JPH1168730A - Cryptographic gateway device - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To provide a cryptographic gateway device that realizes highly confidential encrypted communication without affecting hardware and application programs of existing terminals. SOLUTION: The cryptographic gateway devices 1 and 2 are placed at the boundary between local area networks 4 and 5 and the Internet 3, and transfer is performed with encrypted data only while passing through the Internet 3, and key data is transmitted along the route of the public network 6. Forward. As a result, the encrypted data and the key data for decrypting the encrypted data are transferred by physically different routes, so that highly confidential communication can be realized, and special modification of the transmission destination terminal is required. Since encrypted communication can be performed without any problem, an increase in cost for maintaining confidentiality can be minimized.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a cryptographic gateway device, and more particularly to a cryptographic gateway device for performing encrypted communication between offices widely distributed over the Internet.

[0002]

2. Description of the Related Art FIG. 6 is a block diagram showing the configuration of a conventional cryptographic communication system. In this figure, when communication is performed between the terminal 130 and the terminal 140, one terminal 130
The application program 132 (hereinafter, abbreviated as AP) of the application obtains the session key 162 used for communication from the key distribution center 160. The AP 132 of the terminal 130 transmits the session key to the communication partner terminal 140, thereby sharing a common session key between the two terminals 130 and 140, and encrypting and decrypting the message using the session key. To perform encrypted communication.

FIG. 7 shows a conventional cryptographic gateway device 180.
FIG. 3 is a block diagram showing the configuration of FIG. In this figure, a cryptographic gateway device 180 includes a fixed session key 181 for performing encryption / decryption, a receiving unit 182 for receiving received information, and a received information analysis for analyzing the received information and extracting a communication message. Unit 183 and an encryption / decryption unit 184 for encrypting / decrypting a message using the fixed session key 181
And a transmitting unit 185 for transmitting the encrypted / decrypted message.
Consisting of

FIG. 8 shows the cryptographic gateway device 1 shown in FIG.
It is a block diagram which shows the structure of the encryption communication system which utilized 80. In this figure, terminals 21-1, 21-2, ...,
The cryptographic gateway device 180-1 is externally attached to the terminal of the group A composed of 21-m, and the terminals 31-1, 31-2,
.., 31-n, the cryptographic gateway device 180-2 is externally attached to the terminals of the B group. Since the session keys of the cryptographic gateway devices 180-1 and 180-2 are fixed,
Encrypted communication between terminals 21-1 and 31-2, terminal 21-m and terminal 3
The encrypted communication of 1-2 is encrypted with a common session key. When communication is performed between the terminal 21-1 and the terminal 31-1, communication is performed using a transmission path that does not pass through the encryption gateway devices 180-1 and 180-2.

[0005]

Incidentally, the above-mentioned conventional cryptographic communication system has the following problems. The first problem is that when transferring data on an open network called the Internet,
Data is likely to be monitored by a third party, and important data cannot be easily transferred. The reason is,
This is because, when a public key cryptosystem, which is a currently used cryptosystem, is used, since the algorithm is open to the public, it is difficult but not impossible to break the cipher.

A second problem is that when a secret key encryption method is used, it is necessary to understand in advance which secret key should be used to transfer data when encrypting the data. It will take some time.

Accordingly, an object of the present invention is to provide a cryptographic gateway device which realizes highly confidential encrypted communication without affecting the hardware and application programs of existing terminals.

[0008]

In order to achieve this object, a cryptographic gateway device according to the present invention is a cryptographic gateway device that receives information from a transmitting terminal and encrypts / decrypts the received information. A session key table for holding a set of identification information of a terminal and a receiving terminal and a session key for encryption or decryption, a session key search means for searching for a corresponding session key from the session key table, and for performing encryption Data transmitting means and data receiving means for transmitting and receiving confirmation data and the like, data analyzing means for analyzing encrypted data and confirmation data, and encryption / decryption means for encrypting or decrypting received encrypted data or normal data. Key data transmitting means and key data for transferring key data for decrypting by another route by dial-up or the like Communication means, key data analysis means for analyzing the received key data, and key data creation means for creating the key data based on the result of the session key search. Is physically transferred by another route.

According to this configuration, since the encrypted data and the key data for decrypting the encrypted data are transferred through physically different routes, highly confidential communication can be realized. In addition, since encrypted communication can be performed without special modification of the destination terminal, an increase in cost for maintaining confidentiality can be minimized.

[0010]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a configuration diagram of a cryptographic communication system using an embodiment of a cryptographic gateway device according to the present invention, and FIG. 2 is a block diagram illustrating a configuration of a cryptographic gateway device of the present embodiment.

In FIG. 1, a cryptographic gateway device 1,
2 is installed between the Internet 3 and the local area networks 4 and 5. The encryption gateway devices 4 and 5 are also connected to a public network 6 for dial-up. The cryptographic gateway devices 1 and 2 receive the information transmitted from the transmitting terminal (for example, the terminal 7), encrypt or decrypt the received information, and transmit the resulting transmission information to the receiving terminal (for example, The encrypted information is transmitted to the terminal 8), and information to be transmitted and received and information about the key are physically transmitted by another route.

