KR101081773B1 - Data encryption/decryption equipment and method in the physical layer of ethernet lan - Google Patents

Abstract

PURPOSE: A physical layer data protection apparatus for frame security in an Ethernet LAN and a method thereof are provided to easily install the physical layer data protection apparatus in a system board, thereby providing security with respect to an Ethernet frame in a physical layer. CONSTITUTION: A 48-bit shift register part(210) and 16-bit shift register part(220) distinguish a header of an 8-byte Ethernet frame or 64-bit Ethernet frame in other words. A frame boundary identification circuit part(230) identifies a boundary of an Ethernet frame. A calculating machine part(240) generates a data length identification signal. An encryption operation signal generation part(250) generates a signal which only encrypts a data field of the Ethernet frame. An encryption key generating part(260) generates an encryption key using an encryption initial value. A logical AND circuit part(270) logically computes the encryption key and an encryption operation signal. An exclusive XOR circuit part(280) encrypts the encryption key and data field of the Ethernet frame. A light emitting device operation part(290) informs a normal operation state to an operator.

Description

Data encryption / decryption equipment and method in the physical layer of Ethernet LAN}

The present invention relates to a physical layer data security device and method for frame security in an Ethernet LAN, and more particularly, to a data security device for enhancing security by encrypting data on a physical layer in an Ethernet LAN environment, and a data security method using the same. will be.

In general, when the data exchange between terminals in the Ethernet LAN of IEEE 802.3 is transmitted in the form of a frame, there is no provision for security at the physical layer in this frame transmission.

1 is a structure of a general Ethernet LAN. As shown in FIG. 1, the Ethernet LAN has a form in which several terminals 110a to 110n and 120a to 120n and a server 100 are connected to a single network 130.

In such an Ethernet LAN environment, an intruder can easily access the network, and there is a possibility of information leakage. In other words, there was a weakness in security.

Thus, additional installation of security features is essential to address these security vulnerabilities. In addition, an additional device is required in consideration of maintenance.

It is an object of the present invention to provide a physical layer data security device that enables Ethernet frame security at a physical layer for data transmitted and received under an Ethernet LAN environment.

Another object of the present invention is to provide a method for encrypting and decrypting an Ethernet frame transmitted and received under an Ethernet LAN environment.

The present invention provides a physical layer data security device for frame security in an Ethernet LAN, in order to solve the problems posed above. The physical layer data security device includes: a 48-bit shift register section and a 16-bit shift register section for temporarily storing an Ethernet frame of IEEE 802.3 and determining a physical layer header of the Ethernet frame; A frame boundary discrimination circuit unit configured to determine the boundary of the Ethernet frame by generating the Ethernet frame boundary determination signal of the Ethernet frame by reading the bit pattern of the physical layer header of the Ethernet frame by the 48-bit shift and 16-bit shift register unit; The initial value is set according to the Ethernet frame boundary determination signal, and the initial value is counted down from the initial value whenever the bits of the reception address field, the originating address field, and the data length field of the Ethernet frame are input. A counter unit for generating a data length determination signal for a data field of the Ethernet frame and transmitting the data length determination signal to the 16-bit shift register unit; According to the data length determination signal, the contents of the data length field of the Ethernet frame are inputted from the sixteen-bit shift register unit and converted, and a value obtained by converting the length of the data field of the Ethernet frame in bits is set as an initial value. An encryption operation signal generator for generating an encryption operation signal until the initial value becomes "0" by counting down; An encryption key generator configured to generate an encryption key using an encryption initial value applied according to the Ethernet frame boundary determination signal; A logical (AND) circuit unit configured to logically operate the encryption key and an encryption operation signal to open the encryption key only in a data field of the Ethernet frame; And an exclusive-OR circuit (XOR) for generating an encrypted Ethernet frame by encrypting the data field and the encryption key of the Ethernet frame with an exclusive-OR.

In addition, the physical layer data security apparatus according to another embodiment of the present invention, 48-bit shift register unit for temporarily storing the encrypted encrypted Ethernet frame according to the IEEE 802.3 standard and to determine the physical layer header of the encrypted Ethernet frame; A 16-bit shift register section; A frame boundary in which the 48-bit shift and 16-bit shift registers read the bit pattern of the physical layer header of the encrypted Ethernet frame to determine the boundary of the encrypted Ethernet frame and generate an Ethernet frame boundary determination signal of the encrypted Ethernet frame Discrimination circuit section; The initial value is set according to the Ethernet frame boundary determination signal, and the initial value is counted down from the initial value every time the bits of the reception address field, the source address field, and the data length field of the encrypted Ethernet frame are input. A counter unit for generating a data length determination signal for the data length field of the encrypted Ethernet frame and transmitting the data length determination signal to the 16-bit shift register; In accordance with the data length determination signal, the contents of the data length field of the encrypted Ethernet frame are inputted from the sixteen-bit shift register unit and converted, and the value obtained by converting the length of the data field of the encrypted Ethernet frame in units of bits is an initial value. A decoding operation signal generator for generating a decoding operation signal until the initial value becomes "0" by setting the coefficient to down count; A decryption key generation unit generating a decryption key using an decryption initial value applied according to the Ethernet frame boundary determination signal; A logical (AND) circuit unit configured to logically operate the decryption key and a decryption operation signal to open a decryption key in an encrypted data region of the encrypted Ethernet frame; And an exclusive-OR circuit (XOR) for generating an unencrypted Ethernet frame by decrypting the encrypted data field and the decryption key of the encrypted Ethernet frame with an exclusive-OR.

In addition, the physical layer data security device may further include a light emitting device driver for displaying a normal state during the encryption operation or decryption operation.

In this case, the light emitting device driver further comprises an inverter and a pull-up resistor of a predetermined value.

