WO2017091000A1 - Data encoding and decoding system and method - Google Patents

Abstract

Provided is a data encoding and decoding method. According to an embodiment of the present invention, a data encoding and decoding method, in a method for generating encoded data in a data encoding unit which transmits the encoded data via a communication network to a second terminal connected to the communication network, comprises the steps of: a) an encoding module receiving transmission of data from a first terminal; and b) generating encoded data by means of an encoding key in the encoding module, wherein step a) comprises step a1) for determining, before receiving the transmission of the data, an encoding level of the data such that a session key and/or a packet key is used.

Description

Data encryption and decryption system and method

The present invention relates to a data encryption and decryption system and method, and to encrypt and decrypt data transmitted and received between terminals using various private and public networks to prevent hacking, eavesdropping, and eavesdropping, and to maintain a high level of security. A data encryption and decryption system and method are described.

In general, various terminals operating in a private or public network including wired or wireless, for example, PCs, laptops, VoIP phones, fax terminals, mobile phones, etc. are subjected to enormous physical or property damage due to various hacking I can wear it.

Hacking refers to all kinds of activities that illegally access the vulnerable security network of the network or adversely affect the operation of the information system or a specific terminal. Eventually, hacking is not intended by the developer who developed the application by arbitrarily manipulating the program code of the application. This is to make the application work.

Such hacking is performed through IP address and account information of various terminals, and even in the case of security devices, hackers attack the IP address and account information to disable the security device.

Therefore, the user generally uses a data encryption or an encryption device to prevent data leakage or incapacitation of the security device through hacking.

In the existing VPN and security devices for terminal communication, IP address and account setting were essential. Therefore, there is a problem that the incapacitation of the security device is inevitably caused by distributed denial of service (DDoS) attacks and various hacking techniques that develop day by day.

In addition, there is a possibility that the user's PC becomes a zombie PC, and can be threatened with life as well as enormous damage due to confidential leakage, in the case of a communication device has the problem that the eavesdropping or eavesdropping.

In order to solve the problems of the prior art as described above, an embodiment of the present invention encrypts data transmitted using various private networks and public networks to encrypt and prevent hacking, eavesdropping, and eavesdropping in advance. And a decoding system and method.

According to an aspect of the present invention for solving the above problems, there is provided a data encryption and decryption method. The data encryption and decryption method may include generating the encrypted data in a data encryption unit that transmits encrypted data through the communication network to a second terminal connected through a communication network, the method comprising: a) encrypting data from the first terminal; Receiving a; And b) generating the encrypted data using an encryption key in the encryption module, wherein step a) comprises: a1) a session key or a packet as an encryption level of the data before receiving the data; Determining to use at least one of the keys.

In the step a1), when the encryption level of the data includes encryption using the session key, the encryption module acquires and holds the session key previously generated by an external or the encryption module, and the encryption level of the data is increased. In the case of including encryption using the packet key, the encryption module may be configured to use the packet key.

Step b), b1) checking whether the session key holding; b2) checking whether to use the packet key; And b3) encrypting the data to generate the encrypted data.

In step b3), if it is determined in step b1) that the session key is held, step b2) is performed. If in step b2), it is determined that the use of the packet key is set, the encrypted data is recalled. Generated using a session key and a packet key, and if it is confirmed in step b2) that the use of the packet key is not set, the encrypted data is generated using only the session key, and the session key in step b1). If it is confirmed that does not hold the encrypted data can be generated using the packet key without performing b2).

According to one aspect of the present invention, a data encryption and decryption method is provided. The data encryption and decryption method includes a data encryption unit for transmitting encrypted data through a communication network to a second terminal connected with a communication network, the data terminal being connected between a first terminal and the communication network and receiving data from the first terminal. And an encryption module for generating the encrypted data by encrypting the data using at least one of a session key and a packet key, wherein the encryption module includes the session key from a user before receiving data from the first terminal. Or receiving a setting for using at least one of the packet keys.

The encryption module acquires and holds the session key previously generated by an external or the encryption module before receiving data from the first terminal when the session key is set to use, and is configured to use the packet key. The packet key generated using the packet header information of the packet received from the first terminal may be configured to be used.

The encryption module may check whether the session key is held and whether the packet key is used before encrypting the data.

The encryption module, when the session key is set to use the packet key, encrypts the data using the session key and the packet key, and holds the session key. If it is not set to use, the data is encrypted using only the session key, and if the session key is not held, the data may be encrypted using the packet key.

The encryption module may include a 1-1 input / output unit configured to receive the data from the first terminal; A first security unit connected to the 1-1 input / output unit, encrypting the data, and receiving the setting from the user; And a first input / output unit connected to the first security unit and receiving the encrypted data and transmitting the encrypted data to the communication network, wherein the non-address network device generates the session key without setting an IP address. Can be.

