JP5178269B2 - Decoding device and program - Google Patents

Description

  The present invention relates to an encryption device and a decryption device for concealing a packet during packet communication, and further relates to an encryption method, a decryption method, and a program for realizing this.

  As a feature of the external synchronous stream cipher apparatus, even if a bit error occurs in communication data, only that bit becomes an error and does not affect the subsequent processing. However, the internal state must always be synchronized between the encryption device and the decryption device during communication.

  FIG. 10 shows an encryption processing unit in an encryption device that performs packet encryption processing using the external synchronous stream encryption processing method.

First, the configuration will be described.
A01 is plaintext data (hereinafter simply referred to as plaintext).
A02 is key information such as a secret key for encrypting plaintext A01 and a storage destination address of IV (Initial Vector).
A03 is ciphertext data after cryptographic processing (hereinafter simply referred to as ciphertext).
A1 is a secret key / IV storage memory for storing a secret key and IV.
A2 is an intermediate key storage memory for storing an intermediate key MK for generating a key sequence.
A3 is a memory access management unit.
A4 is a key sequence generation unit.
A5 is an XOR (Exclusive OR) unit that performs exclusive OR of a key sequence and plaintext.
Here, the key sequence is a bit sequence with high randomness output from the key sequence generation unit A4. The encryption side generates a ciphertext by performing exclusive OR with the plaintext bit sequence, and the decryption side This is for generating plaintext by performing exclusive OR with a bit string of ciphertext.

Next, the operation will be described.
Before the packet communication, the opposite secret device and the same secret key and IV are shared and stored in the secret key / IV storage memory A1.
At the time of packet communication, when encrypting the plaintext A01, the memory access management unit A3 receives the key information A02, reads out the corresponding secret key and IV from the secret key / IV storage memory A1 based on this information, It is passed to the key sequence generation unit A4.
Upon receiving the secret key and IV, the key sequence generation unit A4 generates a key sequence used for encryption of the plaintext A01 and passes this to the XOR unit A5. The XOR unit A5 performs an exclusive OR of the plaintext A01 and the key sequence, and outputs a ciphertext A03.
Here, the intermediate key generated simultaneously with the generation of the last key sequence used for encryption is stored in the intermediate key storage memory A2.
10 illustrates the configuration of the encryption processing unit in the encryption device, the configuration is the same in the decryption device, and the configuration is such that the positions of plaintext A01 and ciphertext A03 in FIG. 10 are interchanged.

FIG. 11 shows the inside of the key sequence generation unit A4 in FIG.
First, the configuration will be described.
B0 is a key sequence generation unit.
B11 is a secret key and IV for generating a key sequence.
B12 is the generated key sequence.
B2 is a stirring function for improving the randomness of the input data.
B3 is an intermediate key.
Here, the intermediate key will be described.
The agitation function B2 receives the secret key and IV B11 as input, and performs the process again using the data obtained by executing the process as the input of the agitation function B2. Thereafter, by repeating this, the randomness of the key sequence obtained for each processing by the stirring function B2 is improved. One process by the stirring function B2 is called a round process, and the input data of the stirring function B2 between rounds is called an intermediate key.

Next, the operation of the key sequence generation unit B0 will be described.
FIG. 12 is a diagram showing the key sequence generation processing operation of the key sequence generation unit B0. First, initialization is performed with the secret key and IV B11 as inputs.
Initialization is to improve the randomness of the key sequence output by the agitation function B2 by performing a certain number of round processes. The number of round processing is different from the number recommended for each stream cipher algorithm.
Since the key sequence with high randomness can be obtained after the initialization is completed, the key sequences KC # 1, KC # 2,... Obtained for each subsequent round are used for encryption processing.
Simultaneously with the generation of the key sequence, an intermediate key serving as input data for the next round is obtained. The intermediate key after completion of initialization is MK # 1, and the intermediate key obtained for each subsequent round is MK # 2. MK # 3, and so on.
In the second and subsequent rounds, the secret key and IV B11 are not used, and a key sequence is generated using only the intermediate key obtained in the previous round.

Next, the operation during packet communication of a general external synchronous stream cipher apparatus will be described.
During packet communication, a plurality of key sequences are used per packet. The key sequences are used in the order of KC # 1, KC # 2,.
For example, when encryption is performed using KC # 1, KC # 2,..., KC # 30 in a certain packet, encryption is performed using KC # 31, KC # 32,. To do.
Similarly, the decryption device obtains the same key sequence as that of the encryption device and decrypts the packet.

As described above, in order to generate the same key sequence in packet encryption and decryption, the encryption device and the decryption device must match the intermediate key, which is referred to as “synchronization”.
When performing cryptographic communication with a relay apparatus such as a VPN (Virtual Private Network) apparatus, there is a method of managing an intermediate key with a memory or the like for synchronization.
This is because it is necessary to generate the key sequence KC by changing the secret key and IV for each communication tunnel.
Here, the communication tunnel refers to a virtual network for performing point-to-point communication and point-to-point communication by virtual communication in a public communication network such as the Internet.
Since a separate key sequence KC is used for each communication tunnel, in FIG. 10, the intermediate key storage memory A5 is used to temporarily save the intermediate key from the key sequence generation unit A4.
Further, by obtaining the intermediate key MK # 1 for each communication tunnel and storing it in the intermediate key storage memory A5 before communication, it is possible to hide the initialization time at the start of communication.

Moreover, there exists a technique of patent document 1 as a technique relevant to this invention.
JP-A-5-249891

As described above, in the external synchronous stream cipher, it is necessary to synchronize between the encryption device and the decryption device, and it is necessary to temporarily hold the intermediate key in a memory or the like when generating a key sequence for different communication tunnels. However, the decryption device needs to hold it in a memory or the like even when processing a packet using the same secret key.
For example, the decryption device receives packets P # 1, P # 2, and P # 3 (packets generated in the order of P # 1 → P # 2 → P # 3 from the same secret key) encrypted by the encryption device. When receiving, consider the case of receiving P # 3 first.
Originally, the decryption apparatus holds the intermediate key MK # 1 for P # 1 in a memory or the like, but does not have the intermediate key for P # 3. Therefore, it is necessary to perform a round process from MK # 1 to create an intermediate key for P # 3. However, it is unknown how many key sequences are required for P # 1 and P # 2, so how many It cannot be determined whether the MK after the round processing is for P # 3.

