KR20030054821A - Apparatus and method for high speed encryption/decryption using TCP/IP base network having selective encryption function - Google Patents

Abstract

PURPOSE: A high-speed coding/decoding apparatus and a method thereof having a coding function for a TCP/IP(Transmission Control Protocol/Internet Protocol)-based network are provided to improve the stability of communication by selectively coding/decoding inputted packets based on header information of the packets. CONSTITUTION: A packet input unit(301) receives a packet from a network interface(400). A packet header analyzing unit(302) analyzes a header of a packet to confirm that coding/decoding policy information exists and determines whether or not a packet coding/decoding is performed. A coding/decoding policy database(303) has the custody of policy information about a coding/decoding packet and manages it. A high-speed coding/decoding processing unit(304) performs a coding/decoding on a data portion by using a coding/decoding chip. A packet output unit(305) outputs the coded/decoded packet and a non-coded/decoded packet to a network interface.

Description

Apparatus and method for high speed encryption / decryption using TCP / IP base network having selective encryption function}

The present invention is a specific hardware encryption / decryption processing apparatus for the communication data used in the network environment using TCP / IP, in particular among the various packets transmitted in a network environment consisting of a plurality of terminals specific to the encryption / decryption policy A fast encryption / decryption apparatus and method for a TCP / IP-based network having a function of selectively encrypting / decoding only packets.

1 is a block diagram illustrating a fast encryption / decryption apparatus for a TCP / IP-based network having a conventional encryption function according to the prior art.

Referring to FIG. 1, the network encryption apparatus includes an encryption unit 100 for encrypting a data frame or packet and a decryption unit 200 for decrypting the encrypted data frame or packet.

The encryption unit 100 includes a DTE receiving end 101 for receiving a data frame or packet transmitted from a terminal, a DTE receiving buffer unit 102 for receiving and storing a data frame or packet from the DTE receiving end 101; A first random number generator 103 which is initialized by the first input N bytes of the user data portion of the data frame or packet and outputs a random number in units of bytes, and a first prestored encryption key of N bytes A second exclusive OR operation element for encrypting an N byte encryption key unit 104 and a first exclusive OR operation that encrypts the first N bytes of the N byte encryption key and the user data portion by performing an exclusive OR operation. Section 105, an encryption header that is an output of the DTE receiving buffer section 102, and an encryption that is an output of the first and second exclusive-OR elements 105, 106; And DCE transmission buffer part 107 for receiving and storing the user data input, is configured to include a DCE transmitting terminal 108 for receiving the transmission data stored in the DCE transmit buffer unit 107 to the connected networks.

The decoder 200 may include a DCE receiver 201 for receiving a data frame or packet transmitted from a network, a DCE reception buffer unit 202 for receiving and storing a data frame or packet from the DCE receiver 201; A second random number generator 203 which is initialized by the first input N bytes of the user data portion of the data frame or packet and outputs a random number in units of bytes, and a second stored in advance with N bytes of encryption keys An N-byte encryption key unit 204, a third exclusive-OR operation element unit 205 for decrypting by performing an exclusive OR operation on the N-byte encryption key and the first input N bytes of the user data portion, and the user data A fourth exclusive-OR operation element for performing an exclusive-OR operation on the Nth or later byte of the portion and the random number output from the second random number generator 203 by performing an exclusive OR operation. A DTE transmission buffer unit for receiving and storing the protocol header which is the output of the DTE reception buffer unit 2 and the decoded user data that is the output of the third and fourth exclusive OR operation units 205 and 206. 207 and a DTE transmitter 208 for receiving data stored in the DTE transmission buffer unit 207 and transmitting the data to the connected network.

A fast encryption / decryption apparatus for a TCP / IP-based network having a conventional encryption function as described above will be described with reference to FIG. 1.

First, the operation of the encryption unit 100 will be described. The DTE receiving unit 101 stores the data frame or packet received in the DTE receiving buffer unit 102. In this case, a TAG field is generated to store a protocol header and a user data portion of a data frame or packet and stored together.

The protocol header portion is immediately copied to the DCE transmission buffer unit 107 and stored. The user data portion first uses the input N bytes to initialize the first random number generator 103, and then performs an exclusive OR operation with an N-byte length encryption key previously stored in the first N-byte encryption key 104. FIG. To be encrypted and stored in the DCE transmission buffer section 107. At this time, the first N-byte seed value SEED VALUE is input.

