JP2563921B2 - Secret communication system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Industrial Application] The present invention effectively secures confidentiality in information communication between a plurality of subscriber terminals connected via a central device. The secret communication system to be obtained.

(Prior art) One of the local area networks (LAN) is C
There is a broadband LAN that applies ATV. This broadband LAN uses one or two coaxial cables to configure upstream and downstream broadband (frequency multiplexing) transmission lines in a tree or bus form, and by connecting these via a headend, It realizes bidirectional communication including data and video information. Such a broadband LAN is expected as a next-generation LAN for OA and FA, as well as an urban CATV, because it can realize a multimedia network of facilities at low cost.

By the way, in this type of network, a multiplexing technique such as time division or frequency division is introduced in order to improve the use efficiency of transmission lines, and a plurality of communication lines are set on one transmission line. For example, each subscriber terminal uses a time slot assigned to itself to transmit information to the central device in a time division manner, and captures information given from the central device in a time division manner by capturing the time slot assigned to it. Has become.

However, the information transmitted from the central device to the plurality of subscriber terminals in a time division manner is broadcast to the plurality of subscriber terminals connected to the transmission path.
Therefore, there is a problem in securing the confidentiality of the communication information.

Therefore, conventionally, for example, a public key method has been proposed as an encryption system (secret communication method) suitable for such a communication system,
It is receiving a lot of attention.

However, in this public key encryption method, a large amount of hardware is required for secrecy, and various problems remain in the control of public key selection for secrecy.

In particular, there are many problems in terms of hardware and software when applied to a highly real-time communication system called voice communication for many subscribers such as telephone service.

(Problems to be Solved by the Invention) After collecting communication information from a plurality of subscriber terminals in the central device in this manner, the communication information is broadcasted from the central device to the plurality of subscriber terminals. In a communication system that adopts such a concentrated distribution system, there is a problem that it is very difficult to easily secure the confidentiality of the communication information.

The present invention has been made in consideration of such circumstances,
The purpose is to significantly reduce the processing load on the central device by eliminating the need to generate the encryption key in the central device and the encryption process for the information transmitted between terminals, thereby reducing the amount of hardware and simple control. It is to provide a highly practical confidential communication system that can effectively secure the confidentiality of communication information using an algorithm.

[Structure of the Invention] (Means for Solving Problems) According to the present invention, signal transmission is performed from a plurality of subscriber terminals to a central device via a first transmission path, and the central device performs the signal transmission. In a communication system in which a signal is transmitted via the second transmission line to each, each subscriber terminal generates a key for encryption,
This is transmitted to each of the central devices. Then, the central unit encrypts the key given from each subscriber terminal using the key given from the subscriber terminal of the communication partner, and transmits it to the subscriber terminal of the communication partner. At the subscriber terminal, the key generated by the subscriber terminal is used to decrypt the key encrypted by the central device from the subscriber terminal of the communication partner.

Then, in each subscriber terminal, the information to be communicated to the communication partner subscriber terminal is encrypted using the decrypted key, and this is transmitted to the communication partner subscriber terminal through the central device, Each of the subscriber terminals of the communication partner is configured to decrypt the encrypted communication information using a key generated by itself.

(Operation) Thus, according to the present invention, the keys respectively generated at the respective subscriber terminals are transmitted to the central unit as a control signal (response signal to the central unit), so that at this point the key is used by another subscriber. Does not leak to the person's terminal. Then, the central device transmits the key given by each subscriber terminal to the subscriber terminal of the communication partner by using the key given by the subscriber terminal of the communication partner, so that the key is transmitted. Only the subscriber terminal of the communication partner can be decrypted. As a result, the key does not leak to the third party subscriber terminal even at this point.

After that, each subscriber terminal that is a communication party has a key (decrypted key) generated by the subscriber terminal of the communication partner.
Since the communication information is encrypted by using and is transmitted to the subscriber terminal of the communication partner via the central unit, the communication information can be known only between the subscriber terminals which are the communication parties. . That is, it becomes possible to easily and effectively secure the confidentiality of communication information.

