KR102491708B1 - Method and apparatus for exchanging encryption information - Google Patents

Abstract

To transmit the encryption information, encrypt target data in a target method, optically modulate the encrypted target data into one or more first channels, generate encryption information for the target method, and transmit the encryption information to the first channels. An optical signal is generated by optical modulation with a different second channel, multiplexing the first channels and the second channel, and the optical signal is transmitted to a data receiving device through one optical fiber.

Description

Encryption information exchange method and apparatus {METHOD AND APPARATUS FOR EXCHANGING ENCRYPTION INFORMATION}

The embodiments below relate to data communication technology, and specifically to technology for exchanging encrypted information applied to data communication.

In a conventional data transmission system, exchange of information and symmetric keys for encrypted communication uses a general communication channel (GCC) and a reserved channel of an optical channel transport unit (OTU) packet header. The use of such GCC and reserved channels is not standardized, and the use method is different for each vendor of transmission equipment.

Korean Patent Publication No. 10-2048013 (published on November 22, 2019) discloses a process of exchanging encrypted information for secure communication between devices. Specifically, the disclosed invention discloses that the Diffie-Hellman protocol can be used as a method for exchanging encrypted information.

One embodiment may provide a method of transmitting encryption information along with data.

One embodiment may provide a method of receiving encryption information along with data.

However, the technical challenges are not limited to the above-described technical challenges, and other technical challenges may exist.

According to one aspect, a method of transmitting encrypted information, performed by a data transmission apparatus, includes encrypting target data in a target method, optically modulating the encrypted target data into one or more first channels, and performing the target method. Generating encryption information for , optically modulating the encryption information into a second channel different from the first channels, generating an optical signal by multiplexing the first channels and a second channel, and and transmitting the signal to a data receiving device through one optical fiber.

The encryption information may be information based on a symmetric key encryption method.

The encryption information may include information on at least one of exchanging at least a part of the symmetric key stored in the data receiving apparatus, discarding the symmetric key, and generating a new symmetric key.

The encryption information transmission method may further include changing a previous encryption method to the target method according to a preset period.

According to another aspect, a method for receiving encrypted information, performed by a data receiving device, includes receiving an optical signal from the data receiving device through one optical fiber, and demultiplexing the optical signal to store one or more pieces of target data. Separating first channels and a second channel for encryption information; generating the target data based on the first channels; generating the encryption information based on the second channel; The method includes changing an encryption method of the data receiving device to a target method based on the information, and decrypting target data based on the target method.

The encryption information may be information based on a symmetric key encryption method.

The encryption information may include information on at least one of exchanging at least a part of the symmetric key stored in the data receiving apparatus, discarding the symmetric key, and generating a new symmetric key.

According to another aspect, a data transmission apparatus for transmitting encryption information includes a memory in which a program for transmitting encryption information is recorded, and a processor that executes the program, wherein the program includes target data encrypted in a target method. receiving, optically modulating the target data into one or more first channels, generating encryption information for the target method, optically modulating the encryption information into a second channel different from the first channels The steps of generating an optical signal by multiplexing the first channels and the second channel and transmitting the optical signal to a data receiving device through one optical fiber are performed.

According to another aspect, a data receiving apparatus for receiving encryption information includes a memory in which a program for receiving encryption information is recorded, and a processor that executes the program, wherein the program includes data through one optical fiber. Receiving an optical signal from a receiving device, separating one or more first channels for target data and a second channel for encrypted information by de-multiplexing the optical signal, Generating target data, generating the encryption information based on the second channel, changing the encryption method of the data receiving apparatus to a target method based on the encryption information, and based on the target method Decrypting the target data.

A method of transmitting encryption information along with data may be provided.

A method of receiving encryption information along with data may be provided.

1 shows a data exchange system according to an example.
2 is a configuration diagram of a data transmission device according to an embodiment.
3 is a flowchart of a method of transmitting encrypted information according to an embodiment.
4 illustrates one or more first channels and a second channel according to an example.
5 is a block diagram of a data receiving device according to an embodiment.
6 is a flowchart of a method of receiving encryption information according to an embodiment.

Specific structural or functional descriptions of the embodiments are disclosed for illustrative purposes only, and may be changed and implemented in various forms. Therefore, the form actually implemented is not limited only to the specific embodiments disclosed, and the scope of the present specification includes changes, equivalents, or substitutes included in the technical idea described in the embodiments.

