KR100680025B1 - Apparatus and method for high-speed distributing encryption and deencryption with multi-session - Google Patents

Abstract

The present invention relates to a multisession fast encryption / decryption processing apparatus and method. Unlike the conventional method in which a single encryption / decryption apparatus performs both key sharing and decryption, a high-throughput transmission rate is high through a parallel load distribution encryption / decryption apparatus. Multisession load-balancing parallel encryption / decryption method to realize encryption and decryption of payloads except session headers, and dedicated key sharing for key exchange and key sharing Processing method; Giga-class and tera-class sessions by providing a lookup table configuration method for performing multi-session encryption, a method for sending a session to a parallel encryption / decryption apparatus through header conversion, and defining a traffic bus for receiving the session of the encryption / decryption apparatus. It can be usefully used in the development of the processing and the equipment that can process it.

Multisession, header, parallel encryption / decryption device, key exchange, key sharing, lookup table, encryption device ID, key position, encryption key, decryption key, load balancing

Description

Apparatus and method for multi-session high speed encryption / decryption processing {APPARATUS AND METHOD FOR HIGH-SPEED DISTRIBUTING ENCRYPTION AND DEENCRYPTION WITH MULTI-SESSION}

1 is a diagram illustrating an apparatus for multisession encryption and decryption processing including a session processing flow, and a process thereof;

2 is a diagram illustrating a session header conversion process in a header conversion unit;

3 is a signal timing diagram at the time of traffic bus transmission (header conversion unit-> parallel encryption / decoding device),

4 is a signal timing diagram when receiving a traffic bus (parallel decoding device-> header conversion unit),

5 is a procedure and flow chart for key sharing and payload decryption of a session.

<Explanation of symbols for the main parts of the drawings>

110: session matching unit 120: header conversion unit

130: key sharing processing unit 140: lookup table transmission unit

150: parallel encryption decoder

The present invention relates to an apparatus and method for multi-session high speed encryption / decryption. More particularly, the present invention relates to a multi-session high-speed encryption / decryption apparatus and method for realizing load-distribution type encryption / decryption for multi-session by configuring an encryption / decoding device in parallel. It is about.

In the related art of security for a session, a hardware encryption chip is mounted in an encryption device for relatively high speed processing to encrypt the payload of the session. At this time, in the public key cryptographic device, key exchange and key sharing must be preceded to generate a cryptographic key pair to be used for encryption with the connected counterpart equipment. In the related art, since a payload of a session is encrypted using an encryption key generated after performing a key exchange with an encryption device equipped with an encryption chip for key sharing, a load occurs in a single encryption device. In other words, a single encryption device was performing both key sharing and decryption. For this reason, it is essential to implement a high-speed encryption chip having high performance for high-speed encryption and decryption processing.

On the other hand, even if the cryptographic equipment equipped with a high-speed encryption chip to meet the maximum amount of transmission required, in the future to improve the speed or performance, a new and faster processing encryption chip is required. This is not an easy problem when developing an encryption device that satisfies the giga- or tera-class maximum throughput. As an alternative to solve this problem, a method of speeding up by constructing a plurality of crypto devices in parallel has been proposed, but this does not use a single high-speed line and requires a plurality of communication lines, and additionally a circuit matcher. do. This increases the total cost of the purchase of several cryptographic devices and adds the cost of the circuit matcher to improve speed in terms of cost-effectiveness, and also causes administrative inconvenience in the operation and maintenance of multiple cryptographic devices. do.

Therefore, the present invention has been made to solve the above problems of the prior art, an object of the present invention is to provide a parallel encryption and decryption device by configuring a conventional encryption and decryption chip in parallel for more efficient speed improvement and performance improvement Dedicated key sharing processing unit performs real-time high-speed encryption / decryption processing through load balancing when performing encryption / decryption of multi-sessions, and utilizes existing encryption / decryption chip to dedicate only key sharing to one encryption / decryption device. To provide a multi-session high speed encryption / decryption processing apparatus and method that can effectively reduce the processing delay and load incurred in generating the encryption / decryption key through key exchange by improving the decryption processing by configuring the decryption apparatus in parallel. have.

The multi-session fast encryption and decryption processing apparatus of the present invention for achieving the above object is characterized by comprising a session matching unit, a header conversion unit, a key sharing processing unit, a lookup table transmission unit and a parallel encryption decoding device. Looking at the function of each configuration, the session matching unit reads the header information for each session, the header related to key sharing is sent to the key sharing processing unit, and the header having general information is sent to the header conversion unit. The key sharing processor generates a decryption key by performing a key exchange with a counterpart counterpart device configured to generate an encryption decryption key for decryption. The generated encryption key is stored in the lookup table transmission unit. The lookup table transmitting unit stores the header, the encryption device ID, the key position information, and the encryption key obtained through the key sharing processing unit in the form of a lookup table, and transmits the information to each encryption / decoding device configured in parallel with the header conversion unit. . The header converting unit converts the header of the received session into the corresponding encryption / decryptor ID and key position information transmitted from the lookup table transmission unit and sends the header to the parallel encryption / decryption device through the traffic bus. In the parallel encryption / decryption apparatus, the encryption / decryption apparatus corresponding to the encryption / decryption apparatus ID decrypts the payload part with the encryption / decryption key in the key position information in the session received through the traffic bus and transmits it to the header conversion unit again.

