WO2003094419A1

WO2003094419A1 - Method and apparatus for encryption/decryption in a medium converter

Info

Publication number: WO2003094419A1
Application number: PCT/JP2002/004314
Authority: WO
Inventors: Seiho Itano
Original assignee: Allied-Telesis, K.K.
Priority date: 2002-04-30
Filing date: 2002-04-30
Publication date: 2003-11-13
Also published as: JPWO2003094419A1; AU2002253659A1

Abstract

An encryption/decryption block is provided in a medium converter. Variable length n-byte data (201) entered is divided into a fixed length m to calculate a remainder data length r and a difference between the fixed length m and the remainder data length r is decided to be an additional data length k. Additional k-byte data (202) is added to the end of the variable length n-byte data (201) and reference data to determine the additional data length is arranged at the end of the (n + k)-byte data (205). The (n + k)-byte data (205) is encrypted. When decrypting the encrypted data, the additional data length is determined from the reference data and the corresponding data is deleted so as to restore the previous variable length data.

Description

Method and apparatus for encryption in a converter

Technical field

The present invention relates to a media converter for connecting different types of transmission media, and more particularly, to an encryption / decryption method and apparatus in a media converter.

In recent years, FTTH (Fiber To The Home), which allows users to freely exchange music, video, medical data, and other data over high-speed lines over optical fiber lines to homes, has attracted much attention in recent years. When such FTTH is realized, a media converter for connecting an optical fiber line to an office or a home computer is indispensable.

In general, a media converter is provided with a port for connecting an optical cable, a port for connecting an UTP cable, and a power supply, and a physical layer device is connected to each. Each physical layer device supports MII (Media Independent Interface) defined by the IEEE 802.3 standard. In addition, due to the nature of the media converter, a media converter generally has a missing function that automatically disconnects one link when one link is disconnected.

By using such a media converter, long-distance transmission via an optical cable becomes possible. For example, a LAN (Local Area Network) management switch is connected to one port of a media converter using a UTP (Unshielded Twisted Pair) cable, and an optical cable is connected to the other port. Similarly, the other party converts the optical cable to a UTP cable using a media converter and connects it to the management switch. In this way, LANs can communicate with each other through optical communication lines. A single domain can be configured.

In such communication systems, security in optical communication lines and LANs is one of the important issues. Therefore, it is considered to incorporate the data encryption and Z decryption functions into the media converter.

However, when encrypting variable-length n-byte data using DES (Data Encryption Standard) encryption, one of the encryption technologies, the input to DES must be divided into 8-byte units. . In this case, depending on the value of n, there is a remainder of less than 8 bytes when dividing. For this reason, a technology is needed to expand the remainder to 8 bytes that can be input to DES.

Conventionally, various techniques for converting variable-length data into fixed-length data have been proposed. For example, Japanese Patent Application Laid-Open No. 08-030437 discloses a computer that divides variable-length data into optimal fixed-length data and performs parallel processing by a plurality of arithmetic processing units. Also, in the data stream conversion method disclosed in Japanese Patent Application Laid-Open No. 2000-3323978, variable-length data is transferred to a register, and when the data amount of the register exceeds a predetermined bit, Fixed-length data is generated by sequentially outputting data for each fixed-length bit number. Finally, the data remaining in the register is combined with the next input data and output as the next fixed-length data.

However, in the computer disclosed in Japanese Patent Application Laid-Open No. 08-030437, the length of the variable-length data is set to an integral multiple of the fixed-length data, and the variable-length data is divided. It is not expected that there will be a surplus when this is done.

On the other hand, the above-mentioned Japanese Patent Application Laid-Open Publication No. 2000-3322978 mentions processing of data (remainder) remaining in a register after variable-length data is divided and output for each fixed-length data. Have been.

However, this conventional method aims to output variable-length data as a stream of fixed-length data, and divides certain variable-length data into a set of fixed-length data and processes each fixed-length data. is not. I Therefore, the last data remaining in the register can be combined with the next input data and output as the next fixed-length data.

An object of the present invention is to provide an encryption / decryption method and apparatus in a media converter that converts variable-length data into fixed-length data and performs an encryption process.

Another object of the present invention is to provide an encryption method and apparatus which enable efficient encryption processing of each fixed-length data even if a remainder occurs when variable-length data is divided into fixed-length data. Is to do.