As a proposal to solve this problem, an identifier of MK used for P # 3 (for example, information of 101 when MK # 101 after 100 rounds is used in P # 3) is attached to P # 3 for communication. Can be considered.
However, in the middle of generating the intermediate key for P # 3, an intermediate key required for P # 2 is also generated, but for this, it is impossible to identify which MK is for P # 2. There is also a method of holding all MKs generated in all round processes during this period in the memory, but there is a problem that the amount of memory required is enlarged. As a workaround not to store in memory, a method of recalculating MK # 1 to MK # 2 when P # 2 is received can be considered. There is a problem that decreases.

Further, as a method for solving such a problem due to the external synchronization method, it is conceivable to use an internal synchronization stream cipher. The internal synchronous stream cipher apparatus is characterized in that the key sequence is generated in a form dependent on the ciphertext sequence, so that it is not necessary to synchronize the encryption device and the decryption device as in the external synchronization type.
However, if an error occurs in a bit in the ciphertext, there is a problem that the error spreads to other bits and the error is expanded, and further, a bit error in a packet affects the decryption of the other packet. there is a possibility.

  One of the main objects of the present invention is to solve the above-described problems, and is a case where the memory amount of the memory for storing the intermediate key is suppressed and the packet order is changed in the communication path. However, the main purpose is to realize a mechanism that can perform a decoding process with the same processing load and memory usage as in the normal order.

The encryption device according to the present invention is:
An intermediate key storage unit for storing the first intermediate key and the second intermediate key;
A key that generates a first key sequence using the first intermediate key stored in the intermediate key storage unit and generates a second key sequence using the second intermediate key stored in the intermediate key storage unit A sequence generator,
The plaintext data is encrypted by using the first key sequence generated by the key sequence generation unit to obtain ciphertext data, and the first intermediate key is encrypted by using the second key sequence generated by the key sequence generation unit And an encryption processing unit serving as an encrypted first intermediate key.

The decoding device according to the present invention provides:
Ciphertext data encrypted using the first key sequence generated from the first intermediate key, and encrypted first intermediate key encrypted using the second key sequence generated from the second intermediate key A receiving unit for receiving;
An intermediate key storage unit for storing the second intermediate key generated prior to reception of the ciphertext data and the encrypted first intermediate key;
A key sequence generation unit that generates a second key sequence using the second intermediate key stored in the intermediate key storage unit, and generates a first key sequence using the decrypted first intermediate key;
The encrypted first intermediate key is decrypted using the second key sequence generated by the key sequence generation unit to be a first intermediate key, and the ciphertext is generated using the first key sequence generated by the key sequence generation unit. And a decoding processing unit for decoding data.

  According to the present invention, by using the first intermediate key for concealing data and the second intermediate key for concealing the first intermediate key and communicating the concealed data and the concealed first intermediate key together, Only the second intermediate key needs to be managed, and the amount of memory for storing the intermediate key can be suppressed. Further, the second intermediate key used for decryption by the decryption device can be obtained in advance, and even when the packet order changes in the communication path, the processing load and memory equivalent to those in the normal order Decoding processing is possible with the amount used.

Embodiment 1 FIG.
A configuration example of the encryption device 1 according to the first embodiment is shown in FIG. 1, and a configuration example of the decryption device 2 is shown in FIG.

  First, an outline of operations of the encryption device 1 and the decryption device 2 according to the present embodiment will be described.

In the encryption device 1, the intermediate key MK1 (plain) is converted to the plaintext 101 using the intermediate key MK1 (plain), and the intermediate key MK1 (plain) is encrypted using the intermediate key MK2 which is another intermediate key. 104, the ciphertext 103 and the intermediate key MK (dark) 104 are combined and transmitted as a secret packet 105.
In the decryption device 2, the intermediate key MK2 is generated and stored in advance, and when the secret packet 105 is received, the intermediate key MK1 ( (Encryption) 201 is decrypted to be an intermediate key MK1 (flat), and the ciphertext 202 included in the secret packet 105 is decrypted to be a plaintext 204 by using the intermediate key MK1 (plain).
The decryption device 2 only needs to manage the intermediate key MK2, and the amount of memory for storing the intermediate key can be suppressed. Further, the intermediate key MK2 used for decryption by the decryption device 2 can be obtained in advance, and even when the packet order changes in the communication path, the processing load and memory equivalent to those in the normal order are obtained. Decoding processing is possible with the amount used.

Next, the configuration and operation of the encryption device 1 of FIG. 1 will be described in detail.
101 is plaintext.
Reference numeral 102 denotes key information such as a storage destination address of a key for encrypting the plaintext 101.
Reference numeral 103 denotes a ciphertext after the cryptographic process.
Reference numeral 104 denotes an intermediate key MK1 (dark) obtained by encrypting the intermediate key MK1 (plain) used in the first round when the plaintext 101 is encrypted with the intermediate key MK2.
Reference numeral 11 denotes a secret key / IV storage memory for storing a secret key and IV.
An intermediate key MK1 (plain) storage memory 12 stores an intermediate key MK1 (plain) used when encrypting the plaintext 101.
An intermediate key MK2 storage memory 13 stores an intermediate key MK2 used when encrypting the intermediate key MK1 (flat).
Reference numeral 14 denotes a memory access management unit.
Reference numeral 15 denotes a key sequence generation unit_1 that generates a key sequence for encrypting the plaintext 101 from the intermediate key MK1 (plain).
Reference numeral 16 denotes a key sequence generation unit_2 that generates a key sequence for encrypting MK1 (flat) from the intermediate key MK2.
Reference numeral 17 denotes an XOR unit_1 that performs an exclusive OR of the key sequence generated by the key sequence generation unit_1 and the plaintext 101.
Reference numeral 18 denotes an XOR unit_2 that performs exclusive OR of the key sequence generated by the key sequence generation unit_2 and the intermediate key MK1 (flat).
A transmission unit 19 transmits the ciphertext 103 and the intermediate key MK1 (dark) 104 together as a secret packet 105.