Meanwhile, the multisession fast encryption / decryption processing method of the present invention includes a dedicated key sharing processing method for key exchange and key sharing, a lookup table configuration method for performing multisession encryption and decryption, a header conversion method, and parallel encryption and decryption through header conversion. And a traffic bus definition for receiving a session of the encryption / decryption apparatus. In addition, the multisession fast encryption / decryption processing method of the present invention includes a key exchange and key sharing procedure, and a payload decryption procedure after receiving a session.

Hereinafter, an apparatus and method for multisession high speed encryption and decryption according to the present invention will be described in detail with reference to the accompanying drawings.

1 illustrates a conceptual flow and load balancing parallel encryption / decryption apparatus for session processing.

As shown in FIG. 1, the multisession fast encryption / decryption apparatus of the present invention includes a session matching unit 110, a header conversion unit 120, a key sharing processing unit 130, a lookup table transmission unit 140, and a parallel connection. The encryption / decryption apparatus 150 is comprised. In the session processing in these configurations, the session received through the session matching unit 110 is replaced by a new header, the header is converted in the header converter 120, and transmitted to the parallel encryption device 150 through the traffic bus do. In the parallel encryption / decryption device 150, the encryption / decryption device encrypts and decrypts the payload portion. After the encryption and decryption is performed, the transmission and reception process is reversed. The function of the components of the present invention described above will be described in detail.

Here, as shown in FIG. 1, decryption session processing is performed in a direction opposite to the encryption session processing direction, an encryption key is used for encryption, and a decryption key is used for decryption. The encryption apparatuses # 1, # 2, ..., #N are used for encryption, and the decryption apparatuses # 1, # 2, ..., #N are used for decryption. Here, the same reference numerals # 1, # 2,... , #N, but actually different.

As described above, since the encryption key is replaced with the decryption key and the encryption device is replaced with the decryption device in the decryption, the actual operation is the same. For convenience of description, encryption will be described below with reference to FIG. 1.

The session matching unit 110 reads the header information of the received session and sends it to the key sharing processing unit in the case of a key sharing related header, and sends it to the header converting unit in the case of a header containing information data.

The header converting unit 120 replaces the original header with ID and key position information. The reason for the conversion is that the size of the original header information can be reduced to reduce the memory storage space, and the processing calculation for reading the header can be reduced. Also, when the corresponding encryption device of the parallel encryption device receives the session through the traffic bus, it is possible to determine whether the session should be handled by itself, and to easily utilize the corresponding encryption key through the key position information. For example, if you send an encryption key directly, 256 bits of information are required, but if you send it as key position information, you can only handle 1024 multi-sessions. Details of transmission and reception definition for the traffic bus will be described with reference to FIGS. 3 and 4.

The key sharing processor 130 generates an encryption key through a key exchange with a counterpart connected to a place that is responsible for generating an encryption key through key exchange and key sharing. The obtained encryption key information is stored in the memory together with the original header, encryption device ID, and key position in the lookup table. The key sharing processing unit also plays a role of load balancing. Using ATM headers as an example, loads are distributed by assigning headers with a VPI / VCI value of 1/33 to cryptographic equipment # 1, and assigning headers with 1/34 to cryptographic equipment # 2. . It should be allocated below the maximum transmission capacity of only one cryptographic device.

The lookup table transmitting unit 140 stores and manages the header and encryption key related information transmitted from the key sharing processor in the lookup table, and transmits the information allocated to each encryption device of the header converter and the parallel encryption device. . The header converting unit transmits header, ID, and key position information, and the cipher apparatus transmits the key position and the encryption key.

The parallel encryption device 150 is composed of n encryption devices (# 1, # 2, ..., #N) in parallel, and receives a session to be encrypted through a traffic bus. Since the encryption device has key position information and encryption key transmitted through the lookup table transmission unit, the encryption apparatus receives the received session with its ID and encrypts the payload. While one cipher encrypts the payload of the session, the other cipher waits to receive the next session over the traffic bus.

In the present invention, it is well known that the configuration of the parallel encryption device can be made more flexible by defining the number of encryption devices to n.

