JPH0691528B2 - Data key setting method of line encryption device - Google Patents

Description

Description: TECHNICAL FIELD The present invention relates to a data key setting method for a line encryption device that performs data encrypted communication using a data key via a master encryption device and each terminal encryption device.

[Conventional technology]

In the conventional line encryption device in which the main station and the terminal are connected to each other via the main station encryption device and multiple terminal encryption devices, the data key KD that encrypts communication data is set by turning on the power of the main station encryption device. It is encrypted with a master key KM that is commonly set with the terminal encryption device on the other side and delivered from the master encryption device to the terminal encryption device.

This will be described below with reference to the drawings. FIG. 2 is a connection block diagram by branch line connection, 1 is a host computer, 2 is a master station encryption device connected to the host computer which is this master station, 3 and 4 And 5 are terminals A and B and C, 6 and 7 and 8 respectively.
Is the terminal encryption device of each terminal A, B, C.
8 are connected to the master station encryption device 2.

The data key KD for the terminal encryption devices 6, 7, and 8 is the data key KD according to the procedure shown in FIG.
Deliver KD.

FIG. 3 is an explanatory diagram of a conventional key distribution method.

In the figure, 9 is a key setting command, of which A represents the number of the terminal encryption device 6, and E _KM (KD) represents data obtained by encrypting the data key KD with the master key KM.

Also, 10 is the terminal key acknowledgment response from the cryptographic unit 6 (hereinafter, A _CK abbreviated) is.

First, the master encryption device 2 whose power was turned on at point a in FIG.
Delivers the key setting command 9 of A, E _KM (KD) to the terminal encryption device 6.

The terminal encryption device 6 decrypts the received E _KM (KD) with its own master key KM, obtains the data key KD, and returns A _CK 10 to the master station encryption device 2.

Similarly to this, the master station encryption device 2 is connected to all the terminal encryption devices 7
B, E _KM (KD) and C, E _KM (KD) key setting commands are delivered to and 8 and 8, and the terminal encryption devices 7 and 8 which have decrypted this and have obtained the data key KD are the master station encryption devices. Return _ACK to 2.

Then, when these processes are completed, each terminal encryption device 6, 7,
8 becomes the encrypted communication mode, and the host computer 1 and terminals A3 and B
Enables encrypted communication of data between C4 and C5.

However, in this method, all the terminal encryption devices 6, 7, and 8 need to be turned on when the data key of the master station encryption device 2 is delivered, so that the terminals 3 to 5 side turn on the power supply as necessary. However, there is a problem that the above method cannot be applied to the line encryption device that performs OFF.

To solve this problem, skip terminal cryptographic unit that does not return the A _CK against delivery key setting command from the main station encryptor, by the delivery key設設commands between terminals set data key KD only When the terminal encryption device that did not return the _ACK is turned on, the key encryption device sends a key delivery request to the master station encryption device, and then the main encryption device again. A method has been proposed in which a key setting command is received from a station encryption device to perform key setting. .

The procedure in this case will be described in detail with reference to FIG.

In FIG. 4, the master encryption device 2 which is turned on at point a delivers the key setting command 9 of A, E _KM (KD) to the terminal encryption device 6 of the terminal A3.

The terminal encryption device 6 decrypts the received E _KM (KD) with its own master key KM, obtains the data key KD, and returns A _CK 10 to the master station encryption device 7.

Next, the master encryption device 2 sends B, E _KM to the terminal encryption device 7.
The key setting command 11 of (KD) is delivered, but if the power of the terminal B4 is off at this time and the _ACK 15 for the key delivery command 11 is not returned from the terminal encryption device 7 to the main station encryption device 2, the main station The cryptographic device 2 detects the return time timeout at the point b, and then the C, E _KM (KD) key setting command 12
Is delivered to the terminal encryption device 8 of the terminal C.

On the other hand, when A _CK 13 is returned from the terminal encryption device 8 to the master encryption device 2, the terminal encryption devices 6 and 8 enter the encrypted communication mode.