Thereafter, the Nth and subsequent bytes of the user data portion are encrypted by performing an exclusive OR operation with the random number output from the first random number generator 103 and stored in the DCE transmission buffer unit 107.

The encrypted data frame or packet stored in the DCE transmission buffer unit 107 is transmitted to the DCE transmitting end.

Meanwhile, the operation of the decoding unit 200 will be described. The DCE receiving unit 201 stores the data frame or packet received in the DCE receiving buffer unit 202. In this case, a tag field for distinguishing a protocol header and a user data portion of a data frame or packet is generated and stored together.

The protocol header portion is immediately copied to the DTE transmission buffer unit 207 and stored. The user data portion is first used to initialize the second random number generator 203 by using the N bytes inputted therein, and then performs an exclusive OR operation with an N-byte length encryption key previously stored in the second N-byte encryption key unit 204. The data is decoded and stored in the DTE transmission buffer unit 207. In this case, the first input N bytes become a seed value.

Thereafter, the Nth and subsequent bytes of the user data portion are decoded by performing an exclusive OR operation with the random number output from the second random number generator 203 and stored in the DTE transmission buffer unit 207. The decoded data frame or packet stored in the DTE transmission buffer unit 207 is transmitted to the DTE transmitting end 208.

However, the conventional network encryption apparatus performs a function of unilaterally encrypting / decrypting all input data frames or packets. It cannot perform a selective encryption / decryption function to perform encryption / decryption only for specific packets in a network environment in which various types of packets are transmitted. Therefore, in a network environment in which a plurality of terminals are connected, an encryption / decryption device must be separately connected to each terminal that performs encryption / decryption, thereby increasing costs. In addition, if the policy on encryption / decryption is changed, the physical location of the encryption / decryption device has to be changed, thereby reducing management efficiency.

Therefore, in order to increase such cost or management efficiency, an encryption / decryption apparatus including a function capable of selectively encrypting / decrypting is needed.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problems, and provides an optional encryption / decryption function for selectively encrypting / decoding based on header information of a packet for packets input from a network interface. An object of the present invention is to provide a fast encryption / decryption apparatus and method for a TCP / IP-based network.

Another feature of the present invention is to selectively enable encryption / decryption communication for packets generated from multiple terminals in a network environment in which multiple terminals are connected according to policy information such as terminal location, service, and time. An object of the present invention is to provide a fast encryption / decryption apparatus and method for a TCP / IP-based network having an encryption function.

Another feature is the selective encryption, which uses a dedicated encryption / decryption chip composed of hardware circuitry for encryption / decryption to increase the data encryption / decryption speed, enabling secure encrypted communication without slowing down the network speed even in a high-speed network environment. An object of the present invention is to provide a fast encryption / decryption apparatus and method for a TCP / IP-based network.

1 is a block diagram showing a fast encryption / decryption apparatus for a TCP / IP-based network having a conventional encryption function.

2 is a block diagram showing a fast encryption / decryption apparatus for a TCP / IP-based network with an optional encryption function according to an embodiment of the present invention.

3 is a flowchart illustrating a fast encryption / decryption method for a TCP / IP-based network having an optional encryption function according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100 ... Encryption 101 ... DTE Receiver

102 DTE receive buffer 103 First random number generator

104 ... first N-byte encryption key portion 105 ... first exclusive-OR operation element portion

106 The Sixth Exclusive-OR Element

107 DCE Transmit Buffer 108 DCE Transmitter

200 ... decoder 201 ... DCE receiver

202 ... DCE reception buffer unit 203 ... second random number generation unit

204 ... second N-byte encryption key section 205 ... third exclusive-OR operation element section

206 fourth fourth exclusive OR operation element

207 DTE transmit buffer 208 DTE transmit end

300 ... optional encryption / decryption unit 301 ... packet input

302 ... packet header analysis section 303 ... encryption / decryption policy database

304 High speed encryption / decryption unit 305 Packet output unit

400 ... network interface

In order to achieve the above object, a fast encryption / decryption apparatus for a TCP / IP-based network having an optional encryption function according to the present invention,

A packet input unit for receiving a packet from a network interface;

A packet header analyzing unit for analyzing whether the encryption / decryption policy information exists by analyzing the header of the input packet and determining whether to encrypt / decrypt the packet;

An encryption / decryption policy database for storing and managing policy information on packets to be encrypted / decrypted;

A fast encryption / decoding processor that performs encryption / decryption on the data portion of the packet determined to perform encryption / decryption using an encryption / decryption chip;

And a packet output unit configured to output the encrypted / decrypted packet and the unencrypted / undecrypted packet to a network interface.