At this time, the encryption operation signal generator or decryption operation signal generator,

A 24-bit register for converting the contents of the data length field expressed in bytes into bit units to generate a converted value; And an internal counter configured to set the converted value as an initial value and count down from the initial value to synchronize.

At this time, only the section corresponding to the length of the data field is maintained as "1", and the remaining section is "0".

Here, the initial value is a decimal value "112", the unit of the down coefficient is "1", and "112" is a data length located in the 14th byte after determining the boundary of the Ethernet frame or the encrypted Ethernet frame. Characterized in that the bit conversion value of the field.

In this case, the encryption key generation unit, an encryption element; A 64-bit counter for providing encrypted data in a 64-bit block unit to the encryption element and receiving an initial value from a frame boundary determination signal of the frame boundary determination circuit unit; And a Data Encryption Standard (DES) device that receives the output of the 64-bit counter as encryption data and uses a symmetric key encryption algorithm.

At this time, the 48-bit shift register reads a part (6 bytes) of a preamble field pattern of the Ethernet frame or the encrypted Ethernet frame.

The 16-bit shift register reads a portion (1 byte) of a preamble field pattern of the Ethernet frame or an encrypted Ethernet frame, a pattern of a frame start delimiter field, and a data length field.

Meanwhile, another embodiment of the present invention provides a physical layer data security method for frame security in an Ethernet LAN. This physical layer data security method comprises the steps of: serially inputting an unencrypted IEEE 802.3 Ethernet frame; Reading a bit pattern of a physical layer header of the Ethernet frame to determine a boundary of the Ethernet frame and generating an Ethernet frame boundary determination signal of the Ethernet frame; Setting an initial value according to the Ethernet frame boundary determination signal and counting down each time a bit of a reception address field, an originating address field, and a data length field of the Ethernet frame is input from the initial value; Determining whether the initial value has reached "0"; When the initial value reaches "0", generating an encryption operation signal to generate an encryption key according to the encryption operation signal; Generating a section-opened encryption key that opens and closes only a data field section of the Ethernet frame using the encryption key; And performing an exclusive OR operation on the encryption key opened and closed with the Ethernet frame to generate an encrypted Ethernet frame encrypted only with a data field section of the Ethernet frame, and transmitting the encrypted Ethernet frame to a receiver.

On the other hand, the physical layer data security method according to another embodiment of the present invention, the encrypted Ethernet frame of IEEE 802.3 is input in serial; Reading a bit pattern of a physical layer header of the encrypted Ethernet frame to determine a boundary of the encrypted Ethernet frame and generating an Ethernet frame boundary determination signal of the encrypted Ethernet frame; Setting an initial value according to the Ethernet frame boundary determination signal and counting down each time a bit of a reception address field, an originating address field, and a data length field of the encrypted Ethernet frame is input from the initial value; Determining whether the initial value has reached "0"; When the initial value reaches "0", generating a decryption operation signal to generate a decryption key according to the decryption operation signal; Generating a section-opened decryption key that opens and closes only a data field section of the encrypted Ethernet frame using the decryption key; Generating and transmitting an unencrypted Ethernet frame by performing an exclusive OR operation on the interval-opened decryption key and the encrypted Ethernet frame.

The physical layer data security method further comprises the step of indicating that the light is in a normal state during the encryption operation or the decryption operation.

In this case, the initial value is a decimal value "112", the unit of the downlink coefficient is "1", and "112" is a data length located in the 14th byte after determining the boundary of the Ethernet frame or the encrypted Ethernet frame. Characterized in that the bit conversion value of the field.

At this time, only the section corresponding to the length of the data field is maintained as "1", and the remaining section is "0".

 According to the present invention, it is possible to provide security for an Ethernet frame at the physical layer by simply installing a physical layer data security device on a system board (ie, a motherboard).

In addition, another effect of the present invention is to determine the boundary of the Ethernet frame, and then determine the size of the data field to encrypt / decrypt only the data field except for the fields related to transmission and reception of frames among the various fields of the Ethernet frame. It is possible to implement security in a layer.

In addition, another effect of the present invention is to improve the reliability in terms of the efficiency of the Ethernet LAN system operation and the security of the system by additionally installing and enabling the function when the security is required during the operation of the Ethernet LAN. Can be.

1 is a conceptual diagram showing the structure of a general Ethernet LAN.
2 is a block diagram of an encryption function for Ethernet frame security according to an embodiment of the present invention.
3 is a structure of an Ethernet frame according to an embodiment of the present invention.
4 is a structure of an internal 24-bit register that receives the contents of the data length field 340 having the number of bytes of the data field as its contents and converts the contents into the number of bits of the data field.
5 is a flowchart illustrating a process of encrypting according to an embodiment of the present invention.
6 is a timing diagram of an encryption operation signal according to an embodiment of the present invention.
7 is a block diagram of a decryption function for decrypting an encrypted Ethernet frame according to another embodiment of the present invention.
8 is a flowchart illustrating a decoding process according to another embodiment of the present invention.

The terms or words used in this specification and claims are not to be construed as limiting in their usual or dictionary meanings, and the inventors may appropriately define the concept of terms in order to best explain their invention in the best way possible. It should be interpreted as meaning and concept corresponding to the technical idea of the present invention based on the principle that the present invention.

Therefore, the embodiments described in the present specification and the configuration shown in the drawings are only the most preferred embodiments of the present invention, and do not satisfy all of the technical idea of the present invention, and various equivalents may be substituted for them at the time of the present application. It should be understood that there may be water and variations.

Hereinafter, with reference to the drawings will be described in detail an embodiment of the present invention.

