JP4628002B2 - Encryption system in communication link and communication terminal device thereof - Google Patents

Description

  The present invention relates to an encryption system and a communication terminal device thereof when performing communication by setting a communication link between two points using a network that performs communication by dividing information like an Internet telephone, Especially for eavesdropping and exploitation at the time of communication, and for those who want to perform those acts, it aims to become a deterrent against acts such as eavesdropping and exploitation, while preventing the profit and loss of users due to information leakage The present invention relates to a method for providing a secure communication environment.

  In the present invention, the Internet telephone is not limited to an IP (Internet Protocol) telephone that uses the same IP network (Internet) as that used for an application such as WWW, but a part or all of the network. , Including all telephone services using IP network technology (for example, those using an IP network uniquely constructed by a telecommunications carrier or a company).

  When data is transmitted / received over the Internet, data communicated between application programs running on the host is divided into data units called IP packets and transmitted. In the Internet telephone, a voice signal is compressed and encoded, divided into IP packets, and transmitted / received on an IP network.

  By the way, the communication terminal on the Internet telephone receiving side acquires only the IP packet transmitted to its own terminal from the IP telephone IP packets flowing through the network, and discards the IP packet addressed to the other terminal. Yes. Therefore, it is technically possible to eavesdrop on the contents of a call by taking in an IP packet other than that addressed to him and decoding it.

  In this case, it can be said that it is difficult to prevent eavesdropping of the IP packet because it is highly possible that the eavesdropping action itself is not noticed. Therefore, a method is conceivable in which the IP packet is encrypted so that it cannot be decrypted even if it is wiretapped.

  FIG. 8 shows an example of such a conventional technique. When communication terminal A and communication terminal B connected to the Internet (IP network) make a call, communication terminal A on the transmission side An encryption key is acquired from the Internet telephone service server S (VoIP server) that plays the role of an exchange such as connection / disconnection, and an audio signal is encrypted using an encryption processing device (CODEC) based on the encryption key. Packetized and transmitted to the receiving communication terminal B via the Internet. In the transmission terminal on the receiving side, the received packet is reconstructed into a compression-coded signal before packetization, and the reconstructed signal is restored based on the encryption key acquired from the Internet telephone service server S. , Getting a voice signal.

  However, in the prior art as described above, since only one encryption key is used for one communication, even the encrypted information has a large amount of information like the newly appeared Internet phone. In communication, since the possibility of being deciphered from the regularity increases, there is a problem that the security strength is reduced when eavesdropping / exploitation is performed.

In order to improve this, an invention such as Patent Document 1 has also been proposed. In the invention of Patent Document 1, a technique is disclosed in which encryption is changed for each transmitted packet when the packet is encrypted. However, since this technology performs encryption processing using different encryption keys for individual packets that occur in a short time, it places a great burden on the communication terminal that performs encryption and decryption processing. Become. There is also a problem that the encryption keys acquired from the Internet telephone service server S by the communication terminals A and B on the transmission side and the reception side for encryption and decryption are enormous.
JP 2001-230769 A

  The present invention has been proposed in order to solve the above-described problems of the prior art. In addition to the original communication link, a pseudo communication link is prepared, and communication data flowing through the pseudo communication link is prepared. By applying encryption processing and transmitting it with the original encrypted communication data, it increases the load required for decryption of the person who wiretapped and exploited the communication data, and as a result, making decryption difficult An object of the present invention is to provide an encryption system and an apparatus for a communication link that can improve security.

  In view of the above, the present invention employs the following means in order to make it difficult to decode IP packets. That is, the first means is configured such that a plurality of pseudo communication links are prepared in addition to the communication link originally used for communication, and different communication is applied to each communication link to escape from the eavesdropper's hand. In addition to the technique for performing different encryption on each communication link as in the first means, the second means further distributes IP packets in each communication link to other communication links and transmits them to an eavesdropper. It is constructed so as to escape from the hands.