As shown in FIG. 2, each of the cryptographic gateway devices 1 and 2 includes a data receiving means 11 for receiving data transmitted from a transmitting terminal, and an encryption instruction received from a transmitting terminal. A data analysis unit 12 for identifying an encryption instruction and transfer data, and a session key table 13 for storing a set of session keys for encryption and decryption.
And an encryption / decryption unit 14 that encrypts and decrypts data using the selected key, a data transmission unit 15 that transmits the encrypted and decrypted data, and a transmission instruction from a terminal on the transmission side. A key data generation unit 16 for generating key data for transmitting the selected key to the encryption gateway device on the communication partner side, a key data transmission unit 17 for transmitting the generated key data, and receiving the key data The system includes a key data receiving unit 18, a key data analysis unit 19 that analyzes received key data, and a session key search unit 20 that searches for an analysis result of the received key data and a key to be transmitted.

The data receiving means 11, the data transmitting means 15, the key data transmitting means 17 and the key data receiving means 18 constitute a transmission / reception control unit 21. Since encryption / decryption is automatically performed in the encryption gateway devices 4 and 5, the sender issues an encryption instruction and transmits the data as it is, and the receiver can use the received data as it is. Therefore, it is not necessary for the receiving side to make special preparations for the terminal by encrypted communication.

Next, the operation of the cryptographic gateway devices 1 and 2 having the above configuration will be described. FIG. 3 is a flowchart showing the operation of the cryptographic gateway devices 1 and 2. In this description, the local area network 4
Is the transmitting side, and the terminal 8 of the local area network 5 is the receiving side.

When the cryptographic gateway device 1 receives the data (step S200), it checks the receiving port (step S201). If it is a LAN port, it can be determined that the data is from the terminal 7 on the transmitting side. Since the data from the terminal 7 on the transmission side is encryption instruction data or normal data, it is determined whether or not the data is encryption instruction data (step S202). If it is determined that the data is the encryption instruction data, an inquiry is made to the encryption gateway device 2 of the destination network as to whether the encrypted data can be transmitted (step S203). After making an inquiry about the encryption, it is determined whether or not the dial-up number has been obtained from the other party (step S204). If the dial-up number has been obtained, the inquiry is OK and the preparation for the encryption is performed. In contrast,
If the dial-up number has not been obtained, a report of the encrypted NG is sent to the transmitting terminal (step S209).

When the dial-up number can be obtained, a search for a session key is performed (step S205). When the search is completed, an encryption key is created (step S20).
6) Then, the encryption key is transmitted to the obtained dial-up number (step S207). At the same time, the encryption / decryption unit 1 encrypts data from the terminal 7 on the transmission side.
4 is set to an encryption type (step S208).

If the data received from the terminal 7 on the transmitting side is not the encryption instruction data, it is normal data, so it is determined whether or not the data needs to be encrypted (step S210). If it is unnecessary, it is transmitted as it is (step S211). If encryption is required, the session is confirmed (step S212),
Further, an encryption process is performed using the set encryption formula (step S213), and the data is transmitted to the Internet 3 (step S214).

On the other hand, if the data receiving port is the Internet port, it is determined whether or not the data is encrypted inquiry data (step S215). If the data is encryption inquiry data, a response is made to the encryption gateway that has inquired of the dial-up number (step S216). There are three types of data received from the Internet port: encrypted inquiry data, encrypted data, and normal data (steps S215 and S21).
6).

If the data received from the Internet 3 is not the encrypted inquiry data, the encrypted data or the normal data can be considered. The normal data is output to the LAN port as a normal gateway in the original text (step S220). When the encrypted data is received, the session is confirmed (step S218), and a decryption process is performed according to the set decryption formula (step S21).
9) After the completion of the combining process, output to the LAN port (step S220). If the received port is a dial-up port, key data is analyzed (step S221), and a session key is searched (step S222). After the search for the session key, the encryption / decryption unit 14 performs a decryption process (step S223).

Next, FIG. 4 is a detailed view of FIG. 1. Referring to FIG. 4, encryption from the terminal 7 of the local area network 4 to the terminal 8 of the local area network 5 is performed using the Internet 3. An operation for transmitting data will be described. In order to make it easy to distinguish for the sake of explanation, the codes of the respective parts of the cryptographic gateway device 1 are denoted by "".
A ”is added, and“ B ”is added to the code of each part of the cryptographic gateway device 2.

The encryption instruction data is sent from the terminal 7 on the transmission side to the transmission / reception control unit 21A of the encryption gateway device 1. Since the encryption instruction data received by the transmission / reception control unit 21A is analyzed by the data analysis unit 12A and is the encryption instruction data, the transmission / reception control unit of the encryption gateway device 2 on the local area network 5 side via the Internet 3 The encrypted inquiry data is transmitted to 21B.