As described above, the key sequence is a bit sequence with high randomness output from the key sequence generation unit_1 15 and the key sequence generation unit_2 16, and performs exclusive OR with the plaintext bit sequence on the encryption side. Thus, the ciphertext is generated, and the decryption side generates the plaintext by performing an exclusive OR with the bit string of the ciphertext.
As will be described later, the key sequence generation unit_1 15 and the key sequence generation unit_2 16 generate an intermediate key using the secret key and IV before the plaintext 101 or the intermediate key MK1 (plain) is input. These correspond to the first key sequence generation unit and the second key sequence generation unit, respectively. The key sequences generated by the key sequence generation unit_1 15 and the key sequence generation unit_2 16 correspond to the first key sequence and the second key sequence.

The intermediate key MK1 (plain) storage memory and the intermediate key MK2 storage memory store the intermediate keys generated by the key sequence generation unit_115 and the key sequence generation unit_216, which are intermediate key generation units. Corresponds to the key storage unit.
The intermediate key MK1 (flat) stored in the intermediate key MK1 (flat) storage memory 12 corresponds to the first intermediate key, and the intermediate key MK2 stored in the intermediate key MK2 storage memory 13 is the second key. Corresponds to an intermediate key.
Further, the intermediate key MK1 (dark) 104 corresponds to an encrypted first intermediate key.

The XOR unit_1 17 receives the key sequence generated by the key sequence generation unit_115, and encrypts the plaintext 101 sequentially input, and corresponds to a first encryption processing unit.
Similarly, the XOR unit_2 18 receives the key sequence generated by the key sequence generation unit_2-16 and encrypts the intermediate key MK1 (flat) sequentially input. The second encryption processing unit It corresponds to.

  That is, in the encryption device 1 of the present embodiment, the key sequence generation unit_115 generates the intermediate key MK1 (plain) using one secret key and IV before the plaintext 101 is input, and the intermediate key The MK1 (plain) storage memory 12 stores the generated intermediate key MK1 (plain), and the key sequence generation unit_115 stores the plaintext 101 in the intermediate key MK1 (plain) storage memory 12. The stored intermediate key MK1 (flat) is input, a key sequence is generated from the input intermediate key MK1 (flat), and the XOR unit_1 17 receives the key sequence generated by the key sequence generation unit_115. The plaintext 101 is encrypted using the input key sequence.

  Similarly, before the intermediate key MK1 (flat) is input, the key sequence generation unit _ 2 16 generates the intermediate key MK2 using one secret key and IV different from the above, and the intermediate key MK2 storage memory 13 The generated intermediate key MK2 is stored, and the key sequence generation unit_2 16 inputs the intermediate key MK2 stored in the intermediate key MK2 storage memory 13 when the intermediate key MK1 (flat) is input. Then, the key sequence is generated from the input intermediate key MK2, and the XOR unit_2-18 inputs the key sequence generated by the key sequence generation unit_2216, and uses the input key sequence to generate the intermediate key MK1 (plain). Encryption is performed to obtain an intermediate key MK1 (dark) 104.

  Further, the generated ciphertext 103 and the intermediate key MK1 (dark) are combined in the transmission unit 19 and output as a secret packet 105 to the communication path. For example, in IPsec, which is a standard for general packet encryption communication, the combined ciphertext 103 and intermediate key MK1 (dark) are output to the communication path as the ESP payload area of the IPsec packet.

  In addition, there are two key sequence generation units and two XOR units, which are key sequence generation and XOR processing for encryption of plaintext 101, and key sequence generation for encryption of intermediate key MK1 (plain). And XOR processing are effective in increasing the speed by pipeline processing.

Next, the configuration of the decoding device 2 is shown in FIG.
A receiving unit 29 receives the secret packet 105 transmitted from the encryption device 1 and extracts the intermediate key MK1 (dark) 201 and the ciphertext 202 from the secret packet 105.
Reference numeral 201 denotes an intermediate key MK1 (dark) obtained by encrypting the intermediate key MK1 (flat) used for decrypting the ciphertext 202 with the intermediate key MK2 in the encryption device 1. As described above, the intermediate key MK1 (dark) 201 is extracted from the secret packet 105 by the receiving unit 29.
Reference numeral 202 denotes a ciphertext encrypted by the encryption device 1 using the intermediate key MK1 (flat). As described above, the ciphertext 202 is extracted from the secret packet 105 by the receiving unit 29.
203 is key information such as a storage destination address of a key for decrypting the intermediate key MK1 (dark) 201 and the ciphertext 202.
204 is the plaintext after decryption.
An intermediate key MK2 update management unit 21 determines whether or not to newly calculate the intermediate key MK2 every time the packet is decrypted.
Reference numeral 22 denotes a secret key / IV storage memory for storing a secret key and IV.
An intermediate key MK2 storage memory 23 stores an intermediate key MK2 used when decrypting the intermediate key MK1 (dark) 201.
Reference numeral 24 denotes a memory access management unit.
Reference numeral 25 denotes a key sequence generation unit_1 that generates a key sequence for decrypting the intermediate key MK1 (dark) from the intermediate key MK2.
Reference numeral 26 denotes a key sequence generation unit_2 that generates a key sequence for decrypting the ciphertext 202 from the intermediate key MK1 (flat).
Reference numeral 27 denotes an XOR unit_1 that performs an exclusive OR of the key sequence generated by the key sequence generation unit_1 and the plaintext 101.
Reference numeral 28 denotes an XOR unit_2 that performs an exclusive OR of the key sequence generated by the key sequence generation unit_2 and the intermediate key MK1 (flat).