As described above, in the present invention, in order to perform multi-session and high-speed encryption / decryption, the encryption / decryption apparatus is configured in parallel to enable high-speed encryption / decryption processing. In other words, before performing multi-session encryption and decryption, a dedicated key-sharing processing unit is provided to generate a decryption key value to be used for each network-connected line, and the header is read at each session reception. You can distribute the load. This enables real-time high speed encryption and decryption for multisessions.

The session referred to in the present invention consists of a header including a path in the network and a payload containing information. Therefore, a method for securing session information in a communication network transmitted through a router or a switch to a counterpart station is to encrypt and transmit a payload except for a header including path information in the communication network. An example of a session is an ATM cell consisting of 53 bytes, where the VPI / VCI value of the ATM header represents the movement path in the communication network, and the payload is the information data value to be protected.

2 illustrates a method of converting a header in a header converter. After seeing the header of the normal session received through the session matching unit, the original header is replaced with the encryption device ID and the key position and exported to the parallel encryption device through the traffic bus. When converting the header, ID is the ID of the corresponding encryption / decryption device of the parallel encryption / decryption device, and the key position means the location where the encryption / decryption key is stored. Header conversion reduces the original header size, which reduces the processing time for header reads.

3 is a timing diagram for traffic bus transmission. The timing diagram of the session transfer from the header converter to the parallel encryption / decryption apparatus is shown. In this case, RCLK denotes a receive data clock, DI denotes 16-bit data, RDA denotes receive address information, CS denotes chip select, and WREN denotes a payload boundary as a write enable signal. The present invention provides a method for determining whether the encryption / decryption apparatus is its own ID when the CS signal is 0 when transmitting the session through the traffic bus, when the CS signal is 0. RDA signal is ID 0 or ID 1 value. For example, if it is key position information of the third encryption / decryption device, it is indicated as 011 0. In case of payload, it is defined as 011 1 respectively.

4 is a timing diagram when receiving a traffic bus. The following diagram shows a timing diagram when a session is transmitted to the header converter after encryption and decryption in the parallel encryption / decryption apparatus. In this case, TCLK means a transmission data clock, and Ready ID is a signal indicating that the encryption / decryption device is finished decrypting and the session is ready. TDA transmission address information is the ID of the encryption / decryption device. The payload boundary of the session sent as the read enable signal, and the DO signal means 16-bit transmission data, respectively.

The definition of the traffic bus of the present invention is defined as shown in Figs. 3 and 4, through which the session can be transmitted and received in the form of a bus.

5 illustrates a key sharing and session decryption procedure. First, in the key sharing start, key exchange and key sharing with the connected stations are performed (501). When all connection settings and key sharing are completed, key sharing information including a header is stored in a lookup table, and the corresponding storage information is transmitted to the header converting unit (502). When all the above processes are completed, the encryption / decryption process for the session is performed. After receiving the session, the header converter detects the header in the receiving session (503). The detected header is read to determine whether key sharing is performed (504). If it is determined that the header has not been shared, a key exchange and key sharing process is requested. If the header has been shared, the header is converted into an ID and a key position (505). The converted session is transmitted to the encryption / decryption apparatus (506). The encryption / decryption apparatus decrypts the payload of the corresponding session received through the traffic bus (507). The above process is performed for each session, and the session after decryption and decryption transmits the session in reverse, and replaces the original header through the header conversion unit, and sends it out through the session matching unit.

According to the present invention, as an example, if one encryption / decryption device has a maximum transmission amount of 30 Mbps, the encryption / decryption device having a maximum transmission amount of 150 Mbps can be developed when five encryption / decryption devices are configured in parallel.

Although the present invention has been described in more detail with reference to some embodiments, the present invention is not necessarily limited to these embodiments, and various modifications can be made without departing from the spirit of the present invention.

As described above, the multisession fast encryption / decryption processing apparatus and method according to the present invention performs a load distribution processing while performing encryption / decryption for a high speed multisession through load distribution using a dedicated key sharing processing unit and a parallel encryption / decryption device. By defining a new traffic bus and providing a communication method with the corresponding encryption / decryption device configured in parallel, it is possible to provide one load balancing technology that can be utilized for the development of giga- and tera-class session processing equipment.

Claims (18)

