KR100198951B1 - Cipher system and method using multi-block cipher algorithm - Google Patents

Abstract

1. TECHNICAL FIELD OF THE INVENTION

Data encryption method

2. The technical problem to be solved by the invention

The purpose of this paper is to solve a problem of a communication data link that loses synchronization due to a serious impact on a synchronization protocol or a frame synchronization frame due to a block error derived from an error propagation phenomenon inevitably occurring in an automatic synchronous encryption device.

3. Summary of Solution to Invention

An object of the present invention is to provide an encryption / decryption method and apparatus that can easily perform error analysis and correction by distributing a block error into a single bit error using a plurality of encryption algorithms.

4. Important uses of the invention

Used for automatic synchronous cryptography

Description

Encryption apparatus and method using multi-block encryption algorithm

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a self-synchronizing cipher system, and more particularly, to an automatic sync block cipher apparatus capable of distributing a continuous error of a certain size caused by an error propagation phenomenon into a single bit error in several channels. It is about a method.

1 illustrates a cipher feedback (CFB) structure using a block cipher algorithm according to a conventional automatic synchronous cipher method. In FIG. 1, plain text (P: Plain Text) is first converted into a cipher text (C: Cipher Text) by performing a bit-by-bit Exclusive OR by the output sequence of the block encryptor 11, The output of the block cipher 13 on the receiving side is subjected to an exclusive OR operation one bit at a time and reduced to a decrypted text (D: Decipher Text = Plain Text). In this process, a ciphertext (Block Size = b) having a specific size is fed back to the block cipher 11 to maintain synchronization of the cipher algorithm. In general, automatic synchronous cipher methods include a block cipher algorithm and a stream cipher algorithm. Such a method is an automatic synchronization encryption method that does not require a separate encryption algorithm synchronization protocol for synchronization maintenance or synchronization redundancy because the encryption algorithm can be automatically synchronized. Therefore, it is currently being applied in various fields. By the way, the encryption method adopting such a structure inevitably involves an error propagation phenomenon. The error propagation phenomenon of the automatic sync block encryption method occurs as shown in FIG. If there is an error 21 in the ciphertext to be fed back (receiving side: an error during transmission), an error is propagated by the block size to the output of the continuous encryptor, and an error 22 of the block size is generated in the decrypted data. That is, if an error less than or equal to the block size b occurs in the same block, the error of the maximum size b is propagated to consecutive blocks. The added block error has a 50% probability. That is, the magnitude of the propagated error is added by 1-b (average b / 2). However, it is difficult to consider only an increase in the average bit error rate (BER) (b / 2), and in most cases, a maximum increase in BER (b) should be considered, and the magnitude of the error propagation for these errors depends on the size of the block. As it is proportional, as the block size increases, in addition to the simple BER increase, the effect on the burst error must be considered.

The problem of error propagation caused by the characteristics of the automatic sync block encryption method can be classified into two categories. The first is a problem of data recognition due to BER degradation, and the second is a problem of Moderate Burst Error itself. Some data links cannot tolerate BER degradation, and some communication data links lose synchronization due to block errors that severely affect synchronization protocols or line synchronization frames. In addition, when the automatic sync block encryption method is used for a data link using an error detection and correction (EDC) device, a block error due to error propagation may cause a fatal result that may cause the EDC device to become useless. have.

In order to solve the problem of block error itself among the problems of error propagation caused by the characteristics of automatic sync block encryption method, the present invention uses a plurality of encryption algorithms to block a block error on a plurality of channels. It is an object of the present invention to provide an encryption / decryption method and apparatus that can easily perform error analysis and correction.

1 is a block diagram of a cipher feedback (CFB) of a conventional block cipher algorithm.

2 illustrates an error propagation phenomenon for a single error.

3 is a block diagram of an encryption / decryption apparatus using a multi-block encryption algorithm according to an embodiment of the present invention.

4 illustrates an error propagation phenomenon in a multi-block cryptographic algorithm structure.