Although terms such as first or second may be used to describe various components, such terms should only be construed for the purpose of distinguishing one component from another. For example, a first element may be termed a second element, and similarly, a second element may be termed a first element.

It should be understood that when an element is referred to as being “connected” to another element, it may be directly connected or connected to the other element, but other elements may exist in the middle.

Singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, terms such as "comprise" or "have" are intended to designate that the described feature, number, step, operation, component, part, or combination thereof exists, but one or more other features or numbers, It should be understood that the presence or addition of steps, operations, components, parts, or combinations thereof is not precluded.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related art, and unless explicitly defined in this specification, it should not be interpreted in an ideal or excessively formal meaning. don't

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. In the description with reference to the accompanying drawings, the same reference numerals are given to the same components regardless of reference numerals, and overlapping descriptions thereof will be omitted.

1 shows a data exchange system according to an example.

According to one aspect, the data exchange system 100 may include a data transmission device 110 and a data reception device 120 . Specifically, the data transmission device 110 and the data reception device 120 may be connected through an optical cable 115 and may exchange data through the optical cable 115 . For example, the data exchange system 100 may exchange data through a wavelength division multiplexing (WDM) scheme.

The data transmission device 110 may encrypt data to be transmitted (hereinafter referred to as target data) and transmit the encrypted target data to the data reception device 120 . Since the data receiving device 120 knows the encryption method in advance, it can decrypt the encrypted target data through a decryption method corresponding to the correct encryption method. An encryption method in which the encryption key and the decryption key are the same is called a symmetric key method. The symmetric key method can be mainly used for data encryption because of its high speed of encryption/decryption and high security. For example, symmetric key methods include AES 256 and ARIA 256, and are not limited to the described embodiments.

To maintain security, the symmetric key shared between the data transmission device 110 and the data reception device 120 may be replaced at regular intervals. Encryption information for exchanging, storing, discarding, or replacing an encryption key may be exchanged between the data transmission device 110 and the data reception device 120 . The exchange of encrypted information must be performed so as not to disrupt the flow of data communication.

Below, a method for exchanging encryption information will be described in detail with reference to FIGS. 2 to 6 .

2 is a configuration diagram of a data transmission device according to an embodiment.

The data transmission device 200 includes a communication unit 210, a processor 220 and a memory 230. For example, the data transmission device 200 may be the data transmission device 110 described above with reference to FIG. 1 .

The communication unit 210 is connected to the processor 220 and the memory 230 to transmit and receive data. The communication unit 210 may transmit/receive data by being connected to another external device. Hereinafter, the expression “transmitting and receiving “A” may indicate transmitting and receiving “information or data indicating A”.

The communication unit 210 may be implemented as a circuitry within the data transmission device 200 . For example, the communication unit 210 may include an internal bus and an external bus. As another example, the communication unit 210 may be an element that connects the data transmission device 200 and an external device. The communication unit 210 may be an interface. The communication unit 210 may receive data from an external device and transmit the data to the processor 220 and the memory 230 .

The processor 220 processes data received by the communication unit 210 and data stored in the memory 230 . A “processor” may be a data processing device implemented in hardware having circuitry having a physical structure for executing desired operations. For example, desired operations may include codes or instructions included in a program. For example, a data processing unit implemented in hardware includes a microprocessor, a central processing unit, a processor core, a multi-core processor, and a multiprocessor. , Application-Specific Integrated Circuit (ASIC), and Field Programmable Gate Array (FPGA).

Processor 220 executes computer readable code (eg, software) stored in memory (eg, memory 230 ) and instructions invoked by processor 220 .

The memory 230 stores data received by the communication unit 210 and data processed by the processor 220 . For example, the memory 230 may store a program (or application or software). The stored program may be a set of syntaxes that are coded to transmit encryption information and are executable by the processor 220 .

According to one aspect, the memory 230 may include one or more of volatile memory, non-volatile memory and random access memory (RAM), flash memory, a hard disk drive, and an optical disk drive.

The memory 230 stores a command set (eg, software) for operating the data transmission device 200 . A set of instructions for operating the data transmission device 200 is executed by the processor 220.

The communication unit 210, the processor 220, and the memory 230 will be described in detail with reference to FIGS. 3 and 4 below.

3 is a flowchart of a method of transmitting encrypted information according to an embodiment.