Still another object of the present invention is to provide a decoding method and apparatus capable of easily decoding data obtained by performing encryption processing of variable-length data into original variable-length data. . Disclosure of the invention

According to a first aspect of the present invention, in a method for performing data conversion for performing fixed length processing on variable length data, the method further comprises: calculating a remainder data length when dividing the variable length data into a predetermined fixed length; Determining the difference between the length and the remaining data length as the additional data length, generating additional data including reference data for determining the additional data length, and adding the additional data to the variable length data Generating extended data that can execute the fixed-length processing.

It is preferable that the reference data be placed at a predetermined position of the extended data. In particular, it is desirable to place the reference data at the end of the expanded data.

According to a second aspect of the present invention, there is provided a method for converting data obtained by performing fixed-length processing on variable-length data into the variable-length data. Calculating a surplus data length when dividing the variable length data into a predetermined fixed length, determining a difference between the fixed length and the surplus data length as an additional data length, To determine Generating additional data of the additional data length including reference data, adding the additional data to the variable length data, generating extended data in which the reference data is present at a predetermined position, The fixed-length processing is performed to generate fixed processing result data, and the fixed processing result data is subjected to a fixed processing opposite to the fixed processing to correspond to the extended data. Generating the received data, reading the reference data from the predetermined position of the received data, determining the additional data length from the reference data, and removing the data corresponding to the additional data length from the received data. In this way, the original variable-length data is restored.

The fixed length processing is characterized in that the extended data is divided for each of the fixed lengths, and each of the fixed length data is processed. Preferably, the fixed-length process is an encryption process, and the reverse fixed process is a decryption process corresponding to the encryption process. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a block diagram showing an example of a media converter to which an encryption / decryption method according to the present invention is applied.

FIG. 2 is a schematic block diagram of a data processing system employing an encryption Z decryption method according to an embodiment of the present invention.

FIG. 3 is a flowchart showing an example of an extended data adding operation according to an embodiment of the present invention;

FIG. 4 is a format diagram for explaining generation of extension data, and FIG. 5 is a flowchart showing an example of an extension data deletion operation according to an embodiment of the present invention.

FIG. 6 is a block diagram of the encrypted Z decryption unit 13 of FIG.

Fig. 7 shows the flow of encryption / decryption of the encryption / decryption processing unit shown in Fig. 6. FIG. BEST MODE FOR CARRYING OUT THE INVENTION

1. Media Converter

FIG. 1 is a block diagram showing an example of a media converter to which an encryption Z decryption method according to the present invention is applied. A pair of ports of the media converter 10 are provided with physical layer devices (P HY) 11 and 12, respectively, one physical layer device 11 is connected to a UTP cable, the other physical layer device 12 is connected to an optical cable, Each is connected. As described above, each of the physical layer devices 11 and 12 supports the MII (Media Independent Interface) defined by IEEE 802.3.

Between the physical layer device 11 and the physical layer device 12, an encryption / decryption unit 13 including a FIFO (First in First out) memory is provided. Z decoding is performed. Further, the frequency deviation between transmission and reception can be absorbed by the FIFO memory. For example, variable-length data received by one physical layer device is sequentially written to the FIFO memory, read out in the order in which it was written, encrypted with fixed-length data, and then sent to the other physical layer device. Is done. Conversely, the encrypted data received by the other physical layer device is sequentially written to the FIFO memory, read out in the written order, decrypted, and then sent to the other physical layer device as variable-length data. Sent out.

Note that the encryption / decryption unit 13 according to the present embodiment is configured by an application-specific integrated circuit (ASIC), and also controls the operation of the entire media converter including generation of the encryption / decryption key.

2. Configuration of encryption / decryption system

FIG. 2 is a schematic block diagram of a data processing system employing an encryption / decryption method according to an embodiment of the present invention. In FIG. 2, the transmission side has an extension data addition unit 101, an additional byte length calculation unit 102, and an encryption processing unit 103, and the reception side has a decryption processing unit 104, It has a data removal unit 105 and an added bite length calculation unit 106. Here, the length of the variable-length data is assumed to be n bytes (n is a natural number), and the encryption processing unit 103 can perform encryption processing only on data having a fixed length of m bytes (m is a natural number of 1 or more). Shall be assumed.

Upon input of the variable-length n-byte data, the extension data adding unit 101 expands the data so that the variable-length n-byte data is processed by the encryption unit 103 without any excess or shortage. First, the extension data adding unit 101 transfers the data length n of the variable length n bit data to the additional bit length calculation unit 102. The additional byte length calculation unit 102 calculates the number of remaining bytes r of n Zm and the additional byte length k and returns the result to the extension data addition unit 101 (details will be described later).