A key sharing processor responsible for load balancing the cryptographic apparatuses of the parallel cryptographic apparatus, which generates a cipher key value to be used for each circuit set in advance and reads the header at the reception of each session; A header conversion unit for converting the header of the session into an ID designating a corresponding encryption device to be processed in the encryption device of the parallel encryption device and key position information associated with the encryption key; And Parallel encryption device consisting of N encryption devices for encrypting the payload for the input session distributed by using the ID, key location information, encryption key Multi-session high speed encryption processing apparatus comprising a. Where N is a natural number The apparatus of claim 1, wherein the multisession high speed encryption processing apparatus comprises: And a session matching unit for reading the received header information of the received session and transmitting it to a key sharing processing unit in the case of a header related to key sharing, and transmitting it to a header converting unit in the case of a header having information data. Processing unit. The apparatus of claim 1, wherein the multisession high speed encryption processing apparatus comprises: And storing and managing header and encryption key related information transmitted from the key sharing processor in a look-up table, and further comprising a look-up table transmission unit for transmitting information allocated to each of the encryption device of the header converter and the parallel encryption device. Multisession high speed encryption processing apparatus. 2. The multisession fast encryption apparatus of claim 1, wherein the parallel encryption apparatus is configured in parallel between the header converter and the lookup table transmitter. A key sharing processor responsible for load balancing of the decoding devices of the parallel decoding device, which generates a decoding key value to be used for each circuit connected to the network in advance, and reads a header when receiving a session; A header conversion unit for converting the header of the session into an ID designating a corresponding decoding device to be processed in the decoding device of the parallel decoding device and key position information associated with the decoding key; And Parallel decryption device consisting of N decryption devices for decrypting the encrypted payload for the input session distributed by using the ID, key position information, decryption key Multi-session high-speed decoding processing apparatus comprising a. Where N is a natural number The apparatus of claim 5, wherein the multisession high speed decoding processing apparatus comprises: And a session matching unit which reads the received header information of the received session and transmits it to a key sharing processing unit in the case of a header related to key sharing, and transmits it to a header converting unit in the case of a header having information data. Processing unit. The apparatus of claim 5, wherein the multisession high speed decoding processing apparatus comprises: And storing and managing header and decryption key related information transmitted from the key sharing processor in a lookup table, and further comprising a lookup table transmission unit for transmitting information allocated to each of the header conversion unit and the decoding units of the parallel decoding unit. Multisession high speed decoding processing apparatus. 6. The multi-session high speed decoding processing device according to claim 5, wherein the parallel decoding device is configured in parallel between the header converting unit and the lookup table transmitting unit. An ID for generating an encryption key through sharing of the encryption key through a key exchange with a counterpart established in the key sharing processing unit, sharing the encryption key, and designating a corresponding encryption device to perform processing among the encryption devices in the header conversion unit; Converting into key location information associated with an encryption key; A second step of storing original header, ID, and key position information transmitted from the key sharing processor in a lookup table; And A third step of encrypting the key position information and the encryption key transmitted based on the lookup table, and the payload of the multisession received by the corresponding encryption apparatus corresponding to the ID; Multi-session fast encryption processing method comprising a. 10. The method of claim 9, prior to the first step, Multi-session fast encryption processing further comprising the step of reading the header information of the received session and transmitting it to the key sharing processing unit in the case of a header related to key sharing, and transmitting the header information to the header converting unit in the case of a header having information data. Way. The method of claim 9, wherein the header conversion process in the first step, Detecting a header in a received session; Determining whether to perform key sharing by reading the detected header; And If it is determined that the header has not been shared, requesting a key exchange and key sharing process, and converting information into an ID and a key position of the header if the header has been shared. Multi-session fast encryption processing method characterized in that consisting of. 10. The method of claim 9, wherein the data transmitted from the key sharing processing unit to the header conversion unit and the encryption apparatus, And a header, ID, and key location information to the header conversion unit, and key location information and an encryption key to the corresponding encryption device. The multi-session fast encryption processing method of claim 9, wherein the encrypted session is further transferred to the original header through a header conversion unit. An ID for generating a decryption key through the key exchange with the counterpart connected to the key sharing processor, sharing the decryption key, and designating a corresponding decryption device to perform processing among the decryption devices in the header converter; Converting into key position information associated with a decryption key; A second step of storing original header, ID, and key position information transmitted from the key sharing processor in a lookup table; And A third step of decrypting the key position information and the decryption key transmitted based on the lookup table, and the payload of the multisession received by the corresponding decoding apparatus corresponding to the ID; Multi-session fast decoding processing method comprising a. 15. The method of claim 14, wherein prior to the first step: Multi-session high-speed decoding processing further comprising the step of reading the header information of the received session and transmitting it to the key sharing processing unit in case of a header related to key sharing, and transmitting it to the header converting unit in the case of a header having information data. Way. 15. The method of claim 14, wherein the header conversion process in the first step, Detecting a header in a received session; Determining whether to perform key sharing by reading the detected header; And If it is determined that the header has not been shared, requesting a key exchange and key sharing process, and converting information into an ID and a key position of the header if the header has been shared. Multi-session fast decoding processing method characterized in that consisting of. 15. The method of claim 14, wherein the data transmitted from the key sharing processor to the header converter and the decoder, And a header, ID, and key position information to the header converting unit, and key position information and a decryption key to the corresponding decoding device. 15. The method of claim 14, wherein the decrypted session further transmits the session to replace the original header with a header through a header converter.

Images