The communication terminal device of the present invention is characterized by the following configuration.
(1) Regular communication including a regular packet generation unit that packetizes regular communication data, a regular packet encryption processing unit that encrypts the generated regular packet, and a transmission / reception processing unit for the encrypted regular packet Link forming means.
(2) a pseudo packet generation unit that packetizes pseudo communication data that is meaningless as communication data, a pseudo packet encryption processing unit that encrypts the generated pseudo packet, and a transmission / reception processing unit for the encrypted pseudo packet And means for forming one or a plurality of pseudo communication links. (3) Decryption processing unit for encrypted packets received via the network.
(4) An authentication information transmission / reception processing unit that acquires an encryption key necessary for packet encryption and decryption of the encrypted packet via a network.
(5) Using the encryption key acquired by the authentication information transmission / reception processing unit, the encryption processing unit in the means for forming the regular communication link and the pseudo communication link, respectively, execute different encryption processing, and An authentication control unit configured to cause the decryption processing unit to execute decryption processing.

An encryption system using the communication terminal device as described above is also one aspect of the present invention.

According to the invention of claim 1 or claim 2 having such a configuration, an encryption key that uses a pseudo communication link that transmits false information at the time of a call and is different for each communication link between the original communication link and the pseudo communication link. By using the encryption, decryption becomes more difficult. In particular, even if the pseudo-communication link is decrypted, the eavesdropper has no way of confirming the decryption from the false information. This makes it difficult to decrypt the original packet and improves its safety.

According to a third aspect of the present invention, in the communication terminal device according to the second aspect , the transmission / reception processing unit for the regular packet outputs the received encrypted regular packet to the decryption processing unit, and the authentication control unit includes: The encrypted normal packet output to the decryption processing unit is decrypted using the encryption key acquired by the authentication information transmission / reception processing unit, and the pseudo packet transmission / reception processing unit discards the received pseudo packet It is comprised as follows.

According to the invention of claim 3 having such a configuration, the pseudo packet which is unnecessary data on the receiving side is discarded, and only necessary regular data is decoded, so that the decoding process in the receiving side communication terminal is quickly performed. Can be implemented.

According to a fourth aspect of the present invention, in the communication terminal device according to the second or third aspect , the regular packet generation unit packetizes a voice signal, and the packet decoding processing unit is packetized. An audio generation unit that converts a signal into an audio signal is provided.

According to the invention of claim 4 having such a configuration, the communication terminal on the transmission / reception side can be used as a telephone for transmitting / receiving voice data, and the present invention can be applied to an Internet telephone.

  According to the present invention, when a communication link using a network that performs communication by dividing information, such as an Internet telephone using a personal computer, is used, the user can wiretap / leak information more than when using conventional encryption. It is possible to escape from such damages, and it can also be expected as a deterrent to these acts.

The configuration of the embodiment of the present invention will be specifically described with reference to the drawings.
1. First Embodiment (1) Configuration of Embodiment FIG. 1
FIG. 1 is a network diagram showing an example of an Internet telephone system constituted by an Internet telephone terminal and a server according to the present invention. In the present embodiment, the network N is connected to an exchange, an Internet telephone service server S that operates for distributing an encryption key, and a plurality of communication terminals A and B that function as telephones.

  The communication terminals A and B are telephones used by each user in the Internet telephone. For this reason, these communication terminals A and B are provided with a call control unit 1 for controlling a call function. The call control unit 1 is provided with a tone ringer 2 for calling, a dial 3 for designating a call destination, A speaker 4 (microphone) and a receiver 5 (speaker) are connected. The call control unit 1 is connected to a transmission / reception control unit 8 used for communication via the network N. The information from the transmission / reception control unit 8 is analyzed to control the start and end of the Internet telephone service. Is configured to do.

  Each communication terminal A, B has a normal packet generator 6 for packetizing the output signals from the dial 3 and transmitter 4, and an encryption processor 7 for encrypting the generated packet. Is provided. In addition, a pseudo packet generator 20 is provided in parallel with the regular packet generator 6, and its output is also supplied to the encryption processor 7. The output side of the encryption processing unit 7 is connected to a transmission / reception control unit 8 for transmitting a signal from the communication terminal to the Internet telephone service server S and other communication terminals via the network N.