2 is a block diagram of an encryption function for Ethernet frame security according to an embodiment of the present invention. Referring to Fig. 2, in the encryption function block diagram, a 48-bit shift register section 210 and a 16-bit shift register section for temporarily storing an 8-byte (64-bit) Ethernet frame and determining the header of the Ethernet frame. 220, a frame boundary determination circuit 230 for determining a boundary of an Ethernet frame by determining a bit pattern of a 64-bit shift register (plus a 48-bit shift register and a 16-bit shift register); Counter unit 240 that counts to an initial value applied according to the Ethernet frame boundary discrimination signal generated by discrimination circuit unit 230 to generate a data length discrimination signal, and operation of the data length discrimination signal generated by counter unit 240 Encryption operation signal generator 250 for generating a signal for encrypting only the data field of the Ethernet frame according to the signal, the frame Encryption key generation unit 260 for generating an encryption key using an initial encryption value applied according to the Ethernet frame boundary determination signal generated by the system determination circuit unit 230, and logical operation (AND) of the encryption key and the encryption operation signal. Logical circuit (AND) circuit unit 270 that opens the encryption key only in the data field of the Ethernet frame, exclusive logical sum (XOR) circuit unit 280 and device for encrypting the data field and encryption key of the Ethernet frame with an exclusive logical OR A light emitting device driver 290 or the like is configured to inform the operator that the device is operating normally during the operation.

Here, the shift register sections 210 and 220 are configured using a plurality of 8-bit registers.

3 is a structure of an Ethernet frame according to an embodiment of the present invention. Referring to FIG. 3, the Ethernet frame is an Ethernet frame of the IEEE 802.3 standard and includes a preamble field 300), a frame start delimiter field 310, a reception address field 320, a source address field 330, and a data length. Field 340, data field 350, and cyclic margin check field 360. The following describes these fields in the input direction.

The preamble field 300 is 7 bytes (56 bits) in which 0s and 1s are repeated, which informs the receiver of the input of the Ethernet frame and synchronizes the input data and the reception timing.

The Start Frame Delimiter (SFD) field 310 is a part for notifying the start of an IEEE 802.3 Ethernet frame and is also called a flag 10101011. Here, if the last two bits are 11, the next field indicates the reception address field 320.

A destination address field (DA) 320 is 6 bytes and contains a physical address of a terminal to be received.

The source address field (SA) 330 is 6 bytes and contains the physical address of the originating terminal.

Data length field 340 represents the length of data field 350 as two bytes.

The data field 350 carries data encapsulated in a higher layer protocol and is usually 46 to 1500 bytes. Of course, this is a variable length, and the data length field 340 has the number of bytes of this data field 350 as its value.

In the cyclic redundancy check 360 field, a check calculated in a contracted manner to check whether there is an error in the data received at the receiving end when transmitting data through a network (for example, 130 of FIG. 1). Insert a value.

Here, the reception address field 320, the source address field 330, and the data length field 340 are combined to form 14 bytes 303. In addition, the preamble field 300, the frame start separator field 310, the reception address field 320, the source address field 330, and the data length field 340 are combined to form 22 bytes 305.

Of course, the physical layer header 301 is a combination of the preamble field 300 and the frame start delimiter 310 is 8 bytes.

FIG. 4 is a structure of an internal 24-bit register for converting the number of bytes of a data field, which the data length field 340 has as contents, of the Ethernet frame of FIG. 3 into the number of bits of the data field. That is, the encryption operation signal generator 250 shown in FIG. 2 is provided with a 24-bit register (not shown). A 16-bit data length field (Fig. 2) is provided in certain areas D3 to D18 of the 24-bit register. 3's 340) is passed as is and converted to 24-bit format.

Here, the interval 430 of D0 to D2 and the interval 410 of D19 to D23 are fixed to 0 by 8 bits, and the interval 420 of the remaining D3 to D18 transfers the contents of the data length field of the Ethernet frame. I received it.

As shown in FIG. 4, the contents of the 16-bit shift register 220 are stored in D18 of the internal 24-bit register in D18 of D18-D3 and the most significant bit (MSB) of the 16-bit register 220 in the least significant bit (D3). LSB) is transferred in bit units, and if the contents of bits D23-D19, D2, D1, and D0 are set to "0", the operation shifts the contents of the data length field three times to the left. This is the same operation as multiplying the data length field (340 in FIG. 3) expressed in bytes so that the contents of the internal 24-bit register is a value representing the number of bits in the data field.

5 is a flowchart illustrating a process of encrypting according to an embodiment of the present invention. The encryption process includes a physical layer header (300 and 310 in FIG. 3), a reception address field 320 and a source address field 330 related to Ethernet frame transmission and reception, which are patterns indicating the boundary of the Ethernet frame in the structure of the Ethernet frame. Only data fields except the circular margin inspection field 360 should be encrypted. That is, only the data field 350 of FIG. 3 is encrypted through the encryption process of FIG. 5.

)이 직렬로 입력된다(단계 S500). 즉, 이더넷 프레임(

)이 배타적 논리합 회로부(280)에 입력되며, 장치가 동작 전에는 초기 리셋 상태여서 암호화 동작신호가 0인 상태이므로 구간 개폐된 암호화 키(

)의 값은 0이 되어 이더넷 프레임(

)이 16-비트 시프트 레지스터부(220)와 48-비트 시프트 레지스터부(210)쪽으로 그대로 직렬 입력된다.Referring to FIG. 5, an unencrypted Ethernet frame (

) Is input in series (step S500). That is, the Ethernet frame (

) Is input to the exclusive-OR circuit 280, and since the encryption operation signal is 0 since the device is in the initial reset state before the operation, the encryption key (

) Has a value of 0, which means that Ethernet frames (

) Is serially input into the 16-bit shift register section 220 and the 48-bit shift register section 210 as they are.

)의 물리 계층 헤더(도 3의 301)에 해당하는 패턴을 검출한다(단계 S510). The 48-bit shift register unit 210 and the 16-bit shift register unit 220 serve as a path for the Ethernet frame input in units of bits and the Ethernet frame (

The pattern corresponding to the physical layer header 301 of FIG. 3 is detected (step S510).