According to one aspect of the present invention, a data encryption and decryption method is provided. The data encryption and decryption method may further include decrypting the encrypted data in a data decryption unit that receives encrypted data through the communication network from a first terminal connected to a communication network, the method comprising: a) encrypting the encryption module from the communication network; Receiving the collected data; And b) decrypting the encrypted data using a decryption key in the encryption module, wherein step a) comprises: a1) retaining the session key external to the encryption module or previously generated in the encryption module; Checking whether or not; may further include.

In step b), when it is determined through the step a1) that the encryption module holds the session key, it is confirmed that the session key is used as the decryption key and that the session key is not held. In this case, a packet key is used as the decryption key, and the packet key may be generated using header information for each packet of the encrypted data.

The step b) may further include performing decryption using the packet key after performing the decryption using the session key.

According to one aspect of the present invention, a data encryption and decryption method is provided. The data encryption and decryption method includes a data decryption unit that receives encrypted data through a communication network from a first terminal connected through a communication network, and transmits the encrypted data connected between the second terminal and the communication network from the communication network. And an encryption module for decrypting the encrypted data using at least one of a session key and a packet key to generate decrypted data, wherein the encryption module includes the session before receiving the encrypted data from the communication network. Make sure you have a key.

When it is determined that the encryption module holds the session key, the encryption module decrypts the encrypted data by using the session key, and when it is determined that the encryption module does not hold the session key, a header for each packet of the encrypted data. The encrypted data may be decrypted using a packet key generated using information.

If it is determined that the encryption module holds the session key, the encryption module first decrypts the encrypted data using the session key, and performs the second decryption of the primary decrypted data using the packet key. can do.

The encryption module may include: a 2-1 input / output unit configured to transmit the encrypted data from the communication network; A second security unit connected to the 2-1 input / output unit to decrypt the encrypted data to generate decrypted data and to hold the session key; And a 2-2 input / output unit connected to the second security unit and receiving the decrypted data and transferring the decrypted data to the second terminal. The non-address generating the session key without setting an IP address. It may be a network device.

Data encryption and decryption system and method according to an embodiment of the present invention, by performing the encryption and decryption of data has the effect of preventing hacking, eavesdropping, eavesdropping and the like through a variety of private or public networks.

In addition, the data encryption and decryption system and method according to an embodiment of the present invention, a key that can be generated in the process of directly sharing the encryption key by encrypting or decrypting data using a session key for encryption through public key exchange It is effective to prevent leakage.

In addition, the data encryption and decryption system and method according to an embodiment of the present invention, hackers can not connect to the terminal by using a non-address network device that does not need to set an IP address or account in the network device connected to each terminal For example, there is an effect that a kind of virtual private network occurs.

1 is a block diagram of a data encryption and decryption system according to an embodiment of the present invention.

2 is a flow chart for a) generating a session key using the system of FIG. 1 in accordance with an embodiment of the present invention, and b) a non-address, another embodiment of the system of FIG. 1 used to generate a session key. A block diagram of a network device and c) a diagram illustrating an example of a method for generating a session key using a non-addressed network device.

3 is a flow chart illustrating a) a method of encrypting and decrypting data using an encryption key, b) a detailed flow chart of the step of encrypting data and transmitting it to a communication network, and c) a detail of the step of decrypting and outputting encrypted data. Flowchart.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like elements throughout the specification.

1 is a block diagram of a data encryption and decryption system according to an embodiment of the present invention. Referring to FIG. 1, in the data encryption and decryption system 1 according to an embodiment of the present invention, a data encryption unit 10 is connected to a data decryption unit 20 through a communication network 30. Here, the data encryption unit 10 and the data decryption unit 20 may change roles depending on a terminal to which data is to be transmitted.

That is, for example, when data is to be transmitted from the first terminal 11 to the second terminal 21, the first terminal 11 and the first encryption module 13 are set as the data encryption unit 10 and The second terminal 21 and the second encryption module 23 may be set as the data decryption unit 20. When the second terminal 21 intends to transmit data from the second terminal 21 to the first terminal 11, the first terminal 11 and the first encryption module 13 may be set as the data decryption unit 20, and the first terminal 21 and the second encryption module 23 may be set as the data encryption unit 10.

In addition, the communication network 30 may include a dedicated network or a public network, and may include a wired network such as the Internet or PSTN or a wireless network such as Zigbee or Bluetooth.

Hereinafter, for convenience of description, the first terminal 11 and the first encryption module 13 may use the data encryption unit 10 to encrypt the data, and the second terminal 21 and the second encryption module 23 may use the data. Although it is defined as the data decoding unit 20 to decode, it is obvious that the definition may be changed according to the transmission direction of the data as described above.

