JPH0456504B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION (a) Technical Field of the Invention The present invention relates to a key distribution method for a cryptographic device, and particularly to a key distribution method for a data communication cryptographic device over a communication line.

(b) Prior art and problems Figure 1 is a diagram showing an example of a conventional key distribution system for switched lines. The devices 3 and 5 are modems (including the network control unit NCU), 4 is a switch,
6 represents the receiving side encryption device, and 7 represents the terminal (DTE).

In FIG. 1, data from a main central processing unit 1 is encrypted in a sending side encryption device 2 and sent out via a modem 3 to a communication line. The encrypted data from the transmitting side is received by the receiving side via the communication line and exchange 4. On the receiving side, the encrypted data enters the receiving side encryption device 6 via the modem 5, is decoded by the receiving side encryption device 6, and is input to the terminal 7. Conventionally, in such a system, there have been two methods for setting keys for encryption/decryption in the sending side cryptographic device 2 and the receiving side cryptographic device 6 as shown below. In other words, a method in which an encryption/decryption key common to all cryptographic devices is manually set in each device, and a master key common to all cryptographic devices is set in each device, and the encryption/decryption key is set as the master key. This method encrypts the data and sends it over the communication line.

However, in this method, a common encryption/decryption key for all encryption devices is manually set in each device, and each time a communication is made, the encryption/decryption key is manually set in the encryption device. , it is necessary to manage and store keys in each device,
If this was stolen, the encrypted communication data could be decoded. On the other hand, in the method (2), the key can be sent over a communication line, and after the key transmission is completed, the key is manually or automatically set in the encryption device and encrypted communication starts, so each device can use the key. The advantage is that there is no need to store the master key, but once the master key is leaked,
The drawback was that all keys could be decrypted.

In addition, even in the case of , it is necessary to recognize whether keys have been distributed between encryption devices, and when communicating that requires encryption, the operator must be aware of whether a key has been set or not. As with the point case, there were drawbacks.

(c) Purpose of the Invention The purpose of the present invention is to eliminate the above-mentioned drawbacks of the prior art, and to provide a data communication cryptographic device for exchange lines that allows easy key management, eliminates the need to be aware of key setting or distribution, and improves cryptographic strength. The objective is to provide a high quality key distribution method.

(d) Structure of the Invention The above object of the present invention is to provide a plurality of terminal devices connected to a switching line 4 via a network control device and modems 3 and 5, and having encryption devices 2 and 6 between the modems 3 and 5. A key distribution method using a public key distribution method in a data communication system consisting of 1 and 7, in which a call indication signal (CI) from a modem 5 on the called side
When the data set ready signal (DR) from the modem is triggered by the terminal ready signal (ER) from the called terminal 7 being turned on, data is transmitted between the encryption devices on both the calling and called sides via the modem. and performs a common key generation operation using the public key distribution method, and until the key generation operation is completed, the encryption devices 2 and 6 transmit data set ready signals (which are turned on in the modems of the calling side and the called side). DR) on terminals 1 and 7
This is achieved by a key distribution method of the cryptographic device, which is characterized in that the data set ready signal (DR) is transmitted to the terminals 1 and 7 after the key generation operation is completed.

(e) Embodiments of the invention The present invention provides PKDS (Public Key
Distribution System (Key Distribution System) is used as a ringing indication signal (hereinafter simply referred to as ringing signal) of the modem on the called side.
By executing the terminal ready signal (ER) ON from the DTE in response to (CI) ON as a trigger, key wiring can be performed without any human intervention.

The public key distribution method PKDS is a key distribution method that uses a one-way function, and as shown in Figure 2, a common key is generated for both parties by mutually distributing their keys (X, Y). It is something. In other words, in order to perform encrypted communication using the key calculated by each encryption device based on the public keys (X, Y) sent to each other, the public keys (X, Y) must be leaked. Since no problem occurs, the key (X, Y) is called a public key.

Note that a one-way function is defined by Hellman and
It is the power function of Merkle et al.

FIG. 2 is a diagram showing an embodiment of a key distribution system for a switched line according to the present invention, and in the figure, devices with the same numbers as in FIG. 1 indicate the same devices. In addition, the various signals (CI, ER, etc.) that are transmitted and received while corresponding to the modem etc. in the figure are basically based on the specifications of Recommendation V24 regarding the interface between terminals and modems by CCITT. be.

After the calling party sends a dial signal, modem 3
When the sending cryptographic device 2 receives the data set ready signal ON, which is a preparation completion signal, from the sending cryptographic device 2, the transmitting cryptographic device 2 enters a state of waiting for the public key distribution system PKDS.

In addition, the ER signal is a signal indicating that the device in front of the modem is ready for data transmission, and the DR signal is the signal issued by modem 3 in response to this signal indicating that it is ready, and the ER and DR signals form a pair. in
This is a signal specified by CCITT.

The receiving modem 5 receives the dial signal, and when the calling signal (CI) turns on, the terminal (DTE) 7 turns on the terminal ready signal (ER).

Receiving the ER signal ON from the terminal 7, and using this reception as a trigger, the receiving side cryptographic device 6 starts the public key distribution system PKDS.