Transmission / reception control unit 2 of cryptographic gateway device 2
1B transmits the dial-up number to the transmission / reception control unit 21A of the encryption gateway device 1 through the Internet 3 as a response to the inquiry. Upon receiving the dial-up number, the transmission / reception control unit 21A of the cryptographic gateway device 1 searches the session key table 13A in the session key search unit 20A to search for a session key. When the session key is determined, the key data creation unit 16A
Key data is created, and the key data is passed to the transmission / reception control unit 21A.

When the transmission / reception control unit 21A recognizes that the key data is key data, the transmission / reception control unit 21A transmits the key data to the previously notified dial-up number using the public network 6. At the same time, the session key search unit 20A
Sets the encryption type in the encryption / decryption unit 14A. The transmission / reception control unit 21A converts the received key data into a key data analysis unit 1
6A, the session key search unit 20A refers to the session key table 13A and sets a decryption formula in the encryption / decryption unit 14A.

When data to be encrypted is transmitted from the transmitting terminal 7 to the transmission / reception control unit 21A of the encryption gateway device 1, the data analysis unit 12A analyzes the session and determines that the data is data to be encrypted. Then, the data is encrypted by the encryption / decryption unit 14A, and data is transmitted from the transmission / reception control unit 21A using the Internet 3. In the cryptographic gateway device 2 that receives the encrypted data, the data analysis unit 12B analyzes the session, and the encryption / decryption unit 14B decrypts the session. The decrypted data is transmitted from the transmission / reception control unit 21B to the terminal 8 on the receiving side, and received by the terminal 8 on the receiving side.

As described above, in this embodiment, the cryptographic gateway devices 1 and 2 are located at the boundary between the local area networks 4 and 5 and the Internet 3, and transfer is performed with the encrypted data only while passing through the Internet 3. The key data is transferred via the route of the public network 6. Therefore, since the encrypted data and the key data for decrypting the encrypted data are transferred through physically different routes, highly confidential communication can be realized, and the transmission destination terminal is not specially modified. Since encrypted communication can be performed, an increase in cost for maintaining confidentiality can be minimized. In the above embodiment, the key data is transferred via the public network 6, but the key data may be transferred via a dedicated line 9 as shown in FIG.

[0026]

According to the present invention, since the key data is transmitted over the same route as the encrypted data by using the public network or the dedicated line, no offline processing is required and the secret key encryption is performed. A scheme can be used. In addition, since the encryption / decryption processing is performed by the encryption gateway device, confidentiality on the Internet, which has security concerns, can be maintained. In addition, since encrypted communication can be performed without special modification of the destination terminal, an increase in cost for maintaining confidentiality can be minimized.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of an encryption communication system using an embodiment of an encryption gateway device according to the present invention.

FIG. 2 is a block diagram illustrating a configuration of a cryptographic gateway device according to an embodiment.

FIG. 3 is a flowchart illustrating an operation of the cryptographic gateway device according to the embodiment.

FIG. 4 is a block diagram showing a detailed configuration of the cryptographic communication system of FIG. 1;

FIG. 5 is a configuration diagram of a cryptographic communication system using another embodiment of the cryptographic gateway device according to the present invention.

FIG. 6 is a block diagram showing a configuration of a conventional cryptographic communication system (part 1).

FIG. 7 is a block diagram showing a configuration of a conventional cryptographic gateway device.

8 is a block diagram showing a configuration of a cryptographic communication system (part 2) using the cryptographic gateway device of FIG. 7;

[Explanation of symbols]

 1, 2 Cryptographic gateway device 3 Internet 4, 5 Local area network 6 Public network 7, 8 Terminal 9 Dedicated line 11 Data receiving means 12 Data analysis unit 13 Session key table 14 Encryption / decryption unit 15 Data transmission means 16 Key data creation Unit 17 key data transmission unit 18 key data reception unit 19 key data analysis unit 20 session key search unit 21 transmission / reception control unit

Claims (3)

[Claims] An encryption gateway device for receiving information from a transmission terminal and encrypting / decrypting the received information, comprising identification information of the transmission terminal and the reception terminal and a session key for encryption or decryption. A session key table for holding a set, a session key search unit for searching for a corresponding session key from the session key table, a data transmission unit and a data reception unit for transmitting and receiving confirmation data and the like for performing encryption, and encrypted data. Data analysis means for analyzing received data and confirmation data, etc., encryption / decryption means for encrypting or decrypting received encrypted data or normal data, and key data for decrypting encrypted data are passed on another route by dial-up or the like. Key data transmitting means and key data receiving means, key data analyzing means for analyzing received key data, and session A key data generating means for generating key data based on a result of the key search, wherein the encrypted data and the key data are physically transferred via different routes in accordance with an encryption instruction from a user. . 2. The encryption gateway device according to claim 1, wherein the encrypted data is transferred using the Internet, and the key data is transferred using a public network. 3. The encryption gateway device according to claim 1, wherein the encrypted data is transferred using the Internet, and the key data is transferred using a dedicated line.