The first terminal 11 may transmit data to the second terminal 21 through the communication network 30. In this case, in order to prevent eavesdropping or hacking of data, the data encryption and decryption system 1 according to an embodiment of the present invention may include a first encryption module 13 and a second terminal connected to the first terminal 11. And a second encryption module 23 connected to 21, and may exchange session keys used for encrypting and decrypting data using the first encryption module 13 and the second encryption module 23. 1, the terminals 11 and 21 and the encryption modules 13 and 23 are represented as being connected externally, but the present invention is not limited thereto, and the encryption modules 13 and 23 may be used. May be embedded in the terminals 11 and 21 as software or hardware, respectively.

2 is a flow chart for a) generating a session key using the system of FIG. 1 in accordance with an embodiment of the present invention, and b) a non-address, another embodiment of the system of FIG. 1 used to generate a session key. A block diagram of a network device and c) a diagram illustrating an example of a method for generating a session key using a non-addressed network device.

As described above, in order to encrypt and transmit data from the first terminal 11 to the second terminal 21, a session key is required. In addition, when the key itself is shared through the communication network 30, the session key may be leaked to the outside due to hacking or eavesdropping of the communication network. When the session key used to encrypt and decrypt data is leaked to the outside, even if the data is encrypted and transmitted by the data encryption unit 10, since the data can be decrypted from the outside through the leaked session key, the data encryption unit 10 And the data decryption unit 20 may generate a session key using a public key exchange algorithm.

2A illustrates a method of generating a session key for data encryption and decryption using the system of FIG. 1 according to an embodiment of the present invention. Referring to FIG. 2A, in the method S200 of generating a session key for data encryption and decryption according to an embodiment of the present invention, the first encryption module transmits the reprocessed call packet to the communication network (S210). The second encryption module generates a session key using the reprocessed call packet (S220), the second encryption module transmits the reprocessed response packet to the communication network (S230), and the first encryption module reconstructs Generating a session key using the processed response packet (S240).

First, the first encryption module transmits the reprocessed call packet to the communication network (step S210).

The first terminal generates a call packet for performing a TCP connection with the second terminal and delivers it to the first encryption module. In this case, the call packet is a packet provided to generate a session key before transmitting data in earnest, and does not include data that the first terminal wants to transmit by encrypting.

The first encryption module receives the call packet from the first terminal and generates a first private key. The first private key is a random number generated randomly in the first encryption module and is a value used for generating a session key in the first encryption module without being transmitted to the second encryption module through the communication network. Thereafter, the first encryption module generates a specific value k using the first address and the second address included in the header portion of the call packet. In this case, the first address and the second address are respectively represented as IP addresses of the first terminal and the second terminal, and the IP address of the terminal to which data is to be transmitted is represented by the first address, and the IP address of the terminal to which data is to be represented by the second address. Can be.

After generating the specific value k, the first encryption module generates the first public key by combining y, the first stored private value, and the specific value k. The generated first public key may be included in the payload of the call packet and transferred to the second encryption module.

Meanwhile, the payload of the call packet may be reprocessed in the first encryption module to include information for generating a session key. The payload of the call packet includes at least one of an encryption ID, a serial number capable of specifying a first encryption module, and a first public key. In this case, the encryption ID may be a random number having a specific length indicating that the packet has been reprocessed, and the serial number may be a value generated to distinguish the first encryption module.

Next, the second encryption module generates a session key using the reprocessed call packet (step S220).

The second encryption module receives the packet from the communication network. At this time, the second encryption module checks whether the encryption ID is included in the payload of the received packet. If the encryption ID is not included in the payload, the second encryption module may determine that the packet is not a packet transmitted from the first encryption module and drop the packet.

In addition, if it is confirmed that the payload includes the encryption ID, the second encryption module may determine that the packet as a reprocessed call packet transmitted from the first encryption module, and use it to generate a session key. The second cryptographic module generates a second private key upon receipt of the reprocessed call packet, the second private key being a randomly generated random value in the second cryptographic module, which is not transmitted to the first cryptographic module through the communication network. It is used to generate a session key in the second encryption module.

Thereafter, the second encryption module generates a specific value k using the first address and the second address included in the header portion of the packet. In this case, preferably, the second encryption module may further use the port value to generate a specific value k, and the generated specific value k may be the same as the specific value k generated in the first encryption module. This is because the first address, the second address, and the port value used to generate the specific value k, respectively, in the first and second encryption modules are the same.

Meanwhile, the second encryption module may generate a session key by combining the first public key included in the payload, the decimal value y stored in the device, and the second private key. The payload portion of the call packet is deleted, transformed into the same call packet generated by the first terminal, and the packet is transmitted to the second terminal.

Next, the second encryption module transmits the reprocessed response packet to the communication network (step S230).

After receiving the call packet from the second encryption module, the second terminal generates a response packet that is a response to the call packet, and the response packet is delivered to the second encryption module. In this case, the second encryption module may generate a second public key by combining y, a second stored private value, and a specific value k.

The second encryption module may reprocess the response packet such that at least one of an encryption ID, a serial number capable of specifying the second encryption module, and a second public key is included in the payload of the response packet, and the reprocessed response packet Can be transmitted to the network.

