JPH0511691B2 - - Google Patents

Description

[Detailed Description of the Invention] (Industrial Application Field) The present invention relates to a synchronization method in encrypted communication,
More specifically, it is installed between a data processing device and a data line termination device, and is used to synchronize encryption and decoding on the sending and receiving sides of a line encryption device that encrypts data sent to a communication line. This paper relates to a synchronization method using vectors.

(Prior Art) FIG. 4 is a block diagram showing an example of the configuration of an encrypted communication system, in which FIG. 5a shows a general communication frame format, and FIG. 5b shows a conventional encrypted communication frame format. In the figure, 41 is a host computer which is one of the data processing devices, 42 and 46
is a line encryption device, 43 and 45 are modems (data line termination devices), 44 is a communication line, 47 is a terminal which is one of data processing devices, F is a flag sequence, A is an address field, C is a control field, I is information field, FCS is frame check sequence, IV
is the initialization vector, E(A), E(C), E(I), E
(FCS) and E(F) are address field A, control field C, information field I, frame check sequence FCS, and flag sequence F, respectively. Systems of this kind are detailed, for example, in the following literature:
“IBM3845 Data Encryption Device, IBM3846 Data Encryption Device Overview”.

Regarding the operation in the case of encrypted communication between the host computer 41 and the terminal 47 in FIG.
An example of transmission from the host computer 41 side will be explained. The line encryption device 42 on the sending side notifies the line encryption device 46 on the receiving side of which part of the data transmitted from the host computer 41 has been encrypted, and the line encryption device 46 on the receiving side starts from the encrypted part. must be reunited.

Therefore, conventionally, the line encryption device 42 monitors the message transmitted from the host computer 31 in the communication frame format shown in FIG.
An initialization vector IV indicating the start position of encryption is inserted after the flag sequence F, and the address field A and subsequent parts are encrypted and sent as a message in the encrypted communication frame format shown in FIG. 5b.

(Problems to be Solved by the Invention) However, the conventional method described above has the following problems.

(a) As shown in FIG. 5b, since the initialization vector IV is inserted into the data, data transmission is delayed by this amount.

(b) Initialization vector after flag sequence F
In order to insert the IV, it is necessary to monitor the message sent from the data processing device in the communication frame format shown in FIG. 5a, which complicates the hardware and software of the line encryption device.

(c) After the flag sequence F is the initialization vector
Since it can be seen that it is IV, the encryption strength is weakened.

Accordingly, an object of the present invention is to provide a synchronization method for encrypted communication that has very little data delay, strong encryption strength, and simple hardware and software.

(Means for Solving the Problems) The present invention relates to a data processing device (for example, a host computer or a terminal) and a data line termination device (modem).
The target is line encryption equipment that is installed between communication lines and encrypts data sent over communication lines.

According to the present invention, the line encryption device is provided with a timer for measuring time. Then, when transmitting an initialization vector for synchronizing encryption and decryption between the transmitting side and the receiving side, the following control is performed.

First, the line encryption device on the transmitting side sends a transmission request signal to the data line terminating device in response to the transmission request signal from the data processing device, and starts the timer.

Then, when the timer measures the time and reaches a predetermined timer value until the data line terminating device that has received the transmission request signal sends out a transmission enable signal, the data line terminating device transmits an initialization vector onto the communication line, then receives a send enable signal that permits data transmission from the data line terminating device, and sends the send enable signal to the data processing device.

(Operation) When a data processing device on the sending side (for example, a host computer) has a transmission request, the host computer sends a transmission request signal to a line encryption device connected to the host computer. The line encryption device that receives this sends a transmission request signal to the data line terminating device connected to it, and at the same time starts an internal timer. When this timer measures time and reaches a predetermined timer value, that is, when the data line terminating device that has received the transmission request signal measures the predetermined time until it sends out a send clear signal, the line encryption device Sending the initialization vector onto the communication line via the data line termination device.

Following this, the line cryptographic device sends a transmission permission signal in response to the previous transmission request signal to the host computer. Then, the line encryption device sequentially encrypts the data from the host computer, and transmits the encrypted data to the receiving side (for example, a terminal) via the data line termination device and the communication line.

(Example) Hereinafter, an example of the present invention will be described with reference to the drawings.

1 to 3 are diagrams for explaining one embodiment of the present invention, FIG. 1 is a flowchart showing the synchronization procedure of this embodiment, and FIG. 2a is a line encryption device of this embodiment. FIG. 2B is an operation timing diagram of this embodiment, and FIG. 3 is a diagram showing an encrypted communication frame format of this embodiment.
Incidentally, since the encrypted communication system to which this embodiment is applied has the same configuration as that shown in FIG. 4, the reference numbers shown in the figure will be used when referring to each part of the encrypted communication system in the following explanation.