  The transmission / reception control unit 8 also has a function of transmitting signals received via the network N to the handset 5 and the call control unit 1, and a transmission / reception control unit is provided between the transmission / reception control unit 8 and the handset 5. 8 includes a decryption processing unit 10 for decrypting the encrypted packet received and a speech generation unit 11 for converting the decrypted packet into an analog speech signal. Further, the transmission / reception control unit 8 is provided with an authentication control unit 9 for obtaining an encryption key from the Internet telephone service server S and providing it to the encryption processing unit 7 and the decryption processing unit 10.

  Specific configurations of the encryption processing unit 7 and the transmission / reception control unit 8 in the present embodiment are as shown in FIG. That is, the encryption processing unit 7 is provided with one regular packet encryption processing unit 70 and a plurality of pseudo packet encryption processing units 71 to 74 in parallel. 74 are supplied with pseudo packets that become meaningless signals when reproduced as audio signals from the pseudo packet generator 20. The regular packet encryption processing unit 70 is supplied with a regular packet generated by converting the voice signal of the user by the regular packet generation unit 6.

  The transmission / reception control unit 8 is provided with one regular packet transmission / reception processing unit 80, a plurality of pseudo packet transmission / reception processing units 81 to 84, and an authentication information transmission / reception processing unit 90. Among these, each of the pseudo packet transmission / reception processing units 81 to 84 is connected to each of the plurality of pseudo packet encryption processing units 71 to 74, and the normal packet transmission / reception processing unit 80 includes the normal packet encryption processing unit 70 and the decryption processing unit. 10 is connected. Further, the authentication information transmission / reception processing unit 90 is connected to the authentication control unit 9.

(2) Operation of the first embodiment: FIGS. 6 and 7
The operation of the present embodiment having such a configuration is as shown in the flowcharts of FIGS.
First, as shown in FIG. 6, when the communication terminal A on the transmission side makes a call to the communication terminal B on the reception side, when the user picks up the receiver 5 and operates the dial 3, the signal from the dial 3 is The packet is generated by the packet generator 6 and transmitted from the transmission / reception controller 8 to the Internet telephone service server S via the network N. In this case, the line connection / disconnection control signal may be encrypted by the method described later as in the case of the call, or may be simply packetized and transmitted.

  At the same time, the Internet telephone service server S converts the dial number of the receiving communication terminal B received from the transmitting communication terminal A into a corresponding IP address and sends it back to the transmission / reception control unit 8 of the transmitting communication terminal A. Then, an encryption key necessary for encrypting the packetized voice data is transmitted to the authentication control unit 9 of the communication terminal A.

  The transmission / reception control unit 8 that has received the IP address of the receiving communication terminal B from the Internet telephone service server S secures a call line with the receiving communication terminal B based on this information (step 1). ), A call start command is sent to the call control unit 1. When the setting for calling is completed, the authentication control unit 9 performs an encryption key acquisition process from the Internet telephone service server S connected to the network N via the authentication information transmission / reception processing unit 90 (step 2).

  When the acquisition of the encryption key is successful (Yes in step 3) and the voice signal from the transmitter 4 is sent to the normal packet generator 6 over the telephone line, the normal packet generator 6 receives the input voice signal as a predetermined value. And is packetized every time (step 4), and this is sent to the regular packet encryption processing unit 70 of the encryption processing unit 7. In the normal encryption processing unit 7, the authentication control unit 9 performs the normal packet signal encryption process using the normal packet encryption key acquired from the Internet telephone service server S (step 6). The packet transmission / reception processing unit 80 transmits the data to the receiving communication terminal B via the network N (step 7).

  On the other hand, at the same time as the voice signal from the transmitter 4 is sent to the regular packet generator 6, the pseudo packet generator 20 generates a pseudo packet that is meaningless as voice data in response to a command from the call controller 1. In step 4, the pseudo packet is sent to a plurality of pseudo packet encryption processing units 71 to 74 provided in the encryption processing unit 7. Each pseudo packet encryption processing unit 71 to 74 encrypts each pseudo packet using a plurality of pseudo packet encryption keys acquired through the authentication control unit 9 (step 6). The pseudo packet is transmitted from each pseudo packet transmission processing unit to the communication terminal B on the receiving side via the network N (step 7).