Steps 310 to 370 below are performed by the data transmission device 200 described above with reference to FIG. 2 .

In step 310, the data transmission device 200 changes the previous encryption method to a target method based on a preset time. The target method refers to an encryption method that has been changed through exchange, discard, or replacement of an encryption key. For example, an encryption method may be changed according to a preset period.

For the change of the encryption method, public key-based key exchange algorithms such as RSA, Diffie-Hellman, and ECDH may be used, and are not limited to the disclosed embodiments.

In step 320, the data transmission device 200 encrypts the target data in a targeted manner. Target data may be plural according to the type of data to be transmitted. Each of the plurality of target data may be encrypted.

In step 330, the data transmission device 200 optically modulates the encrypted target data into one or more first channels. A specific channel may mean a specific wavelength of a frequency carrier. For example, one encrypted target data may be optically modulated into a plurality of first channels. As another example, each of the plurality of target data may be optically modulated into a plurality of first channels by being optically modulated into one channel. The one or more first channels are described in detail below with reference to FIG. 4 .

Steps 340 and 350 may be performed independently of steps 320 and 330 and in parallel.

In step 340, the data transmission device 200 generates encryption information for the target method. The encryption information may be information about an encryption key that is exchanged, stored, discarded, or replaced.

In step 350, the data transmission device 200 optically modulates the encrypted information into the second channel. The second channel may be a channel different from one or more of the first channels. That is, a separate channel may be allocated for encryption information.

In step 360, the data transmission device 200 generates an optical signal by multiplexing the first channels and the second channels. The optical signal may be a signal obtained by merging a plurality of wavelengths.

In step 370, the data transmission device 200 transmits the optical signal to the data reception device through an optical cable. For example, an optical signal may be transmitted through one optical fiber among a plurality of optical fibers of an optical cable. Encryption information may be exchanged between the data transmission device 200 and the data reception device along with transmission of target data through an optical signal multiplexed into a plurality of channels.

4 illustrates one or more first channels and a second channel according to an example.

According to one aspect, the encrypted target data may be optically modulated into one or more first channels 410 . For example, the first channels 410 may be a plurality of channels transmitting one target data. As another example, each of the first channels 410 may be channels for transmitting different types of target data.

In order to transmit encryption information, a second channel 420 different from the first channels 410 that transmit target data may be allocated. Encryption information may be optically modulated into the second channel.

One optical signal may be generated by simultaneously multiplexing the first channels 410 and the second channels 420, and the optical signal may be transmitted to a data receiving device through an optical cable (specifically, an optical fiber). .

5 is a block diagram of a data receiving device according to an embodiment.

The data receiving device 500 includes a communication unit 510 , a processor 520 and a memory 530 . For example, the data transmission device 500 may be the data reception device 120 described above with reference to FIG. 1 .

The communication unit 510 is connected to the processor 520 and the memory 530 to transmit and receive data. The communication unit 510 may transmit/receive data by being connected to another external device.

The communication unit 510 may be implemented as a circuitry within the data receiving device 500 . For example, the communication unit 510 may include an internal bus and an external bus. As another example, the communication unit 510 may be an element that connects the data receiving device 500 and an external device. The communication unit 510 may be an interface. The communication unit 510 may receive data from an external device and transmit the data to the processor 520 and the memory 530 .

The processor 520 processes data received by the communication unit 510 and data stored in the memory 530 . Processor 520 executes computer readable code (eg, software) stored in memory (eg, memory 530 ) and instructions invoked by processor 520 .

The memory 530 stores data received by the communication unit 510 and data processed by the processor 520 . For example, the memory 530 may store a program (or application or software). The stored program may be a set of syntaxes coded to receive encryption information and executed by the processor 520 .

According to one aspect, memory 530 may include one or more of volatile memory, non-volatile memory and RAM, flash memory, hard disk drive and optical disk drive.

The memory 530 stores a command set (eg, software) for operating the data receiving device 500 . A command set for operating the data receiving device 500 is executed by the processor 520 .

The communication unit 510, the processor 520, and the memory 530 will be described in detail with reference to FIG. 6 below.

6 is a flowchart of a method of receiving encryption information according to an embodiment.

Steps 610 to 650 below are performed by the data receiving apparatus 500 described above with reference to FIG. 5 .

In step 610, the data receiving device 500 receives an optical signal from the data receiving device 200 through an optical cable (specifically, an optical fiber). The received optical signal may be the optical signal of step 370 described above with reference to FIG. 3 .