  That is, in the decryption device 2 of the present embodiment, the key sequence generation unit_125 generates the intermediate key MK2 using one secret key and IV before the intermediate key MK1 (dark) 201 is input, The intermediate key MK2 storage memory 23 stores the generated intermediate key MK2, and the key sequence generation unit_125 is stored in the intermediate key MK2 storage memory 23 when the intermediate key MK1 (dark) 201 is input. The intermediate key MK2 is input, a key sequence is generated from the input intermediate key MK2, and the XOR unit — 127 receives the key sequence generated by the key sequence generation unit — 25 and uses the input key sequence The intermediate key MK1 (dark) 201 is decrypted.

  Subsequently, when the ciphertext 202 is input, the key sequence generation unit_2226 inputs the previously decrypted intermediate key MK1 (flat), and generates a key sequence from the input intermediate key MK1 (flat). The XOR unit_2 28 receives the key sequence generated by the key sequence generation unit_2 226, decrypts the ciphertext 202 using the input key sequence, and obtains the plaintext 204.

  In addition, there are two key sequence generation units and two XOR units. This is a key sequence generation and XOR process for decrypting the intermediate key MK1 (dark) 201, and a key sequence generation for decrypting the ciphertext 202. And XOR processing are effective in increasing the speed by pipeline processing.

  The intermediate key MK2 update management unit 21 determines whether or not the received packet from the key information 203 is the latest (the latest packet encrypted by the encryption device 1) in the communication tunnel. In the latest case, the memory access management unit 24 reads the latest intermediate key MK2 stored in the intermediate key MK2 storage memory, generates a new intermediate key MK2 by the key sequence generation unit_125, and the memory access management unit 24 In the intermediate key MK2 storage memory.

In the decryption device 2, the intermediate key MK2 storage memory 23 corresponds to an intermediate key storage unit. The intermediate key MK2 stored in the intermediate key MK2 storage memory 23 corresponds to the second intermediate key.
Further, the key sequence generation unit_125 corresponds to a first key sequence generation unit, and the key sequence generation unit_2_226 corresponds to a second key sequence generation unit. Note that the key sequence generated by the key sequence generation unit_125 corresponds to the second key sequence, and the key sequence generated by the key sequence generation unit_226 corresponds to the first key sequence.
Further, the XOR section_1 127 corresponds to a first decoding processing section, and the XOR section_2_28 corresponds to a second decoding processing section.

  Next, with respect to the present embodiment, the initialization operation performed before packet communication will be described with reference to the flowchart of FIG.

The memory access management unit 14 reads out the secret key and IV from the secret key / IV storage memory 11 (S401), and passes them to the key sequence generation unit_115 waiting for processing.
The key sequence generation unit_1 15 performs round processing from the received secret key and IV to a round just before generating a key sequence usable for encryption, and generates an intermediate key MK1 (flat) (S402) (intermediate) Key MK1 (flat) generation step).
Then, the key sequence generation unit_1 15 passes the finally obtained intermediate key MK1 (flat) to the memory access management unit 14, and the memory access management unit 14 passes the intermediate key MK1 (flat) to the intermediate key MK1 (flat). Saving in the saving memory 12 (S403) (intermediate key MK1 (flat) saving step).
The above intermediate key generation process is performed for a combination of one secret key and one IV.
Subsequently, the memory access management unit 14 reads out a secret key and IV different from those used above from the secret key / IV storage unit 11 (S404), and passes them to the key sequence generation unit_216 that is waiting for processing.
The key sequence generation unit_2 16 performs round processing from the received secret key and IV to a round immediately before generating a key sequence usable for encryption, and generates an intermediate key MK2 (S405) (intermediate key MK2 generation) Step).
Then, the key sequence generation unit_216 passes the finally obtained intermediate key MK2 to the memory access management unit 14, and the memory access management unit 14 stores the intermediate key MK2 in the intermediate key MK2 storage memory 13 (S406). (Intermediate key MK2 storage step).
As described above, S401 to S406 are performed for each communication tunnel (S407).

  Next, the initialization operation performed before packet communication will be described with reference to the flowchart of FIG.

The memory access management unit 24 reads the secret key and IV from the secret key / IV storage memory 22 (S501), and passes this to the key sequence generation unit_125 waiting for processing.
The key sequence generation unit_1 25 performs round processing from the received secret key and IV to the round just before generating a key sequence that can be used for encryption, and generates an intermediate key MK2 (S502) (generate intermediate key MK2) Step).
Here, the intermediate key MK2 used for decrypting the intermediate key MK1 (encryption) added to the packet encrypted first by the encryption device is set to MK2_1. The intermediate keys MK2 used to decrypt the added intermediate key MK1 (dark) are MK2_2, MK2_3,.
When the number of intermediate keys MK2 to be generated before communication is n, the larger the value of n, the more the same as when the packets are received in the normal order even when a larger packet order change occurs on the communication path. Decoding is possible by processing.
However, if the value of n is increased, the size of the intermediate key MK2 storage memory 23 required in proportion thereto increases.
Here, n = 32, and MK2_1 to MK2_32 are generated and stored in the private key / IV storage memory 22 by the key sequence generation unit_125 before communication. (Intermediate key MK2 storage step) (S503).
The above intermediate key generation process is performed for a combination of one secret key and one IV. S501 to S503 are performed for each communication tunnel (S504).

  Next, the operation at the time of packet communication will be described with reference to the flowchart of FIG.