First, the configuration of the line encryption devices 42 and 46 will be explained with reference to FIG. 2a. In figure a,
11 is a central processing unit (CPU) having a built-in timer, 12 is a read-only memory (ROM) which is a program memory, and 13 is a battery 13a.
14 is a cryptographic processing unit (CIP) controlled by the CPU 11, 15 is an operation unit (OP), 16 is a random access memory (RAM) backed up by
17 is a data processing device interface unit (DTE/IF) that controls the interface with the data processing device (host computer 41 or terminal 47 in the example shown in FIG. 4), and 17 is the data line termination device (modem 43 or 45). Data line terminal equipment interface section (DCE/IF) that controls the interface
It is. Both the DTE/IF 16 and the DCE/IF 17 have a CCITTV24/V28 line interface. Further, each of the above sections is connected to each other by an internal bus 18.

Next, the operation of this embodiment will be explained. Here, in FIG. 2b, A is the transmission request signal RS1 from the data processing device, B is the transmission request signal RS2 of the line encryption device, C is the send clear signal CS sent by the line encryption device to the data processing device, and Ni is the transmission request signal RS1 from the data processing device. indicates the transmission data SD on the communication line 44.

Hereinafter, the case where the data is transmitted from the host computer 41 will be explained as an example. host computer 41
When a transmission request occurs (steps in Figure 1)
101), the host computer 41 turns on the RS1 signal
(A in Figure 2b: Step 102). The CPU 11 of the line encryption device 42 on the sending side turns on the RS1 signal.
Detects through DTE/IF16 that the
Turn on the RS2 signal to the modem 43 via the DCE/IF17 (FIG. 2 b, b) and at the same time the CPU 11
Activate the internal timer (step 103). The timer value T of this timer is input in advance from the operation unit 15 and backed up by the battery 13a.
It is stored in RAM13. Also, the timer value T
is a value determined by the modem 43, and is the time from when the modem 43's transmission request signal (that is, the RS2 signal) is turned on until the transmission permission signal that the modem 43 sends to the line encryption device 42 is turned on.

When the timer is started and T time has elapsed (step 104), the timer counts up and the CPU
An interrupt occurs within 11. This will cause the CPU
11 transmits the initialization vector IV to the modem 43 via the DCE/IF 17, as shown in FIG. 2b (d) (step 105). Then the initialization vector
When the IV transmission is finished, the CPU 11 sends the DTE/IF 16
Turn on the CS signal as shown in Figure 2b (c) via
Then, encryption of the data transmitted from the host computer 41 is started (step 106). At this time, the data with all marks "1" is encrypted (d in Fig. 2b). The host computer 41, which has detected the CS signal ON, transmits data in the frame format shown in FIG. 5a. The line encryption device 42 is
The transmission data in the above frame format received from DTE/IF16 is encrypted with CIP14, and
Transmit from IF17 (step 107). Therefore, all the messages sent from the host computer 41 are encrypted as shown in FIG. 3, and sent as encrypted data to the modem 43 as shown in FIG. 2b (d).

The operation when transmitting from the host computer 41 has been described above, but the same applies to the operation when transmitting from the terminal 47.

One embodiment of the present invention has been described above. The present invention is not limited to the above-mentioned embodiment, but can be similarly applied to encrypted communication between other data processing devices.

(Effects of the Invention) As explained above, according to the present invention, the following effects can be obtained.

(b) From the perspective of the data processing device, the configuration is such that the initialization vector is sent during the response time when the clear-to-send signal sent from the line encryption device is received in response to the transmission request signal sent by the data processing device.
Data delay is reduced compared to conventional methods.

(b) In response to the transmission request signal sent by the data processing device, the timer in the line cryptographic device measures a predetermined time and then automatically transmits the initialization vector, so the message sent from the data processing device There is no need for monitoring, and the hardware and software of the line encryption device can be reduced.

(c) Since all data from the data processing device is encrypted after transmitting the initialization vector, the encryption strength is increased.

[Brief explanation of the drawing]

FIG. 1 is a flowchart showing the synchronization procedure of an embodiment of the present invention, FIG. 2a is a block diagram of the line encryption device of this embodiment, FIG. The figure shows the cryptographic communication frame format of this embodiment, FIG. 4 is a block diagram of a configuration example of the cryptographic communication system, FIG. 5a shows a general communication frame format, and FIG. 5b shows a conventional cryptographic communication frame format. FIG. 3 is a diagram showing a communication frame format. 11...Central processing unit (CPU), 12...Read only memory (ROM), 13...Random access memory (RAM), 13a...Battery,
14... Encryption processing section (CIP), 15... Operation section (OP), 16... Data processing equipment interface section (DTE/IF), 17... Data line termination equipment interface section (DCE/IF), 18...Internal bus.

Claims (1)

[Scope of Claims] 1. A line encryption device that is installed between a data processing device and a data line termination device and encrypts data sent on a communication line, which is provided with a timer to measure time, and is provided on a sending side and a receiving side. When transmitting an initialization vector for synchronizing encryption and decryption, the line encryption device on the sending side sends a transmission request signal to the data line termination device in response to the transmission request signal from the data processing device. , starts the timer, and when the timer measures the time and reaches a predetermined timer value until the data line terminating device that has received the transmission request signal sends out a transmission enable signal, the data is Transmitting an initialization vector onto the communication line via the line terminating device, then receiving a send clear signal that permits data transmission from the data line terminating device, and sending the send clear signal to the data processing device. A synchronization method in encrypted communication characterized by: