KR101901999B1 - Apparatus for Transmitting/Receiving Data Packet Using Dual Security Means in Digital Walkie-Talkie for Small Combat Operation and Method thereof - Google Patents

Abstract

The present invention provides a transmitting/receiving method for packet-based communication performed by a digital walkie-talkie and, more specifically, to a transmitting/receiving method for packet-based communication additionally including an authentication means between digital walkie-talkies in addition to encryption/decryption means as an information protection measure. A transmitting apparatus (10) for packet-based communication used in a transmitting digital walkie-talkie receives a seed generated by considering individual, group, and broadcasting communication methods by an information generator (30), generates a first authentication key for authentication between apparatuses based on the seed, and uses a generated session key to encrypt voice data. Also, a receiving apparatus (20) for packet-based communication used in a receiving digital walkie-talkie receives a seed generated by an information generator (30) to generate a second authentication key to perform authentication between digital walkie-talkie apparatuses, and decrypts the encrypted voice data.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a data packet transmission / reception apparatus and a data packet transmission / reception apparatus using a dual security means in a digital radio for operating a small-

The present invention relates to a data transmitting and receiving apparatus. And more particularly, to a device for transmitting and receiving encrypted data in a digital radiotelephone for small area operation.

There is a demand for technology development of digital radio for voice and data operation in small units (platoon - squad, squad - squad). Research on the security of the transmission and reception data in the communication environment using the digital radio for the operation of the small base station is under way. In particular, various techniques for protection of the cancer / decryption as protection for the information distributed in the multi- Has been developed.

The relatively short distance wireless communication is widely used for military purposes and work sites. Particularly, as a device for a conventional wireless communication, a P-96K device of a small base station is equipped with only a function for communication itself with a focus on a voice transmission / reception function, or only a voice communication technology through a simple communication method is applied However, there are many cases where a separate encryption algorithm is not applied.

In addition, in a conventional small base station radio, when a communication frequency is exposed, voice is eavesdropped like radio reception, so that there is no security.

Conventional small-group radios can prevent simple eavesdropping during a secure voice call, but it is difficult to prevent eavesdropping through the deodorized equipment when the equipment is deodorized. In the case of exposing information even in a secure voice call There was also a risk of exposure of the transmission and reception.

Korean Patent No. 10-0994161 (November 15, 2010)

SUMMARY OF THE INVENTION The present invention is conceived to solve the problems described above, and it is an object of the present invention to provide a transceiver for communication of individual, group and broadcasting modes performed by a digital radio. In particular, as a protection scheme for information transmitted and received in a packet-based communication used in a digital radio, a transceiver for packet-based communication with improved security is secured by ensuring additional information protection measures through mutual authentication between transmitting and receiving devices in addition to encryption decryption and means. do.

In order to achieve the above object, the present invention provides a transmission method for packet-based communication, the method comprising the steps of: determining a validity of an encrypted data packet using a predetermined seed generated based on a first noise source as an entropy source; Generating a first authentication key that can be verified; And generating a session key for encrypting the data packet using the seed, encrypting and transmitting the data packet using the generated session key, .

In the present invention, the first authentication key is an authentication key for receiving a packet transmitted from a transmitting digital radio to a receiving side, and the receiving digital radio generates a second authentication key, The device can be authenticated by comparison. In more detail, a transmitting apparatus for packet-based communication used in a transmitting-side digital radiotelephone generates and transmits a first authentication key, and a receiving apparatus for packet-based communication used in a receiving-side digital radiotelephone transmits a second authentication key And the receiving device for packet-based communication can perform authentication between the devices by comparing the generated second authentication key with the first authentication key.

In the present invention, a concrete method of generating a first authentication key and a second authentication key by a transmitting apparatus for packet-based communication and a receiving apparatus for packet-based communication will be described below in detail.

In the present invention, the first noise source is a noise source used for generating a random number by generating a random number in an information generator other than a digital radio, a second noise source is a noise source distinguished from the first noise source, And a noise source used to generate the first authentication key. In the present invention, the second noise source includes at least a part of the password and voice data, and a transmitting device for packet-based communication can use a part of voice data to generate a random number, Lt; / RTI > The details of the noise source will be described later in the description of the present invention.

According to another aspect of the present invention, there is provided a receiving method for packet-based communication, the method comprising: receiving a first authentication request message including a first authentication result, which is an entropy source, Generating a key; Comparing the generated second authentication key with a first authentication key received from a sender; And detecting a session key for decrypting the data packet using the seed and decrypting an encrypted data packet received from a sender using the detected session key; .

In the present invention, the receiving apparatus for packet-based communication performing the receiving method for packet-based communication does not generate a random number but receives the random number and transmitting-side identifier information from the transmitting apparatus for packet-based communication provided in the transmitting- And can generate a second authentication key using the second authentication key.

The present invention also discloses a computer program stored in a computer-readable recording medium for executing a transmission method for packet-based communication and a receiving method for packet-based communication in a computer.

According to the present invention, voice data can be transmitted and received using double security means.

In particular, it is possible to prevent exposure of voice data transmitted and received by using packet-based double encryption means.

1 illustrates a process of transmitting and receiving data in a digital radio equipped with a transceiver for packet-based communication.
2 is a block diagram of a transmitting apparatus for packet-based communication according to an embodiment of the present invention.
3 is an enlarged block diagram of the first authentication key generation unit in the embodiment of FIG.
4 is a block diagram of an information generator according to an embodiment of the present invention.
5 is an enlarged block diagram of a transmitter in the embodiment of FIG.
FIG. 6 shows a transmission frame including a data packet transmitted by the transmission unit 200 in the embodiment of FIG.
7 is a block diagram of a receiving apparatus for packet-based communication according to an embodiment of the present invention.
8 is an enlarged block diagram of a second authentication key generation unit in the embodiment of FIG.
9 is an enlarged block diagram of the decoding unit in the embodiment of FIG.
10 is a flowchart of a transmission method for packet-based communication according to an embodiment of the present invention.
11 is an enlarged flow chart of the step of generating the first authentication key in the embodiment of FIG.
12 is an enlarged flow chart of the step of transmitting in the embodiment of Fig.
13 is a flowchart of a receiving method for packet-based communication according to an embodiment of the present invention.
FIG. 14 is a conceptual diagram illustrating a transmission and reception process of a packet-based communication according to an embodiment of the present invention.
FIG. 15 shows a concept of a cryptographic software operation performed by a transmitting apparatus for packet-based communication and a receiving apparatus for packet-based communication according to the present invention.
16 is a flowchart of a packet-based transmission / reception method according to an embodiment of the present invention.
17 is a block diagram of a digital radio in which the packet-based transmission / reception apparatus of the present invention is used.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following description with reference to the accompanying drawings, the same or corresponding components are denoted by the same reference numerals, and a duplicate description thereof will be omitted.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope. The singular expressions include plural expressions unless the context clearly dictates otherwise. Each of the steps described below may be implemented by one or a plurality of software modules, or hardware that is responsible for each function, or a combination of software and hardware.