Preferably, when the packet input unit receives a packet from the network interface, the packet input unit allocates a buffer space for storing the packet, and then stores the packet received from the interface.

Preferably, the packet header analyzing unit analyzes the header of the packet and compares the set encryption / decryption policy information to determine whether the currently input packet is a packet to perform encryption / decryption.

Preferably, the encryption / decryption policy database stores and manages information such as packet origin address, destination address, time of occurrence, type of service, etc. of the packet to be encrypted / decrypted for selective encryption / decryption of the packet. It is done.

Preferably, the encryption / decryption policy information stored in the encryption / decryption policy database is configured by combining packet information such as a source address, a destination address, a generation time, and a service type of the packet.

Preferably, the fast encryption / decoding processor includes an encryption / decoding chip that generates a random number, and encrypts / decodes at high speed by reading a data portion of a packet in units of bytes through a combination with a random number generated by the encryption / decoding chip. It is done.

Preferably, the packet output unit outputs a packet to a network interface and removes a buffer space in which the output packet is stored.

A fast encryption / decryption method for a TCP / IP-based network having an optional encryption function according to the present invention,

Receiving a packet from a network interface;

Allocating a buffer and storing the input packet;

Retrieving the encryption / decryption policy information after analyzing the header information of the packet;

Checking whether an encryption / decryption policy corresponding to the packet exists;

If the encryption / decryption policy exists, the packet is output to the network interface. If the encryption / decryption policy does not exist, the packet is transmitted to the network interface after encryption / decoding by combining the random number and data part generated from the encryption / decryption chip. It characterized in that it comprises a step of outputting.

2 is a block diagram illustrating a fast encryption / decryption apparatus for a TCP / IP-based network having an optional encryption function according to an embodiment of the present invention.

2, a packet input unit 301 for receiving a packet from the network interface 400, a packet header analyzer 302 for checking whether a packet is to be encrypted / decrypted by analyzing a header of the input packet, and a cancer. The encryption / decryption policy database 303, which stores and manages policy information on the packet to be decrypted / decrypted, and the encryption / decryption using a dedicated encryption / decryption chip on the data portion of the packet determined to be encrypted / decrypted. It consists of a high speed encryption / decryption processing unit 304 and a packet output unit 305 for outputting the processed packet to the network interface 400.

A fast encryption / decryption apparatus and method for a TCP / IP-based network having a selective encryption function according to an embodiment of the present invention as described above will be described with reference to the accompanying drawings.

Referring to FIG. 2, the packet input unit 301 of the selective encryption / decryption unit 300 receives a packet through a network interface 400 card, performs a preparation operation for encryption / decryption processing, and inputs the received packet. After allocating a buffer to store the data, store the packet here. Then, the packet is accessed by referring to the allocated buffer.

The packet header analyzing unit 302 reads and analyzes header information of a packet stored in a buffer by the packet input unit 301, and compares the analyzed packet with the policy information existing in the encryption / decryption policy database 303. Determines whether the packet is to be encrypted / decrypted.

At this time, the packet header analyzer 302 analyzes the packet header, and analyzes the source address, the destination address, the time of occurrence, the type of the packet, and the like. The analyzed information of the packet header is used to search the encryption / decryption policy database 303.

The encryption / decryption policy database 303 stores information on a packet to be encrypted / decrypted so that the packet header analyzer 302 provides information for determining whether to encrypt or decode the packet.

The encryption / decryption policy database 303 stores and manages policy information for performing encryption / decryption. The policy information is used by a service operator to perform selective encryption / decryption as a destination address, a start address, a service address, or the like. By recording this, it is possible to refer to this to determine whether the packet is to be encrypted / decrypted. That is, the encryption / decryption policy information is composed of a combination of packet information such as the start or end position of the packet, the time of occurrence, the type of service, and the like. Compare and determine whether to encrypt / decrypt the packet.

