JPH11239184A - Switching hub - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a switching hub with reduced processing delays and a low probability of data wire tapping. SOLUTION: A switching hub is provided with a plurality of ports 1, an address filter section 9 which informs a transmission buffer storing means 11 of transmission information, and a transmission buffer storing means 11 which fetches transmitting data from a reception buffer 5 based on the transmission information from the filter section 9 and transmits the data to the port 1 through which the data are transmitted. In the switching hub, a terminal having an enciphering function and a cryptographic key table obtained in advance by exchanging cryptographic keys is provided on the filter section 9, and a function that sends enciphered data and plain data corresponding to the ports 1 is provided to the storing means 11.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a switching hub used for relaying data between a plurality of terminals or between a plurality of networks in a local area network (LAN). And a switching hub that can ensure the confidentiality of the switching hub.

[0002]

2. Description of the Related Art Hitherto, as a method of improving security in a LAN, a method of installing encryption software in a terminal or incorporating an extension board having an encryption function in a terminal has been mainly used.

However, in a network having a switching hub (concentrator) for controlling a plurality of terminals,
It is easier to provide the switching hub with an encryption function. Therefore, a method is used in which the network management software of the switching hub owns a list of terminal addresses, and when a terminal having no address in the list transmits data, the management software disconnects the data transmission. When data is transmitted to all terminals connected to the switching hub, an extension board having an encryption function incorporated in the switching hub searches the address list, and no address is registered in the list. A method is used in which encrypted data is transmitted to a port of a switching hub to which a terminal is connected, so that the terminal cannot decrypt the data.

[0004]

However, although the switching hub having the above-described configuration has a very high effect of enhancing security, it has a disadvantage that the cost is high, and the switching hub has a problem associated with encryption. There is a problem that processing delay is large. Also, since data is transmitted to terminals that are not registered in the list even though they are encrypted, there is a risk that data that has been intercepted may be decrypted by terminals that are illegally connected to the switching hub. Have a point.

The present invention has been made in view of the above problems, and an object of the present invention is to provide a switching hub which has a small processing delay and a low probability of data tapping.

[0006]

According to the first aspect of the present invention,
A plurality of ports, an address filter unit for notifying the transmission information to the transmission buffer storage unit, and data to be transmitted are extracted from the reception buffer based on the transmission information notified from the address filter unit, and the data is transmitted to the port to be transmitted. In a switching hub having a transmission buffer storing means for transmitting an encryption key, an encryption key table obtained by exchanging an encryption key with a terminal having an encryption function in advance is provided in an address filter section, and encryption / flattening is performed according to a port. The transmission buffer storage means is provided with a function of transmitting cultural data.

[0007] According to a second aspect of the present invention, a plurality of ports,
An address filter for notifying the transmission buffer storage means of transmission information, and a transmission buffer for extracting data to be transmitted from the reception buffer based on the transmission information notified from the address filter and transmitting the data to a port to be transmitted. A switching hub having storage means;
A cryptographic key table obtained by exchanging cryptographic keys in advance with a terminal without an encryption function or a terminal with an encryption function is provided in the address filter unit, and encryption / flattening is performed on the port to be transmitted according to the terminal. The transmission buffer storage means is provided with a function of transmitting cultural data.

[0008] According to a third aspect of the present invention, a plurality of ports,
An address filter for notifying the transmission buffer storage means of transmission information, and a transmission buffer for extracting data to be transmitted from the reception buffer based on the transmission information notified from the address filter and transmitting the data to a port to be transmitted. A switching hub having storage means;
An encryption function is added to some ports, and an encryption key table obtained by exchanging an encryption key with a terminal having the encryption function in advance is provided in the address filter unit, and whether the received data is encrypted or not is determined. It is characterized in that a function of transmitting encrypted / plaintext data to a port to be transmitted according to the port is provided in a port having an encryption function.

