JPH0439935B2 - - Google Patents

Description

Detailed Description of the Invention (Field of Industrial Application) The present invention relates to a cryptographic communication method for encrypting and communicating information transmitted between terminal devices, and in particular to a data encryption key for encrypting information. Concerning cryptographic communication methods with characteristics in generation and delivery.

(Prior Art) Conventionally, as shown in Fig. 2, when encrypted transmission is performed between a master station A and a slave station B using a conventional encryption system, a key for encrypting data on a transmission path, that is, a data encryption key is used. The KS needs to be exchanged every time encrypted communication is performed from the viewpoint of encryption strength, and the central processing unit (not shown) of the main station A uses a known algorithm, for example, the multiplicative congruence method, i.e. x _o+1 = λ・
x _o (modP)) n=0, 1, 2,.../x ₀ , x ₁ ,...
...x _o , x _o+1 are random numbers, λ and P are integer constants,
The initial value X ₀ is an integer less than or equal to P. ) is generated as a non-reproducible pseudo-random number and distributed between master station A and slave station B as a data encryption key E _KM (KS) encrypted with a common secret master key KM. and the slave station uses E _KM (KS) as the master key.
Decrypt with KM to obtain data encryption key KS.

Thereafter, master station A encrypts the transmission information DATA with KS using the data encryption key KS obtained by decrypting E _KM (KS), and transmits E _KS (DATA) to slave station B.
Slave station B decodes E _KS (DATA) using KS and obtains transmission information DATA.

(Problem to be Solved by the Invention) However, in order to generate a data encryption key and distribute it between master station A and slave station B using the method described above, software processing is required for each encrypted communication. It is necessary to perform n-digit multiplication and modulus calculations (n is the maximum number of digits that can be processed by the central processing unit of the main station), which increases the load on the central processing unit of the main station and takes time to process. It has the disadvantage that it requires a lot of time, and also has the disadvantage that transmission efficiency is poor because delivery is performed each time.

An object of the present invention is to eliminate the problems of the conventional methods described above and to provide a cryptographic communication system that has a high-speed encryption key generation and delivery method for data with strong cryptographic strength.

(Means for Solving Problems) According to the present invention, when a master station and a slave station are each provided with a cryptographic processing section and data communication is performed between the master station and the slave station, the cryptographic processing section of the transmitting station encrypts the data. In an encrypted communication method in which transmitted data is encrypted using an encryption key, and received data is decrypted using the data encryption key in an encryption processing section of a receiving station, the data encryption key is encrypted in a master station and a slave station. Alternatively, a storage unit is provided to store a master key for decryption, and the encryption processing unit of the main station is used to generate a data encryption key that generates multiple data encryption keys using the encryption function of the encryption processing unit. Prior to data communication, the main station activates the data encryption key generation section to generate a plurality of data encryption keys, stores the keys in its own memory, and thereby transmits data to the main station. The master station sets multiple data encryption keys. Next, the master station sequentially encrypts its own multiple data encryption keys using its own master key, and then transmits them all to the slave station. , When receiving data is decrypted using the own station's master key and stored in the own station's memory, multiple data encryption keys are set on the slave station, and data communication is performed between the master station and the slave station. , the transmitting station selects a specific data encryption key from its own memory, encrypts transmission data using the data encryption key, and adds data specifying the data encryption key to the encrypted transmission data. The receiving station selects a specific data encryption key from its own memory based on the data specifying the data encryption key, and decrypts the transmitted data using the data encryption key. An encrypted communication method characterized by:

(Operation) According to the present invention, data encryption keys for a plurality of blocks are installed in common in the master station and the slave station in advance. The data encryption key for which block is to be used is notified to the other party by a command each time encrypted communication is performed, and the other party can correctly decrypt the data. Therefore, it is not necessary to deliver a data encryption key for each encrypted communication, which reduces the load on the central processing unit and improves transmission efficiency.

(Embodiment) FIG. 1 is a block diagram showing the configuration of a master station and a slave station according to an embodiment of the present invention. connected. The method for generating the main station data encryption key will be described in detail below with reference to this figure and FIG. 3.

A cryptographic processing unit 4 receives a random number generation command from the central processing unit 1, which includes a random number generation command, the address of the memory 2 to which the random number is to be transferred, and the number of transfer blocks.
is the IV backed up in the cryptographic processing unit.
The exclusive OR of the initial value IV ₀ of the register 43 and the count value C of the binary counter 44 at that time is calculated.
The EXOR circuit 46 generates key data such that IV ₀ C=K ₀ expressed by equation (1) in FIG.
Next, the real key data is sent to the DES algorithm processing unit 48
(Data Encode Standard), and the contents IV ₀ of the IV register 43 are set to DES algorithm processing unit 48.
When _the random number data RN ₀ of the first block is encrypted with the key _{K 0} expressed by equation ( _{2 )} in FIG. output buffer 47
will be written to. After that, the random number data RN0 is IV
The data is input to the register 43 and transferred to the data encryption key area of the memory 2 via the input/output register 41. Next, the contents of IV register 43
_{DES _ _}
The content RN 0 of the IV register 43 is set to the algorithm processing unit 48 and the content RN ₀ of the IV register 43 is set to the DES algorithm processing unit 48
, the second block of random number data RN ₁ encrypted with the key K ₁ , that is, E _K1 (RN _{0 )} = RN ₁ , is output from the DES algorithm processing unit 48 and written to the output buffer 47. . Thereafter, the random number data RN ₁ is input to the IV register 43, transferred to the memory 2 via the input/output register 41, and written next to the previously transferred RN ₀ . Repeat the above operations and
Random number data of +1 block number RN ₀ , RN ₁ ...RN _o
is set in the memory 2 as shown in FIG. Here, the random number data RN _o and the key data K _o are expressed by equations (3) and (4) in FIG.