In encrypting the plaintext 101, the memory access management unit 14 receives key information 102 used for encryption (S601), and based on this information, the corresponding intermediate key MK1 (from the intermediate key MK1 (plain) storage memory 12) (Plain) (the private key corresponding to the plaintext 101 to be encrypted and the intermediate key MK1 (plain) generated by IV) are read (S602), and this is transferred to the key sequence generation unit_115 waiting for processing.
The key sequence generation unit_1 15 that has received the intermediate key performs round processing a plurality of times using the intermediate key MK1 (plain) as an input, and generates a plurality of key sequences used for encryption of the plaintext 101 (S603). (Key sequence generation step).
The key sequence generation unit_1 15 passes the generated plurality of key sequences to the XOR unit_1 17, and the XOR unit_1 17 performs exclusive OR of the plaintext and the key sequence, and outputs the ciphertext 103 (S604) ( Cryptographic processing step).
The XOR unit_1 17 transfers the intermediate key MK1 (flat) generated simultaneously with the generation of the ciphertext 103 to the memory access management unit 14 and the XOR unit_2-18.
The memory access management unit 14 overwrites and stores the intermediate key MK1 (flat) in the intermediate key MK1 (flat) storage memory 12 (intermediate key MK1 (flat) storage step) (S605).
Based on the key information 102, the memory access management unit 14 reads the corresponding intermediate key MK2 from the intermediate key MK2 storage memory 13 (the secret key corresponding to the intermediate key MK1 (flat) to be encrypted and the intermediate key MK2 generated by IV). ) Is read (S606), and this is transferred to the key sequence generation unit _216 that is waiting for processing.
Upon receiving the intermediate key MK2, the key sequence generation unit _ 216 performs a round process a plurality of times using the intermediate key MK2 as an input, and generates a plurality of key sequences used for encryption of the intermediate key MK1 (flat) ( S607) ((Intermediate key MK1 (flat)) key sequence generation step).
The key sequence generation unit_2 16 passes the generated plurality of key sequences to the XOR unit_2-18, and the XOR unit_2-18 performs an exclusive OR of the intermediate key MK1 (flat) and the key sequence to obtain the intermediate key MK1 (dark key). ) 104 is output (S608) ((intermediate key MK1 (flat)) encryption processing step).
The memory access management unit 14 overwrites and stores the intermediate key MK2 in the intermediate key MK2 storage memory 13 (intermediate key MK2 storage step) (S609).
If there is a next packet to be encrypted, S601 to S609 are repeated (S610).
When there are no more packets to be encrypted, the transmission unit 19 transmits the packet as a secret packet 105.
The above is the operation of the encryption device.

  Next, the operation of the decoding device 2 will be described along the flowchart of FIG.

First, the receiving unit 29 receives the secret packet 105 transmitted from the encryption device 1, and extracts the intermediate key MK1 (dark) 201 and the ciphertext 202 from the secret packet 105 (S700).
Next, when decrypting MK1 (dark) 201, the memory access management unit 24 receives key information 203 used for decryption (S701), and based on this information, the corresponding intermediate key MK2 from the intermediate key MK2 storage memory 23 is received. (The private key corresponding to the ciphertext 202 to be decrypted and the intermediate key MK2_A generated by IV are read (S702), and this is passed to the key sequence generation unit_125 waiting for processing.
Receiving the intermediate key MK2_A, the key sequence generation unit_1 25 performs a plurality of round processes with the intermediate key MK2_A as an input, and generates a plurality of key sequences used for decrypting the intermediate key MK1 (dark) 201 ( S703) (Key sequence generation step for intermediate key MK1 (flat)) (first key sequence generation step).
The key sequence generation unit_1 25 passes the generated plurality of key sequences to the XOR unit_1 27, and the XOR unit_1 27 performs an exclusive OR of the intermediate key MK1 (dark) 201 and the key sequence to obtain the intermediate key MK1 ( Is output (S704) (intermediate key MK1 (flat) decryption processing step) (first decryption processing step).
The XOR unit_1 27 passes the intermediate key MK1 (flat) to the key sequence generation unit_2226.
Receiving the intermediate key MK1 (flat), the key sequence generation unit _ 226 performs round processing for the intermediate key MK1 (flat) a plurality of times, and generates a plurality of key sequences used for decrypting the ciphertext 202 ( S705) (second key sequence generation step).
The key sequence generation unit_2 26 passes the generated plurality of key sequences to the XOR unit_2 28, and the XOR unit_2 28 performs exclusive OR of the ciphertext 202 and the key sequence, and outputs the plaintext 204 (S706). (Second decoding processing step).

Here, the intermediate key MK2 update management unit 28 determines whether or not the decrypted packet is the latest packet in the tunnel from the key information 203 (S707). An instruction is issued to the memory access management unit 24.
The memory access management unit 24 reads the intermediate key MK2_N capable of generating the latest key sequence for the tunnel from the private key / IV storage memory 22 (S708), and passes this to the key sequence generation unit_125.
N = N + 1 is set (S709), and the key sequence generation unit_1 25 performs round processing to generate an intermediate key MK2_N (S710), and passes this to the memory access management unit 24.
The memory access management unit 24 stores MK2_N in the intermediate key MK2 storage memory 13 (S711). Here, when N of the generated intermediate key MK2_N is smaller than a certain number (W) by A of the intermediate key MK2_A used in the latest decryption, S709 to S711 are repeated (S712). Here, the value of W is related to how many orders change from the latest received packet to the same process as the normal order process, and for each tunnel prepared before the previous communication. It is desirable to match the number n of intermediate keys MK2.
The above is a flow for decoding one packet, and when there is a next packet after performing the steps up to here, S701 to S712 are repeated (S713).

The configuration of the intermediate key MK2 storage memory is shown in FIG.
A secret key and IV are prepared for each communication tunnel (virtual network), and an area for storing the secret key and the intermediate key MK2 generated from the IV is provided.
In FIG. 3, the number of communication tunnels to be managed is L.
If each communication tunnel (virtual network) has a plurality of intermediate keys MK2, and the notation is MK2_a_b, it is assumed that the communication tunnel number a is the b-th intermediate key MK2.
Since one intermediate key MK2 corresponds to one packet, for example, when performing encrypted communication with IPsec, the IPsec sequence number added to each packet corresponds to the value b, and which MK2_a_b is used in which packet It can be determined whether it should be done.