)의 경계임을 판별하고 프레임 경계 판별 신호를 생성한다. 즉, 도 3에 도시된 바와 같이, 물리 계층 헤더(301)와 수신 주소 필드(320)의 경계를 판별하게 된다. In other words, when a pattern is detected, the frame boundary discrimination circuitry 230 controls the Ethernet frame (

Frame boundary determination signal is generated. That is, as shown in FIG. 3, the boundary between the physical layer header 301 and the reception address field 320 is determined.

)에서 데이터 길이 필드(도 3의 340)가 16-비트 시프트 레지스터(220)에 도달하였을 때 그 내용을 데이터 길이 판별 신호에 준해 암호화 동작 신호 발생부(250)내에 구비된 24-비트 레지스터로 도 4의 형식으로 전달하여 주는 역할을 한다.In addition, the 16-bit shift register unit 220 is an Ethernet frame input in units of bits (

When the data length field 340 of FIG. 3 reaches the 16-bit shift register 220, the content is converted into a 24-bit register provided in the encryption operation signal generator 250 in accordance with the data length determination signal. It plays the role of delivering in the form of 4.

When the frame boundary discrimination signal is generated by the frame boundary discrimination circuit 230, the counter unit 240 sets the decimal value "112" as an initial value in response to the frame boundary discrimination signal (step S520).

)의 헤더(도 3의 301)에 해당하는 패턴이 검출되면 프레임 경계 판별 신호를 발생시켜 계수기부(240)에 십진수 값 "112"를 로드하도록 하여 이더넷 프레임(

)의 각 비트가 입력될 때마다 1 씩 감소하도록 구성한다. In other words, the frame boundary discrimination circuit 230 may be configured as an Ethernet frame (which is input in series).

When the pattern corresponding to the header (301 of FIG. 3) is detected, a frame boundary discrimination signal is generated to load the decimal value "112" into the counter unit 240 so that the Ethernet frame (

Each bit of) is decremented by 1 for each input.

)의 데이터 길이 필드(도 3의 340)의 2 바이트가 이더넷 프레임 경계 판별 후 14 번째 바이트에 위치하는 데 이를 비트로 환산하면 112 비트이다. 부연하면, 도 3에 도시된 수신 주소 필드(320), 발신 주소 필드(330) 및 데이터 길이 필드(340)를 비트수로 표시하면 "112"가 된다. This decimal value "112" represents the Ethernet frame that is entered after Ethernet boundary determination.

2 bytes of the data length field (340 of FIG. 3) are located in the 14th byte after the Ethernet frame boundary determination, which is 112 bits. In other words, the reception address field 320, the origination address field 330, and the data length field 340 shown in FIG.

)의 경계 판별 후 이더넷 프레임의 21-22 번째 바이트에 위치하는 데이터 길이 필드(도 3의 340)가 16-비트 시프트 레지스터부(220)에 112 번째 클록(clock)에 도달하므로 계수기 값이 0이 될 때 발생한 데이터 길이 판별 신호에 준해 계수기부(240)에서 16-비트 시프트 레지스터부(220)에 입력된 데이터 길이 필드(340)의 값을 암호화 동작 신호 발생부(250)로 전달하여주기 위함이다. 여기서 클록은 클록 생성기에 의해 발생하는데, 이는 널리 공지되어 있는 기술이므로 더 이상의 설명은 생략하기로 한다.This is an Ethernet frame (

After the boundary is determined, the data length field (340 in FIG. 3) located in the 21st to 22nd bytes of the Ethernet frame reaches the 112th clock in the 16-bit shift register 220, so that the counter value is 0. The data length field 340 input from the counter unit 240 to the 16-bit shift register unit 220 according to the data length determination signal generated when the data length determination signal is generated is transmitted to the encryption operation signal generator 250. . Here, the clock is generated by a clock generator, which is a well known technique, and thus, further description thereof will be omitted.

Meanwhile, the encryption key generator 260 is operated by loading an initial value into an internal counter of the encryption key generator 260 in synchronization with the frame boundary determination signal. This is for determining the boundary of the frame at the receiving side and operating the decryption key generation unit (760 in Fig. 7) so that the encryption key and the decryption key have the same stream. The corresponding content is described in the decoding function block diagram of FIG. 7.

)의 수신 주소 필드(320), 발신 주소 필드(330) 및 데이터 길이 필드(340)의 각 비트가 입력될 때마다 1 씩 감소시킨다(단계 S530). After that, the Ethernet frame (

Each bit of the reception address field 320, the origination address field 330, and the data length field 340 is reduced by one (step S530).

By repeating step S530, it is determined whether the initial value "112" has reached "0" (step S540).

If it is determined that "0" is reached, the counter unit 240 generates a data length determination signal and transmits the data length determination signal to the encryption operation signal generator 250, and the length of the Ethernet frame at the time when the data length determination signal is generated. Since the field enters the contents of the 16-bit shift register 220, the contents of the 16-bit shift register 220 are transmitted to the encryption operation signal generator 250.

Accordingly, the encryption operation signal generation unit 250 reads the contents of the data length field (340 in Fig. 3) indicating the number of bytes of the data field based on the data length determination signal, converts the contents into 24-bits, and the contents of the 24-bit register. Represents the number of bits in the data field. A diagram showing this is shown in FIG. 4.