  These packetization, encryption, and transmission processes are repeated until the call control unit 1 determines that the call has ended (step 8). As a result, a plurality of communication links are formed between the communication terminals A and B on the transmission side and the reception side, as shown in FIG. 3, and packets encrypted with different encryption keys for each communication link. Will be sent.

  On the other hand, in the communication terminal B on the receiving side, as shown in FIG. 7, when the setting for calling is completed (step 1), the authentication control unit 9 is connected to the network N via the authentication information transmission / reception processing unit 90. An encryption key is acquired from the Internet telephone service server S (step 2). If the acquisition of the encryption key is successful (Yes in step 3), the pseudo packet transmission / reception processing units 81 to 84 and the normal packet transmission / reception respectively corresponding to the plurality of pseudo packets and one normal packet transmitted from the communication terminal A on the transmission side. The regular packet received by the processing unit (step 4) and received by the regular packet transmission / reception processing unit 80 is sent to the decoding processing unit 10 of the receiving communication terminal. On the other hand, the pseudo packets received by the pseudo packet transmission / reception processing units 81 to 84 are discarded by the respective pseudo packet transmission / reception processing units 81 to 84 and are not transmitted to the decryption processing unit 10.

  The encrypted normal packet sent to the decryption processing unit 10 is decrypted by using the encryption key acquired by the authentication control unit 9 through the authentication information transmission / reception processing unit 90 (step 6). The packet is sent to the voice generation unit 11, converted into a voice signal (step 7), and reaches the user through the receiver 5.

  The call control unit 1 monitors the input status of the audio signal received by the receiver 5 (step 8), and returns to step 4 if it is determined that the communication is not terminated, and subsequently receives the packet. On the other hand, if it is determined that the communication has ended, the call control unit 1 moves to a communication link disconnection process and ends the call (Yes in step 8).

(3) Effects of First Embodiment As described above, according to the first embodiment, a plurality of communication links and pseudo communication links to be originally communicated are set, and different encryption is performed for each communication link. Therefore, it is not easy to distinguish the communication link originally used. In particular, when an eavesdropper attempts to decrypt a packet on a pseudo-communication link, the contents are completely meaningless even if the decryption is performed, so it is known whether or not the decryption has succeeded. It is not possible. As a result, unless the decryption is intentionally stopped, the decryption work will be continued indefinitely, and it will not be possible to proceed to the decryption work of the legitimate packet that should be decrypted, and the possibility that the legitimate packet will be decrypted is reduced. To do.

(1) Configuration of Second Embodiment Next, a second embodiment which is a reference example of the present invention will be described.
In the second embodiment, as shown in FIG. 5, the normal packet generated by the normal packet generator 6 and the pseudo packets for the plurality of pseudo communication links formed by the pseudo packet generator 20 are encrypted. Then, by distributing and mixing to a plurality of communication links, no meaningful audio signal can be obtained even if any communication link is wiretapped.

  That is, in the second embodiment, as shown in FIG. 4, a communication data distribution / reconfiguration processing unit 30 is provided between the encryption processing unit 7 and the transmission / reception control unit 8. The communication data distribution / reconstruction processing unit 30 receives a pseudo packet from each of the pseudo packet encryption processing units 71 to 74 in the encryption processing unit 7 and a normal packet from the normal packet encryption processing unit 70. Each pseudo packet and regular packet are distributed according to a predetermined rule and sent to the network N via the regular / pseudo packet transmission / reception processing units 80 to 84 of the transmission / reception control unit 8.

  As an example of this distribution, the first packet of the regular packet encryption processing unit is sent to the first regular / pseudo packet transmission / reception processing unit 80, and the second packet is the second regular / pseudo packet transmission / reception processing unit. The first packet of the first pseudo packet encryption processing unit 71 is sent to the second regular / pseudo packet transmission / reception processing unit 81, and the second packet is sent to the third regular / pseudo packet transmission / reception unit 81. The first packet of the second pseudo packet encryption processing unit 72 is sent to the third regular / pseudo packet transmission / reception processing unit 82, and the second packet is the fourth regular / pseudo packet. A configuration in which packets sent from each encryption processing unit are sent to different packet transmission / reception processing units one by one or a fixed number, such as being sent to the transmission / reception processing unit 83 That.