Finally, the first encryption module generates a session key using the reprocessed response packet (step S240).

The first encryption module receives the packet from the communication network and checks whether the encryption ID is included in the payload of the packet. When the encryption ID is not included in the payload, the first encryption module may determine that the packet is not a packet transmitted from the second encryption module and drop the packet.

In addition, if the payload includes the encryption ID, the first encryption module may determine the packet as a reprocessed response packet and use it to generate a session key. The first encryption module may generate a session key by combining the second public key included in the payload of the reprocessed response packet, the previously stored decimal value y, and the first private key. The payload portion of the response packet may be deleted and transformed into the same response packet generated by the second terminal, and then the packet may be delivered to the first terminal.

On the other hand, the method (S200) for generating a session key for data encryption and decryption according to an embodiment of the present invention described above is performed before performing data transmission in the case of TCP communication to generate a new session key for each communication It can increase security. Also, in case of UDP communication, if the communication is disconnected for more than the preset time, if the communication status changes compared to the current communication, such as when a new communication is configured or when the communication program to be used is changed, the session key is renewed. By setting to generate, security against session hijacking may be increased.

In addition, as a session key generation algorithm that uses a public key to generate a session key as in an embodiment of the present invention, a Diffie Hellman algorithm is typically used, but this is only one example. All algorithms that can generate the session key for encryption are allowed.

Meanwhile, such a session key generation algorithm may be implemented through a data encryption and decryption system using a non-address network device, which is another embodiment of the system of FIG. 1. The non-address network device refers to a network device for which an IP address or MAC address, etc. necessary for communication for transmitting and receiving data is not set or an account is not required.

Referring to FIG. 2B, the first encryption module 13 of the data encryption and decryption system 2 according to an embodiment of the present invention may include a first-first input / output unit 131, a first security unit 133, and a first security module 133. It may be replaced by the first non-address network device 130 including the 1-2 input and output unit 135, the second encryption module 23, the 2-1 input and output unit 231, the second security unit 233 ) And the second non-address network device 230 including the second input / output unit 235. Since the first and second non-address network devices do not have IP addresses, the first and second non-address network devices cannot directly penetrate from the outside through a communication network or the like, and thus are devices having high safety from hacking into the device.

Through this, data transmitted from the terminals 11 and 21 may be encrypted or decrypted using a session key generated through public key exchange between non-address network devices 130 and 230 independently of the terminals 11 and 21. In addition, by using the non-address network devices 130 and 230, the same effect as that of the communication using the virtual private network may be generated.

Hereinafter, a method of generating the session key disclosed in FIG. 2A using a non-address network device will be described in more detail with reference to FIGS. 2B and 2C. In addition, for convenience of description, it is defined to use the Diffie Hellman algorithm, which is one of a kind of public key algorithm using a public key as an encryption and decryption method used in the system, but the present invention is not limited thereto and encrypts by exchanging the public key. And various public key algorithms capable of performing decryption operations. In addition, in order to help the understanding of the system of the present invention, only the process of transmitting data from the first terminal to the second terminal will be described, and the description of the reverse process will be omitted. However, it can be said that the process of transmitting data from the second terminal to the first terminal can have the same process and effect in the reverse order of the description disclosed below.

2B and 2C, a data encryption and decryption system 2 using a non-address network device according to an embodiment of the present invention may include a first terminal 11, a first non-address network device 130, and a communication network. 30, the second terminal 21, and the second non-address network device 230.

Here, the first terminal 11 may have a first address, the second terminal 21 may have a second address, and the first terminal 11 and the second terminal 21 may each have different accounts. .

The first non-address network device 130 and the second non-address network device 230 must hold the same session key for encrypting and decrypting data. However, when the session key is directly shared, since the session key data is not encrypted, session key information may be leaked through hacking or eavesdropping, and thus encryption information may be attacked. Therefore, the first non-address network device 130 and the second non-address network device 230 may perform a process of generating the same session key in each device through public key exchange before sharing data.

2C illustrates an example of TCP communication using a Diffie Hellman algorithm in a method for generating a session key by a data encryption and decryption system using a non-address network device according to an embodiment of the present invention.

Referring to FIG. 2C, the first terminal 11 has a first address represented by 192.168.123.10, is connected to the first non-address network device 130, and the second terminal 21 is represented by 192.168.456.7. The second address and is connected to the second non-address network device 230.

First, the first terminal 11 generates a call packet for performing a TCP connection with the second terminal 21 and transmits it to the first non-address network device 130. The call packet is a packet provided to generate a session key before the data is transmitted in earnest, and preferably, the first packet 11 does not include data to be encrypted and transmitted.

The first non-address network device 130 receives a call packet from the first terminal 11 through the 1-2 input / output unit 135 and generates a first private key in the first security unit 133. The first private key is a random number generated randomly by the first security unit 133, and is not transmitted to the second non-address network device 230 through the communication network 30, and the session is performed by the first non-address network device 130. Required value for generating a key. Thereafter, the first security unit 133 generates a specific value k using the first address and the second address included in the header portion of the call packet. At this time, preferably, the first security unit 133 may further use the port value to generate a specific value k.