The extension data adding unit 101 generates extension data of k bits including the number of surplus pipes r at a predetermined position, attaches the extension data to a predetermined position of variable-length n-byte data, and adds (n + k) bytes The data is output to the encryption processing unit 103 as data. It is desirable that extension data be added to the end of variable-length n-byte data. At this time, it is necessary to specify where the data representing the number of remaining bytes r exists from the end of the (n + k) byte data. Therefore, it is desirable to place data representing the number of remaining bytes r at the end of (n + k) -byte data.

The encryption processing unit 103 divides the (n + k) -byte data into fixed-length m bytes, and performs an encryption process on each of the divided fixed-length m-byte data. The data as a result of the processing is transmitted to the receiving side through, for example, a transmission line.

The decryption processing unit 104 on the receiving side performs processing opposite to the processing of the encryption processing unit 103 on the received data to decrypt the fixed-length m-byte data, and combines them. Then, the data is output to the extended data removing unit 105 as (n + k) byte data. The extension data removal unit 105 reads the number of bits r remaining from a predetermined position of the input (n + k) byte data, and passes the number to the additional byte length calculation unit 106. The additional byte length calculation unit 106 calculates the added byte length k from the number of remaining bytes r, and returns it to the extended data removal unit 105. The extended data removing unit 105 removes the k-byte extended data from a predetermined position of the (n + k) -byte data, and outputs the original variable-length n-byte data.

3. Generation and addition of extension data

FIG. 3 is a flowchart showing an example of an extension data adding operation according to an embodiment of the present invention, and FIG. 4 is a format diagram for explaining generation of extension data. As shown in Fig. 3, when the number of bytes n of variable-length n-byte data 201 is input, the additional byte length calculation unit 102 calculates the remainder r (= nM〇D m) of dividing n by m. Then, a value obtained by subtracting the remainder r from the fixed length m of the encryption processing unit 103 is calculated as an additional byte length k (step S20).

The relationship among the fixed length m, the remaining byte length r, and the additional byte length will be described with reference to FIG. As described above, since the encryption processing unit 103 accepts only fixed-length m bytes, the variable-length n-byte data 201 must be divided into fixed-length m bytes. At that time, there may be r bytes (0≤r <m) of extra data.

In order to process the remaining r bytes of data in the encryption processing unit 103, k (= m-r) bytes of the extended data 202 are added to the n-byte data 201 at a predetermined position (here, the last byte). ). As a result, data 205 having a byte length (n + k) divisible by the fixed length m is obtained.

Since the extension data 202 is eventually removed, it is necessary to write reference data to the extension data 202 so that the length of the extension data 202 can be calculated. In the present embodiment, the value of the remaining data length r is written as a reference data at a predetermined position (here, at the end) of the extension data 202. For example, if the range of the fixed length m is 1 <m <256, then r is m, so a data area of 1 byte (≤ 255) is reserved to represent the remaining data length r. It's enough.

Thus, the additional data length calculation unit 102 calculates the remaining data length r and the additional bit length k, and returns to the extended data addition unit 101. As shown in FIG. 3, the extension data addition unit 101 generates k-byte extension data 202 consisting of a (k-1) -byte paddle 203 and 1-byte reference data 204. Then, it is added to a predetermined position (here, at the end) of the n-byte data 201 (step S21).

As a result, data 205 having a byte length (n + k) divisible by the fixed length m is supplied to the encryption processing unit 103, and is converted into (n + k) / m fixed-length m-byte data. The division process is executed (step S22). Thus, the fixed-length processing of the variable-length data 201 can be performed only by adding a small amount of the extended data 202.

4. Delete extended data

FIG. 5 is a flowchart showing an example of an extended data deletion operation according to an embodiment of the present invention. First, the decryption processing section 104 performs processing opposite to the processing of the encryption processing section 103 on the received data to decrypt the fixed-length m-byte data and synthesizes them ( (n + k) The noise data 205 is output to the extended data removing unit 105. As described above, the remaining byte number r is written as reference data at a predetermined position (here, the last byte) of the input (n + k) byte data 205. Therefore, the extended data removing unit 105 reads out the last one byte of data and passes it to the additional byte length calculating unit 106. The additional byte length calculation unit 106 calculates the additional byte length k = m-r by subtracting the number of remaining bytes r from the fixed length m (step S23), and uses the value k as the extension data removal unit 1 0 Return to 5.

The extension data removal unit 105 removes the last k bits of the (n + k) byte data 205, that is, the extension data 202 (step S24), and removes the original variable length n Outputs byte data 201. Thus, from the fixed-length encryption Output data can be easily restored to the original variable-length data.