As shown in Figure 2, the subsequent operation of the public key distribution system PKDS is such that the called side sends a generated key signal X to the calling side, and an acknowledgment signal indicating that it has been received correctly and generated key information Y is sent to the called party,
Set the generation key for both.

In addition, while the common key generation operation using the public key distribution system PKDS is being performed in FIG.
The ON of the DR signal sent to 1 and terminal 7 is
This DR signal is blocked by the encryption devices 2 and 6, and upon completion of the common key generation operation, the DR signal is blocked.
ON is transmitted to the terminal 7, and an acknowledgment signal is sent from the receiving side to the calling side. In response, the central device 1 is also notified that the DR signal is ON, and subsequent data transmission and reception begins.

Here, in order to block the DR signal from the modem in the cryptographic device during the common key generation operation, the signal processing section in the cryptographic device should hold the DR signal when it is detected, and then It is sufficient to configure a circuit that performs interrupt processing to output the held contents. A suitable specific structure of such a circuit is, for example, the one described in the specification of the earlier application (Japanese Patent Application No. 1992-85) filed by the present applicant, and will be described below.

Figure 3 shows the DR from the modem in the encryption device.
FIG. 3 is a diagram showing an example of a specific circuit configuration for blocking a signal. 15 shown in this figure is a control device (hereinafter referred to as
16 is an address decoding circuit, and 17 is an interrupt circuit that receives the DR ₁ signal and generates an interrupt signal IRQ when the input turns ON. 18 is a bus driver, 19 is a bus receiver, 20 is a flip-flop circuit, 21 is a receiver, and 22 is a driver.

In addition, in Fig. 3, two types of DR signals are shown, and these are the first DR signal that is input from the modem to the encryption device, and the first DR signal that is input from the encryption devices 2 and 6 to the main central processing unit (HOST) 1. and a second DR signal output to the terminal 7. Therefore, in the explanation of this figure, in order to distinguish between these,
The first DR signal input from the modem _{is DR1} , and the second DR signal output from the encryption devices 2 and 6 is
Set as DR ₂ .

In FIG. 3, when DR ₁ turns ON, the signal turned ON is input to the interrupt generation circuit 17 and bus driver 18 via the receiver 21 in the encryption devices 2 and 6. This allows the interrupt signal IRQ to
Send to CPU15. The CPU 15 thereby recognizes that an interrupt has occurred, and sends signals corresponding to various addresses via the address decoding circuit 16 in order to find out which bus driver the interrupt has occurred. Input the output of the bus driver to the data bus. As a result, when the output of the bus driver 18 is input to the data bus, the DR ₁ signal is turned ON.
You can tell by CPU15. After this, public key distribution method
A common key is generated between cryptographic devices using PKDS. While this is being done, the DR ₂ signal remains OFF as an initial value.

Furthermore, in FIG. 3, when the key generation is completed,
The CPU 15 sends an ON signal to the bus receiver 19 and sends an ON signal to the FF2 via the address decoding circuit 16.
The signal to the clock terminal 0 is turned on, and the _DR2 signal is turned on via the driver 22.

With such a configuration, it is possible to internally block DR signals from the modems 3 and 5 in the cryptographic devices 2 and 6 until the generation and setting of the common key are completely completed.

According to this method, the common key generation operation using the public key distribution system PKDS is incorporated into transmission control as an automatically proceeding process.
The operator does not need to be aware of whether or not keys have been set through distribution, and key distribution between cryptographic devices can be realized without any human intervention.

Moreover, the above-mentioned encrypted communication can be performed simply by adding the encrypted communication device according to the present invention without any influence on each communication device when the encrypted communication device is not used.

(f) Effects of the Invention As explained in detail above, according to the present invention, the public key distribution method PKDS of the cryptographic device in the exchange line
This has the great effect of allowing key distribution to be carried out unconsciously and without any human intervention.

[Brief explanation of the drawing]

FIG. 1 is a diagram showing an example of a conventional key distribution method. In the figure, 1 is the main central processing unit (HOST) on the calling side, 2 is the cryptographic device on the sending side, and 3 and 5 are modems ( (including network control unit NCU), 4 is a switch,
6 represents the receiving side encryption device, and 7 represents the terminal (DTE). FIG. 2 is a diagram showing an embodiment of the key distribution system for a switched line according to the present invention, and the symbols and numbers in the diagram are the same as those in FIG. 1. FIG. 3 is a diagram showing an example of a specific circuit configuration for blocking a DR signal from a modem in an encryption device.

Claims (1)

[Scope of Claims] 1 Publication in a data communication system consisting of a plurality of terminals 1 and 7 connected to a switching line 4 via modems 3 and 5 and having encryption devices 2 and 6 between the modems 3 and 5 A key distribution method based on a key distribution method, in which a call indication signal (CI) from the modem 5 on the called side
When the data set ready signal (DR) from the modem is triggered by the terminal ready signal (ER) from the called terminal 7 being turned on, data is transmitted between the encryption devices on both the calling and called sides via the modem. and performs a common key generation operation using the public key distribution method, and until the key generation operation is completed, the encryption devices 2 and 6 transmit data set ready signals (which are turned on in the modems of the calling side and the called side). DR) on terminals 1 and 7
A key distribution system for a cryptographic device, characterized in that the data set ready signal (DR) is transmitted to the terminals 1 and 7 after the key generation operation is completed.