Further, according to such a communication form, the central unit only has to perform the encryption processing when transmitting the key information to the subscriber terminals, and the encrypted information is given when the information is communicated between the subscriber terminals. Since the communication information may be transmitted as it is, it is possible to obtain an effect that the processing load on the central device is not increased.

Embodiment An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a schematic configuration diagram of a communication system configured by applying the embodiment system, and (a) is a configuration of a central device 1,
FIG. 3 is a diagram showing a relationship with a plurality of subscriber terminals (MAU) 3 connected to the central unit 1 via a transmission line 2, and FIG. 3B is a diagram showing a configuration example of the subscriber terminal (MAU) 3. . Here, the transmission line 2 is composed of an upstream line (uplink) and a downstream line (downlink), and is frequency-multiplexed, for example. Then, the information from each of the subscriber terminals 3 is transmitted to the central device 1 via the up line, and the central device 1 transmits information to the plurality of subscriber terminals 3 via the down line. .

Each of the subscriber terminals 3 has a standard telephone, for example.
One to a plurality of units are respectively connected.

However, the frame of the signal transmitted between the central device 1 and the plurality of subscriber terminals 3 via the transmission path (uplink and downlink) 2 is configured as shown in FIG. 2, for example. There is.

That is, FIG. 2 (a) shows a frame structure of a signal transmitted from the central device 1 to the subscriber terminal 3 via the down line, FD is a frame delimiter, and ASG is the central device 1 to each subscriber terminal 3. Control signals to be transmitted to, and TS0, TS1, to TS
Reference numeral 95 is a time slot assigned to each of the subscriber circuits 3 and used for information transmission from the central unit 1 to the subscriber terminal 3. The control signal ASG, as shown in FIG. 2 (b), for example, designates the MAU address designating the subscriber terminal 3 which sends a response signal RSP, which will be described later, and each subscriber terminal 3, and designates the MAU address. The subscriber terminal 3 is composed of a plurality of ASG subframes which respectively provide the control signal ASG.

Further, FIG. 2 (c) shows a frame structure of a signal transmitted from the plurality of subscriber terminals 3 to the central unit 1 through the up line, and RSP is a designated subscriber to the control ASG from the central unit 1. The response signals TS0, TS1, to TS95 from the terminals are time slots assigned to the respective subscriber circuits 3 and used for information transmission from the respective subscriber terminals 3 to the central unit 1.

The one frame length of the signal transmitted between the central device 1 and the subscriber terminal 3 in such a frame structure is, for example, 500 μsec, and the head portion thereof is separated by the carrier.

The time slots TS0.TS1 to TS95 described above may be fixedly assigned to a plurality of subscriber terminals 3, or to the subscriber terminals 3 involved in voice data exchange. Only the variable allocation may be possible.
These time slots TS0.TS1 to TS95 are used to control the signal transmission timing of each subscriber terminal 3 in consideration of the difference in transmission time caused by the difference in the connection position of each subscriber terminal 3 to the transmission path 2. It will be set after going. Regarding the control of the transmission timing, for example, Japanese Patent Application No. 59-2688.
As proposed in No. 24, etc., the control is performed based on the measurement result of the transmission delay time between the central device 1 and the subscriber terminal 3.

Now, the central unit 1 for transmitting and receiving signals to and from each of the subscriber terminals 3 in such a form is configured as follows.

That is, as shown in FIG. 1 (a), the central unit 1 is connected to the transmission line 2 via the diplexer 11, and the subscriber terminal 3
It is intended to transmit signals to and from. This transmission line 2
The signal transmitted from the subscriber terminal 3 via the is transmitted from the diplexer 11 to the demodulator 12 and demodulated. The frame decomposition circuit 13 converts this demodulated signal into the response signal described above.
The RSP and each time slot TSo, TS1, to TS95 are decomposed into frames.

Under the control of the exchange control unit 15, the time switch 14 divides each time slot TSo, TS1,
~ TS95 information exchange control, subscriber terminal 3 of the communication partner
Are allocated to the time slots TSo, TS1, to TS95 allocated to the.

Then, the exchange-controlled information is guided to the frame synthesizing circuit 16 and is assembled with the control signal AGS generated by the ASG / RSP processing unit 17 into a frame having the structure shown in FIG. 2 (a). To be This signal (downlink frame) is then modulated by the modulator 18, and the diplexer 11
Is transmitted to the transmission line 2 via the.

Here, the ASG / RSP processing unit 17 generates the control signal ASG, inputs the response signal RSP from the subscriber terminal 3 decomposed by the frame decomposition circuit 13, and inputs the response signal RSP from the exchange control unit 15 described above. It controls the operation of each part of the central apparatus 1 including the operation. The delay measuring unit 19 uses the ASG /
Under the control of the RSP processor 17, the control signal ASG and the response signal RS
Using P, the transmission delay time between the central unit 1 and the plurality of subscriber terminals 3 is measured respectively. Information on the delay time measured by the delay measuring unit 19 is given to each of the subscriber terminals 3 via the ASG / RSP processing unit 17, and control of signal transmission timing at each subscriber terminal 3 is performed. Be seen.

Also, the encryption key holding circuit 20 sends a response signal as described later.
The key for encryption, which is given from each subscriber circuit 3 using the RSP, is stored in association with each subscriber terminal 3. Then, under the control of the exchange control unit 15, the key is selectively read out, and this is read by the key encryption circuit 21.
Has been given to.

The key encryption circuit 21 is for encrypting an encryption key to be given to the subscriber terminal 3 of the communication partner by using the key given by the communication partner. The key encrypted in this way is sent to the subscriber terminal 3 of the communication partner via the ASG / RSP processing unit 17 as a form of the control signal ASG.

On the other hand, the subscriber terminal 3 that communicates information with the central apparatus 1 is configured as shown in FIG. 1 (b).

The diplexer 31 inputs / outputs a signal communicated with the central unit 1 via the transmission line 2, and the received signal is guided to the frame decomposing circuit 33 via the demodulator 32. The frame disassembly circuit 33 extracts the control signal ASG and the time slot signal assigned to itself. Then, the information transmitted from the central unit 1 via the time slot assigned to itself is given to the subscriber interface 35 via the voice data decoding circuit 34 described later, and is connected to the subscriber interface 35. It is output to a telephone (not shown).

The communication information (voice data) input from the telephone set via the subscriber interface 35 is given to the frame synthesizing circuit 37 via the voice data encrypting circuit 36, which will be described later, and is inserted and output in the time slot assigned to itself. And frame composition is performed. This signal is output from the modulator 38 to the transmission line 2 via the diplexer 31.

The frame disassembling circuit 33 and the frame synthesizing circuit 37
Under the control of the time slot allocation control unit 39, knows the time slot allocated to itself, extracts the information signal of the time slot, and inserts the information signal into the time slot. At this time, the frame synthesizing circuit 37 controls the signal transmission timing under the control of the transmission timing control unit 40. This timing control compensates for the above-mentioned difference in transmission delay time.

Here, the ASG / RSP processing unit 41 receives the control signal ASG from the central unit 1 via the frame decomposing circuit 33, and also generates a response signal RSP to the central unit 1 via the frame synthesizing circuit 37. It is what is output. The ASG / RSP processing unit 41 performs the above-described time slot allocation and transmission timing control.

Furthermore, the ASG / RSP processing unit 41 uses the control signal ASG and the response signal RSP communicated with the central apparatus 1 to obtain the encryption key generated by the encryption / decryption key generation circuit 42. The key information transmitted to the central device 1 and extracted from the central device 1 by the communication partner subscriber terminal 3 is extracted. As described above, the central device 1 generates the key of the subscriber terminal 3 of the communication partner, and the information of this key is generated by the central device 1.
It consists of information encrypted with the key given to.

The key decryption circuit 43 decrypts the information of the key encrypted in this way, and extracts the key of the communication partner.
The key information is held by the encryption key holding circuit 44 and given to the voice data encryption circuit 36.