According to a fourth aspect of the present invention, a plurality of ports are provided.
An address filter for notifying the transmission buffer storage means of transmission information, and a transmission buffer for extracting data to be transmitted from the reception buffer based on the transmission information notified from the address filter and transmitting the data to a port to be transmitted. A switching hub having storage means;
Adds an encryption function to some ports, and determines whether the port with the encryption key table obtained by exchanging the encryption key with the terminal having the encryption function in advance is encrypted for the received data. And a function of transmitting encrypted / plaintext data to a port to be transmitted according to the terminal is provided in a port having an encryption function.

[0010]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a switching hub according to a first embodiment of the present invention will be described with reference to FIGS. 1 to 3, and a switching hub according to a second embodiment will be described with reference to FIGS. The switching hub according to the third embodiment will be described in detail with reference to FIGS. 7 to 10, and the switching hub according to the fourth embodiment will be described in detail with reference to FIGS.

[First Embodiment] FIG. 1 is a block diagram of a switching hub according to a first embodiment. FIG.
Is an encryption key table. FIG. 3 is a configuration diagram of a network using a switching hub.

The switching hub according to the present embodiment comprises ports 1a to 1d, a reception buffer storage 3, a reception buffer 5, an address filter 9, and a transmission buffer storage 11. Note that the number of ports 1 is not limited to four.

The switching hub of this embodiment has an encryption key for each of the ports 1a to 1d. The combination is shown in the encryption key table shown in FIG. That is, when data is transmitted from the port 1a to the port 1b using the encryption key K12, and when data is transmitted from the port 1c to the port 1d, the data is encrypted using the encryption key K34. It will be transmitted from port 1.

Next, the operation of the switching hub of this embodiment will be described with reference to FIG. Now, the network A is connected to the port 1a, and the network B is connected to the port 1b. A plurality of terminals are connected to the network A via a repeater, and among them, a terminal 1 having no encryption function exists. Similarly, a terminal 2 having an encryption function and a terminal 3 having no encryption function are connected to the network B via a repeater.

In FIG. 3, when a terminal 1 having no encryption function in network A transmits data to a specific external network B, the contents of the data are stored in terminals other than terminal 2 in network B. You don't want to be known. At this time, the data received at the port 1a is encrypted using the encryption key K12, and transmitted to the network B from the port 1b.

The switching hub of the present embodiment exchanges a terminal having an encryption function with the encryption key shown in the encryption key table of FIG. 2 in advance. When receiving the data to be transmitted from the terminal 1 to the terminal 2 at the port 1a, the reception buffer storage means 3 stores the data to be transmitted in the reception buffer 5 and the address filter unit 9
To the receiving information. Here, the reception information is a destination address (DA), a transmission source address (SA), a data length, a reception port number, an identifier of whether or not the data is encrypted, and a data storage address where the data is stored in the reception buffer 3. is there.

The address filter unit 9 searches the routing database 10 for the port 1 to be transmitted based on the received reception information, and notifies the transmission buffer storage unit 11 of the transmission information. Here, the transmission information includes a transmission port number, a data storage address, a port encryption key, and port encryption On /
Off information.

The transmission buffer storage means 11 takes out data from the reception buffer 5 based on the information obtained from the address filter unit 9, encrypts the data with a predetermined encryption key, and transmits the data to the port 1 b to be transmitted. Send data. When the port 1b transmits data to the network B and the terminal 2 receives the data, the terminal 2 of the network B
Has an encryption function, and decrypts it with the encryption key K12 exchanged with the terminal 1 in advance.

When the terminal 2 returns the decrypted data via the switching hub, the terminal 2 encrypts and transmits the decrypted data using a predetermined encryption key K21 for communicating with the network A. The encrypted data transmitted from the terminal 2 is received at the port 1b, and the switching hub transmits the encrypted reply data to the encryption key K21.
And send it to Network A. The transmitted data is taken into the terminal 1. Therefore, the terminal on the network A can communicate only with the terminal 2 on the network B.

According to the present embodiment, a terminal that does not have an encryption function or a terminal that does not exchange encryption keys with a switching hub of the network B can obtain encrypted data from the switching hub intentionally. If the user does not have the encryption key, it cannot be decrypted. In addition, if the encryption key is exchanged between the switching hub and the terminal having the encryption function, the terminal of the network A can perform the encryption on the network B without adding or exchanging the network interface having the encryption function. Function can be realized.