)의 한 비트가 입력될 때마다 1 씩 감소시키며 내부 계수기의 값이 "0"이 될 때까지 암호화 동작 신호의 값을 "1"로 유지하며 그 외 구간은 "0"이 되는 암호화 동작 신호를 발생시킨다. 부연하면, 암호화 동작 신호 발생부(250)에서는 데이터 길이 필드(도 3의 340)에 표시된 데이터 필드(350)의 길이에 해당하는 동안만 암호화 동작 신호를 "1"로 유지하고 나머지 구간은 "0"이 되는 신호인 암호화 동작 신호를 생성한다.After setting this value to the initial value of the internal counter (not shown), the Ethernet frame (

Whenever one bit of) is input, it decreases by 1 and keeps the value of the encryption operation signal as "1" until the value of the internal counter becomes "0". Generate. In other words, the encryption operation signal generator 250 maintains the encryption operation signal as "1" only while it corresponds to the length of the data field 350 displayed in the data length field 340 of FIG. Generates an encryption operation signal which is a signal "

)의 데이터 필드(도 3의 350)에 해당하는 구간만 로직 "1"이고 그 외 구간은 로직 "0"을 유지한다. 도 6에 암호화 동작 신호의 타이밍 도를 도시하였다. 즉, 도 6은 데이터 필드(도 3의 350) 에 해당하는 구간(600)만 로직 "1"이고 그 외 구간은 로직 "0"을 유지한다.The encryption operation signal generated in this way is an Ethernet frame (

Only the section corresponding to the data field 350 of FIG. 3 is logic “1” and the other sections maintain logic “0”. 6 is a timing diagram of an encryption operation signal. That is, in FIG. 6, only the section 600 corresponding to the data field 350 of FIG. 3 maintains logic “1” and the other sections maintain logic “0”.

The encryption key generator 260 includes a 64-bit counter (not shown) for providing encrypted data in units of 64-bit blocks to an encryption device (not shown) and a DES (Data Encryption Standard) device using a symmetric key encryption algorithm. H) and the like. Accordingly, the counter (not shown) operates by receiving an initial value through the frame boundary discrimination signal of the frame boundary discrimination circuit unit 230, and outputs the counter as encrypted input data of the DES device (not shown).

The encryption key generation unit 260 operates when the frame boundary discrimination signal is generated. The decryption key generation unit (760 of FIG. 7) operates when the boundary discrimination signal of the encrypted frame is generated when the receiving side decrypts the decryption key. By synchronizing with the receiver, the decryption key of the receiver is synchronized with the same bit stream as the encryption key of the transmitter. Related information will be described in the decoding process with reference to FIG. 7.

Only one bit (bit 1) of the output of the DES device output in the 64-bit block unit is taken as an encryption key, which is converted into an encryption key that is opened and closed by performing an AND operation with the encryption operation signal and converted into an encryption key that is opened and closed. Do it.

)가 암호화 동작 신호와 논리적(AND) 연산을 거치면 구간 개폐된 암호화 키(

)가 생성된다(단계 S550).In the AND circuit unit 270, an encryption key (

) Opens and closes the encryption key (

Is generated (step S550).

)의 데이터 구간 동안만 로직 "1"이고 나머지 구간은 로직 "0"이므로 암호화 키(

)와 논리적 연산을 거친 구간 개폐된 암호화 키(

) 는 이더넷 프레임(

)의 데이터 필드(도 3의 350) 구간에서는

=

이고 나머지 구간에서는

=(로직 "0") 이다. 여기서,

는 이더넷 프레임(

)의 데이터 필드(350) 구간만 암호화하는 암호화 키이다. As shown in Figure 6, the encryption operation signal is an Ethernet frame (

Logic "1" only for the data interval of the) and logic "0" for the remaining intervals.

) And an open / closed encryption key that has been logically computed (

) Is the Ethernet frame (

In the data field (350 in FIG. 3)

=

On the rest of the

= (Logic "0") here,

Is the Ethernet frame (

It is an encryption key for encrypting only the data field 350 section.

)과 구간 개폐된 암호화 키(

)를 비트 단위로 배타적 논리합(XOR) 연산을 수행한다. 구간 개폐된 암호화 키(

)는 이더넷 프레임(

)의 데이터 필드(도 3의 350) 구간에서는

=

이므로 이더넷 프레임의 데이터 필드(도 3의 350) 구간에서는 다음 수학식 1의 연산에 의해 암호화된다.Exclusive-OR circuit 280 is an Ethernet frame (

) And an open / closed encryption key (

) Performs a bitwise exclusive OR (XOR) operation. Bind-opened encryption key (

) Is the Ethernet frame (

In the data field (350 in FIG. 3)

=

Therefore, in the data field section (350 of FIG. 3) of the Ethernet frame, it is encrypted by the operation of Equation 1.

는 암호화 이더넷 프레임을,

는 암호화되지 않은 이더넷 프레임을,

는 구간 개폐 암호화 키를 나타낸다. 따라서, 이들 이더넷 프레임을 구별하기 위해 암호화 이더넷 프레임은

로, 이더넷 프레임은

로 표시한다.here,

Encrypt ethernet frames,

Unencrypted ethernet frames,

Denotes an interval open / close encryption key. Therefore, to distinguish between these Ethernet frames, encrypted Ethernet frames

Ethernet frames are

To be displayed.

)의 나머지 구간에서는

=(로직 0)이므로 수학식 1을 이용하면 다음 수학식 2와 같이 연산된다. Ethernet frame (

In the rest of)

Since = (logic 0), using Equation 1 is calculated as Equation 2 below.

=

이므로 이는 암호화되지 않은 것과 같다. 이더넷 프레임(

)과 구간 개폐된 암호화 키(

)는 프레임 경계 판별 신호에 동기가 맞은 상태이므로 이더넷 프레임(

)과 구간 개폐된 암호화 키(

)를 배타적 논리합(XOR) 연산을 하면 이는 이더넷 프레임(

) 중에서 데이터 필드만 암호화된 암호화 이더넷 프레임(

)이 전송됨을 의미한다(단계 S560).therefore,

=

This is equivalent to unencrypted. Ethernet frame (

) And an open / closed encryption key (

) Is in sync with the frame boundary determination signal, so Ethernet frames (

) And an open / closed encryption key (

) Can be used as an exclusive OR (XOR) operation.