For example, when 32 intermediate keys MK2 are obtained for each communication tunnel before communication, the communication tunnel number 1 holds MK2_1_1 to MK2_1_32.
Here, if the value of M in FIG. 3 is 64, a maximum of 64 intermediate keys MK2 can be held for each communication tunnel.
When communication is started, the intermediate keys generated in advance are basically consumed in order from the lowest number of b, so it is necessary to generate a new intermediate key MK2_1_33 or later as appropriate.
Once MK2_1_64 is generated and stored in the corresponding area, the MK2_1_65 cycles around and uses the memory area so as to overwrite the area of MK2_1_1.

Next, an example of how to use the intermediate key MK2 storage memory 23 will be shown.
First, it is assumed that MK2_1_1 to MK2_1_32 are stored in the intermediate key MK2 storage memory 23.
When packets are received in the order encrypted in the communication tunnel 1, when no packets are received yet, it is expected that MK2_1_1 will be received next, and 32 packets are considered in the order change. The previous MK2_1_32 is held.
When the packet corresponding to MK2_1_1 is received and decrypted, the next packet that is expected to be received is the packet corresponding to MK_2_1_2. Therefore, MK2_1_33 is generated in consideration of up to 32 destinations, and the intermediate key MK2 is stored. Save to memory.
Subsequently, it is assumed that the packet order changes in the communication path and a packet using MK2_10 is received.
This intermediate key becomes unnecessary after using MK2_1_10, but MK2_1_2 to MK2_1_9 are unused, so it is necessary to leave them in the intermediate key storage memory in consideration of the possibility of receiving packets that use them in the future. There is.
Further, considering that it corresponds to the order change from MK2_1_1 to 32 ahead, MK2_1_34 to MK2_1_42 are generated and stored in the intermediate key MK2 storage memory.
As described above, by performing memory management in consideration of dealing with packets encrypted from the previous Q packets to the previous S packets with the latest received packet as a reference, the order in more communication channels can be changed. It is thought that it can respond.
As in the IPsec sequence number check, it is appropriate to set Q to about several tens, and unconditionally discard it without decoding when Q or more packets are received to prevent a replay attack.
In the previous example, since 64 MK2 storage areas are provided for each communication tunnel, assuming that the number of the packet having the latest sequence number received so far is k, the intermediate key storage memory has MK2_1_k-31 to MK2_1_k + 32 It is desirable to always save.

In this way, the intermediate key MK2 storage memory 23 can store Q + S + 1 (Q ≧ 1, S ≧ 1) intermediate keys MK2, and the key sequence generation unit_125 receives the latest ciphertext from the reception unit 29. Every time it is received, an ungenerated intermediate key MK2 is generated from the intermediate keys MK2 to S ahead of the intermediate key MK2 corresponding to the latest ciphertext received by the receiving unit 29.
Then, the intermediate key MK2 storage memory 23 stores the intermediate key MK2 generated by the key sequence generation unit_125 following the last intermediate key MK2 currently stored, and the latest received by the reception unit 29. Discard Q or more intermediate keys MK2 before the intermediate key MK2 corresponding to the ciphertext.

  The above is the basic processing flow of the encryption device 1 and the decryption device 2 shown in FIGS.

Next, the processing load when the packet order changes in the communication path in the present embodiment will be described.
In the present embodiment, the decryption process in the decryption device 2 is not particularly different in the processing load and memory usage from when received in the correct order, even when the order of received packets is not in the order of encryption.
For example, when encryption is performed in the order of packet P # 1, packet P # 2, and packet P # 3 by encryption device 1, packet P # 3 is received before packet P # 1 and packet P # 2. However, it is only necessary to read out the corresponding intermediate key MK2 from the intermediate key MK2 storage memory and generate a key sequence for decrypting the intermediate key MK1 (dark) in P # 3.

Conventionally, when a packet has not arrived, a key sequence for the unarrived packet is generated from the intermediate key for the unarrived packet, and a key for the next packet is generated from the intermediate key generated when generating the key sequence for the unarrived packet. A series was generated. For this reason, it is necessary to separately hold the key sequence for the unarrived packet in the memory until the unarrived packet arrives. However, it is not necessary to hold the key sequence for the unarrived packet in the memory.
This is because MK1 (dark) that is the decoding target of MK2 has a fixed length.
Since it is possible to obtain the intermediate key MK2 to be used in advance on the decryption side, it is possible to retain the key sequence at the time of a change of order, which is a problem with the conventional method, by preliminarily retaining it in a memory or the like. There is no need for special measures such as preparing memory for storage.

As described above, according to the method of the present embodiment, the intermediate key MK2 used for decryption by the decryption device can be obtained in advance, and even if the packet order changes in the communication path, This can be handled by a decoding process equivalent to that in the normal order.
In addition, since the system of the present embodiment is an external synchronous stream encryption system, even if an error occurs in a bit in the ciphertext, the error is spread to other bits as in the internal synchronous stream encryption system. There is no problem of enlargement.

  In the present embodiment, the intermediate key 1 for concealing data and the intermediate key 2 for concealing the intermediate key 1 are used, and the intermediate key 1 concealed together with the concealed data is communicated as a concealment packet, so that the intermediate side on the decryption side The stream cipher implementation method that facilitates synchronization between the encryption device and the decryption device by managing only the key 2 has been described.

  Further, in the present embodiment, the decryption device stores one intermediate key 2 corresponding to a packet that may be received in the future in one memory or the like, thereby reducing the memory usage capacity. Explained the cryptographic implementation method.

  In the present embodiment, the decryption device previously calculates the intermediate key 2 corresponding to a packet that may be received in the future and stores it in a memory or the like, so that the order of the packets can be changed in the communication path. We have described a stream cipher implementation method that can ensure the same performance as when received in the correct order when it occurs.