Specific meanings and examples of the terms will be described below in accordance with the order of each drawing.

Hereinafter, the configuration of a transmitting apparatus 10 for packet-based communication, a receiving apparatus 20 for packet-based communication, and an information generator 30 according to an embodiment of the present invention will be described in detail.

1 illustrates a process of transmitting and receiving data in a digital radio equipped with a transceiver for packet-based communication.

The transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication according to the present invention are used for the digital radios 40 and 50 based on the seed generated in the information generator 30, It is possible to transmit and receive data packets including voice data. The information generator 30 of the present invention may generate a seed by a predetermined method, generate a seed table using the generated seed, and encrypt the generated seed table to generate an encrypted seed table.

The seed generated by the information generator 30 of the present invention includes a seed for individual communication, a group seed for group communication, and a seed for broadcast communication. That is, the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication provided in the digital radios of the present invention are used for individual communication, group communication, and broadcasting communication, .

The seed for the group communication and the broadcast communication generated by the information generator 30 of the present invention may be prepared differently from the seed for the individual communication. A transmitting apparatus 10 for packet-based communication and a receiving apparatus 20 for packet-based communication according to the present invention can receive and use a seed, which is separately prepared for individual, group, and broadcast communication, from the information generator 30.

For example, the transmitting apparatus 10 for packet-based communication receives the encrypted seed table generated by the information generator 30, decodes the received seed table in an encrypted state, One seed can be selected from the seed table in consideration of the identifier information. In addition, the receiving apparatus 20 for packet-based communication of the present invention receives the encrypted seed table generated by the information generator 30, decodes the received seed table in an encrypted state, One seed can be selected from the seed table in consideration of the side identifier information. The transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication according to the present invention receive the encrypted seed table and can decode and use the encrypted seed table. However, the seed selected in the decrypted seed table may be used as information Or may be received directly from the generator 30.

2 is a block diagram of a transmitting apparatus 10 for packet based communication in accordance with an embodiment of the present invention.

The transmission apparatus 10 for packet-based communication according to the present invention includes a first authentication key generation unit 100 and a transmission unit 200. For example, the transmitting apparatus 10 for packet-based communication may be used in a digital radio unit for a small office under a sub-unit operating environment to encrypt and transmit a data packet including voice data to be transmitted.

For example, the transmitting apparatus 10 for packet-based communication of the present invention achieves an eavesdropping function for the purpose of protecting information distributed on the battlefield, and at the same time, By using mutual authentication and encryption / decryption means added on a packet-by-packet basis, the survivability of a combatant using a digital radio for a small unit provided with a transmission device 10 for packet-based communication can be improved.

In addition, as will be described later, the transmitting apparatus 10 for packet-based communication and the receiving apparatus 10 for packet-based communication are capable of performing double encryption of data packets to be transmitted / received, such as mutual authentication and block encryption / Thereby improving the security of data to be transmitted and received, and automatically encrypting and decrypting plain text / inscriptions. Will be described with reference to FIG.

The first authentication key generation unit 100 includes a random number generation unit 120 and a first combination unit 140. For example, the first authentication key generator 100 generates a first authentication key that can verify the validity of an encrypted data packet using a predetermined seed generated based on a first noise source that is an entropy source. The first authentication key generated by the first authentication key generation unit 100 is a MAC (Message Authorization Code) value, and is a key for authentication between a transceiver apparatus that transmits and receives an encrypted data packet.

In the present invention, the first authentication key is an authentication key generated at the transmitting side, which is used for authentication in receiving the packet transmitted from the transmitting digital radio, at the receiving digital radio, And is an authentication key for comparison with the first authentication key. More specifically, the first authentication key is a MAC value for authenticating the transmitting apparatus 10 for packet-based communication, and the second authentication key is a MAC value for authenticating the receiving apparatus 20 for packet- . Will be described with reference to FIG.

The seed used by the first authentication key generator 100 to generate the first authentication key may be generated in the information generator 30 including the seed generator 720. [ The seed used by the first authentication key generation unit 100 includes a random number generated based on the first noise source and at least one other noise source different from the noise source used to generate the random number among the first noise source A stationary noise source) in consideration of the transmitting-side identifier information and the receiving-side identifier information in the seed table storing the plurality of seeds. Hereinafter, an information generator 30 for generating a seed used by the first authentication key generating unit 100 will be described.

The information generator 30 includes a first noise source 600 and a seed processing unit 700. The information generator 30 is separately provided outside the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication, and generates a seed based on the first noise source 600, The seed table is arranged in accordance with the transmitting-side identifier information and the receiving-side identifier information, and the generated seed table is encrypted to generate the encrypted seed table.

The transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication according to the present invention receive the encrypted seed table, decrypt the received seed table in an encrypted state, One seed can be selected from the seed table in consideration of the transmitting-side identifier information or the receiving-side identifier information. In addition, the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication according to the present invention may receive a seed for group and broadcasting communication separately from the information generator 30 in addition to the individual communication.

The first noise source 600 includes a first fluctuation noise source 620 and a first fixed noise source 640. For example, the noise sources included in the first noise source 600 may be used as an entropy source for increasing the entropy of a random number. In the present invention, the first fluctuation noise source may be varied every time the seed is generated, but the first fixed noise source may have uniqueness and may be provided so as not to vary in units of packets of a data packet. In addition, the first fluctuation noise source 620 may include a processor usage rate, a memory usage rate, or a mouse movement in which the information generator 30 is used as a noise source in order to increase the entropy (disorder).

The first random number generation unit 710 is provided in the same manner as the second random number generation unit 120 provided in the transmission apparatus 10 for packet based communication and uses the first fluctuation noise source 620 as an entropy source To generate random numbers. For example, the first random number generator 710 included in the information generator 30 may be a deterministic (or non-deterministic) random number generator. The first random number generator 710 of the present invention can generate random numbers used for generating the seed table.