5 is a diagram illustrating an error dispersion process according to the present invention.

6 is a schematic structural diagram of an encryption apparatus including an error detection and correction apparatus therein.

7 illustrates error variance for continuous errors.

8 is a flowchart of an encryption / decryption method of the present invention.

* Explanation of symbols for main parts of the drawings

31, 37: Multi-block encryption algorithm 32, 36: P / S converter

33,35: P / S converter 34, 38: XOR operation logic

The encryption method according to the present invention includes a first step of generating exclusive encrypted data by performing an exclusive OR operation on input data generated by a plurality of encryption algorithms; Feeding back the first encrypted data; A third step of encrypting the fed back first encrypted data using the plurality of algorithms to generate a second key sequence; A fourth step of generating second encrypted data by performing an exclusive OR operation on the second key sequence; And repeating the above-described first to fourth steps.

Decryption method according to another embodiment of the present invention, the first step of serial-to-parallel conversion of the encrypted data transmitted from the transmitting side; Generating a plurality of key sequences using the serial-parallel converted cryptographic data using a plurality of cryptographic algorithms; A third step of parallel-serial conversion of the plurality of key sequences; And generating a decoded data by performing an exclusive-OR operation on the parallel-serial converted key sequence and repeating the first to fourth steps.

According to another aspect of the present invention, an encryption and decryption method includes: a first step of generating exclusive encrypted data by performing an exclusive OR operation on input data generated by a plurality of encryption algorithms; Feeding back the first encrypted data; A third step of serial-to-parallel converting the fed back encrypted data; Generating a plurality of second key sequences of the serial-parallel converted cryptographic data using a plurality of algorithms; A fifth step of performing parallel-serial conversion of the second key sequence; Generating a second encrypted data by performing an exclusive OR operation on the second key sequence and the input data; A seventh step of generating third encrypted data by repeating the above-described first to sixth steps; An eighth step of serial-to-parallel conversion of the third encrypted data transmitted from the transmitting side; A ninth step of generating a plurality of third key sequences using the serial-parallel converted third encrypted data using a plurality of encryption algorithms; A tenth step of parallel-serial conversion of the plurality of third key sequences; An eleventh step of generating an exclusive decoded data by performing an exclusive OR operation on the parallel-serial converted third key sequence; And a twelfth step of repeating the eighth to eleventh steps.

According to still another embodiment of the present invention, an encryption apparatus includes: means for exclusively ORing input data with a first key sequence generated by a plurality of encryption algorithms; Means for serial-to-parallel conversion of the output signal of the exclusive OR means; Means for encrypting the output signal of the serial-parallel conversion means by using a plurality of encryption algorithms to generate a second key sequence; And means for parallel-to-serial conversion of the second key sequence and outputting the converted second key sequence to the exclusive OR means.

Decryption apparatus according to another embodiment of the present invention, means for serial-to-parallel conversion of the encrypted data transmitted from the transmitting side; Means for generating a plurality of key sequences using the serial-parallel converted cryptographic data using a plurality of cryptographic algorithms; Means for parallel-to-serial conversion of the plurality of key sequences; And means for performing an exclusive OR operation on the parallel-serial converted key sequence.

An encryption and decryption apparatus according to another embodiment of the present invention comprises: first exclusive OR means for performing an exclusive OR operation on input data generated by a plurality of encryption algorithms; First series-parallel conversion means for serial-parallel conversion of the output signal of the first exclusive OR means; Means for encrypting the output signal of the first serial-to-parallel conversion means using a plurality of encryption algorithms to generate a second key sequence; First parallel-serial conversion means for parallel-serial conversion of the second key sequence and outputting the converted second key sequence to the exclusive OR-means; Second serial-parallel conversion means for serial-parallel converting the transmitted cryptographic data; Means for generating a plurality of third key sequences from the output signal of the second serial-to-parallel conversion means using a plurality of cryptographic algorithms; Second parallel serial conversion means for parallel-serial conversion of the plurality of third key sequences; And second exclusive-OR operation means for performing an exclusive-OR operation on the output signal of the second parallel-serial conversion means.