Embodiment 2. FIG.
As other embodiments, configurations such as the encryption device 8 shown in FIG. 8 and the decryption device 9 shown in FIG. 9 are also conceivable.
The encryption device 8 has a configuration in which the key sequence generation unit_115, the key sequence generation unit_2 16, and the XOR unit_1 17 and the XOR unit_2 18 in FIG. 1 are provided one by one, and the decryption device 9 has the key sequence generation unit in FIG. _ 1 25, key sequence generation unit _ 26, XOR unit _ 1 27, and XOR unit _ 2 28.

In the configuration of FIG. 8, the key sequence generation unit and the XOR unit are shared and used for encryption of plaintext and intermediate key MK1 (plain).
Similarly, in the configuration of FIG. 9, the key sequence generation unit and the XOR unit are shared and used for decryption of the ciphertext and the intermediate key MK1 (dark).
Since the pipeline processing of the key sequence generation processing and the XOR processing cannot be performed, the processing performance is inferior to that of the embodiment of FIG. 1 or FIG. 2, but is the same as that of Embodiment 1 in that the synchronization between the encryption device and the decryption device is facilitated. effective.

Finally, a hardware configuration example of the encryption devices 1 and 8 and the decryption devices 2 and 9 shown in the first and second embodiments will be described.
FIG. 13 is a diagram illustrating an example of hardware resources of the encryption devices 1 and 8 and the decryption devices 2 and 9 described in the first and second embodiments.
The configuration in FIG. 13 is merely an example of the hardware configuration of the encryption devices 1 and 8 and the decryption devices 2 and 9, and the hardware configuration of the encryption devices 1 and 8 and the decryption devices 2 and 9 is as shown in FIG. The configuration described above is not limited, and other configurations may be used.

In FIG. 13, the encryption devices 1 and 8 and the decryption devices 2 and 9 include a CPU 1911 (also referred to as a central processing unit, a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, and a processor) that executes a program. Yes.
The CPU 1911 is connected to, for example, a ROM (Read Only Memory) 1913, a RAM (Random Access Memory) 1914, a communication board 1915, a display device 1901, a keyboard 1902, a mouse 1903, and a magnetic disk device 1920 via the bus 1912. Control hardware devices.
Further, the CPU 1911 may be connected to an FDD 1904 (Flexible Disk Drive), a compact disk device 1905 (CDD), a printer device 1906, and a scanner device 1907. Further, instead of the magnetic disk device 1920, a storage device such as an optical disk device or a memory card (registered trademark) read / write device may be used.
The RAM 1914 is an example of a volatile memory. The storage media of the ROM 1913, the FDD 1904, the CDD 1905, and the magnetic disk device 1920 are an example of a nonvolatile memory. These are examples of the storage device.
A communication board 1915, a keyboard 1902, a mouse 1903, a scanner device 1907, an FDD 1904, and the like are examples of input devices.
The communication board 1915, the display device 1901, the printer device 1906, and the like are examples of output devices.

  The communication board 1915 is connected to the network. For example, the communication board 1915 is connected to a LAN (Local Area Network), the Internet, a WAN (Wide Area Network), or the like.

The magnetic disk device 1920 stores an operating system 1921 (OS), a window system 1922, a program group 1923, and a file group 1924.
The programs in the program group 1923 are executed by the CPU 1911 using the operating system 1921 and the window system 1922.

Further, the RAM 1914 temporarily stores at least a part of the operating system 1921 program and application programs to be executed by the CPU 1911.
The RAM 1914 stores various data necessary for processing by the CPU 1911.

The ROM 1913 stores a BIOS (Basic Input Output System) program, and the magnetic disk device 1920 stores a boot program.
When the encryption devices 1 and 8 and the decryption devices 2 and 9 are activated, the BIOS program in the ROM 1913 and the boot program in the magnetic disk device 1920 are executed, and the operating system 1921 is activated by the BIOS program and the boot program.

  The program group 1923 stores programs for executing the functions described as “˜units” in the description of the first and second embodiments. The program is read and executed by the CPU 1911.

In the file group 1924, in the description of the first and second embodiments, “determination of”, “calculation of”, “calculation of”, “comparison of”, “generation of”, “update of” ”,“ Setting of ”,“ registration of ”,“ selection of ”, etc., information, data, signal values, variable values, and parameters indicating the results of the processing are represented by“ ˜file ”or“ ˜ It is stored as each item of “Database”.
The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 1911 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, editing, output, printing, and display.
Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
The arrows in the flowcharts described in the first and second embodiments mainly indicate input / output of data and signals. The data and signal values are the RAM 1914 memory, the FDD 1904 flexible disk, the CDD 1905 compact disk, and the magnetic field. Recording is performed on a recording medium such as a magnetic disk of the disk device 1920, other optical disks, mini disks, and DVDs. Data and signals are transmitted online via a bus 1912, signal lines, cables, or other transmission media.

  In addition, what is described as “˜unit” in the description of the first and second embodiments may be “˜circuit”, “˜device”, “˜device”, and “˜step”, It may be “˜procedure” or “˜processing”. That is, what is described as “˜unit” may be realized by firmware stored in the ROM 1913. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 1911 and executed by the CPU 1911. That is, the program causes the computer to function as the “˜unit” in the first and second embodiments. Alternatively, the computer executes the procedure and method of “to unit” in the first and second embodiments.

  As described above, the encryption devices 1 and 8 and the decryption devices 2 and 9 shown in the first and second embodiments include a CPU as a processing device, a memory as a storage device, a magnetic disk, a keyboard as an input device, a mouse, a communication board, and the like. The computer includes a display device, a communication board, and the like as an output device, and implements the functions indicated as “˜units” using the processing device, the storage device, the input device, and the output device as described above.