Of the encrypted Ethernet frames with only data fields encrypted

) Is transmitted (step S560).

)의 정상적인 송신 중에는 암호화 동작 신호에 로직 "1" 과 로직 "0"인 구간이 반복적으로 나타나는 데 이를 이용하여 발광 소자를 구동한다. On the other hand, as another embodiment of the present invention, the light emitting device driver 290 uses the logic of the encryption operation signal as a circuit for visually indicating whether the normal operation of the device. Ethernet frame (

), During the normal transmission, the interval between the logic "1" and the logic "0" repeatedly appears in the encryption operation signal.

Logic " 1 " section of the encryption operation signal becomes a logic " 0 " signal via the inverter element 291, and a light emitting element connected to a 4.7 k pull-up resistor (not shown) is driven during the signal " logic " To visually inform the operator of the normal operation of the security device.

)을 일시 저장하고 이 암호화 이더넷 프레임(

)의 헤더를 판별하기 위한 48-비트 시프트 레지스터부(710)와 16-비트 시프트 레지스터부(720), 64 비트로 구성된 시프트 레지스터(48-비트 시프트 레지스터와 16-비트 시프트 레지스터부를 더한 것임)의 비트 패턴을 판별하여 암호화 이더넷 프레임(

)의 경계를 판별하기 위한 프레임 경계 판별 회로부(730), 상기 프레임 경계 판별 회로부(730)가 생성한 이더넷 프레임 경계 판별 신호에 준해 인가된 초기값으로 계수하여 개폐 신호 발생의 동작 신호를 발생시키는 계수기부(740), 상기 계수기부(740)가 생성한 개폐 신호 발생 동작 신호에 따라 암호화 이더넷 프레임(

)의 암호화된 데이터 필드를 복호화하여 주기 위한 복호화 동작 신호의 발생을 위한 복호화 동작 신호 발생부(750), 상기 프레임 경계 판별 회로부(730)가 생성한 이더넷 프레임 경계 판별 신호에 따라 인가된 복호화 초기값을 이용하여 복호화 키를 발생하여 주는 복호화 키 생성부(760), 복호화 키와 복호화 동작 신호를 논리적(AND) 연산하여 암호화 이더넷 프레임(

)의 암호화된 데이터 필드에서 복호화 키를 열어주는 역할을 하는 논리적(AND) 회로부(770), 암호화 이더넷 프레임(

)의 암호화된 데이터 필드와 복호화 키를 배타적 논리합으로 복호화하여 주는 배타적 논리합(XOR) 회로부(780) 등이 구성된다. 7 is a block diagram of a decryption function for decrypting an encrypted Ethernet frame according to another embodiment of the present invention. Referring to Figure 7, Decryption function block diagram encryption Ethernet frame (

) Temporarily saves this encrypted Ethernet frame (

Bit of the 48-bit shift register section 710 and 16-bit shift register section 720, and 64-bit shift register (48-bit shift register plus 16-bit shift register section) for determining the header of Determines the pattern and encrypts Ethernet frames (

A coefficient for generating an operation signal of opening / closing signal generation by counting an initial value applied according to the Ethernet frame boundary determination signal generated by the frame boundary determination circuit unit 730 and the frame boundary determination circuit unit 730 to determine the boundary of The base 740 and the encrypted Ethernet frame according to the open / close signal generation operation signal generated by the counter unit 740 (

Decryption operation signal generator 750 for generating a decryption operation signal for decrypting the encrypted data field of the control unit, and an initial decryption value applied according to the Ethernet frame boundary determination signal generated by the frame boundary determination circuit unit 730. Decryption key generation unit 760 for generating a decryption key by using a logical (AND) operation of the decryption key and decryption operation signal to encrypt the Ethernet frame (

Logical (AND) circuitry 770, which opens the decryption key in the encrypted data field of the

An exclusive OR (XOR) circuit unit 780 for decrypting the encrypted data field and the decryption key by the exclusive OR.

Although not shown in FIG. 7, a light emitting device driver (not shown) may be configured to indicate that the decoding proceeds smoothly during the decoding operation. Since the corresponding content is described in FIG. 2, it will be omitted.

)이 직렬로 입력된다(단계 S800). 즉, 암호화 이더넷 프레임(

)이 배타적 논리합 회로부(780)에 입력되며, 장치가 동작 전에는 초기 리셋 상태로 복호화 동작 신호가 0 인 상태여서 구간 개폐된 복호화 키(

) 값도 0 이므로 암호화 이더넷 프레임(

)이 16-비트 시프트 레지스터부(720)와 48-비트 시프트 레지스터부(710)쪽으로 직렬 입력된다. 8 is a flowchart illustrating a decoding process according to another embodiment of the present invention. Referring to Figure 8, the encrypted Ethernet frame (

) Is input in series (step S800). That is, encrypted Ethernet frames (

) Is input to the exclusive-OR circuit 780, and the decryption key (opened / closed) is opened because the decryption operation signal is 0 in the initial reset state before the device is operated.

) Value is also 0, so the encrypted Ethernet frame (

) Is serially input into the 16-bit shift register section 720 and the 48-bit shift register section 710.

)의 통로 역할을 하며 암호화 이더넷 프레임(

)의 물리 계층 헤더(도 3의 301)에 해당하는 패턴을 검출한다(단계 S810). The 48-bit shift register unit 710 and the 16-bit shift register unit 720 may each include an encrypted Ethernet frame inputted in bits.

Pass through and pass through an encrypted Ethernet frame (

The pattern corresponding to the physical layer header 301 of FIG. 3 is detected (step S810).