[Second Embodiment] FIG. 4 is a block diagram of a switching hub according to a second embodiment. FIG.
Is an encryption key table. FIG. 6 is a configuration diagram of a network using a switching hub. The configuration of the switching hub of the present embodiment is the same as that of the embodiment shown in FIG. 1, and the same portions are denoted by the same reference numerals and detailed description thereof will be omitted.

The operation of the switching hub of this embodiment will be described with reference to FIG. Now, network A is connected to port 1a, and network B is connected to port 1b.
Is connected, and a terminal p having an encryption function is connected to port 1c.
Is connected, and a network D is connected to the port 1d. A terminal 1 having no encryption function is connected to the network A via a repeater. Similarly, a terminal 2 having an encryption function is connected to the network B via a repeater.
And a terminal 3 having no encryption function. Also, a terminal 4 having no encryption function is connected to the network D via a repeater.

As a case where a specific terminal accesses a specific terminal of the external network, a case is considered where the terminal 1 transmits data to the network B for which contents other than the specific terminal are not desired to be known. The switching hub has an encryption key for each address. The combination is an encryption key table (see FIG. 5). When the terminal 1 without the encryption function sends a ciphertext to the terminal 2 with the encryption function, normal data output from the terminal 1 is received at the port 1a of the switching hub. The data received is
The data is taken into the reception buffer 5 by the reception buffer storage unit 3. At that time, the reception buffer storage unit 3 passes the reception information used for transmitting data to the address filter unit 9, and the address filter unit 9 transmits the transmission information for transmission to the transmission buffer storage unit 11 based on the reception information. And the information about the terminal-to-terminal encryption key for the encryption function.

The transmission buffer storage means 11 reads data from the reception buffer 5 based on the transmission information obtained from the address filter section 9 and performs encryption using an encryption function. The encrypted data is passed to port 1b.
For transmission from the terminal 1 to the terminal 2, encryption is performed using the encryption key K12 from the encryption key table.

The terminal 2 on the network B decodes the transmitted data and decrypts the data coming from the terminal 1.
When the terminal 2 returns a reply to the terminal 1 based on the decrypted data, the terminal 2 transmits the data encrypted using the encryption key K21 to the network B. The switching hub detects that the data is transmitted from the terminal 2 to the terminal 1, and transmits the data to the network A in plaintext with the encryption key K21. The terminal 1 receives the plain data. As a result, the terminal 1 can send the encrypted data to the network B without having the encryption function, and can transmit and receive the data only to the terminal 2.

According to the present embodiment, when another terminal of network A that is not registered in the switching hub accesses terminal 2, no encryption processing is performed. That is, since encryption is performed on a terminal basis, the switching hub of the present embodiment can be easily used in a case where terminals having an encryption function and terminals having no encryption function coexist. Since terminals that perform encryption can be mixed, terminals having an encryption function can be sequentially added as necessary.

[Third Embodiment] FIG. 7 is a block diagram of a switching hub according to a third embodiment. FIG.
Is an encryption key table. FIG. 9 shows a data structure passed to a port to be transmitted. FIG. 10 is a configuration diagram of a network using a switching hub. The configuration of the switching hub of the present embodiment is the same as that of the embodiment shown in FIG. 1, and the same portions are denoted by the same reference numerals and detailed description thereof will be omitted.

The operation of the switching hub of this embodiment will be described with reference to FIG. The switching hub of the present embodiment has a configuration in which only some ports 1 have an encryption function, and here, port 1d has an encryption function. Network A is connected to port 1a, network B is connected to port 1b,
Network C is connected to port 1c, and port 1d
Is connected to the network D. Network A
Is connected to the terminal 1 via a repeater, the network B is connected to the terminal 2 and the terminal 3 via a repeater,
The terminal 4 and the terminal 5 are connected to the network D via a repeater.