After that, all the telegrams between the master station encryption device 2 and the terminals A3 and C5 are encrypted and transmitted with the data key KD, so that encrypted communication of data between the host computer 1 and the terminals A3 and C5 is performed.

After that, for example, when the power supply of the terminal B4 side is turned on at the point c, the terminal encryption device 7 sends the key distribution request RE to the master encryption device 2.
Send Q14.

In response to this key distribution request REQ14, the master station encryption device 2 sends the B, E _KM (KD) key setting command 1 to the terminal encryption device 7 again.
When 1 is delivered and A _CK 15 is returned from the terminal encryption device 7 to the master encryption device 2, the terminal encryption device 7 is in the encrypted communication mode, so that the encrypted communication of data between the host computer 1 and the terminal B4 is also performed. It will be possible.

[Problems to be solved by the invention]

However, in such a conventional method, even if the terminal encryption device 7 tries to detect the polling of the terminal B at the time of transmitting the key distribution request REQ14, the communication between the master encryption device 2 and the other terminals A and C has already been completed. Since the terminal encryption device 7 started up with a delay does not have the data key KD because it is encrypted with the data key KD and is in communication, the terminal encryption device 7 cannot disconnect the polling message. There is a problem that the transmission timing cannot be set due to the polling message.

Further, this transmission timing is taken by the end of the transmission message of the master station encryption device 2, but the end of this transmission message is turned off of the carrier of the master station encryption device 2 in the terminal encryption device 7, that is, the carrier detection signal (CD). When it is OFF, it is not possible to determine whether the terminal encryption device 7 is polled, which causes a problem.

For example, when the terminal encryption device 7 that rises with a delay detects a carrier detection signal (CD) of a telegram in which the master station encryption device 2 polls the terminal A3, the transmission of the terminal encryption device 6 and the terminal encryption device 7 is performed. This causes a problem that normal communication cannot be performed due to collision with each other.

The present invention has been made to solve these problems. Even when individually turning on / off the power of each terminal cryptographic device, the terminal cryptographic device that started up with a delay is the same as other terminal cryptographic devices. It is an object of the present invention to realize a data key setting method for a line encryption device that enables data communication to be performed.

[Means for solving problems]

In order to achieve this object, the present invention provides a data key setting method of a line encryption device, which performs data encrypted communication between a master encryption device and each terminal encryption device using a data key,
When the master station encryption device and each terminal encryption device each have a common master key for encryption and decryption, and the power of the master station encryption device and each terminal encryption device is turned on and off at the same time And a mode setting means for setting the second mode corresponding to the case where each terminal encryption device is individually turned on and off independently of other devices. When the mode setting means is set to the first mode, the master station encryption device encrypts the data key with the master key by turning on the power of the master station encryption device and each terminal encryption device, and delivers the data key to each terminal encryption device. When the data key is set in the master encryption device and each terminal encryption device and the mode setting means is set to the second mode, the master encryption device is turned on when the power of the master encryption device is turned on. And the terminal in the power-on state And sets as the data key the master key No. apparatus, the terminal cryptographic device power is turned N delayed and sets the master key to the time of the power ON as the data key.

[Action]

In the data key setting method of the line encryption device of the present invention as described above, the power of the main station encryption device and each terminal encryption device is turned on and off.
In the case of a line encryption device in which FF is performed at the same time, the mode setting means is set to the first mode, and each terminal encryption device is turned on and off independently of other devices. Is applicable to any line encryption device by setting the mode setting means to the second mode, and when the mode setting means is set to the second mode,
When the power of the master cryptographic device is turned on, the power of the master cryptographic device is turned on.
The master key is set as a data key in the terminal encryption device in the state, and the power is turned on after a delay.The terminal encryption device is set to the master key as a data key at the time of turning on, so the power is turned on after a delay. The terminal encryption device can also surely have the data key, so that it is possible to communicate with the master encryption device without causing a collision with another terminal encryption device in transmission.

〔Example〕

An embodiment of the present invention will be described below with reference to FIGS. 1 and 5.