2 is a diagram illustrating a configuration example of an encryption device according to Embodiment 1. FIG. 3 is a diagram illustrating a configuration example of a decoding device according to Embodiment 1. FIG. 3 is a diagram illustrating an internal configuration example of an intermediate key MK2 storage memory according to Embodiment 1. FIG. FIG. 6 is a flowchart showing an operation example at the time of initialization of the cryptographic apparatus according to the first embodiment. FIG. 10 is a flowchart showing an operation example at the time of initialization of the decoding apparatus according to the first embodiment. FIG. 6 is a flowchart illustrating an operation example during communication of the encryption device according to the first embodiment. FIG. 10 is a flowchart showing an operation example during communication of the decoding apparatus according to the first embodiment. 6 is a diagram illustrating a configuration example of a cryptographic device according to a second embodiment. FIG. FIG. 10 is a diagram illustrating a configuration example of a decoding device according to a second embodiment. It is an internal block diagram of the general encryption processing part by the stream encryption based on a prior art. It is an internal block diagram of the key sequence generation part which concerns on a prior art. It is a figure which shows the key sequence generation image of the key sequence generation part which concerns on a prior art. 3 is a diagram illustrating a hardware configuration example of an encryption device and a decryption device according to Embodiments 1 and 2. FIG.

Explanation of symbols

  1 encryption device, 2 decryption device, 8 encryption device, 9 decryption device, 11 secret key / IV storage memory, 12 intermediate key MK1 (plain) storage memory, 13 intermediate key MK2 storage memory, 14 memory access management unit, 15 key sequence Generation unit_1, 16 Key sequence generation unit_2, 17 XOR unit_1, 18 XOR unit_2, 19 Transmission unit, 21 Intermediate key MK2 update management unit, 22 Private key / IV storage memory, 23 Intermediate key MK2 storage memory, 24 memory Access management unit, 25 key sequence generation unit_1, 26 key sequence generation unit_2, 27 XOR unit_1, 28 XOR unit_2, 29 reception unit, 81 secret key / IV storage memory, 82 intermediate key MK1 (plain) storage memory, 83 Intermediate key MK2 storage memory, 84 Memory access management unit, 85 Key sequence generation unit_1, 86 XOR unit_1, 87 Transmission unit, 9 1 intermediate key MK2 update management unit, 92 secret key / IV storage memory, 93 intermediate key MK2 storage memory, 94 memory access management unit, 95 key sequence generation unit_1, 96 XOR unit_1, 97 receiving unit, 101 plaintext, 102 key Information, 103 Ciphertext, 104 Intermediate Key MK1 (Dark), 105 Secret Packet, 201 Intermediate Key MK1 (Dark), 202 Ciphertext, 203 Key Information, 204 Plaintext, 801 Plaintext, 802 Key Information, 803 Ciphertext, 804 Intermediate Key MK1 (dark), 805 secret packet, 901 intermediate key MK1 (dark), 902 ciphertext, 903 key information, 904 plaintext.

Claims (7)

Ciphertext data encrypted using the first key sequence generated from the first intermediate key and ciphertext obtained by encrypting the first intermediate key using the second key sequence generated from the second intermediate key A receiving unit for receiving the first intermediate key;
An intermediate key storage unit for storing the second intermediate key generated prior to reception of the ciphertext data and the encrypted first intermediate key;
A key sequence generation unit that generates a second key sequence using a second intermediate key stored in the intermediate key storage unit;
A decryption processing unit that decrypts the encrypted first intermediate key using the second key sequence generated by the key sequence generation unit and sets the first intermediate key as a first intermediate key;
The key sequence generation unit
Generating a first key sequence using the first intermediate key decrypted by the decryption processing unit;
The decryption processing unit
Decrypting the ciphertext data using the first key sequence generated by the key sequence generation unit ;
The receiver is
Receive multiple ciphertext data with a specified data order in random order,
The intermediate key storage unit
A plurality of second intermediate keys are stored in association with the data order of the ciphertext data,
The decoding device further includes:
An intermediate key update management unit that determines the data order of the ciphertext data received by the receiving unit;
The key sequence generation unit
A second key sequence is generated using a second intermediate key corresponding to the data order determined by the intermediate key update management unit among a plurality of second intermediate keys stored in the intermediate key storage unit. A decoding device. The key sequence generation unit
When the intermediate key update management unit determines that the ciphertext data received by the receiving unit is the latest ciphertext data, the second intermediate key stored in the intermediate key storage unit is used. Generating one or more second intermediate keys used for decryption of ciphertext data received by the receiving unit thereafter;
The intermediate key storage unit
The decryption apparatus according to claim 1 , wherein the second intermediate key generated by the key sequence generation unit is stored. The intermediate key storage unit
Q + S + 1 (Q ≧ 1, S ≧ 1) second intermediate keys can be stored,
The key sequence generation unit
Each time the receiving unit receives the latest ciphertext data, the second non-generated second key from the second intermediate key to the S-th second intermediate key corresponding to the latest ciphertext data received by the receiving unit. Generate an intermediate key,
The intermediate key storage unit
The second intermediate key generated by the key sequence generation unit is stored following the last second intermediate key currently stored, and the second cipher corresponding to the latest ciphertext data received by the reception unit The decryption apparatus according to claim 2 , wherein the second intermediate key Q or more before the key is discarded. The key sequence generation unit
One new second intermediate key is generated using the last second intermediate key stored in the intermediate key storage unit. Thereafter, a new second intermediate key is further generated from the newly generated second intermediate key. 4. The decryption apparatus according to claim 3 , wherein the second intermediate key that has not been generated is generated by repeating the generation. The receiver is
Receive ciphertext data from each of multiple virtual networks,
The intermediate key storage unit
The decryption apparatus according to claim 1, wherein a second intermediate key is stored for each virtual network. The key sequence generation unit
A first key sequence generation unit that generates a second key sequence by using the second intermediate key stored in the intermediate key storage unit, and a first key sequence by using the decrypted first intermediate key A second key sequence generation unit,
The decryption processing unit
A first decryption processing unit that decrypts the encrypted first intermediate key using the second key sequence generated by the first key sequence generation unit, and a first generated by the second key sequence generation unit decoding apparatus according to claim 1, characterized in that it comprises a second decoding unit for decoding the encrypted data using the key sequence. A program for causing a computer to function as the decoding device according to claim 1 .

Images