(2) Operation of the Second Embodiment The operation of the second embodiment having such a configuration is basically the same as that of the first embodiment, as shown in FIGS. In the flowchart, a packet distribution process is added on the transmission side, and a combination process of received packets is added on the reception side.

  That is, as shown in FIG. 6, in the communication terminal A on the transmission side, when the setting of the communication path is completed (step 1), the authentication control unit 9 encrypts from the Internet telephone service server S via the authentication information transmission / reception processing unit 90. Key acquisition processing is performed (step 2). When acquisition of the encryption key is successful (Yes in step 3), packet generation (step 4) and packet encryption are performed for each of the pseudo packet and the regular packet (step 5).

  Each encrypted packet is distributed according to a certain rule in the communication data distribution / reconstruction processing unit (step 6), and each distributed packet is transmitted to the regular / pseudo packet transmission / reception processing unit 80 of the transmission / reception control unit 8. To -84. Each transmission / reception processing unit receives packets from the plurality of pseudo packet encryption processing units 71 to 74 or regular packet encryption processing unit 70 sent from the distribution / reconfiguration processing unit 30 according to a certain input order. To the communication terminal B on the side. In this way, as shown in FIG. 5, a regular packet and a pseudo packet encrypted with different encryption keys are mixedly transmitted to each communication link.

  On the other hand, as shown in FIG. 7, in the communication terminal B on the receiving side, when the call setting is completed (step 1), the authentication control unit 9 communicates from the Internet telephone service server S via the authentication information transmission / reception processing unit 90. A plurality of encryption keys corresponding to the number of links is acquired (step 2). When the acquisition of the encryption key is successful (Yes in Step 3), the packets received by the regular / pseudo packet transmission / reception processing units 80 to 84 connected to each communication link (Step 4) are processed to distribute / reconfigure communication data. The unit 30 performs a combining process according to a rule reverse to the predetermined rule adopted in the distributed process of the transmitting communication terminal (step 5), and reconstructs a plurality of encrypted pseudo packet signals and normal packet signals. Then, only the normal packet signal is extracted from the extracted packet and sent to the decryption processing unit 10. In the decryption processing unit, the regular packet is decrypted in accordance with the encryption key acquired by the authentication control unit 9 (step 6), and the decrypted regular packet is output to the voice generation unit 11 as a speech signal (step 7). ).

  Also in the communication terminal B on the receiving side, the call control unit 1 monitors the input status of the audio signal received by the receiver 5 and returns to step 4 if it is determined that the communication is not terminated, and subsequently receives the packet. Do. On the other hand, when it is determined that the communication is terminated, the call control unit 1 moves to a communication link disconnection process and terminates the call (step 8).

(3) Effect of Second Embodiment According to the second embodiment having such a configuration, a plurality of communication links are formed, and regular packets and pseudo packets encrypted in each link are provided. Therefore, even if an eavesdropper successfully decodes any communication link, the audio signal obtained from the communication link has no meaning. As a result, the risk of eavesdropping on the contents of the call is eliminated for Internet telephone users, and the eavesdropper cannot know the success or failure of the decryption and continues the decryption work unnecessarily. As a result, the safety against eavesdropping of regular packets can be further improved.

  As described above, according to the second embodiment, since packet information that is originally required is distributed and transmitted to each communication link, the necessary packet information is distributed even if it is wiretapped. Decoding becomes difficult. In addition, both necessary packets and fake packets are subjected to a plurality of encryption processes, and it is not easy to decipher them.

The block diagram which shows the whole structure of typical embodiment of this invention. The block diagram which shows the detail of the encryption process part in a typical embodiment of this invention, and a transmission / reception control part. The schematic diagram which shows the transmission condition of the packet in typical embodiment of this invention. The block diagram which shows the detail of the encryption process part in the reference example of this invention, and a transmission / reception control part. The schematic diagram which shows the transmission condition of the packet in the reference example of this invention. The flowchart which shows operation | movement of the communication terminal of the transmission side in typical embodiment of this invention. The flowchart which shows operation | movement of the communication terminal of the receiving side in typical embodiment of this invention. The schematic diagram which shows the transmission condition of the packet in a prior art.