After generating the specific value k, the first security unit 133 generates the first public key by combining y, the first private key, and the specific value k, which are previously stored decimal values. The generated first public key may be included in the payload of the call packet and transferred to the second non-address network device 230.

Meanwhile, the payload of the call packet may be reprocessed by the first security unit 133 to include information for generating a session key. The payload of the call packet includes at least one of an encryption ID, a serial key value of the first non-address network device 130, and a first public key. In this case, the encryption ID is a random value of a specific length indicating that the packet is reprocessed, and the serial key value may be generated for each non-address network device and may be generated to distinguish the non-address network device.

The reprocessed call packet is transmitted to the communication network via the 1-1 input / output unit 131 and is delivered to the second non-address network device 230. When the second security unit 233 of the second non-address network device 230 receives the packet through the 2-1 input / output unit 231, the second security unit 233 confirms whether an encryption ID is included in the payload of the corresponding packet. In this case, when the encryption ID is not included in the payload, the second security unit 233 may determine that the packet is not a packet transmitted from the first non-address network device 130 and drop the packet.

In addition, when it is confirmed that the payload includes the encryption ID, the second security unit 233 may determine that the packet is a packet transmitted from the first non-address network device 130 and use it to generate a session key. When the second security unit 233 receives the reprocessed call packet, the second security key generates a second private key, and the second private key is a random number generated randomly by the second security unit 233, and is generated through the communication network 30. It is used to generate a session key at the second non-address network device 230 without being forwarded to the first non-address network device 130.

Thereafter, the second security unit 233 generates a specific value k using the first address and the second address included in the header portion of the packet. At this time, preferably, the second security unit 233 may further use the port value to generate a specific value k, and the generated specific value k may be the same value as the specific value k generated by the first security unit 133. This is because the first address, the second address, and the port value used by the first and second security units 133 and 233 to generate the specific value k are the same.

Meanwhile, the second security unit 233 may generate a session key by combining the first public key included in the payload, the decimal value y stored in the device, and the second private key, and reprocess after generating the session key. The payload portion of the call packet is deleted and transformed into a call packet generated by the first terminal 11, and then the packet is transferred to the second terminal 21 using the second-2 input / output unit 235.

Next, after receiving the call packet, the second terminal 21 generates a response packet that is a response to the call packet, and the response packet is returned to the second security unit 233 through the second-2 input / output unit 235. Is passed to. In this case, the second security unit 233 generates a second public key by combining y, a second stored private value, a second private key, and a specific value k.

The second security unit 233 may reprocess the response packet such that at least one of the encryption ID, the serial key value of the second non-address network device 230, and the second public key is included in the payload of the response packet. The processed response packet is transmitted to the communication network through the 2-1 input / output unit 231 and delivered to the first non-address network device 130.

The first non-address network device 130 receives the reprocessed response packet through the 1-1 input / output unit 131 and checks whether an encryption ID is included in the payload. In this case, when the encryption ID is not included in the payload, the first security unit 133 may determine that the packet is not a packet transmitted from the second non-address network device 230 and drop the packet.

If the payload includes the encryption ID, the first security unit 133 determines that the packet is a packet transmitted from the second non-address network device 230 and uses the packet to generate a session key. . The first security unit 133 may generate a session key by combining the second public key included in the payload, y, which is a previously stored decimal value, and the first private key. The response packet may be reprocessed after generating the session key. After deleting the payload portion of the packet, the packet is transformed into a response packet generated by the second terminal 21 and then transmitted to the first terminal 11 using the 1-2 input / output unit 135.

The session key generation process described above using FIG. 2C is performed before performing data transmission in the case of TCP communication, thereby increasing security by generating a new session key for each data. In the case of UDP communication, if the communication is disconnected for more than a preset time, a new communication key is generated when the communication status changes compared to the current communication, such as when a new communication is configured or when the communication program to be used is changed. It can also increase security.

Meanwhile, the data encryption and decryption system and method according to an embodiment of the present invention may perform data encryption and decryption using a packet key in addition to the above-described session key. The above-described session key is a key used to encrypt or decrypt a data bundle, and the packet key is a key used to encrypt or decrypt each data packet.

Since the packet key encrypts or decrypts each data packet, even if one packet key is leaked, another packet key is used in the next data packet, thereby having a higher security against key leakage.

A packet key generated to perform data encryption and decryption according to an embodiment of the present invention is generated by the first encryption module 13 and the second encryption module 23 of FIG. 1 using header information for each data packet. Can be. The packet key generated by the first encryption module 13 encrypts data transmitted from the first terminal 11 in packet units, and the packet key generated by the second encryption module 23 is encrypted from the communication network 30. It is used to receive data and decrypt the data.