5. Examples

Hereinafter, as a specific example, a media converter that transmits data to be transmitted after encrypting the data and then decrypts the received data from the data that has been encrypted will be described. In this case, the encryption processing unit 103 in FIG. 2 corresponds to the DS encryption module, and the decryption processing unit 104 corresponds to the DS decryption module. FIG. 6 is a detailed block diagram of the encryption / decryption unit 13 of FIG. The variable-length transmission data output from the data processing unit (not shown) is input to an input FIFO (First In First Out) memory 301 through the physical layer 300a, and sequentially to the paddle addition module 3 Output to 02.

The paddle addition module 302 corresponds to the extension data addition unit 101 and the addition byte length calculation unit 102 in FIG. The paddle addition module 302 adds k-bit extended data to the input n-byte transmission data, and outputs (n + k) -byte data to the encryption module 303.

The encryption module 303 divides (n + k) -byte data into fixed-length m-byte data and executes an encryption process on each of them according to the encryption key. The encrypted (n + k) byte data is sent to the physical layer 300b via the output FIFO memory 304.

The data received from the physical layer 300 b is sequentially input to the decoding module 306 via the input FIFO memory 305. The decryption module 303 decrypts the fixed-length m-byte data from the received data according to the encryption key, combines them, and outputs the resultant data to the paddle removal module 3007 as (n + k) -byte data. I do.

The paddle removal module 307 corresponds to the extended data removal unit 105 and the added byte length calculation unit 106 in FIG. The paddle removal module 307 calculates the additional bit length k from the last one byte of data, and calculates the maximum length of (n + k) byte data. 2/04314

Ten

The trailing k-bit data is removed to generate variable-length n-byte data, which is output to the physical layer 300a through the output FIFO memory 308.

The input FI FO memory 301 of the transmission unit is provided to absorb the phase difference between the transmission clock of the physical layer 300a side and the clock of the encryption / decryption module. The memory 304 is provided to absorb a phase difference between the transmission clock on the other physical layer 300b side and the port of the encryption / decryption module. Similarly, the input FI FO memory 305 of the receiving unit is provided to absorb the phase difference between the reception clock of the physical layer 30 Ob and the clock of the encryption / decryption module, and the output FI FO memory 308 is provided. It is provided to absorb the phase difference between the reception clock on the physical layer 300a side and the clock of the encryption Z decryption module.

FIG. 7 is a diagram showing the flow of encryption / decryption by the transmission / reception unit shown in FIG. Here, a case will be described where the fixed-length byte number m = 8 and 0 ≦ r <8 of the DES encryption module 303 and data with a variable-length byte number n = 67 are transmitted and received. First, when 67 bytes of transmission data is input (Fig. 7 (a)), r = 3, k = m-r = 5 since 67 bytes Z 8 bytes = 8 remainders 3 (Fig. 7 ( b)). Therefore, the 5-byte paddle data (0x0000000003) including r = 3 in the last byte is added to the 67-byte transmission data to extend the transmission data to 72 bytes (Fig. 7 (c)) .

Next, the extended transmission data of 72 bytes is divided into 8-byte units, and the 9 divided 8-byte data are respectively encrypted in the DES ECB mode (Fig. 7 (d)). In this way, 72 bytes of encrypted data are obtained (Fig. 7 (e)). Thus, DES encryption of variable-length data can be performed only by adding a small amount of paddle data.

On the other hand, when such encrypted data is received, the DES decryption module 303 decrypts each of the 8-byte data (FIG. 7 (f)). 8 decrypted The byte data is combined to obtain 72 bits of data, and the additional paddle length k is calculated from the last byte (0x03). Here, since k = 8-3 = 5 bytes, the last 5 bytes of paddle data (0x0000000003) are removed from the 72-byte data (Fig. 7 (h)). Thus, the original 67-byte data is obtained (Fig. 7 (i)). Thus, the DES encrypted data can be easily restored to the original variable length data.

In the present embodiment, the DES encryption technology has been described as an example, but the present invention is not limited to this. INDUSTRIAL APPLICABILITY The present invention can be applied to a case where an encryption processing technique that accepts only fixed-length data is used for processing variable-length input data. Also, the extension data appending unit 101, additional byte length calculation unit 102, and encryption processing unit 103 on the transmission side, or the decryption processing unit 104 on the reception side, shown in FIG. The data removing unit 105 and the additional byte length calculating unit 106 can be configured as hardware, but can also be realized by software. That is, a program for instructing the computer to perform the operation of generating, adding, and removing extended data described in FIGS. 3 to 5 is stored in a memory, and a program corresponding to each operation is run on the computer. A similar function can be realized. As described above, according to the present invention, a surplus data length when dividing variable-length data into a predetermined fixed length is calculated, and a difference between the fixed length and the surplus data length is determined as an additional data length. Then, by adding the additional data including the reference data for determining the additional data length to the variable length data, extended data that can execute the fixed length encryption processing is generated. Therefore, only by adding a small amount of additional data to variable-length data, fixed-length encryption of variable-length data becomes possible.