)의 경계임을 판별하고 프레임 경계 판별 신호를 생성한다. 즉, 도 3에 도시된 바와 같이, 물리 계층 헤더(301)와 수신 주소 필드(320)의 경계를 판별하게 된다. In other words, when a pattern is detected, the frame boundary discrimination circuit unit 730 determines an encrypted Ethernet frame (

Frame boundary determination signal is generated. That is, as shown in FIG. 3, the boundary between the physical layer header 301 and the reception address field 320 is determined.

)에서 데이터 길이 필드(도 3의 340) 필드가 16-비트 시프트 레지스터(720)에 도달하였을 때 그 내용을 데이터 길이 판별 신호에 준해 복호화 동작 신호 발생부(750)로 전달하여 주는 역할을 한다.In addition, the 16-bit shift register unit 720 is an Ethernet frame (byte) inputted in units of bytes.

When the data length field 340 of FIG. 3 reaches the 16-bit shift register 720, the data length field 340 transmits the contents to the decoding operation signal generator 750 according to the data length determination signal.

When the frame boundary determination signal is generated by the frame boundary determination circuit unit 730, the counter unit 740 and the decryption key generation unit 760 operate in response to the frame boundary determination signal. The counter 740 operates by setting the decimal value "112" as an initial value. (Step S820).

)의 수신주소, 발신 주소 및 데이터 길이 필드(도 3의 303)의 각 비트가 입력될 때마다 1씩 감소시킨다(단계 S830).As the initial value "112" is loaded, the counter unit 740 performs an encryption Ethernet frame (

Each bit of the reception address, origination address, and data length fields (303 in Fig. 3) is decremented by one (step S830).

Accordingly, the counter 740 checks whether the initial value "112" reaches "0" (step S840).

)를 논리적 회로부(770)에서 논리적 연산을 하여 구간 개폐된 복호화 키(

)를 생성한다.(단계 S850) As a result of the check, when the initial value reaches "0", a data length determination signal is generated and the contents of the data length field of the encrypted Ethernet frame C _i reaching the 16-bit register 710 according to the signal are decrypted. The signal generator 750 transmits the signal. The decryption operation signal generator 750 generates a decryption key operation signal having a logic of "1" and a rest of a logic of "0" for a section of the data field to be decrypted using the number of bytes of the data field which is the content of the data length field. This decryption key operation signal and decryption key (

) And the decryption key (

(Step S850).

)와 수신되는 암호화된 암호화 이더넷 데이터 프레임(C_i)을 배타적 논리합 회로부(780)에서 배타적 논리합(XOR) 연산을 하면 다음 수학식 3에 의해 복호화된다. 따라서, 송신측에서 전송한 이더넷 프레임(

)이 생성된다(단계 S860).Interlocked decryption key (

) And the received encrypted encrypted Ethernet data frame (C _i ) by the exclusive logical OR circuit unit 780 in the exclusive logical OR (XOR) operation is decrypted by the following equation (3). Therefore, the Ethernet frame transmitted from the sending side (

) Is generated (step S860).

는 암호화가 안 된 이더넷 프레임이며, 구간 개폐된 복호화 키(

)는 구간 개폐된 암호화 키와 동일한 형태의 비트 스트림을 갖는다. Where C _i is an encrypted encrypted Ethernet frame,

Is an unencrypted Ethernet frame, and the decryption key (

) Has a bit stream of the same type as an encryption key that is opened and closed.

In an embodiment of the present invention, the functional block of the encryption process shown in FIG. 2 and the functional block of the decryption process shown in FIG. 7 are separately configured, but it may be configured in one board module. In this case, the encryption / decryption function may be used. This is done at the same time.

100: server
110a to 110n, 120a to 120n: terminal
210, 710: 48-bit shift register section
220, 720: 16-bit shift register section
230, 730: frame boundary discrimination circuit section
240, 740: counter
250: encryption operation signal generator 750: decryption operation signal generator
260: encryption key generation unit 760: decryption key generation unit
270, 770: logical (AND) circuit
280, 780: exclusive OR circuit
290: light emitting device driver

Claims (13)