First, referring to FIG. 5, FIG. 5 is a block diagram showing an example of a terminal encryption device used in an embodiment of the present invention.

In the figure, 16 is a terminal encryption device, and this terminal encryption device 16 comprises the following 18 to 22 elements.

That is, 17 is a mode setting switch, 18 is a microprocessor unit (hereinafter abbreviated as CPU), 19 is a read-only memory (hereinafter abbreviated as ROM) as a storage unit that stores a control program, and 20 is an encryption processing unit. , 21 is a line interface unit (hereinafter abbreviated as line I / F), 22 is a master key setting unit, and the mode setting switch 17, ROM 19, encryption processing unit 20, line I / F 21, and master key setting unit 22 are CPU 18
Further, one line I / F21 is connected to a master station encryption device (not shown) and another terminal encryption device, and the other line I / F21 is connected to a terminal (not shown).

In this configuration, the mode setting switch 17 is connected to the terminal encryption device 16, the master encryption device connected to this terminal encryption device 16, the host computer connected to this master encryption device, and the terminal encryption device 16. In the line encryption device consisting of the connected terminals, if each terminal turns on and off at the same time as turning on and off the power of the main station encryption device without being independent of other devices, the key delivery mode (first 1 mode), and if each terminal turns on and off the power independently of other devices, it is set to KM mode (second mode), and its switch is applicable mode. It is supposed to be done in advance according to.

FIG. 1 is a flow chart showing an embodiment of a data key setting method executed by the terminal encryption device 16 and the master station encryption device of FIG.

Note that E _KM (KD) in FIG. 1 represents data obtained by encrypting the data key KD with the master key KM by the master station encryption device.

First, when the power of the line encryption device is turned on (power ON) (S1), the CPU 12 of the terminal encryption device 16 causes the mode setting switch 1
The setting mode of 7 is read (S2), and it is determined whether the delivery mode is KM mode based on it (S3).

In this case, if the power is turned on and off at the same time as the power of the master encryption device is turned on and off independently of other devices, the power of the line encryption device and all of the main encryption device Since the terminal cryptographic devices 16 of are turned on at the same time, the setting mode of the mode setting switch 17 is read in all the terminal cryptographic devices 16 and each is determined to be the key delivery mode. Independent power ON, O
If FF is performed, the setting mode of the mode setting switch 17 is read only in the terminal encryption device 16 whose power is ON, and it is determined to be the KM mode.

Incidentally, the main station encryption device also reads the setting mode of the mode setting switch and makes a determination.

When the setting mode of the mode setting switch 17 is determined to be the key distribution mode, whether each of the master station encryption device and the terminal encryption device 16 is using itself as the master station encryption device,
It is determined whether the terminal encryption device 16 is used (S4).

After the above judgment, the master station encryption device sends an arbitrary random number to the data key.
KD and encrypt this with the master key KM, then E _KM (KD)
Key setting command for the line I / F2 to the terminal encryption device 16
Delivered from 1 (S5), waits for the return of the A _CK from the terminal cryptographic device 16 (S6).

When A _CK is returned from the terminal encryption device 16, the master encryption device sends E _KM (KD) to all the terminal encryption devices 16.
It is judged whether the delivery of the key setting command of
7), completed wait for return of A _CK by performing the delivery of key setting command for the next terminal encryptors 16 unless further E for all terminals encryptors 16 when there is a return of A _CK
The process of determining whether the delivery of the _KM (KD) key setting command is completed is repeated.

Delivery of the key setting command to all terminal encryptors 16, the return of A _CK is completed, the main station cryptographic unit sets the data key KD to the encryption processing unit (S8).

After that, the encrypted communication process is started (S9), and the data between the master station encryption device and the terminal is encrypted by the data key KD for communication.

On the other hand, after the determination in S4, the terminal encryption device 16 waits for delivery of the key setting command from the master station encryption device (S10),
(S11), obtains the data key KD performs decoding with master key KM are set on the master key setting unit 22 (S12), the data key performs the return of the A _CK receives this command to the master station encryptor Set KD to encryption processing unit 20 (S
After 8), the process shifts to the above-mentioned encrypted communication process (S9).