The seed generating unit 720 generates a seed in consideration of the random number, the transmitting side identifier information, and the receiving side identifier information generated by the first random number generating unit 710. For example, the seed generator 720 may generate a seed using a hash algorithm. The seed generator 720 of the present invention can generate the logical sum of the transmitting side identifier information and the receiving side identifier information by XORing the generated random number.

The seed generator 720 of the information generator 30 of the present invention may generate seeds using different methods depending on the communication method of the digital radio. For example, when generating a seed for individual communication, the seed generation unit 720 may generate a seed considering both the transmitting-side identifier information, the receiving-side identifier information, and the random number. In addition, in the case of a seed for group and broadcast communication, the seed generating unit 720 may generate the seed in consideration of the group identifier information without considering the transmitting-side identifier information and the receiving-side identifier information.

In particular, the seed generator 720 of the present invention may arbitrarily select an iteration in addition to the random number, and the seed generator 720 may use a salt. The seed table generation unit 730 receives a first fixed noise source 640 such as a random number, transmission side identifier information, and reception side identifier information generated in the first random number generation unit 710, 710), and generates a seed table using the seeds. The seed table encryption unit 740 encrypts the generated seed table to generate an encrypted seed table.

The first authentication key generator 100 of the present invention can generate the first authentication key using the seed generated by the information generator 30 described above. Preferably, the first authentication key generator 100 receives and decrypts the encrypted seed table in the information generator 30, selects one seed in consideration of the receiver identifier information in the decrypted seed table, The first authentication key can be generated using the selected seed. Also, the first authentication key generator 100 of the present invention may generate the first authentication key by directly receiving the seed, not the encrypted seed table, from the information generator 30. [

For example, the first authentication key generated by the first authentication key generating unit 100 may be generated using a hash function that outputs a hash value having a fixed length, with the random number, the seed, have. The first authentication key generated by the first authentication key generation unit 100 may generate a first authentication key by receiving the random number, the seed, and the transmission side identifier information and driving the hash function. The first authentication key generation unit 100 may be provided in the same manner as that of the second authentication key generating unit 300. Will be described with reference to FIG.

The second random number generator 120 receives the second fluctuation noise source 840 and generates a random number. For example, the second random number generation unit 120 provided in the transmission apparatus 10 for packet-based communication may be provided in the same configuration as the random number generation unit 710 of the information generator 30 to generate a random number. The second random number generation unit 120 of the present invention can generate a random number variable in units of data packets in generating a random number and can generate a second random noise source 840, A random number can be generated by using the user password as a noise source as the random number 820.

The first authentication key generator 100 of the present invention may generate the first authentication key using a random number generated by the second random number generator 120 or a second fixed noise source different from the second variation noise source . That is, the second random number generator 120 may use at least a part of the user's voice and data as the input of the second random number generator 120 as a second fluctuation noise source to increase the entropy (disorder) It is possible to protect user 's password information when a random number is generated.

In the present invention, the second noise source 800 is a noise source distinguished from the first noise source 600 of the information generator 30, and the noise source used by the transmission device 10 for packet- As shown above. The second fluctuation noise source 840 included in the second noise source 800 may be a noise source varying in units of packets of data to be transmitted and a second fixed noise source may be a noise source that is not variable in packet units of data.

The first combining unit 140 combines the random number generated by the second random number generating unit 120 with the seed and transmission side identifier information received from the information generator 30. The first authentication key generation unit 100 may generate the first authentication key using a hash function that receives the combined random number, seed, and transmission side identifier information in the first combination unit 140.

The seed used by the first authentication key generator 100 is selected in consideration of the transmitting-side identifier information and the receiving-side identifier information in the seed table 730 generated by the information generator, or a seed selected by considering the group identifier information . The second fluctuation noise source and the second fixed noise source used by the first authentication key generation unit 100 can be distinguished by whether they are variable for each packet unit of data, same. Will be described with reference to FIG.

The transmitting unit 200 includes a session key generating unit 220, an encrypting unit 240, and a superimposing unit 260. For example, the transmitter 200 generates a session key for encrypting the data packet using the seed received from the information generator 30, encrypts (voice) the data packet using the generated session key, and transmits . Will be described with reference to FIG.

For example, the frame of the transmission data transmitted from the transmission unit 200 to the reception side includes the encrypted voice data packet, the first authentication key 272 (MAC), the random number 274, Rand generated by the random number generation unit 120, And transmitting-side identifier information 276 (ID). Specifically, the frame of transmission data transmitted from the transmitter 200 to the receiver can be divided into an encryption layer header 270 and an encryption layer Payload 280.

The encryption layer header 270 of the transmission data transmitted by the transmission unit 200 includes a first authentication key 272, a MAC, a random number 274, Rand and transmission side identifier information 276, Lt; RTI ID = 0.0 > 280 < / RTI >

The session key generation unit 220 generates a session key in response to the seed received from the information generator 30 and the random number generated by the second random number generator 120 in addition to the sender identifier information and the receiver identifier information, And generates the session key based on the generation function.

For example, the session key generation function used by the session key generation unit 220 may include a seed received from the information generator 30, a random number generated by the second random number generation unit 120, Side identifier information in a predetermined order, and generates a fixed-length output value by receiving a random number of a certain length, transmission-side identifier information, and reception-side identifier information.

The session key generated by the session key generation unit 220 of the present invention is generated on the basis of a seed received from the information generator 30 in consideration of individual, group, and broadcast communication methods. In order to decrypt the encrypted data packet The session key used in the encryption process is required. As will be described later, the receiving apparatus 20 for packet-based communication according to the present invention selects one seed in consideration of the sender identifier information in the seed table generated by the information generator 30, (Generate) the key, and decrypt the encrypted data packet received from the sender using the detected (generated) session key.

The encryption unit 240 encrypts the voice data packet to be transmitted using the generated session key in a packet unit. For example, the encryption unit 240 may encrypt a data packet on a packet (block) basis using the session key generated by the session key generation unit 220. The encryption unit 240 can encrypt a data packet in a packet unit by using a predetermined block encryption algorithm in order to encrypt a data packet in a packet (block) unit.

Since the encrypting unit 240 encrypts the data packet in a packet unit in the counter application mode, encryption is performed using an independent session key for each unit packet, and there is no encrypted packet-by-packet feedback. In addition, since the encryption unit 240 of the present invention encrypts data packets using a block encryption algorithm, padding is not required, and even if there is an error due to block-level encryption characteristics, only the corresponding blocks of the plain text can be affected.