The first encryption module 13 may use the header information and the additional information of the data packet to generate the packet key. Here, the header information may be at least one of a first address (originating IP address), which is an IP address of a first terminal, a second address (destination IP address), and a packet ID, which is an IP address of a second terminal. It may be at least one of a number or a setting key.

At this time, the serial number is a value generated to distinguish the first encryption module, and the setting key is a specific key that changes according to the user's setting. In addition, in the case of TCP communication, the first encryption module may further use the sequence ID of the TCP packet to generate the packet key.

Among the information used to generate the packet key, the first address, the second address, the serial number of the first encryption module, and the configuration key are fixed values that do not change during the communication session. However, the packet ID is an ID generated to distinguish the packets, and in the case of TCP communication, since the sequence ID is a change value that changes every time the communication session is reconfigured, data is generated using a different packet key for each data packet and communication session. Because it can encrypt, high security can be maintained.

Meanwhile, the second encryption module 23 generates a packet key for decrypting the data. In this case, the second encryption module 23 may receive the encrypted data from the communication network 30 and generate a packet key for decrypting the data using the received header data and additional information for each data packet.

The header information may be at least one of a first address (originating IP address), a second address (destination IP address), and a packet ID, and the additional information may be at least one of a serial number or a setting key.

At this time, the serial number is the serial number of the first encryption module, the second encryption module 230 may obtain the serial number of the first encryption module before receiving the encrypted data from the communication network 30, in particular, TCP In the case of communication, the communication session may be acquired and stored in advance in the step of configuring the communication session. The setting key may be the same key as the first encryption module set by the user as a specific key that changes according to the setting of the user. Further, in the case of TCP communication, the second encryption module may further use the sequence ID of the TCP packet to generate the packet key.

Meanwhile, the first and second encryption modules for generating the packet key may be replaced with the first and second non-address network devices, respectively, as in the example of the system for generating the session key described above with reference to FIG. 2B.

The first non-address network device 130 transmits data to be encrypted from the first terminal 11 to the first security unit 133 through the 1-2 input / output unit 135. The first security unit 133 may include at least one of at least one of a first address (originating IP address), a second address (destination IP address), and a packet ID from the header information of the received data, and at least one of a serial number or a setting key as additional information. A packet key is generated using one piece of information. In this case, the first security unit 133 may generate a packet key using all of the first address, the second address, the packet ID, the serial number, and the setting key.

The serial number is the ID value of the non-address network device that is generated to identify the non-address network device. The serial number is generated by combining a time value at the moment the power is supplied to the first non-address network device 130 and a random number of specific digits. Since the generated serial number is not a fixed value for each device, the first non-address network device 130 may be rebooted as needed to irregularly change the serial number of the device, thereby preventing the leakage of the serial number. have.

In addition, the setting key is a key that can be arbitrarily set by the user. The setting key may generate an encryption group by setting the same setting key value to devices to which the user wants to perform encrypted communication, thereby increasing security capability. In addition, in the case of TCP communication, the first security unit 133 may further use the sequence ID of the TCP communication session generated for data transmission to generate a packet key.

The packet key generated by the first non-address network device 130 is used by the first security unit 133 to encrypt the packet. That is, when a packet key is generated using the header information of the A data packet, the first security unit 133 encrypts the A data packet using the a packet key and communicates with the communication network through the 1-1 input / output unit 131. An encrypted A data packet can be transmitted at 30.

The encrypted data packet is transmitted to the second non-address network device 230 through the communication network 30. The second non-address network device 230 receives the encrypted data packet through the 2-1 input / output unit 231 and transmits the encrypted data packet to the second security unit 233.

The second security unit 233 may generate a packet key for decrypting data using the header information of the encrypted data packet. The second security unit 233 may include at least one of a first address (originating IP address), a second address (destination IP address), and a packet ID from the header information of the encrypted data packet, and a serial number or setting key which is additional information. A packet key is generated using at least one information. In this case, the second security unit 133 may generate a packet key using all of the first address, the second address, the packet ID, the serial number, and the setting key.

At this time, the serial number of the additional information used to generate the packet key in the second security unit 233 may be a serial number of the first non-address network device 130, the second security unit 233 is a communication in TCP communication In the process of exchanging signals to form a communication network defined by the session configuration step, the serial number of the first non-address network device 130 may be obtained and stored to generate a packet key. In addition, in the case of TCP communication, the first security unit 133 may further use the sequence ID of the TCP communication session generated for data transmission to generate a packet key.

Therefore, the packet information and additional information used by the second security unit 233 to generate the packet key are the same as the information used by the first security unit 133 to generate the packet key. If the encrypted A data packet is generated and transmitted by generating the packet key, the second security unit 233 generates the same a packet key generated by the first security unit 133 by using the header information of the encrypted A data packet. As a result, the encrypted A data packet can be decrypted.