The encryption / decryption is performed by the fast encryption / decryption processing unit 304 only for packets requiring encryption / decryption according to the analysis result of the packet header analyzer 302, and the packet output unit does not require encryption / decryption. 305 takes care of it immediately.

The fast encryption / decryption processing unit 304 encrypts / decrypts the data portion of the packet using a dedicated encryption / decryption chip. The random encryption / decoding chip (eg, a SEAM chip) generates random numbers. The fast encryption / decoding processor 204 generates a random byte generated by the dedicated encryption / decoding chip and the data portion of the packet read from the buffer in byte units. Combination is performed to encrypt / decrypt, and the encrypted / decrypted packet is stored in the buffer again.

The packet output unit 305 outputs the processed packet to the outside via the network interface 400 card. The packet output unit 305 copies the packet to the buffer of the network interface card and outputs it to the outside, and then removes the buffer allocated by the packet output unit 305 to store the packet, thereby completing the packet processing.

3 is a flowchart illustrating a fast encryption / decryption method for a TCP / IP-based network having an optional encryption function according to an embodiment of the present invention.

Referring to FIG. 2, FIG. 3 has a function of encrypting / decoding an IP packet in a TCP / IP-based network, and starts operation when a packet is input from the outside. When a packet is input from the network interface (S301), the packet input unit 301 allocates a buffer to store the input packet and stores the packet (S302).

When the packet is stored in the buffer, the packet header analyzer 302 reads the header of the packet from the buffer, and then analyzes the header to analyze the start address, the destination address, the time of occurrence, the type of the packet, and the like (S303).

After analyzing the packet header, the encryption / decryption policy database 303 is searched to determine whether the packet header exists in the encryption / decryption policy corresponding to the packet using the analyzed content of the packet header (S305).

At this time, when a search result is received from the encryption / decryption policy database 303, the packet header analyzer 302 checks whether an encryption / decryption policy for the current packet exists based on this (S306). If there is an encryption / decryption policy, this indicates that the current packet is a packet that requires encryption / decryption. If an encryption / decryption policy does not exist, it means a packet that does not require encryption / decryption.

The packet that needs to be encrypted / decrypted is encrypted / decrypted by the fast encryption / decryption processing unit 304. When the encryption / decoding random number is generated in the dedicated encryption / decoding chip (S307), the fast encryption / decoding processor 304 performs encryption / decoding by combining the data portion of the packet with the generated random number (S308). That is, the fast encryption / decoding processor 304 encrypts / decodes the packet by combining only the data portion except for the header portion in the packet with the random number generated in the dedicated encryption / decoding chip.

In other words, the fast encryption / decoding processor 304 reads the data portion of the packet from the packet stored in the buffer in byte units and performs encryption / decoding by combining it with random numbers generated in the dedicated encryption / decoding chip in order, and then encrypting / decoding. The data portion of the packet stored in the buffer is encrypted / decoded by storing the data portion of the packet again in the buffer.

The packet that has been encrypted / decoded by the fast encryption / decryption processing unit 304 or that does not need encryption / decryption by the packet header analyzer 302 is output by the packet output unit 305 to the network interface 400. (S309).

The packet output unit 305 outputs the packet stored in the buffer to the network interface 400, and then removes the buffer allocated for storing the packet (S310), thereby completing processing for the packet.

Another embodiment of the present invention provides a selective high-speed encrypted communication function between a plurality of terminals installed in a network unit in a financial area-only security environment.

Another embodiment provides a high speed encryption / decryption of packet data in a TCP / IP based network by using a dedicated hardware encryption / decoding device using a dedicated encryption / decoding chip that generates random numbers.

In another embodiment, a specific packet may be selectively encrypted / decoded among packets transmitted in a TCP / IP-based network environment including a plurality of terminals, and selectively encrypted / decoded only specific packets. Is selected by searching the encryption / decryption policy database.