The superimposing unit 160 superimposes the voice data packet encrypted on a packet-by-packet basis, the transmitting-side identifier information, the generated random number, and the first authentication key. For example, although there is no limitation on the order of superimposing the data packet, the transmitting side identifier information, the random number, and the first authentication key encrypted in units of packets in the superimposing unit 160, The encrypted layer payload 280 is constructed by arranging the encryption layer header 270 in the order of the first authentication key, the random number 274 and the transmission side identifier information, arranging the encrypted data packet following the encryption layer header 270, can do.

Table 1 above shows the location and transmission protocol layer of the encryption layer used by the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication according to the present invention.

FIG. 3 is an enlarged block diagram of the first authentication key generation unit 100 in the embodiment of FIG.

The first authentication key generation unit 100 includes a second random number generation unit 120 and a first combination unit 140. For example, the first authentication key generator 100 generates a first authentication key that can verify the validity of an encrypted data packet using a predetermined seed generated based on a first noise source that is an entropy source. The seed used by the first authentication key generation unit 100 can be selected in consideration of the transmitting-side identifier information and the receiving-side identifier information (or the group identifier information) in the seed table generated by the information generator 30, same.

The seed used by the first authentication key generator 100 may be selected from the seed table generated based on the first noise source 600 in the information generator 30 and the first noise source 600 may be selected from the first variation noise source 600. [ (620) and a first fixed noise source (640).

The second random number generator 120 receives the second fluctuation noise source 840 and generates a random number. The second random number generator 120 of the transmitter 10 for packet-based communication may be provided in the same manner as the first random number generator 710 of the information generator 30, Are omitted since they are the same as described above. The first combiner 140 combines the random number generated by the second random number generator 120 and the seed and transmitter identifier information received from the information generator 30.

4 is a block diagram of an information generator 30 according to an embodiment of the present invention.

The information generator 30 includes a first noise source 600 and a seed processing unit 700. The information generator 30 may be separately provided outside the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication to generate an encrypted seed table. The transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication according to the present invention may further include a separate communication unit capable of receiving the encrypted seed table, The seed table can be decoded and one seed can be selected in consideration of the transmitting-side identifier information or the receiving-side identifier information as described above.

In the present invention, the first noise source 600 is distinguished from the second noise source 800 used by the transmission apparatus 10 for packet-based communication. The first noise source 600 includes a first fluctuation noise source 620, And a fixed noise source 640. The first fluctuation noise source 620 may be input to the random number generation unit 710 as a noise source variable every time the seed table is generated, and may be used to increase the entropy (disorder) of the random number. The second fixed noise source 820 is used to generate a unique seed table to be used among a plurality of transmission apparatuses in the seed generator 720 as a noise source which is not variable.

5 is an enlarged block diagram of the transmitter 200 in the embodiment of FIG.

The transmitting unit 200 includes a session key generating unit 220, an encrypting unit 240, and a superimposing unit 260. For example, the transmitting unit 200 generates a session key for encrypting the data packet using a seed received from the information generator 30, encrypts the data packet using the generated session key, As shown above.

The session key generation unit 220 generates a session key in response to the seed received from the information generator 30 and the random number generated by the second random number generator 120 in addition to the sender identifier information and the receiver identifier information, And generates the session key based on the generation function. The session key generation unit 220 of the present invention can generate different session keys on a data packet basis, and the specific method by which the session key generation unit 220 generates a session key is as described above.

The encryption unit 240 encrypts the voice data packet to be transmitted on a packet-by-packet basis using the session key. Since the encrypting unit 240 encrypts voice data on a packet-by-packet basis using a block encryption algorithm, encryption can be performed using an independent session key for each unit packet as described above. The superimposing unit 160 superimposes the voice data packet encrypted on a packet-by-packet basis, the transmitting-side identifier information, the generated random number, and the first authentication key. The method of forming the transmission data frame by superimposing the data packet, the transmitting side identifier information, the generated random number, and the first authentication key in the unit of packet by the overlapping unit 160 is the same as described above, and therefore will not be described.

FIG. 6 shows a transmission frame including a voice data packet transmitted by the transmission unit 200 in the embodiment of FIG.

The superimposing unit 160 constructs the encryption layer header 270 in the order of the first authentication key 272, the MAC number, the random number 274, and the transmission side identifier information 276, 270, and then configure the encryption layer Payload 280 by arranging the encrypted voice data packets.

Table 2 shows the structure of the frame of the transmission data packet transmitted by the transmission unit 200 shown in FIG. The MAC (272) field in which the first authentication key is located is used to authenticate the validity of the message (data packet) as the first authentication key for authentication of the transmitting digital radio, and the Rand 274 field is used to authenticate the second random number The random number generated by the generating unit 120 is located, and the ID 276 is located at the transmitting side identifier information. In addition, the Encryption Data 280 field is where the encrypted voice data packet is located, and the length of the packet may vary depending on the operation mode.

7 is a block diagram of a receiving device 20 for packet based communication in accordance with an embodiment of the present invention.

The receiving apparatus 20 for packet-based communication includes a second authentication key generation unit 300, a comparison unit 400, and a decryption unit 500. For example, the receiving device 20 for packet-based communication may be used in a digital radios under a sub-unit operating environment to decode received encrypted voice data packets.

For example, the receiving apparatus 20 for packet-based communication of the present invention may receive the transmitting-side identifier information, the random number, the first authentication key, and the encrypted voice data packet from the transmitting apparatus 10 for packet- have. The receiving apparatus 20 for packet-based communication selects one seed from a seed table prepared in advance using the transmitting-side identifier information received from the transmitting side, and transmits the selected seed, the transmitting-side identifier information received from the transmitting side, And compares the generated second authentication key with the first authentication key, and decrypts the encrypted data packet only when the second authentication key is matched.

In the present invention, the receiving apparatus 20 for packet-based communication receives the encrypted seed table from the information generator 30, decodes the received encrypted seed table, and considers the transmitting-side identifier information in the decrypted seed table Although one seed can be selected, the receiving apparatus 20 for packet-based communication may receive the seed directly from the information generator 30 according to the individual, group and broadcast communication schemes. Will be described with reference to FIG.