Then, the voice data encryption circuit 36 generates the voice data of the communication partner to be transmitted by the subscriber terminal 3 of the communication partner, encrypts the voice data using the key, and outputs the encrypted data. Further, the voice data decoding circuit 34 receives voice data which the subscriber terminal 3 of the communication partner encrypts and transmits using the key generated by itself, and decodes this with the key generated by itself. Has become.

Next, an information communication procedure in the communication system configured as described above will be described.

FIG. 3 schematically shows the concept of this information communication procedure, and FIG. 4 is a diagram showing a concrete flow of the procedure processing.

Now, a set of subscriber terminals 3 trying to communicate information is set to A, B.
Then, as shown in FIG. 3 (a), first, the subscriber terminal
A and B respectively generate keys (Key, A, Key, B) for encryption and notify the central unit 1 of this. This key notification is performed using the response signal RSP.

Then, from the subscriber terminals A and B, the respective keys (Key, A, Ke
The central device 1 having received y, B) encrypts the key (Key, A) with the key (Key, B) as shown in FIG. 3 (b), and transmits this to the subscriber terminal B. , Key (Key, B)
It is encrypted in A) and is sent to subscriber terminal A.

At the subscriber terminals A and B, it is possible to know these encrypted keys by decrypting them with the keys generated by themselves. That is, the subscriber terminal A has a key (Key, A)
By decrypting the key (Key, B) encrypted by the key (Key, A), the key (Key, B) generated by the subscriber terminal B of the communication partner is known. Similarly, the subscriber terminal B uses the key (Ke
By decrypting the key (Key, A) encrypted with y, B) with the key (Key, B), the key (Key, A) generated by the subscriber terminal A of the communication partner is known.

The encryption with the key and the decryption thereof are realized by, for example, exclusive OR processing.

In this way, when the keys (Key, A, Key, B) generated by each of the subscriber terminals A and B of the communication destination are notified,
Next, as shown in FIG. 3 (c), in the subscriber terminals A and B, the keys (Key,
B, Key, A) are used to encrypt communication data. Then, this encrypted communication data is transmitted to each of the subscriber terminals B and A of the communication partner, and the key (Key,
The decryption is performed using A, Key, B).

More specifically, as shown in FIG. 4, subscriber terminals A and B
Respectively generate a key for encryption, and notify the central device (center) 1 of this. The notification of the key from the subscriber terminal is performed, for example, every time the key is periodically updated, or each time the subscriber terminal sets up a call.

Then, when a call is made from the subscriber terminal, time slot setting and voice / information signal communication channel setting are performed.
According to the dial information, the time slot is set for the subscriber terminal of the communication partner, and the communication channel is set for the voice / information signal.

After that, the key is notified to the subscriber terminal of the communication partner as described above, and the voice communication path of the communication subscriber terminal is set.

Then, information communication using the above-mentioned key is performed via this communication path.

When a new key is set in the middle of this information communication, the key is notified each time. When the end of the call is detected, the time slot set as described above is released and the information communication between the subscriber terminals is ended.

As described above, according to the present system, the encryption key generated by each subscriber terminal 3 is notified to the central device 1 via the upstream line, so that at this point, the key is transmitted to the third party (others). Subscriber's terminal). Thereafter, the central device 1 encrypts the key with the key generated by the subscriber terminal of the communication partner and transmits it to the subscriber terminal 3 of the communication partner, so that the subscriber of the communication partner It is possible to effectively notify the key only to the terminal. In other words, the subscriber terminal that can decrypt the encrypted key is only the subscriber terminal that is the communication partner that knows the key used for the encryption, and therefore the confidentiality of the key is sufficiently secured for communication. Notification can be made only to the subscriber terminal of the other party.

After that, the subscriber terminals, which are parties to the communication, communicate by encrypting the communication information by using the key generated by the subscriber terminal of the communication partner, so that the confidentiality of the information is sufficiently ensured.