When transmitting data from the network A, the network B, and the network C to the network D, the data to be transmitted is always encrypted.
Only the specific terminal has a function of decrypting the encrypted data. When any one of the terminals having no encryption function of the network B (the terminal 2 in FIG. 10) communicates with the terminal 4 having the encryption function of the network D, a communication is previously established between the switching hub and the terminal 4. Exchange the encryption key. The switching hub has an encryption key table as shown in FIG.

When the terminal 2 sends data to the terminal 4, the switching hub receives the data at the port 1b. Then, the reception buffer storage unit 3 stores the data in the reception buffer 5 and passes reception information for routing to the address filter unit 9. The address filter unit 9 sends a transmission port number, a data storage address, a port encryption key, and port encryption On / Off information to the transmission buffer storage unit 11 based on the received reception information.

The transmission buffer storage means 11 takes out the data from the reception buffer 5 and sends the transmission data to the port 1d in a data format as shown in FIG. Port 1
d performs encryption based on the received information and the encryption key Kn4, and transmits the encrypted data to the network D.

Since the terminal 4 has a decryption function, it decrypts the encrypted data and performs plaintext. When a reply is returned from the terminal 4 to the terminal 2, the encrypted reply data is transmitted to the network D. Encrypted data is port 1
At d, the decrypted data decrypted with the encryption key K4n is stored in the reception buffer 5. The reception buffer 5 passes information necessary for routing to the address filter unit 9,
The address filter unit 9 passes the transmission information to the transmission buffer storage unit 11. The transmission buffer storing means 11 having received the transmission information sends the data to the port 1b. The port 1b sends data to the network B, and the data is received at the terminal 2.

According to the present embodiment, the terminal 5 can eavesdrop the encrypted data but cannot decrypt it because there is no encryption key. In addition, since the encryption function is provided between a network having an encryption function and another network, an encryption function can be added to a specific port in the form of an extension module.

[Fourth Embodiment] FIG. 11 is a block diagram of a switching hub according to a fourth embodiment. FIG. 12 shows an encryption key table. FIG. 13 is a configuration diagram of a network using a switching hub. The configuration of the switching hub of the present embodiment is the same as that of the embodiment shown in FIG. 1, and the same portions are denoted by the same reference numerals and detailed description thereof will be omitted.

The operation of the switching hub of this embodiment will be described with reference to FIG. In the present embodiment, only the transmission / reception units of some ports have an encryption function, and here, port 1d has an encryption function. Network A is connected to port 1a,
Network B is connected to port 1b, and port 1d
Is connected to the network D. Network A
Is connected to the terminal 1 via a repeater, the network B is connected to the terminals 2 and 3 via the repeater, and the network D is connected to the terminals 4 and 5 via the repeater.

When a terminal having an encryption function registered in the switching hub communicates with a terminal having no encryption function, a specific terminal is connected to the port 1d having the encryption function in advance. FIG. 12 is an encryption key table included in the address filter unit 9. When data is transmitted from the terminal 2 to the terminal 4, the data is received at the port 1 b, the data is stored in the reception buffer 5 by the reception buffer storage unit 3, and the reception information is sent to the address filter unit 9. The address filter unit 9 includes a transmission buffer storage unit 11
Is transmitted to the port 1d transmission unit from the reception buffer 5. The port 1d transmitting unit determines whether or not to perform encryption by comparing with the encryption table.

Here, the encryption is performed with the encryption key K24, and the data is transmitted. The terminal 4 receives the encrypted data and determines the encryption key K24
To decrypt. When a reply is sent, data is transmitted after being encrypted using the encryption key K42.

The port 1d of the switching hub is connected to the terminal 4
To the terminal 2 is detected, and the encryption key K42
And sends the decoded data to the reception buffer storage means 3. The reception buffer storage means 3 sends data to the reception buffer 5 and reception information to the address filter section 9, and the address filter section 9 transmits the data to the transmission buffer storage means 1 based on the reception information.
1 to send the transmission information. The transmission buffer storage means 11 sends data from the reception buffer 5 to the port 1b based on the transmission information, and the terminal 2 receives the decrypted data. Thus, when communication is performed from the terminal 2 not registered in the encryption key table to the terminal 5, the data is transmitted to the network D as it is because the encryption function is not performed. Also, the terminal 5 receives the data as it is and returns a reply to the terminal 2. Since the switching hub receives normal data, the switching hub transmits the data as it is, and the terminal 2 receives the data. On the other hand, for the terminal 4 having the encryption function, the terminal 2 can perform encrypted communication on the network D.