A 48-bit shift register section and a 16-bit shift register section for temporarily storing an Ethernet frame of the IEEE 802.3 standard and for determining a physical layer header of the Ethernet frame;
A frame boundary discrimination circuit unit configured to determine the boundary of the Ethernet frame by generating the Ethernet frame boundary determination signal of the Ethernet frame by reading the bit pattern of the physical layer header of the Ethernet frame by the 48-bit shift and 16-bit shift register unit;
The initial value is set according to the Ethernet frame boundary determination signal, and the initial value is counted down from the initial value whenever the bits of the reception address field, the originating address field, and the data length field of the Ethernet frame are input. A counter unit for generating a data length determination signal for a data field of the Ethernet frame and transmitting the data length determination signal to the 16-bit shift register unit;
In response to the data length determination signal, the value of the data length field of the Ethernet frame is inputted from the 16-bit shift register and converted, and the data length of the data field of the Ethernet frame is converted into a bit unit as an initial value. An encryption operation signal generator for generating an encryption operation signal until the initial value becomes "0" by counting down;
An encryption key generator configured to generate an encryption key using an encryption initial value applied according to the Ethernet frame boundary determination signal;
A logical (AND) circuit unit configured to logically operate the encryption key and an encryption operation signal to open the encryption key only in a data field of the Ethernet frame; And
Exclusive logical OR (XOR) circuit unit for generating an encrypted Ethernet frame by encrypting the data field and the encryption key of the Ethernet frame with an exclusive logical OR.
Physical layer data security device for frame security on an Ethernet LAN comprising a. A 48-bit shift register section and a 16-bit shift register section for temporarily storing an encrypted encrypted Ethernet frame according to the IEEE 802.3 standard and for determining a physical layer header of the encrypted Ethernet frame;
A frame boundary in which the 48-bit shift and 16-bit shift registers read the bit pattern of the physical layer header of the encrypted Ethernet frame to determine the boundary of the encrypted Ethernet frame and generate an Ethernet frame boundary determination signal of the encrypted Ethernet frame Discrimination circuit section;
The initial value is set according to the Ethernet frame boundary determination signal, and the initial value is counted down from the initial value every time the bits of the reception address field, the source address field, and the data length field of the encrypted Ethernet frame are input. A counter unit for generating a data length determination signal for a data field of the encrypted Ethernet frame and transmitting the data length determination signal to the 16-bit shift register;
According to the data length determination signal, the content of the data length field of the encrypted Ethernet frame is inputted from the 16-bit shift register unit, converted, and the value of the length of the data field of the encrypted Ethernet frame converted into bits as an initial value. A decoding operation signal generator for generating a decoding operation signal until the initial value becomes "0" by setting and counting down;
A decryption key generation unit generating a decryption key using an decryption initial value applied according to the Ethernet frame boundary determination signal;
A logical (AND) circuit unit configured to logically operate the decryption key and a decryption operation signal to open a decryption key in an encrypted data region of the encrypted Ethernet frame; And
Exclusive logical OR (XOR) circuit unit for generating an unencrypted Ethernet frame by decrypting the encrypted data field and the decryption key of the encrypted Ethernet frame with an exclusive logical OR.
Physical layer data security device for frame security on an Ethernet LAN comprising a. The method according to claim 1 or 2,
Further comprising a light emitting device driver for displaying a normal state during the encryption operation or decryption operation,
The light emitting device driver further includes an inverter and a pull-up resistor having a predetermined value. The method according to claim 1 or 2,
The encryption operation signal generator or decryption operation signal generator,
A 24-bit register for converting the contents of the data length field indicating the number of bytes of the data field by bit to generate a converted value; And
And an internal counter configured to set the converted value to an initial value and count down from the initial value to synchronize. The method according to claim 1 or 2,
Only the section corresponding to the length (number of bits of the data field) of the data field is kept as "1", and the encryption section signal or decryption operation signal is physical layer data for frame security in an Ethernet LAN in which the remaining section is "0". Security device. The method according to claim 1 or 2,
The initial value is a decimal value "112", the unit of the downlink coefficient is "1", and the "112" is a data length field of the 14th byte after the boundary determination of the Ethernet frame or the encrypted Ethernet frame. Physical layer data security device for frame security in Ethernet LAN, which is a bit conversion value. The method of claim 1,
The encryption key generation unit,
Encryption element;
A 64-bit counter for providing encrypted data in a 64-bit block unit to the encryption element and receiving an initial value from a frame boundary determination signal of the frame boundary determination circuit unit; And
And a data encryption standard (DES) device for receiving the output of the 64-bit counter as encryption data and using a symmetric key encryption algorithm. The method according to claim 1 or 2,
The 48-bit shift register section reads a part (6 byte) pattern of a preamble field of the Ethernet frame or an encrypted Ethernet frame,
And the 16-bit shift register unit reads a portion (1 byte) of a preamble field of the Ethernet frame or an encrypted Ethernet frame, a frame start delimiter, and a data length field. Serially inputting an unencrypted IEEE 802.3 Ethernet frame;
Reading a bit pattern of a physical layer header of the Ethernet frame to determine a boundary of the Ethernet frame and generating an Ethernet frame boundary determination signal of the Ethernet frame;
Setting an initial value according to the Ethernet frame boundary determination signal and counting down each time a bit of a reception address field, an originating address field, and a data length field of the Ethernet frame is input from the initial value;
Determining whether the initial value has reached "0";
When the initial value reaches "0", generating an encryption operation signal to generate an encryption key according to the encryption operation signal;
Generating a section-opened encryption key that opens and closes only a data field section of the Ethernet frame using the encryption key;
Performing an exclusive OR operation on the encryption key opened and closed with the Ethernet frame to generate an encrypted Ethernet frame encrypted only in the data field section of the Ethernet frame and transmitting the encrypted Ethernet frame to a receiver;
Physical layer data security method for frame security on an Ethernet LAN comprising a. Inputting an encrypted IEEE 802.3 encrypted Ethernet frame serially;
Reading a bit pattern of a physical layer header of the encrypted Ethernet frame to determine a boundary of the encrypted Ethernet frame and generating an Ethernet frame boundary determination signal of the encrypted Ethernet frame;
Setting an initial value according to the Ethernet frame boundary determination signal and counting down each time a bit of a reception address field, an originating address field, and a data length field of the encrypted Ethernet frame is input from the initial value;
Determining whether the initial value has reached "0";
When the initial value reaches "0", generating a decryption operation signal to generate a decryption key according to the decryption operation signal;
Generating a section-opened decryption key that opens and closes only a data field section of the encrypted Ethernet frame using the decryption key;
Generating and transmitting an unencrypted Ethernet frame by performing an exclusive-OR operation on the section-opened decryption key and the encrypted Ethernet frame.
Physical layer data security method for frame security on an Ethernet LAN comprising a. The method according to claim 9 or 10,
A method of physical layer data security for frame security in an Ethernet LAN further comprising the step of light emitting a normal state during an encryption operation or a decryption operation. The method according to claim 9 or 10,
The initial value is a decimal value "112", the unit of the downlink coefficient is "1", and the "112" is a data length field of the 14th byte after the boundary determination of the Ethernet frame or the encrypted Ethernet frame. Physical layer data security method for frame security in Ethernet LAN which is bit conversion value. The method according to claim 9 or 10,
Only the section corresponding to the length of the data field is kept as "1" and the remaining section is "0", wherein the encryption operation signal or the decryption operation signal is physical layer data security method for frame security in an Ethernet LAN.

Images