Meanwhile, the data encryption and decryption system according to an embodiment of the present invention may encrypt or decrypt data in the same manner as the flowchart shown in FIG. 3A. Hereinafter, a data encryption and decryption method will be described based on the first encryption module and the first terminal. However, the present invention is not limited thereto, and the second encryption module and the second terminal may also encrypt and decrypt data in the same manner. Can be done. In addition, the first encryption module and the second encryption module may be set to perform only one of encryption and decryption.

Referring to FIG. 3A, the data encryption and decryption method 300 according to an embodiment of the present invention includes setting a data encryption level (S310), determining whether data is transmitted from a terminal (S320), and data. And transmitting the encrypted data (S330), determining whether the encrypted data is received from the communication network (S340), and decrypting and outputting the encrypted data (S350).

First, the user sets the data encryption level (step S310). When the first encryption module performs data encryption by changing a setting of the first encryption module, the user may set a data encryption level such that the first encryption module uses at least one of a session key and a packet key for data encryption. . The setting in step S310 may not be applied in the process of decrypting data since the decryption level is determined according to the degree of encryption of the received data when the first encryption module decrypts the data.

In this case, when the user is configured to use the session key, the first encryption module may directly generate the session key as described with reference to FIG. 2 or may receive the previously generated session key from the outside.

Next, the first encryption module determines whether data is transmitted from the first terminal (step S320). When receiving the data from the first terminal, the first encryption module performs step S330 of encrypting the data and transmitting the data to the communication network, and determining whether to receive the encrypted data from the communication network if the data is not received from the terminal. Can be done.

In operation S330, the first encryption module encrypts data and transmits the data to the communication network, as illustrated in FIG. 3B, confirming whether a session key is held in operation S331, and checking whether packet key usage is set in operation S332. Encrypting the data using both the session key and the packet key (S333), encrypting the data using the session key (S334), encrypting the data using the packet key (S335), and encrypting the data. Transmitting to the communication network (S336).

In order to encrypt data and transmit it to the communication network, the first encryption module first checks whether a session key is held (step S331). In this case, if it is determined in step S310 that the session key is held, it is checked whether the packet key is used or not (step S332), and if it is determined that the session key is not held, data is encrypted using only the packet key. (Step S335).

Next, the first encryption module checks whether the packet key is set for use (step S332). If the first encryption module does not set the packet key to be used in step S310, the first encryption module encrypts the data using only the session key (step S334). If the packet key is set to use the packet key, the first encryption module uses both the session key and the packet key to encrypt the data. Encrypt (step S333).

In this case, the packet key used to encrypt data in the first encryption module may be generated using header information for each data packet to be encrypted in the first encryption module.

Finally, the first encryption module transmits the encrypted data to the communication network in steps S333 to S335 (step S336).

On the other hand, when the first encryption module does not receive data from the terminal, the first encryption module determines whether it receives the encrypted data from the communication network (step S340). In this case, when it is determined that the first encryption module does not receive the encrypted data from the communication network, the first encryption module does not receive data from both the terminal and the communication network, and thus repeats step S320.

If it is determined that the first encryption module has received the encrypted data from the communication network, the first encryption module decrypts the received encryption data and transfers the received encryption data to the first terminal to output the data to the user (step S350).

The first encryption module decrypts and outputs the encrypted data (S350), as shown in FIG. 3C, confirming whether or not the session key is held (S351), and performing decryption of the data using the held session key. Step S352, checking whether the data packet is encrypted (S353), generating a packet key to perform decryption of the data packet (S354), and delivering and decrypting the decrypted data to the terminal (S355). Include.

Upon receiving the encrypted data from the communication network, the first encryption module first checks whether a session key is held (step S351). In this case, when it is determined in step S310 that the session key is held, the first encryption module decrypts the encrypted data received from the communication network using the held session key (step S352). In addition, if it is determined that the first encryption module does not hold the session key, the first encryption module may determine that the session key is not used in the process of encrypting the encrypted data received from the communication network, and may not perform step S352. have.

Next, the first encryption module checks whether the received data packet is encrypted (step S353). The first encryption module checks whether the encrypted data received from step S352 or the communication network is encrypted for each packet, and if it is determined that encryption for each packet is performed, the first encryption module generates a packet key to decrypt the corresponding data packet ( Step S354).

In addition, when the first encryption module confirms that the data packet is not encrypted, the first encryption module may not perform step S354. The data packet may preferably be data obtained by performing step S352, since the first encryption module needs to perform at least one data decryption process by receiving encrypted data through a communication network.

On the other hand, the first encryption module delivers the data that has performed at least one decryption step of step S352 or step S354 to the first terminal (step S355), and the first terminal outputs the received data to the user to decrypt the data. You can end the process.

The data encryption and decryption method according to an embodiment of the present invention illustrated in FIGS. 3A to 3C described above may be implemented through a data encryption and decryption system including the non-address network device shown in FIG. 2B. In this case, the first encryption module is replaced with the first non-address network device, and the first security unit may perform each step.