As described above, according to the fast encryption / decryption apparatus and method for a TCP / IP-based network having the selective encryption / decryption function according to the present invention, the received packets are selectively encrypted / received based on the header information of the packet. Since decryption can be performed, encrypted communication can be selectively performed on packets generated from a plurality of terminals in a network environment in which a plurality of terminals are connected according to policy information such as terminal location, service, and time.

In addition, by using a dedicated SEAM chip composed of hardware circuitry for encryption / decryption, the data encryption / decoding rate is increased to enable secure communication without degrading network speed even in a high-speed network environment.

Claims (12)

A packet input unit for receiving a packet from a network interface; A packet header analyzing unit for analyzing whether the encryption / decryption policy information exists by analyzing the header of the input packet and determining whether to encrypt / decrypt the packet; An encryption / decryption policy database for storing and managing policy information on packets to be encrypted / decrypted; A fast encryption / decoding processor that performs encryption / decryption on the data portion of the packet determined to perform encryption / decryption using an encryption / decryption chip; And a packet output unit configured to output the encrypted / decoded packet and the unencrypted / decoded packet to a network interface. 2. The high speed encryption / decryption apparatus for a TCP / IP-based network having a selective encryption / decryption function. The method of claim 1, The packet input unit allocates a buffer space to store a packet when receiving a packet from a network interface, and stores the packet received from the interface. The packet input unit provides fast encryption / decryption for a TCP / IP-based network with a selective encryption / decryption function. Device. The method of claim 1, The packet header analyzing unit analyzes the header of the packet and compares the set encryption / decryption policy information to determine whether the currently input packet is a packet to be encrypted / decrypted. Encryption / decryption device for IP / IP-based networks. The method of claim 1, The encryption / decryption policy database stores and manages information such as packet origin address, destination address, occurrence time, type of service, etc. of the packet to be encrypted / decrypted for selective encryption / decryption of the packet. Fast encryption / decryption device for TCP / IP-based networks with encryption / decryption capabilities. The method of claim 4, wherein The encryption / decryption policy information stored in the encryption / decryption policy database is configured by combining packet information such as a source address, a destination address, a time of occurrence, and a service type of the TCP / TCP with a selective encryption / decryption function. Fast encryption / decryption device for IP-based networks. The method of claim 1, The fast encryption / decoding processor includes an encryption / decoding chip that generates a random number, and selectively encrypts / decodes the data part of the packet by byte unit by combining the random number with the encryption / decoding chip generated. Fast encryption / decryption device for TCP / IP-based networks with encryption / decryption capabilities. The method of claim 1, The packet output unit outputs a packet to a network interface and removes a buffer space in which the output packet is stored. The fast encryption / decryption apparatus for a TCP / IP-based network having a selective encryption / decryption function. In the TCP / IP-based network environment consisting of multiple terminals, header information of packets transmitted is analyzed, the header information is compared with encryption policy information, and then only specific packets present in the encryption / decryption policy information are selectively encrypted / decrypted. A fast encryption / decryption apparatus for a TCP / IP-based network with an optional encryption / decryption function, characterized in that it comprises an optional encryption / decryption means for performing. A dedicated hardware encryption / decoding device is provided with a dedicated hardware encryption / decoding device that generates random numbers in packets input / output through a network interface, and includes encryption / decoding means for encrypting / decoding packet data at high speed in a TCP / IP-based network. A high speed encryption / decryption device for a TCP / IP-based network having an optional encryption / decryption function. The method of claim 9, A fast encryption / decryption device for a TCP / IP-based network with an optional encryption / decryption function, characterized in that it selectively selects a specific packet for encryption / decryption to search the encryption / decryption policy database. Receiving a packet from a network interface; Allocating a buffer and storing the input packet; Retrieving the encryption / decryption policy information after analyzing the header information of the packet; Checking whether an encryption / decryption policy corresponding to the packet exists; If the encryption / decryption policy exists, the packet is output to the network interface. If the encryption / decryption policy does not exist, the packet is transmitted to the network interface after encryption / decoding by combining the random number and data part generated from the encryption / decryption chip. A fast encryption / decryption method for a TCP / IP-based network with an optional encryption function, characterized in that it comprises the step of outputting. The method of claim 11, And if the packet is output from the network interface, removing the buffer in which the packet was stored. The fast encryption / decryption method for a TCP / IP-based network having an optional encryption function.