The present invention will now be described in more detail with reference to the accompanying drawings. 3 is a diagram illustrating an error distribution structure using a multi-block encryption algorithm applied to a cipher feedback structure CFB. Here, the encryption / decryption process is processed using several encryption algorithms. That is, it is a structure in which n block cipher algorithms 31 of the same block size are connected in parallel, and serial-to-parallel conversion of ciphertexts in the S / P converter (Serial to Parallel Converter) 33 for synchronization of each cipher algorithm. Is fed back to each cryptographic algorithm. The P / S converter 32 performs parallel-to-serial conversion and multiplexing of the key sequences generated by each algorithm to synchronize with the speed of the plaintext P. The exclusive OR operation logic 34 converts the multiplexed key sequence into the plaintext. Performs an exclusive OR operation bit by bit. The process of error distribution through this process is as follows.

To express the data flow of the multi-algorithm structure shown in FIG. 3 in a matrix, the block size is b (column) and the number of arbitrary algorithms is n (row), and the key sequence outputted by multiplexing is K. _{In the case of ij} , a key sequence of bxn size can be represented by a bxn matrix structure as shown in Equation 1 below.

The output sequence of [Equation 1] is i = 1 to b (for j = 1 to c (K _ij )).

Also, the encrypted text plaintext (P) and the key sequence to the exclusive-OR operation represented by one bit generated also C _ij may be expressed by the following Equation (2) of the.

The output sequence of Equation 2 is i = 1 to b (for j = 1 to n (C _ij )). The cipher text C _ij is transmitted to the receiving end through a transmission link, and the receiving end is decrypted through a process symmetrical with the transmitting end. That is, the received cipher text is converted in parallel through the serial-to-parallel converter 35, and then generates a parallel key sequence using the multiple cryptographic algorithm 37, which in turn is converted to the serial sequence through the parallel-to-serial converter 36. After conversion to, the data is decrypted by performing an exclusive operation with the encryption transmitted from the XOR logic 38. In Equation 2, each column is a data sequence encrypted by a key sequence output by the same algorithm. Thus, an error in any column propagates through the same column of the next matrix. To explain this, if you generalize the ciphertext data sequence by assigning numbers in the order of output in each matrix, it can be expressed as Cxyz, and the output data sequence can be expressed as follows.

x = 1 to m (for y = 1 to b (for z = 1 to n (Cxyz))), where m = 1,2,3 .......: matrix output number

This generalized representation of the output sequence shows an example in which a single error is propagated to the next matrix in FIG. If FIG. 4 is a 1-bit error for ten thousand and one ciphertext C ₁₂₂ (41) occurs in the, in the decoding process C ₁₂₂ is transmitted to an error in decoding contact C _122, an error is continuous with the matrix C ₁₂₂ belongs spread by C ₁₂₂ And C _{212 to} C _{2b 2} (43), which are the same columns of the next matrix to be outputted. When this is output, the b bit errors derived from the error propagation are distributed into a single error of 1 bit every n bits. That is, since the encryption output sequence is a bxn matrix structure, the output of each algorithm is synchronized every n bits, so that block errors added by a single error are distributed every n times. This error dispersion phenomenon is illustrated in FIG. 5, where the output sequence D _mbn is a sequence corresponding to the output sequence C _mbn . Referring to FIG. 5, the error 51 generated in the cipher text, the fixed error 52 of the decrypted text, and the propagated error 53 are shown. When the decrypted text is represented by the original data sequence D _i , the fixed error of the decrypted text is shown. 52 corresponds to the fixed error 54 of D _i , and the propagated error 53 is distributed to a single bit every n bits, such as error 55. As can be seen from FIG. 5, the fixed error 52 and the error 55 caused by the error propagation are mixed, and the error caused by the propagation is likely to exist as a single error of 50%, resulting in error propagation. The increase in BER by b / 2 should be interpreted simply as b / 2, and since it is a single bit error, it is easy to control and analyze errors.