Explanation of symbols

A ... Transmission side communication terminal B ... Reception side communication terminal S ... Internet telephone service server N ... Network 1 ... Call control unit 2 ... Tone ringer 3 ... Dial 4 ... Transmitter 5 ... Receiver 6 ... Packet generation unit 7 ... Encryption Processing unit 8 ... transmission / reception control unit 9 ... authentication control unit 10 ... decryption processing unit 11 ... voice generation unit 20 ... pseudo packet generation unit 70 ... regular packet encryption processing units 71 to 74 ... pseudo packet encryption processing units 80 to 84 ... Regular / pseudo packet transmission / reception processor 90 ... Authentication information transmission / reception processor

Claims (4)

Formation of a regular communication link including a regular packet generation unit that packetizes regular communication data, a regular packet encryption processing unit that encrypts the generated regular packet, and a transmission / reception processing unit for the encrypted regular packet Means,
A pseudo packet generation unit that packetizes pseudo communication data that is meaningless as communication data, a pseudo packet encryption processing unit that encrypts the generated pseudo packet, and a transmission / reception processing unit for the encrypted pseudo packet Means for forming one or more pseudo communication links, a decryption processing unit for encrypted packets received via the network,
An authentication information transmission / reception processing unit for acquiring an encryption key necessary for packet encryption and decryption of the encrypted packet via a network;
Using the encryption key acquired by the authentication information transmission / reception processor, the encryption processor in the means for forming the regular communication link and the pseudo communication link performs different encryption processes, and the decryption processor A communication terminal device provided with an authentication control unit configured to execute a decryption process,
Packetized regular communication data by the regular packet generator,
A process of encrypting the packetized regular packet in the encryption processing unit with an encryption key acquired via the network by the authentication information transmission / reception processing unit;
The pseudo packet generation unit packetizes pseudo communication data which is meaningless as communication data,
A process for encrypting the packetized pseudo packet in the pseudo packet encryption processing unit using an encryption key different from the encryption key used for encrypting the regular packet;
A process of transmitting the encrypted normal packet and pseudo packet to other communication terminals on the network using a plurality of communication links by the normal packet transmission / reception processing unit and the pseudo packet transmission / reception processing unit;
On other communication terminals connected to the network,
A process of receiving the encrypted normal packet and the pseudo packet by using the plurality of communication links by the normal packet transmission / reception processing unit and the pseudo packet transmission / reception processing unit;
An encryption system in a communication link , wherein the received normal packet is decrypted by the decryption processing unit using an encryption key acquired by the authentication information transmission / reception processing unit via a network . Formation of a regular communication link including a regular packet generation unit that packetizes regular communication data, a regular packet encryption processing unit that encrypts the generated regular packet, and a transmission / reception processing unit for the encrypted regular packet Means,
A pseudo packet generation unit that packetizes pseudo communication data that is meaningless as communication data, a pseudo packet encryption processing unit that encrypts the generated pseudo packet, and a transmission / reception processing unit for the encrypted pseudo packet Means for forming one or more pseudo communication links, a decryption processing unit for encrypted packets received via the network,
An authentication information transmission / reception processing unit for acquiring an encryption key necessary for packet encryption and decryption of the encrypted packet via a network;
Using the encryption key acquired by the authentication information transmission / reception processor, the encryption processor in the means for forming the regular communication link and the pseudo communication link performs different encryption processes, and the decryption processor A communication terminal device comprising: an authentication control unit configured to execute a decryption process on the device. The regular packet transmission / reception processing unit outputs the received encrypted regular packet to the decryption processing unit,
The authentication control unit uses the encryption key acquired by the authentication information transmission / reception processing unit to decrypt the encrypted regular packet output to the decryption processing unit,
The communication terminal apparatus according to claim 2 , wherein the pseudo packet transmission / reception processing unit is configured to discard the received pseudo packet. It said normal packet generating unit, which packetizes the audio signal, according to claim 2, characterized in that the decryption processing unit of the packet is a voice generating unit for converting a signal packetized voice signal Or the communication terminal device of Claim 3 .

Images