The second authentication key generation unit 300 includes a second combination unit 320. For example, the second authentication key generator 300 receives a predetermined seed generated based on the first noise source 600, which is an entropy source, from the information generator 30, And generates a second authentication key that can confirm the validity of the data packet. The seed used by the second authentication key generation unit 300 is generated by the information generator 30 and is transmitted to the second authentication key generating unit 300 as one of the seed tables generated by the information generator 30, Can be provided as seeds. The second authentication key generation unit 300 can select one seed in the seed table in consideration of the transmitting-side identifier information.

Specifically, the seed used by the second authentication key generation unit 300 includes a random number generated based on the first noise source 600 and at least one random number generated from the noise source used to generate the random number, It may be selected in consideration of the transmitting-side identifier information and the receiving-side identifier information in the seed table storing a plurality of seeds generated considering further other noise sources. The specific method in which the seed table used by the second authentication key generation unit 300 is generated by the information generator 30 is the same as described above, and thus will not be described. Will be described with reference to FIG.

The second combining unit 320 combines the seed received from the information generator 30, the random number received from the transmitting side, and the transmitting side identifier information received from the transmitting side. The second authentication key generation unit 300 may generate the second authentication key using the hash function that receives the combined random number, seed, and transmission side identifier information in the second combination unit 320. [ The hash function used by the second authentication key generation unit 300 of the present invention may be the same as the configuration of the first authentication key generation unit 100. [

The comparing unit 400 compares the generated second authentication key with the first authentication key received from the transmitting side. For example, the comparison unit 400 compares the second authentication key generated by the receiving apparatus 20 for packet-based communication with the first authentication key received from the transmitting apparatus 10 for packet-based communication, The validity of the voice data packet can be confirmed.

The first authentication key and the second authentication key generated in each of the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication are based on a random number variable in packet units and a random number variable in packet units The authentication key and the session key value for encryption / decryption are not exposed. Will be described with reference to FIG.

The decryption unit 500 includes a session key detection unit 520. For example, the decryption unit 500 decrypts the session key for the data packet decryption using the seed selected based on the transmitting side identifier information and the receiving side identifier (or group identifier) in the seed table generated by the information generator 30, (Decrypts) the encrypted data packet received from the transmitting side using the detected (generated) session key.

For example, when the comparison unit 400 compares the second authentication key with the first authentication key received from the transmitter, if the comparison unit 400 determines that they match, it can decrypt the received encrypted data packet have. As described above, the encrypting unit 240 of the transmitting apparatus 10 for packet-based communication encrypts a data packet using a session key generated by inputting a random number variable in units of packets and a seed selected in the seed table , So that the encrypted data packet can be encrypted on a packet-by-packet basis using an independent session key.

Similarly, the decryption unit 500 decrypts the random number received from the transmission apparatus 10 for packet-based communication and the transmission side identification information received from the transmission apparatus 10 for packet-based communication and the transmission side identification information (Generated) in consideration of both the seed and the receiving-side identification information, which are selected in consideration of the received data. Therefore, if the decryption unit 500 does not have the same random number and seed value as the transmitting side with respect to the data packet, the decryption unit 500 can not detect (generate) the same session key for the transmitting side and the corresponding packet, I can not do it normally.

The session key detection unit 520 receives a session key generation function for receiving a seed received from the information generator 30, a random number received from the transmission side, transmission side identifier information received from the transmission side, and reception side identifier information in a predetermined order And detects a session key for encrypting the data packet. In the present invention, the session key detecting unit 520 detects the session key for encrypting the data packet based on the session key generating function is provided by generating a session key for encrypting the data packet based on the session key generating function . The session key detector 520 can detect a session key for each packet unit of the encrypted voice data packet received from the transmitter.

This is because the second random number generator 120 of the transmitting apparatus 10 for packet-based communication generates a random number in units of packets, and the random number received from the transmitting end used by the session key detecting unit 520 is a packet unit The session key can also be detected or generated for each packet unit. The decrypting unit 500 of the present invention decrypts the encrypted voice data packet received from the transmitting side by using the session key detected in units of packets on a packet basis as described above.

FIG. 8 is an enlarged block diagram of the second authentication key generation unit 300 in the embodiment of FIG.

The second authentication key generation unit 300 includes a second combination unit 320. For example, the second authentication key generator 300 may generate a second authentication key using the predetermined seed generated based on the first noise source 600, which is an entropy source, in the information generator 30, It is possible to generate a second authentication key that can be confirmed. The second authentication key generator of the present invention may be configured to verify whether the encrypted data packet is valid by verifying whether or not it is a transceiver for packet-based communication. The second authentication key generation unit 300 of the present invention generates a second authentication key using a hash function in the authentication key generation unit 300 based on the random number value received from the transmission apparatus 10 for packet- 2 authentication keys can be generated.

FIG. 9 is an enlarged block diagram of the decoding unit 500 in the embodiment of FIG.

The decryption unit 500 includes a session key detection unit 520. For example, the decryption unit 500 detects a session key for decrypting the data packet using a seed selected from the seed table generated by the information generator 30, and receives the session key from the transmission side using the detected session key And decrypts the encrypted data packet.

For example, the decryption unit 500 may detect different session keys in units of the received encrypted data packets, and decrypt the encrypted data in units of packets using the detected session key. The session key used by the decryption unit 500 may be provided as a symmetric key detected according to a combination of the transmitting side identifier information, the receiving side identifier information, the seed and the random number information as described above.

10 is a flowchart of a transmission method for packet-based communication according to an embodiment of the present invention.

The transmission method for packet-based communication includes the following steps performed in a time-series manner in the transmission apparatus 10 for packet-based communication.

In step S100, the first authentication key generating unit 100 generates a first authentication key for verifying the validity of the encrypted data packet using the predetermined seed generated based on the first noise source, which is an entropy source in the information generator 30 Key. The specific method by which the first authentication key generating unit 100 generates the first authentication key is as described above.

In step S200, the transmitting unit 200 generates a session key for encrypting the data packet using the seed transmitted from the information generator 30, encrypts and transmits the voice data packet using the generated session key. For example, the transmitter 200 generates a session key, which is generated on a packet-by-packet basis using a random number seed, which is variable in units of voice data packets, and can perform packet-based encryption using the generated session key. Same as.

11 is an enlarged flow chart of the step of generating the first authentication key in the embodiment of FIG.