This process will be described with reference to the flowchart shown in FIG. First, the plain text generates an encrypted text by performing an XOR operation on the output of the block cipher algorithm by serial-parallel conversion of the key sequence (step 81). The generated cipher text is sent to the receiving side (step 83), and also fed back to keep the algorithm synchronized. The ciphertext fed back is parallel-to-serial converted (step 84), and demultiplexed into n ciphertext data sequences. This demultiplexed n ciphertext sequence is fed back to each block cipher algorithm. According to this feedback ciphertext, each block cipher algorithm generates n key sequences (step 86). Each key sequence thus generated is parallel-serial converted again (step 87), multiplexed into one key sequence, and XORed with the plain text again (step 81) to generate a cipher text (step 82). This process is repeated to perform the encryption process.

In addition, the cipher text transmitted to the receiving side is input to the receiving side encryptor and maintained as information for maintaining algorithm synchronization. At this time, the input ciphertext is demultiplexed into n ciphertext data sequences through serial-to-parallel conversion (step 88). This demultiplexed n ciphertext sequence is fed back to each block cipher algorithm (step 89). According to this feedback ciphertext, each block algorithm generates n sequences (step 90). The n key sequences thus generated are again parallel-serial converted (step 91), and are subjected to XOR operation with the ciphertext multiplexed and transmitted into one key sequence (step 92) to generate a decrypted text (step 93). The decoding process is performed by repeating the above process.

The present invention as described above is particularly useful when applied to the case where an error correction is inserted into the data link. That is, it can be applied to the case of using for the purpose of information protection of a certain section. In other words, as shown in FIG. 6, if the conventional automatic sync block cipher method is used where the EDC device 61 is installed, the EDC function may be completely lost. However, when the automatic synchronous encryption method capable of error distribution according to the present invention is applied to the interval as shown in FIG. 6, the problem due to the error propagation phenomenon can be minimized, and the distributed single bit error can be corrected. At this time, it is more efficient if the number n of the encryption algorithm matches the size of the codeword.

The invention is also applicable to data links that do not accept block errors. Block error has a kind of burst error characteristic, especially the larger the block size is closer to the burst error. Block errors can lead to loss of data link synchronization or serious problems with data services. In particular, when a block cipher method with a large block size is used, a single bit error may stop the data service momentarily because the block error due to error propagation becomes large. However, as in the automatic synchronous encryption method according to the present invention, when the error is distributed, only a simple error increase of an average of b / 2 times should be considered for 1-bit errors in the same block, thereby solving the problem caused by the block error. have.

The invention is also applicable to data links capable of multi-bit error correction. As mentioned in the introduction, the field of information protection is no longer limited to transmission paths. In particular, the need for information protection in data buses and local area networks (LANs) in mass storage systems is increasing. In addition, multi-bit error correction is essential in systems requiring high reliability. In this interval, a single algorithm error distribution scheme is suitable and can correct not only 1-bit errors but also continuous block errors as shown in FIG. If the EDC device is capable of correcting n bit errors, the error variance architecture allows correction of nb-sequential block errors (i.e. burst errors).

Although the invention has been described and illustrated with respect to particular embodiments, it is not intended to limit the invention, and those skilled in the art will recognize that various modifications and variations are possible within the spirit and scope of the invention. Could be.

According to the present invention as described above, a block error, which is a continuous error of a certain size derived due to an error propagation phenomenon by using several block cipher algorithms, is distributed as an error in a single bit to any several channels, and thus as much as the block size. Successive errors are distributed into single bit errors, which alleviates the problems caused by block errors occurring on the data link, and facilitates control and analysis of errors. There is an effect that can provide a solution.