In addition, since the reference data is read from the extended data and the additional data length added to the reference data can be determined, the original data can be easily changed by removing the additional data length from the extended data. Long data can be restored.

As described above, according to the present invention, the input has a fixed length for variable-length data. This is a very effective technique when performing encryption processing.

Claims

Scope of Claim 1. For media converters that connect different types of transmission media,

A first physical layer interface for connecting a first transmission medium,

A second physical layer interface for connecting a second transmission medium;

Is connected between the first and second physical layer interfaces, converts the variable length data input from the first physical layer interface into predetermined fixed length data, encrypts the data, and encrypts the encrypted data. An encryption means for outputting to the second physical layer interface,

Has,

The encryption means,

Calculating means for calculating a surplus data length when dividing the variable length data into a predetermined fixed length, and determining a difference between the fixed length and the surplus data length as an additional data length; and determining the additional data length. Extension data adding means for generating additional data including reference data for performing the encryption processing at a predetermined position, and adding the additional data to the variable-length data to generate extended data that can be encrypted. ,

Encryption processing means for generating the encrypted data by performing the encryption processing on the extended data;

A media converter comprising:

2. Connected between the first and second physical layer interfaces, and decrypts encrypted data input from the second physical layer interface to generate variable-length data; Further comprising decoding means for outputting to the layer interface, wherein the decoding means,

Decryption processing means for decrypting the encrypted data to generate received data corresponding to the extended data;

Reading the reference data from the predetermined position of the received data; Extension data removing means for determining the additional data length from data, and removing data corresponding to the additional data length from the received data;

2. The media converter according to claim 1, comprising:

3. The media converter according to claim 1, wherein the extension data adding means arranges the reference data at the end of the extension data.

4. The media converter according to claim 1, wherein the encryption processing means divides the extended data for each fixed length and encrypts the fixed length data.

5. A method for encrypting variable-length data in a media converter that connects different types of first transmission medium and second transmission medium,

a) calculating the remaining data length when dividing the variable length data into a predetermined fixed length, b) determining the difference between the fixed length and the remaining data length as an additional data length, c) the additional data length Generate additional data, including reference data for determining

d) generating extended data that can be encrypted by adding the additional data to the variable-length data;

e) encrypting the extended data for each of the fixed lengths;

An encryption method in a media converter.

6. The method according to claim 5, wherein the reference data is arranged at a predetermined position of the additional data, and the additional data is arranged at a predetermined position of the variable length data. Encryption method in media converter.

7. The encryption method in a media converter according to claim 6, wherein the reference data is arranged at the end of the extended data.

8. The method according to claim 5, wherein the reference data is the remaining data length.

9. In the method for decrypting encrypted data generated by the encryption method according to claim 5,

a) receiving the encrypted data;

b) generating received data by performing a decryption process on the received encrypted data;

c) reading reference data from a predetermined position of the received data,

d) determining an additional data length from the reference data,

e) restoring the original variable length data by removing data corresponding to the additional data length from the received data,

A decoding method in a media converter.

10. The decoding method in the media converter according to claim 9, wherein said reference data is arranged at the end of said extended data.

11. The decoding method in the media converter according to claim 9, wherein the reference data is the remaining data length.

1 2. The computer in the media converter that connects the first transmission medium and the second transmission medium of different types transmits n (n is a natural number) variable-length data to a fixed length m (0 <m <n) bytes. In the program for executing the process of encrypting in units,

calculating the remainder r of n / m;

Determining the difference between the fixed length m and the remainder r as an additional data length k;

Generating additional data including reference data r for specifying the additional data length k;

Generating (n + k) bytes of extended data by adding the additional data to the variable length data;

The (n + k) -byte expanded data is divided into the fixed Encrypting;

A program characterized by having:

13. A program for executing a process of decrypting the encrypted data described in claim 12 and restoring the original variable-length data,

Generating (n + k) bytes of received data corresponding to the extended data by decrypting the encrypted data;

Reading the reference data from the predetermined position of the (n + k) -byte received data, and determining the additional data length k from the reference data; and Reconstructing the original n-byte variable length data by removing data corresponding to the additional data length k.