In step S120, the second random number generation unit 120 receives the second fluctuation noise source 840 and generates a random number variable in units of packets. The second variation noise source 840 used by the second random number generation unit 120 may collect a part of the voice data and may include a password input by the user as the second fixed noise source. The second random number generating unit 120 provided in the transmitting apparatus 10 for packet based communication may be provided in the same configuration as the random number generating unit 710 of the information generator 30, It is omitted as it is the same.

In S140, the first combining unit 140 combines the random number generated in the second random number generating unit 120, the seed received from the information generator 30, and the transmitting-side identifier information. The first authentication key generation unit 100 of the present invention generates the first authentication key using the first random number generated by the first combination unit 140, the seed received from the information generator 30, The authentication key can be generated, and the specific method of generating the first authentication key is as described above, so that it is omitted.

12 is an enlarged flow chart of the step of transmitting in the embodiment of FIG.

In step S220, the session key generation unit 220 inputs the sender identifier information and the receiver identifier information in addition to the seed received from the information generator 30 and the random number generated by the second random number generator 120 in a predetermined order And generates the session key based on the received session key generation function. The session key generation unit 220 can generate the session key on a packet-by-packet basis based on the session key generation function as described above.

In S240, the encryption unit 240 encrypts the voice data packet to be transmitted using the generated session key in units of a packet. For example, the encryption unit 240 can encrypt a voice data packet on a packet (block) basis using the session key generated by the session key generation unit 220 as described above.

In S260, the superimposing unit 260 superimposes the voice data packet encrypted on a packet-by-packet basis, the transmitting-side identifier information, the random number generated by the second random number generating unit 120, and the first authentication key. For example, although there is no limitation on the order of superimposing the voice data packet, the transmitting side identifier information, the random number, and the first authentication key encrypted in units of packets in the superimposing unit 160, the superimposing unit 160 preferably The encryption layer header 270 is constructed by superimposing the first authentication key, the random number 274 and the transmission-side identifier information in this order, arranging the encrypted data packet following the encryption layer header 270, The configuration is as described above.

13 is a flowchart of a receiving method for packet-based communication according to an embodiment of the present invention.

In step S300, the second authentication key generation unit 300 generates a seed for the seed generated based on the first noise source, which is an entropy source in the information generator 30, in consideration of the sender identifier and the receiver identifier, , The second authentication key can be generated using the hash function that receives the random number and the transmission side identifier information received from the transmission side in a predetermined order.

In S400, the comparison unit 400 compares the generated second authentication key with the first authentication key received from the transmission side. At S500, the decryption unit 500 detects a session key for decrypting the data packet using one seed selected from the seed table generated from the information generator 30, and transmits the decrypted session key to the transmitting side And decrypts the encrypted data packet received from the client.

The decryption unit 500 decrypts the received encrypted data packet on a packet-by-packet basis in order to decrypt the received information in the form of information such as the receiving-side identifier information, the transmitting-side identifier information received from the transmitting apparatus 10 for packet-based communication, The process of detecting a session key on a packet-by-packet basis using the seed and decoding the packet using the detected session key is the same as described above, and thus will not be described.

FIG. 14 is a conceptual diagram illustrating a transmission and reception process of a packet-based communication according to an embodiment of the present invention.

In S100, the first authentication key generation unit 100 generates a first authentication key. The first authentication key generated by the first authentication key generation unit 100 of the present invention includes a random number generated by the second random number generation unit 120 as a MAC (Message Authorization Code) value, , The transmission side identifier information and the reception side identification information, and can be used to authenticate the validity of the data packet transmitted / received between the transmission / reception devices prior to the decoding process of the data packet.

In step S110, the first authentication key generating unit 100 generates a first authentication key by performing packet-based communication (communication) for communication between the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet- The communication mode of the transmitting apparatus 10 for the communication network 10 can be selected. In S150, the first authentication key generation unit 100 may generate the first authentication key according to the selected communication mode.

In step S240, the transmitter 200 encrypts the voice data in units of packets (blocks) using the session key generated in units of data packets in the session key generator 220. [

In S260, the transmitting unit 200 superimposes the voice data packet encrypted on a packet-by-packet basis, the transmitting-side identifier information, the random number generated in the random number generating unit 120, and the first authentication key and transmits them to the receiving side. The frame of the data packet transmitted by the transmission unit 200 is as described above, and thus will not be described.

In step S300, the second authentication key generation unit 300 generates a second authentication key that can verify the validity of the encrypted data packet using a predetermined seed generated based on the first noise source as the entropy source. The specific method of using the seed table generated by the second authentication key generator 300 in the information generator 30 is the same as described above, and thus will not be described.

In step S310, the second authentication key generation unit 300 generates a communication mode for communication between the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication before generating the second authentication key You can choose. In step S320, the comparison unit 400 compares the second authentication key generated by the second authentication key generation unit 300 with the first authentication key received from the transmission side and confirms whether or not they match.

In S500, when the comparison unit 400 compares the second authentication key with the first authentication key received from the transmitting side, if it is determined that they match, the decrypting unit 500 can decrypt the received encrypted voice data packet have.

In step S520, the session key detector 520 generates a session key generating function based on a seed received from the information generator 30, a random number received from the transmitting side, a transmitting side identifier information, and a receiving side identifier information, Lt; / RTI > The session key detecting unit 520 can detect different session keys for each received encrypted data packet unit as described above.

In S540, the decryption unit 500 may decrypt the encrypted voice data packet using the session key detected on a packet-by-packet basis.

FIG. 15 shows a concept of a cryptographic software operation performed by the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication according to the present invention.

In step S610, the second random number generator 120 provided in the transmitter 10 for packet-based communication of the transmitter digital radio generates a random number based on the second fluctuation noise source 840 of the second noise source 800 . The second noise source 800 of the present invention is distinguished from the first noise source 600 used by the information generator 30. The second random number generator 120 receives a part of the user's voice data, The information is included in the random number generation as described above.

In step S620, the first authentication key generator 100 provided in the transmitter 10 for packet-based communication of the transmitter digital radio receives the random number generated by the second random number generator 120 and the second fixed noise source 820, And the seed generated by the information generator 30 are used to generate the first authentication key.

In S630, the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication receive the encrypted seed table generated in the information generator 30. [ In S640, the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication decrypt the encrypted seed table generated in the information generator 30. [ The transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication can generate the first authentication key or generate the session key using the decrypted seed table.