Claims (7)

An automatic synchronous encryption method for encrypting input data using a plurality of encryption algorithms, the method comprising: a first step of generating the first encrypted data by performing an exclusive OR on the first data sequence generated by the plurality of encryption algorithms. ; Feeding back the first encrypted data; Generating a second key sequence by encrypting the fed back first encrypted data using the plurality of algorithms; Generating a second cryptographic data by performing an exclusive OR operation on the second key sequence and the input data; And repeating the above-described first to fourth steps. The method of claim 1, wherein the third step comprises: serial-to-parallel converting the fed back cryptographic data; Generating a plurality of parallel key sequences using the serial-to-parallel converted cryptographic data using a plurality of algorithms; And parallel-to-serial conversion of the parallel key sequence. An automatic synchronous decryption method for decrypting encrypted encrypted data using a plurality of cryptographic algorithms, comprising: a first step of serial-to-parallel converting encrypted data transmitted from a transmitting side; Generating a plurality of key sequences using the serial-parallel converted cryptographic data using a plurality of cryptographic algorithms; A third step of parallel-serial conversion of the plurality of key sequences; Generating a decoded data by performing an exclusive OR operation on the parallel-serial converted key sequence; And repeating the first to fourth steps. A method for automatically encrypting and decrypting input data using a plurality of cryptographic algorithms, the method comprising: exclusively ORing the input data with a first key sequence generated by the plurality of cryptographic algorithms to generate first encrypted data First step; Feeding back the first encrypted data; A third step of serial-to-parallel conversion of the fed back encrypted data; Generating a plurality of second key sequences of the serial-parallel converted cryptographic data using a plurality of algorithms; A fifth step of performing parallel-serial conversion of the second key sequence; Generating a second encrypted data by performing an exclusive OR operation on the second key sequence and the input data; A seventh step of generating third encrypted data by repeating the above-described first to sixth steps; An eighth step of serial-to-parallel conversion of the third encrypted data transmitted from the transmitting side; A ninth step of generating a plurality of third key sequences using the serial-parallel converted third encrypted data using a plurality of encryption algorithms; A tenth step of parallel-serial conversion of the plurality of third key sequences; An eleventh step of performing an exclusive OR operation on the parallel-serial converted third key sequence to generate first decrypted data; And a twelfth step of repeating the eighth to eleventh steps. An automatic synchronous encryption device for encrypting input data using a plurality of cryptographic algorithms, comprising: means for exclusively ORing the input data on a first key sequence generated by the plurality of encryption algorithms; Means for serial-to-parallel conversion of the output signal of the exclusive OR means; Means for encrypting the output signal of the serial-parallel conversion means by using a plurality of encryption algorithms to generate a second key sequence; And means for parallel-to-serial conversion of the second key sequence and outputting the converted second key sequence to the exclusive OR-means. An automatic synchronous decryption apparatus for decrypting encrypted encrypted data using a plurality of cryptographic algorithms, comprising: means for serial-to-parallel converting encrypted data transmitted from a transmitting side; Means for generating a plurality of key sequences using the serial-parallel converted cryptographic data using a plurality of cryptographic algorithms; Means for parallel-to-serial conversion of the plurality of key sequences; And means for performing an exclusive OR operation on the parallel-serial converted key sequence. An apparatus for encrypting and decrypting input data using a plurality of cryptographic algorithms, comprising: first exclusive OR means for performing an exclusive OR on the input data generated by the plurality of encryption algorithms; First series-parallel conversion means for serial-parallel conversion of the output signal of the first exclusive OR means; Means for encrypting the output signal of the first serial-to-parallel conversion means using a plurality of encryption algorithms to generate a second key sequence; First parallel-serial conversion means for parallel-serial conversion of the second key sequence and outputting the converted second key sequence to the exclusive OR-means; Second serial-parallel conversion means for serial-parallel converting the transmitted cryptographic data; Means for generating a plurality of third key sequences using the plurality of cryptographic algorithms on the output signal of the second serial-to-parallel conversion means; Second parallel serial conversion means for parallel-serial conversion of the plurality of third key sequences; And second exclusive OR operation means for exclusive OR operation on the output signal of the second parallel-serial conversion means.