Here, the central unit 1 only
Only the encryption processing is performed, and since the encryption is not involved after the call path is set, the processing load hardly increases. Therefore, it is possible to sufficiently allocate the processing function to the call setting processing and the like, and there is an effect that there is almost no possibility of causing hardware and software problems.

The present invention is not limited to the above embodiment. For example, how to generate a key for encryption, when it was generated,
The encryption method may be determined according to the specifications of the communication system. Also, the format of the signal communicated between the central unit and the subscriber terminal can be variously modified. In addition, the present invention can be variously modified and implemented without departing from the gist thereof.

[Effects of the Invention] As described above, according to the present invention, the system configuration can be simplified, and the confidentiality of communication information can be simplified and effectively secured. Played.

[Brief description of drawings]

FIG. 1 shows an embodiment of the present invention. FIG. 1 is a schematic configuration diagram of a communication system configured by applying the embodiment system, FIG. 2 is a diagram showing a signal format, and FIG. 3 is an encryption. FIG. 4 is a diagram showing the concept of the processing procedure of the integrated communication, and FIG. 4 is a diagram showing a specific example of the communication processing procedure. 1 ... Central device, 2 ... Transmission line, 3 ... Subscriber terminal (MA
U), 17 ... ASG / RSP processing unit, 21 ... Encryption key holding circuit,
22 ... Key encryption circuit, 41 ... ASG / RSP processing section, 42 ... encryption / decryption key generation circuit, 43 ... key decryption circuit, 44 ... encryption key holding circuit.

Continuation of front page (51) Int.Cl. ⁶ Identification number Internal reference number FI Technical indication location H04L 9/00 601A (72) Inventor Yoshihiro Saito 1-3-3 Uchisaiwaicho, Chiyoda-ku, Tokyo Within TEPCO (72) Inventor Kazuyoshi Ozawa 1 Komukai Toshiba-cho, Sachi-ku, Kawasaki-shi Toshiba Research Institute Co., Ltd. (72) Inventor Hiroshi Kobayashi 1 Komu-shi Toshiba-cho, Kawasaki-shi Toshiba-shi Research Institute (72) Hideharu Haruyama 1 Komukai Toshiba-cho, Sachi-ku, Kawasaki City (56) References Japanese Patent Laid-Open No. 61-53853 (JP, A) Japanese Patent No. 61-177837 (JP, A) Japanese Patent Publication 6 -81134 (JP, B2) Ikeno, Koyama "Modern Cryptography" (Sho 61-9-1) IEICE P. 268

Claims (3)

(57) [Claims] 1. A plurality of subscriber terminals each have a first wired transmission path directionally coupled to each other, and a signal transmitted from the subscriber terminal is sent only to a central unit via the first wired transmission path. A second wired transmission line that is transmitted and is branched and connected to each of the plurality of subscriber terminals is provided, and a signal transmitted from the central device is sent to each of the subscriber terminals via the second wired transmission line. In a confidential communication system applied to a wired information transmission system transmitted in a broadcast, each of the subscriber terminals generates a key for encryption and transmits the key to the central device, Among the subscriber terminals, the keys sent from the second subscriber terminal and the keys sent from the first subscriber terminal are sent from the first subscriber terminal and the second subscriber terminal, respectively, which are trying to communicate. Encrypted with the given key The first and second subscriber terminals decrypt the keys of the second and first subscriber terminals encrypted and delivered from the central apparatus, respectively, using the keys generated by themselves. From then on, the transmission information to the second and first subscriber terminals is encrypted and transmitted using the decrypted keys of the second and first subscriber terminals, and from the second and first subscriber terminals. The transmitted received information is decrypted using the key generated by itself, and the key distribution to the subscriber terminal and the information transmission between the subscriber terminals are performed by using the common key generated by the subscriber terminal. A confidential communication system characterized by being used individually. 2. The confidential communication system according to claim 1, wherein the subscriber terminal generates a key for encryption each time a call is set up. 3. The confidential communication system according to claim 1, wherein the encryption key is updated periodically.