In step 620, the data receiving apparatus 500 separates one or more first channels for target data and a second channel for encryption information by demultiplexing the optical signal.

In step 630, the data receiving device 500 generates target data based on the first channels. The process of step 630 may be the reverse of the process of step 330 described above with reference to FIG. 3 . The generated target data may be encrypted data.

In step 640, the data receiving device 500 generates encryption information based on the second channel. The process of step 640 may be the reverse of the process of step 350 described above with reference to FIG. 3 .

In step 650, the data receiving device 500 changes the encryption method of the data receiving device to a target method based on the encryption information.

In step 660, the data receiving apparatus 500 decodes the target data based on the target method. The process of step 660 may be the reverse of the process of step 320 described above with reference to FIG. 3 .

The embodiments described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, the devices, methods and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate (FPGA). array), programmable logic units (PLUs), microprocessors, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which one processing device is used, but those skilled in the art will understand that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it can include. For example, a processing device may include a plurality of processors or a processor and a controller. Other processing configurations are also possible, such as parallel processors.

Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. The device can be commanded. Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. , or may be permanently or temporarily embodied in a transmitted signal wave. Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on computer readable media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination, and the program instructions recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in the art of computer software. may be Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler.

The hardware device described above may be configured to operate as one or a plurality of software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with limited drawings, those skilled in the art can apply various technical modifications and variations based on this. For example, the described techniques may be performed in an order different from the method described, and/or components of the described system, structure, device, circuit, etc. may be combined or combined in a different form than the method described, or other components may be used. Or even if it is replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

100: data exchange system
110: data transmission device
120: data receiving device

Claims (10)

A method of transmitting encrypted information, performed by a data transmission device, comprising:
changing a previous encryption method into a target method according to a preset period;
Encrypting target data in the target method;
optically modulating the encrypted target data into one or more first channels;
Generating encryption information for the target method - the encryption information includes information on at least one of exchanging at least a part of a symmetric key stored in a data receiving device, discarding the symmetric key, and generating a new symmetric key -;
optically modulating the encryption information into a second channel different from the first channels;
generating an optical signal by multiplexing the first and second channels; and
Transmitting the optical signal to the data receiving device through one optical fiber
including,
Cryptographic information transmission method.
delete delete delete A method for receiving encrypted information, performed by a data receiving apparatus, comprising:
receiving an optical signal from a data receiving device through one optical fiber;
separating one or more first channels for target data and a second channel for encrypted information by demultiplexing the optical signal;
generating the target data based on the first channels;
Generating the encryption information based on the second channel - the encryption information for at least one of exchanging at least a part of a symmetric key stored in the data receiving apparatus, discarding the symmetric key, and generating a new symmetric key. contains information -;
changing an encryption method of the data receiving apparatus into a target method based on the encryption information; and
Decrypting target data based on the target method
including,
How to receive cryptographic information.
delete delete A computer program stored in a computer readable recording medium to be combined with hardware to execute the method of any one of claims 1 or 5.
A data transmission device for transmitting encrypted information,
a memory in which a program for transmitting encryption information is recorded; and
Processor that executes the above program
including,
said program,
changing a previous encryption method into a target method according to a preset period;
receiving target data encrypted by the target method;
optically modulating the target data into one or more first channels;
Generating encryption information for the target method - the encryption information includes information on at least one of exchanging at least a part of a symmetric key stored in a data receiving device, discarding the symmetric key, and generating a new symmetric key -;
optically modulating the encryption information into a second channel different from the first channels;
generating an optical signal by multiplexing the first and second channels; and
Transmitting the optical signal to the data receiving device through one optical fiber
to do,
data transmission device
The data receiving device for receiving encryption information,
a memory in which a program for receiving encryption information is recorded; and
Processor that executes the above program
including,
said program,
receiving an optical signal from a data receiving device through one optical fiber;
separating one or more first channels for target data and a second channel for encrypted information by de-multiplexing the optical signal;
generating the target data based on the first channels;
Generating the encryption information based on the second channel - the encryption information for at least one of exchanging at least a part of a symmetric key stored in the data receiving apparatus, discarding the symmetric key, and generating a new symmetric key. contains information -;
changing an encryption method of the data receiving apparatus into a target method based on the encryption information; and
Decrypting target data based on the target method
including,
data receiving device.

Images