According to the present embodiment, since the encryption is performed on a terminal basis, the switching hub of the present embodiment can be easily used in a case where a terminal having an encryption function and a terminal having no encryption function are mixed. In addition, since terminals that perform encryption can be mixed, terminals having an encryption function can be sequentially added as necessary.

[0040]

As described above, according to the first aspect of the present invention, there are provided a plurality of ports, an address filter for notifying the transmission buffer storage means of transmission information, and a transmission information notified from the address filter. In the switching hub having transmission buffer storage means for extracting data to be transmitted from a reception buffer and transmitting data to a port to be transmitted, an encryption key is exchanged in advance with a terminal having an encryption function. The encryption key table obtained in the address filter section and the function of sending encrypted and plaintext data according to the port are provided in the transmission buffer storage means, so terminals and switching hubs without encryption function Terminals that have not exchanged encryption keys with will not be able to decrypt even if they intentionally take in encrypted data from the switching hub, Once you have even the exchange of encryption key, adding a network interface that has an encryption function,
It is possible to provide a switching hub that can realize an encryption function without replacement, has a small processing delay, and has a low probability of eavesdropping on data.

According to the second aspect of the present invention, transmission is performed based on a plurality of ports, an address filter unit that notifies transmission buffer storage means of transmission information, and transmission information notified from the address filter unit. In a switching hub having a transmission buffer storage unit for extracting data from a reception buffer and transmitting data to a port to be transmitted, exchange of an encryption key with a terminal having no encryption function or a terminal having an encryption function in advance. The encryption key table obtained by the execution is provided in the address filter unit, and the function of transmitting encrypted and plain data to the port to be transmitted according to the terminal is provided in the transmission buffer storage means. Terminals that do not have or do not exchange encryption keys with the switching hub intentionally use encrypted data from the switching hub. In silicon, can not decipher, also,
As long as the encryption key is exchanged, a network interface with an encryption function can be added and the encryption function can be realized without exchanging, providing a switching hub with little processing delay and low probability of data eavesdropping It has the effect that it can be done. In addition, the encryption is performed for each terminal, so that the switching hub of the present embodiment can be easily used in a case where a terminal having an encryption function and a terminal having no encryption function are mixed, and a terminal that performs encryption is mixed. Therefore, it is possible to increase the number of terminals having an encryption function sequentially as needed.

According to the third aspect of the present invention, transmission is performed based on a plurality of ports, an address filter unit for notifying the transmission buffer storage means of transmission information, and transmission information notified from the address filter unit. In a switching hub having transmission buffer storage means for extracting data from a reception buffer and transmitting data to a port to be transmitted, an encryption function is added to some ports, and a terminal having the encryption function is encrypted in advance with a terminal having the encryption function. An encryption key table obtained by exchanging keys is provided in the address filter unit, it is determined whether the received data is encrypted, and the encrypted and plain data is transmitted to the port to be transmitted according to the port Function to send data to a port with an encryption function. Terminals that do not the conversion also takes in the encrypted data coming from the switching hub intentionally,
If the decryption is not possible and the encryption key is exchanged, the encryption function can be realized without adding or exchanging the network interface with the encryption function, the processing delay is small, and the data can be eavesdropped. This has the effect of providing a switching hub with a low probability. Also,
Since this is an encryption function between a network having an encryption function and another network, it is possible to add an encryption function to a specific port in the form of an extension module.