RN ₀ , RN ₁ , ... generated in this way
Use RN _o as the data encryption key.

FIG. 4a shows the frame format of general encrypted communication used in the present invention, where F is a flag sequence, A is an address part, C is a control part,
EI is the encrypted information part and FCS is the frame check sequence.

Hereinafter, a case in which encrypted communication is performed between a master station and a slave station will be described in detail with reference to this figure and FIG.

The cryptographic processing unit 4 receives the encryption command for the data encryption key from the central processing unit 1 and transmits the secret master key KM that is set in advance in the key register 45 and is common to the master station and the slave station to the DES algorithm processing unit 48. and set the data encryption key to
RN ₀ , RN ₁ , . . . RN _o are read out in blocks from the memory 2 via the input/output register 41,
The input buffer 42 is set. Thereafter, it is encrypted by the DES algorithm processing unit 48, written to the output buffer 47, and written to the cryptogram data encryption key area of the memory 2 via the input/output register 41. In this way, data encryption key E _KM of n+1 block encrypted with master key KM
(RN ₀ ), E _KM (RN ₁ ), ...E _KM (RN _o ) in Figure 4b
It is transmitted from the communication control unit 3 to the slave station in a frame format of . Here, a data encryption key distribution command CI is set in the control unit C. The slave station that received this frame analyzes that it is a data encryption key delivery command C1, decrypts the encrypted information part using the master key KM, and issues the data encryption keys RN ₀ , RN ₁ , . . . , get RN _o .
In this way, the delivery of the data encryption key for the n+1 block has been completed, so next the master station encrypts the transmission information DATA to the slave station with the data encryption key RN ₀ and E _RN (DATA) as shown in Figure 4c. Transmit in frame format. Here, the control unit C receives the transmission information using the data encryption key RN ₀ of the first block.
Command C2 is set to indicate that DATA has been encrypted. The slave station that received this frame will
Since the command of the control unit C is C2, the encrypted information part is decrypted with the data encryption key RN ₀ ,
Obtain transmission information DATA. In this way, the commands of the control section C are sent to the data encryption keys RN ₀ , RN ₁ , . . . RN _o of the encrypted information section C2, C3, . . .
...Cn+2 is prepared, so data encryption keys can be used randomly as needed.

(Effects of the Invention) As explained in detail above, according to the present invention, 1
The cryptographic processing unit receives instructions from the central processing unit.
Using hardware based on the DES algorithm, multiple blocks of random number data are generated and used as data encryption keys, so data encryption keys can be generated at high speed without putting a load on the central processing unit, and the encryption strength is also high. It can be expected to have a strong effect. Furthermore, since the data encryption keys of the plurality of blocks can be used, it is expected that the transmission efficiency will be improved.

[Brief explanation of drawings]

Fig. 1 is a block diagram showing the configuration of a master station and a slave station according to an embodiment of the present invention, Fig. 2 is a diagram showing a conventional encrypted communication system between a master station and a slave station, and Fig. 3 is an embodiment of the present invention. FIG. 4 is a diagram showing a data encryption key generation formula and a storage format in a memory, and FIG. 4 is a diagram showing an encrypted communication frame format according to an embodiment of the present invention. DESCRIPTION OF SYMBOLS 1...Central processing unit, 2...Memory, 3...Communication control unit, 4...Encryption processing unit, 5...Bus, 41...
...Input/output register, 42...Input buffer, 43
...IV register with power backup, 44
... Binary counter, 45 ... Key register, 46
...EXOR circuit, 47...Output buffer, 48
...DES algorithm processing section.

Claims (1)

[Claims] 1. When a master station and a slave station are each provided with a cryptographic processing section and data communication is performed between the master station and the slave station, the cryptographic processing section of the transmitting station uses a data encryption key to transmit data. In an encrypted communication method in which received data is encrypted and then decrypted using a data encryption key in the receiving station's cryptographic processing unit, the master station and slave stations are provided with a master key to encrypt or decrypt the previous data encryption key. At the same time, the cryptographic processing unit of the main station is provided with a data encryption key generation unit that generates a plurality of data encryption keys using the encryption function of the cryptographic processing unit. , the main station activates the data encryption key generation unit to generate a plurality of data encryption keys, stores the keys in its own memory, and thereby sets a plurality of data encryption keys in the main station. Next, the master station sequentially encrypts its own multiple data encryption keys using its own master key, and then transmits them all to the slave station, and the slave station transmits the received data to its own master key. When performing data communication between the master station and the slave station by decrypting the data using the key and storing it in its own memory, and setting multiple data encryption keys on the slave station, the transmitting station decrypts the data using the key and stores it in its own memory. Select a specific data encryption key from memory, encrypt transmission data using the data encryption key, add data specifying the data encryption key to the encrypted transmission data, transmit it, and send it to the receiving station. is an encrypted communication method in which a specific data encryption key is selected from the own memory based on data specifying the data encryption key, and transmitted data is decrypted using the data encryption key.