In S650, the receiving apparatus 20 for packet-based communication provided in the receiving digital radio generates a second authentication key using the random number and the transmitting-side identifier information received from the transmitting apparatus 10 for packet-based communication. In S660, the receiving apparatus 20 for packet-based communication compares the first authentication key located in the authentication header with the second authentication key generated in the second authentication key generating unit 300, .

In S670, the session key generating unit 220 provided in the transmitting apparatus 10 for packet-based communication of the transmitting digital radio transmits the seed generated by the information generator 30, the transmitting side identifier and the random number value received from the transmitting side, And can generate a session key using its (receiver side) identifier information. In operation S680, the encrypting unit 240 of the transmitting apparatus 10 for packet-based communication encrypts the voice data using the session key, and the decrypting unit 500 of the receiving apparatus 20 for packet- To decrypt the encrypted voice data.

16 is a flowchart of a packet-based transmission / reception method according to an embodiment of the present invention.

In step S820, the first authentication key generation unit 100 receives the seed table generated by the information generator 30, and selects one seed in consideration of the receiver-side identifier information. In step S840, the first authentication key generation unit 100 collects at least a part of the voice data, generates a random number using the collected voice as an entropy source, and generates a first authentication key (MAC) using the generated random number Can be generated.

In step S860, the transmitter 200 encrypts the voice data packet to be transmitted using the session key generated on a packet-by-packet basis. In step S880, the transmitting unit 200 superimposes the voice data packet encrypted on a packet-by-packet basis, the transmitting-side identifier information, the random number generated by the second random number generating unit 120, and the first authentication key and transmits them to the receiving side.

At S920, the receiving device 20 for packet-based communication receives the encrypted voice data packet from the transmitting device 10 for packet-based communication. In step S940, the second authentication key generator 300 may select one seed from the seed table generated by the information generator 30 in consideration of the transmitter identifier information received from the transmitter 10 for packet-based communication have.

In step S960, the comparison unit 400 compares the second authentication key generated in consideration of the transmission-side identifier information and the received random number received from the transmission apparatus 10 for packet-based communication with the first authentication key received from the transmission side Compare. In step S980, when the second authentication key and the first authentication key match, the decryption unit 500 decrypts the encrypted encrypted voice data packet received using the session key detected on a packet-by-packet basis.

17 is a block diagram of a small-unit digital radio 40 in which the packet-based transmission / reception apparatus of the present invention is used.

The small base station digital radio set 40 in which the packet based transmission and reception apparatuses 10 and 20 of the present invention are used includes a microphone 1100, a transmission unit 1200, a control unit 1300, a storage unit 1400, a reception unit 1500, 1600). For example, the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication according to the present invention are used for the transmitting unit 1200 and the receiving unit 1500 provided in the small- And the voice data can be transmitted and received by using the double encryption means.

The microphone 1100 receives the voice of the user using the small-unit digital radio 40. For example, the microphone 1100 of the present invention may include a PTT (Push To Talk) circuit when receiving voice data of a user, and may control transmission and reception through a PTT circuit. When a voice is input, the voice can be largely controlled to be a voice having a predetermined size, or vice versa.

The transmitting unit 1200 includes a packet-based transmitting apparatus 10 and generates a first authentication key for verifying the validity of the encrypted data packet using a predetermined seed generated by the information generator 30, It is possible to encrypt voice data on a packet-by-packet basis using the seed and the session key generated using the seed, and transmit the voice data to the receiving side.

The control unit 1300 includes a transmission / reception frequency setting unit, a transmission / reception channel setting unit, a volume control unit, and a routing unit. The control unit 1300 can set transmission and reception channels by setting transmission and reception frequency bands of the transmission unit 1200 and the reception unit 1500. In addition, the control unit 1300 can allocate transmission and reception frequencies differently in units of voice data packets.

The routing unit performs routing using preset routing information (path information) between the transmitting apparatus 10 for packet-based communication and the receiving apparatus 20 for packet-based communication. For example, the routing unit is provided in the control unit of the small-unit digital radio 40 of the present invention, so that the small-unit digital radio 40 share router information with each other.

The routing unit uses a predetermined routing protocol to share the router information between the small-unit digital radios 40, and transmits the encrypted data packet to the target small digital radios 40 using shared router information according to the routing protocol It can transmit and receive. In addition, the control unit 1300 can synchronize with the encryption SW provided in the external computer apparatus, and can preset the pre-options necessary for the small-unit digital radio 40 to transmit and receive the encrypted data packet.

The storage unit 1400 may temporarily store encrypted voice data packets and decoded voice data packets transmitted or received by the transmitting unit 1200 and the receiving unit 1500. The receiving unit 1500 may include a packet-based receiving device 20 to generate a second authentication key, compare the generated second authentication key with an authentication key of the other communication device, It is possible to decrypt the encrypted data packet using the session key detected on a packet-by-packet basis. When the data packet to be transmitted / received is voice data, the speaker 1600 can output the voice data decoded by the receiving unit 1500 and adjust the volume.

The display window / keypad 1700 is used to receive a user's message (or data) input or to notify the user of receiving a message (or data) or to control the digital radio.

All or part of the method of an embodiment of the present invention described above can be implemented in the form of a computer-executable recording medium (or a computer program product) such as a program module executed by a computer. Here, the computer-readable medium may include computer storage media (e.g., memory, hard disk, magnetic / optical media or solid-state drives). Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media.

Also, all or part of the method according to an embodiment of the present invention may include instructions executable by a computer, the computer program comprising programmable machine instructions to be processed by a processor, Language, an object-oriented programming language, an assembly language, or a machine language.

Means or module in the present specification may mean hardware capable of performing the functions and operations according to the respective names described herein and may be implemented by computer program code , Or may refer to an electronic recording medium, e.g., a processor or a microprocessor, having computer program code embodied thereon to perform particular functions and operations. In other words, a means or module may mean a functional and / or structural combination of hardware for carrying out the technical idea of the present invention and / or software for driving the hardware.

Thus, a method according to an embodiment of the present invention may be implemented by a computer program as described above being executed by a computing device. The computing device may include a processor, a memory, a storage device, a high-speed interface connected to the memory and a high-speed expansion port, and a low-speed interface connected to the low-speed bus and the storage device. Each of these components is connected to each other using a variety of buses and can be mounted on a common motherboard or mounted in any other suitable manner.