If the KM mode is determined in S3, the master encryption device and the terminal encryption device 16 respectively set the master key KM as the data key KD (S13), and shift to encrypted communication processing (S13).
9).

In this case, when the master station encryption device 16 is turned on, there is a terminal encryption device 16 that is not turned on.
When the power is turned on with a delay of 16, the master key KM is set in the encryption processing unit as the data key KD in the same manner as described above at that time, and the encryption communication processing can be started.

Thus, the key setting command delivery between the main station encryption apparatus and a terminal cryptographic device 16 in this KM mode does not perform the return of the A _CK, interfere with the communication between the main station cryptographic device and another terminal encryptors 16 There is nothing to do.

〔The invention's effect〕

As described above, according to the present invention, the master encryption device and each terminal encryption device each have a common master key for encryption and decryption, and the master encryption device and each terminal encryption device have a power supply. The first mode corresponding to simultaneous ON / OFF of the device and the second mode corresponding to each terminal encryption device being independently powered on / off independently of other devices.
If the mode setting means is set to the first mode, the main station encryption device and each terminal encryption device are powered on, and the data key is set in the main station encryption device. When the data is encrypted with the master key and delivered to each terminal encryption device, the data key is set in the master station encryption device and each terminal encryption device, and the mode setting means is set to the second mode, When the power of the station encryption device is turned on, the master key and the terminal encryption device whose power is on are set to the master key as a data key, and the power of the terminal encryption device that was turned on after a delay is turned on. Sometimes the master key is set as the data key.

Therefore, according to the data key setting method of the line encryption device of the present invention, in the case of the line encryption device in which the power of the main station encryption device and the power of the terminal encryption device are simultaneously turned on and off, the mode setting means is set to the first mode. In the case of a line encryption device in which each terminal encryption device is individually turned on and off independently of other devices, by setting the mode setting means to the second mode, any line encryption device can be used. When applicable, and when the mode setting means is set to the second mode, when the power of the master encryption device is turned on, the master key is used as the data key for the master encryption device and the terminal encryption device whose power is on. The terminal encryption device that is turned on after a delay and the power is turned on later sets the master key as a data key at that time, so the terminal encryption device that is turned on after a delay can surely have the data key. Yes, and so on It is possible to obtain an effect that communication with the master encryption device becomes possible without the transmission of the terminal encryption device of the other device colliding with the transmission.

[Brief description of drawings]

FIG. 1 is a flow chart showing an embodiment of the present invention,
FIG. 4 is a wiring block diagram of a branch line, FIG. 3 is an explanatory diagram of a conventional data key setting method, FIG. 4 is an explanatory diagram of another conventional key distribution method, and FIG. 5 is an embodiment of the present invention. It is a block diagram of the encryption device used for an example. 16 …… Terminal encryption device 17 …… Mode setting switch 18 …… CPU 19 …… ROM 20 …… Cryptographic processing unit 21 …… Line I / F 22 …… Master key setting unit KD …… Data key KM …… Master key

Claims (1)

[Claims] 1. A data key setting method for a line encryption device that performs data encryption communication between a master encryption device and each terminal encryption device using a data key, wherein: It has a common master key for encryption and decryption, and the first mode and each terminal encryption device are compatible when the power of the main station encryption device and each terminal encryption device are turned on and off at the same time. When the power supply is turned on and off independently of the device described above, a mode setting means for setting the second mode is provided, and the mode setting means is set to the first mode. By turning on the power of the master station encryption device and each terminal encryption device, the master station encryption device encrypts the data key with the master key,
When the data key is delivered to each terminal encryption device and the data key is set in the master encryption device and each terminal encryption device, and the mode setting means is set to the second mode, the power supply of the master encryption device is set. When ON, set the master key as a data key in the main station encryption device and the terminal encryption device that is in the power ON state, and set the master key as the data key when the power is turned ON for the terminal encryption device that is turned ON later. A method for setting a data key of a line encryption device, characterized by: