x0000000003) is removed from the 72-byte data (FIG. 7 (h)). Thus, the original 67-byte data is obtained (FIG. 7 (i)). In this way, the DES encrypted data can be easily restored to the original variable length data.
In the present embodiment, the DES encryption technique has been described as an example, but the present invention is not limited to this. The present invention can be applied to the case of using an encryption processing technique that accepts only fixed-length data for processing variable-length input data.
Further, the transmission side extended data adding unit 101, the additional byte length calculating unit 102, and the encryption processing unit 103, or the receiving side decryption processing unit 104, the extended data removing unit 105, and the additional byte length shown in FIG. The calculation unit 106 can be configured as hardware, but can also be realized by software. That is, the program for instructing the computer to generate, add and remove the extended data described in FIGS. 3 to 5 is stored in the memory, and the program corresponding to each operation is run on the computer in the same manner. Functions can be realized.
As described above, according to the present invention, the remainder data length when variable length data is divided into a predetermined fixed length is calculated, and the difference between the fixed length and the remainder data length is determined as the additional data length. Then, by adding the additional data including the reference data for determining the additional data length to the variable length data, extended data capable of executing the fixed length encryption process is generated. Therefore, it is possible to perform fixed-length encryption processing of variable-length data only by adding a small amount of additional data to variable-length data.
In addition, since it is possible to read the reference data from the expanded data and determine the additional data length added to it, the original variable length data can be easily removed by removing the additional data length data from the expanded data. Can be restored.
As described above, the present invention is a very effective technique for executing encryption processing in which the input has a fixed length for variable length data.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an example of a media converter to which an encryption / decryption method according to the present invention is applied.
FIG. 2 is a schematic block diagram of a data processing system employing an encryption / decryption technique according to an embodiment of the present invention.
FIG. 3 is a flowchart showing an example of the extended data adding operation according to the embodiment of the present invention.
FIG. 4 is a format diagram for explaining generation of extension data.
FIG. 5 is a flowchart showing an example of an extended data deletion operation according to an embodiment of the present invention.
FIG. 6 is a block diagram of the encryption / decryption unit 13 of FIG.
FIG. 7 is a diagram showing the flow of encryption / decryption of the encryption / decryption processing unit shown in FIG.

Claims (13)

In media converters that connect different types of transmission media,
A first physical layer interface for connecting a first transmission medium;
A second physical layer interface for connecting a second transmission medium;
Connected between the first and second physical layer interfaces, variable length data input from the first physical layer interface is converted into predetermined fixed length data and encrypted, and the encrypted data is converted into the second physical layer interface. Encryption means for outputting to the layer interface;
Have
The encryption means includes
A calculation means for calculating a remainder data length when the variable length data is divided into a predetermined fixed length, and determining a difference between the fixed length and the remainder data length as an additional data length;
Generate additional data including reference data for determining the additional data length in a predetermined position, and generate the expanded data that can be encrypted by adding the additional data to the variable length data. Extended data appending means;
Encryption processing means for generating the encrypted data by performing the encryption processing on the expanded data;
The media converter characterized by having. Decryption connected between the first physical layer interface and the second physical layer interface, decrypting encrypted data input from the second physical layer interface to generate variable-length data, and outputting to the first physical layer interface Further comprising:
The decoding means includes
Decryption processing means for decrypting the encrypted data and generating received data corresponding to the expanded data;
An extended data removing unit that reads the reference data from the predetermined position of the received data, determines the additional data length from the reference data, and removes data corresponding to the additional data length from the received data;
The media converter according to claim 1, further comprising: 2. The media converter according to claim 1, wherein the extension data adding means arranges the reference data at the end of the extended data. 2. The media converter according to claim 1, wherein the encryption processing unit divides the expanded data into the fixed lengths and encrypts the fixed length data. In a method of encrypting variable length data in a media converter connecting different types of first transmission medium and second transmission medium
a) calculating a remainder data length when the variable length data is divided into a predetermined fixed length;
b) determining a difference between the fixed length and the remainder data length as an additional data length;
c) generating additional data including reference data for determining the additional data length;
d) generating expanded data that can be encrypted by adding the additional data to the variable-length data;
e) encrypting the expanded data for each fixed length;
The encryption method in the media converter characterized by the above-mentioned. 6. The media converter according to claim 5, wherein the reference data is arranged at a predetermined position of the additional data, and the additional data is arranged at a predetermined position of the variable length data. Encryption method. 7. The encryption method in the media converter according to claim 6, wherein the reference data is arranged at the end of the extended data. 6. The encryption method in the media converter according to claim 5, wherein the reference data has the remainder data length. In the method for decrypting encrypted data generated by the encryption method according to claim 5,
a) receiving the encrypted data;
b) generating received data by executing a decryption process on the received encrypted data;
c) reading reference data from a predetermined position of the received data;
d) determining the additional data length from the reference data;
e) restoring the original variable length data by removing data corresponding to the additional data length from the received data;
The decoding method in the media converter characterized by the above-mentioned. 10. The decoding method according to claim 9, wherein the reference data is arranged at the end of the extended data. 10. The decoding method in the media converter according to claim 9, wherein the reference data has the remainder data length. Processing for encrypting variable length data of n (n is a natural number) bytes in fixed length m (0 <m <n) byte unit in a computer in a media converter connecting different types of first transmission medium and second transmission medium In the program to execute
calculating a remainder r of n / m;
Determining a difference between the fixed length m and the remainder r as an additional data length k;
Generating additional data including reference data r for specifying the additional data length k;
Generating (n + k) byte extended data by adding the additional data to the variable length data;
Dividing the (n + k) byte extended data into the fixed length m and encrypting the data;
The program characterized by having. In a program for executing the process of decrypting the encrypted data described in claim 12 and restoring the original variable length data,
Generating (n + k) bytes of received data corresponding to the expanded data by decrypting the encrypted data;
Reading the reference data from the predetermined position of the received data of (n + k) bytes, and determining the additional data length k from the reference data;
Removing the data corresponding to the additional data length k from the received data of (n + k) bytes to restore the original n-byte variable length data;
The program characterized by having.

Images