According to the fourth aspect of the present invention, transmission is performed based on a plurality of ports, an address filter for notifying the transmission buffer storage means of transmission information, and transmission information notified from the address filter. In a switching hub having transmission buffer storage means for extracting data from a reception buffer and transmitting data to a port to be transmitted, an encryption function is added to some ports, and a terminal having the encryption function is encrypted in advance with a terminal having the encryption function. Judge whether the port with the encryption key table obtained by exchanging the key is encrypted for the received data and send the encrypted / plaintext data to the port to be transmitted according to the terminal. Since the sending function is provided on the port with the encryption function, the encryption key is exchanged with terminals or switching hubs without the encryption function. Terminal cannot decrypt even if the encrypted data from the switching hub is taken intentionally, and if the encryption key is exchanged, there is no need to add or exchange a network interface with encryption function. Also, it is possible to provide a switching hub that can realize an encryption function, has a small processing delay, and has a low probability of eavesdropping on data. In addition, since encryption is performed on a terminal basis, the switching hub of the present embodiment can be easily used in a case where a terminal having an encryption function and a terminal having no encryption function are mixed, and a terminal that performs encryption is mixed. Therefore, it is possible to increase the number of terminals having an encryption function as needed.

[Brief description of the drawings]

FIG. 1 is a block diagram of a switching hub according to a first embodiment.

FIG. 2 is an encryption key table.

FIG. 3 is a configuration diagram of a network using a switching hub.

FIG. 4 is a block diagram of a switching hub according to a second embodiment.

FIG. 5 is an encryption key table.

FIG. 6 is a configuration diagram of a network using a switching hub.

FIG. 7 is a block diagram of a switching hub according to a third embodiment.

FIG. 8 is an encryption key table.

FIG. 9 shows a data structure passed to a port to be transmitted.

FIG. 10 is a configuration diagram of a network using a switching hub.

FIG. 11 is a block diagram of a switching hub according to a fourth embodiment.

FIG. 12 is an encryption key table.

FIG. 13 is a configuration diagram of a network using a switching hub.

[Explanation of symbols]

 1 port 3 reception buffer storage means 5 reception buffer 9 address filter unit 11 transmission buffer storage means

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Mario Jose Cardona

Claims (4)

[Claims] An address filter for notifying transmission information to a plurality of ports, a transmission buffer storage, and data to be transmitted are extracted from a reception buffer and transmitted based on the transmission information notified from the address filter. In a switching hub having transmission buffer storage means for transmitting data to a port, an encryption key table obtained by exchanging an encryption key with a terminal having an encryption function in advance is provided in an address filter section, and A switching buffer storing means for transmitting encrypted and plaintext data in the transmission buffer storage means. 2. A method for extracting data to be transmitted from a reception buffer based on a plurality of ports, an address filter unit for notifying transmission buffer storage means of transmission information, and transmission information notified from the address filter unit, and transmitting the data. In a switching hub having transmission buffer storage means for transmitting data to a port to be used, an encryption key table obtained by exchanging an encryption key with a terminal having no encryption function or a terminal having an encryption function in advance is used as an address. In preparation for the filter section,
A switching hub, wherein a function of transmitting encrypted / plaintext data to a port to be transmitted according to a terminal is provided in the transmission buffer storage means. 3. A method for extracting data to be transmitted from a reception buffer based on a plurality of ports, an address filter unit for notifying transmission buffer storage means of transmission information, and transmission information notified from the address filter unit, and transmitting the data. In a switching hub having transmission buffer storage means for transmitting data to a port to be encrypted, an encryption function is added to some ports, and an encryption key is obtained by exchanging an encryption key with a terminal having an encryption function in advance. A key table is provided in the address filter unit, and it is determined whether received data is encrypted or not, and a function of transmitting encrypted / plaintext data to a port to be transmitted according to a port has an encryption function. A switching hub characterized by being provided in a port. 4. Extracting data to be transmitted from a reception buffer based on a plurality of ports, an address filter unit for notifying transmission buffer storage means of transmission information, and transmission information notified from the address filter unit, and transmitting the data. In a switching hub having transmission buffer storage means for transmitting data to a port to be encrypted, an encryption function is added to some ports, and an encryption key is obtained by exchanging an encryption key with a terminal having an encryption function in advance. The port with the key table is
It is characterized in that a port having an encryption function is provided with a function of judging whether received data is encrypted or not and transmitting encrypted / plaintext data to a port to be transmitted according to a terminal. And a switching hub.