It will be apparent to those skilled in the art that various modifications, substitutions and substitutions are possible, without departing from the scope and spirit of the invention as disclosed in the accompanying claims. will be. Therefore, the embodiments disclosed in the present invention and the accompanying drawings are intended to illustrate and not to limit the technical spirit of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments and the accompanying drawings . The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

Claims (19)

A transmission and reception method for packet-based communication performed by a digital radio communicating with an information generator,
Receiving an encrypted seed table constructed by the information generator from the information generator;
Decrypting the encrypted seed table and obtaining a seed from the decrypted seed table;
Generating a first authentication key capable of verifying the validity of an encrypted data packet using the predetermined seed generated based on a first noise source as an entropy source;
Generating a session key for encrypting the data packet using the seed, encrypting the data packet using the generated session key, and transmitting the encrypted data packet;
Generating a second authentication key capable of verifying the validity of the encrypted data packet using the predetermined seed generated based on the first noise source as the entropy source;
Comparing the generated second authentication key with the first authentication key received from the transmitting side; And
Detecting a session key for decrypting the data packet using the seed and decrypting the encrypted data packet received from the sender using the detected session key; / RTI >
The encrypted seed table includes (i) a seed for individual communication and (ii) a seed for group communication and broadcast communication, and the seed for the individual communication is generated in consideration of the transmitting-side identifier information and the receiving-side identifier information , The seed for the group communication and the broadcasting communication is generated in consideration of the group identifier information,
Wherein the seed is generated by considering a first random number generated based on the first noise source and at least one other noise source distinguished from a noise source used to generate the first random number of the first noise source, Selecting the decoded seed table to be stored in consideration of the receiver-side identifier information,
Wherein the step of generating the first authentication key further comprises generating a second random number by receiving a second fluctuation noise source variable in units of the data packet and generating the second random number or the second fluctuation noise source, Generates the first authentication key using a different second fixed noise source,
Wherein the generating of the first authentication key further comprises combining the generated second random number, the seed, and the sender identifier information, and the step of combining the generated second random number, the seed, Generates the first authentication key using a hash function serving as an input,
Wherein the step of transmitting includes generating the session key based on a session key generation function for receiving the seed and the generated second random number in addition to the transmission side identification information and the reception side identification information in a predetermined order Encrypts and transmits the data packet using the generated session key,
Wherein the step of transmitting comprises the steps of encrypting the data packet to be transmitted using the generated session key in a unit of a packet, and transmitting the encrypted data packet, the transmitting-side identifier information, the generated second random number And superimposing the first authentication key, the method comprising: transmitting the encrypted data packet, the transmitting side identifier information, the second random number, and the first authentication key to the receiving side,
Wherein the step of generating the second authentication key further comprises a step of combining the seed, the second random number generated from the transmission side, and the transmission side identifier information, wherein the seed, the second random number generated from the transmission side, Generates the second authentication key using a hash function that receives the sender identifier information as an input,
Wherein the step of decrypting comprises the step of encrypting the data packet based on the seed, a second random number generated from the transmitting side, the transmitting side identifier information, and the receiving side identifier information, The method of claim 1, further comprising detecting a session key, and decrypting the data packet in units of packets using the detected session key. delete delete delete The method according to claim 1,
Wherein the second fluctuation noise source and the second fixed noise source are classified into whether the data packet is variable for each unit of the data packet,
Wherein the seed is generated by performing an exclusive OR operation on a logical sum of the generated random number, the transmitting-side identifier information, and the receiving-side identifier information. delete delete The method of claim 1, wherein generating the random number comprises:
Wherein the random number generator generates the random number by using at least a part of the data packet in addition to the second fluctuation noise source as the entropy source. delete delete delete delete 1. A transceiver for packet-based communication in communication with an information generator,
A communication unit for receiving the encrypted seed table constructed by the information generator from the information generator;
The encrypted seed table is decrypted, a predetermined seed is obtained from the decrypted seed table, and the validity of the encrypted data packet can be verified using the predetermined seed generated based on the first noise source as the entropy source A first authentication key generator for generating a first authentication key;
Generating a session key for encrypting the data packet using the seed, encrypting the data packet using the generated session key, and transmitting the encrypted data packet;
A second authentication key generator for generating a second authentication key that can verify the validity of the encrypted data packet using the predetermined seed generated based on the first noise source as the entropy source;
An authentication key comparing unit comparing the generated second authentication key with the first authentication key received from the transmitting side; And
And a decryption unit for detecting a session key for decrypting the data packet using the seed and for decrypting the encrypted data packet received from the transmitting side using the detected session key,
The encrypted seed table includes (i) a seed for individual communication and (ii) a seed for group communication and broadcast communication, and the seed for the individual communication is generated in consideration of the transmitting-side identifier information and the receiving-side identifier information , The seed for the group communication and the broadcasting communication is generated in consideration of the group identifier information,
Wherein the seed includes a plurality of seeds generated by considering a random number generated based on the first noise source and at least one other noise source distinguished from a noise source used to generate the random number among the first noise sources, Selected in consideration of the receiver-side identifier information in the seed table,
Wherein the first authentication key generator comprises: a second random number generator for receiving a second fluctuation noise source and generating a random number; And a combining unit configured to combine the generated random number, the seed, and the transmission side identifier information, wherein the hash function that receives the generated random number, the seed, and the transmission side identifier information, Generates the first authentication key using a second fixed noise source different from the first authentication key,
Wherein the transmitting unit comprises: a session key generating unit for generating the session key based on a session key generating function for receiving the seed and the generated random number, and receiving the transmitting-side identifier information and the receiving-side identifier information in a predetermined order; An encryption unit for encrypting the data packet to be transmitted in units of packets using the generated session key; And a superimposing unit for superposing the data packet, the transmission-side identifier information, the generated random number, and the first authentication key, the encrypted data packet, the transmission-side identifier information, Transmits the random number and the first authentication key to the receiving side,
Wherein the second authentication key generation unit further includes a second combining unit that combines the seed, the random number generated from the transmitting side, and the transmitting-side identifier information, and transmits the seed, the random number generated from the transmitting side, Generates the second authentication key using a hash function serving as an input,
The decoding unit detects a session key for encrypting the data packet based on the seed, a random number generated from the transmitting side, the transmitting side identifier information, and the receiving side identifier information in a preset order Further comprising a session key detection unit operable to decrypt the encrypted data packet received using the detected session key in units of packets. delete delete delete delete delete A program stored in a computer-readable recording medium for realizing a transmission / reception method for packet-based communication according to any one of claims 1, 5, and 8 through execution by a processor.

Images