Although one embodiment of the present invention has been described above, the spirit of the present invention is not limited to the embodiments set forth herein, and those skilled in the art who understand the spirit of the present invention, within the scope of the same idea, the addition of components Other embodiments may be easily proposed by changing, deleting, adding, and the like, but this will also fall within the spirit of the present invention.

Claims (16)

In the method for generating the encrypted data in a data encryption unit for transmitting encrypted data through the communication network to a second terminal connected to a communication network, a) receiving, by the encryption module, data from the first terminal; And b) generating the encrypted data using an encryption key in the encryption module; Step a) is a1) before receiving the data, determining the encryption level of the data to use at least one of a session key or a packet key; data encryption and decryption method further comprising. The method of claim 1, In the step a1), when the encryption level of the data includes encryption using the session key, the encryption module acquires and holds the session key previously generated by an external or the encryption module, and the encryption level of the data is increased. And encrypting using the packet key, wherein the encryption module is configured to use the packet key. The method of claim 2, Step b), b1) checking whether the session key is held; b2) checking whether to use the packet key; And b3) encrypting the data to generate the encrypted data. The method of claim 3, wherein In step b3), if it is determined in step b1) that the session key is held, step b2) is performed. If in step b2), it is determined that the use of the packet key is set, the encrypted data is recalled. Generated using a session key and a packet key, and if it is determined in step b2) that the use of the packet key is not set, the encrypted data is generated using only the session key, and in the step b1) If it is confirmed that does not hold the data encryption and decryption method to generate the encrypted data using the packet key without performing the b2). A data encryption unit for transmitting encrypted data through a communication network to a second terminal connected to a communication network, An encryption module connected between a first terminal and the communication network and receiving data from the first terminal to encrypt the data using at least one of a session key and a packet key to generate the encrypted data, The encryption module is a data encryption and decryption system receiving a setting to use at least one of the session key or the packet key from the user, before receiving the data from the first terminal. The method of claim 5, The encryption module acquires and holds the session key previously generated by an external or the encryption module before receiving data from the first terminal when the session key is set to use, and is configured to use the packet key. And configured to use the packet key generated by using the packet-specific header information of the data received from the first terminal. The method of claim 6, The encryption module, the data encryption and decryption system before confirming whether to hold the session key and the use of the packet key before encrypting the data. The method of claim 7, wherein The encryption module, Hold the session key and, when set to use the packet key, encrypt the data using the session key and the packet key, Retains the session key and, if not set to use the packet key, encrypts the data using only the session key, And encrypting the data using the packet key when the session key is not held. The method of claim 5, The encryption module may include a 1-1 input / output unit configured to receive the data from the first terminal; A first security unit connected to the 1-1 input / output unit, encrypting the data, and receiving the setting from the user; And And a first input / output unit connected to the first security unit and receiving the encrypted data and transmitting the encrypted data to the communication network. And a non-address network device for generating said session key without an IP address being set. In the method for decrypting the encrypted data in a data decryption unit for receiving encrypted data through the communication network from a first terminal connected to a communication network, a) receiving an encrypted data by the encryption module from the communication network; And b) decrypting the encrypted data using a decryption key in the encryption module; Step a) is a1) confirming whether the session key is held outside of the encryption module or previously generated by the encryption module. The method of claim 10, The step b) uses the session key as the decryption key when it is determined through the step a1) that the encryption module holds the session key; When it is determined that the session key is not held, a packet key is used as the decryption key, and the packet key is generated using packet information of each packet of the encrypted data. The method of claim 11, The step b) further comprises the step of performing decryption using the packet key after performing the decryption using the session key. In the data decryption unit for receiving encrypted data through the communication network from a first terminal connected to a communication network, An encryption module connected between a second terminal and the communication network and receiving the encrypted data from the communication network to decrypt the encrypted data using at least one of a session key and a packet key to generate decrypted data; The encryption module, the data encryption and decryption system to confirm that the session key, before receiving the encrypted data from the communication network. The method of claim 13, If it is determined that the encryption module holds the session key, the encryption module decrypts the encrypted data using the session key, And if it is determined that the session key is not held, decrypts the encrypted data by using a packet key generated by using packet information of each packet of the encrypted data. The method of claim 14, If it is determined that the encryption module holds the session key, the encryption module first decrypts the encrypted data using the session key, and performs the second decryption of the primary decrypted data using the packet key. Data encryption and decryption system. The method of claim 13, The encryption module, A 2-1 input / output unit for transmitting the encrypted data from the communication network; A second security unit connected to the 2-1 input / output unit to decrypt the encrypted data to generate decrypted data and to hold the session key; And And a 2-2 input / output unit connected to the second security unit and receiving the decrypted data and delivering the decrypted data to the second terminal. And a non-address network device for generating said session key without an IP address being set.

Images