WO2017090996A1

WO2017090996A1 - Data encoding and decoding system and method

Info

Publication number: WO2017090996A1
Application number: PCT/KR2016/013600
Authority: WO
Inventors: 이광원
Original assignee: 이광원
Priority date: 2015-11-24
Filing date: 2016-11-24
Publication date: 2017-06-01
Also published as: WO2017090789A1; WO2017091002A1; WO2017091000A1

Abstract

Provided are data encoding and decoding system and method. According to an embodiment of the present invention, a data encoding and decoding system, in a data encoding unit for transmitting encoded data through a communication network to a second terminal connected by means of the communication network, comprises an encoding module connected between a first terminal and a communication network, receiving transmission of data from the first terminal, encoding the data, and generating a session key that is required for generation of the encoded data. The encoding module generates a first public key, transmits same to the communication network, receives from the communication network a second public key, which is a response to the first public key, and generates the session key by means of a public key algorithm which is for generating the session key by means of the received second public key.

Description

Data encryption and decryption system and method

The present invention relates to a data encryption and decryption system and method, and to encrypt and decrypt data transmitted and received between terminals using various private and public networks to prevent hacking, eavesdropping, and eavesdropping, and to maintain a high level of security. A data encryption and decryption system and method are described.

In general, various terminals operating in a private or public network including wired or wireless, for example, PCs, laptops, VoIP phones, fax terminals, mobile phones, etc. are subjected to enormous physical or property damage due to various hacking I can wear it.

Hacking refers to all kinds of activities that illegally access the vulnerable security network of the network or adversely affect the operation of the information system or a specific terminal. Eventually, hacking is not intended by the developer who developed the application by arbitrarily manipulating the program code of the application. This is to make the application work.

Such hacking is performed through IP address and account information of various terminals, and even in the case of security devices, hackers attack the IP address and account information to disable the security device.

Therefore, the user generally uses a data encryption or an encryption device to prevent data leakage or incapacitation of the security device through hacking.

In the existing VPN and security devices for terminal communication, IP address and account setting were essential. Therefore, there is a problem that the incapacitation of the security device is inevitably caused by distributed denial of service (DDoS) attacks and various hacking techniques that develop day by day.

In addition, there is a possibility that the user's PC becomes a zombie PC, and can be threatened with life as well as enormous damage due to confidential leakage, in the case of a communication device has the problem that the eavesdropping or eavesdropping.

In order to solve the problems of the prior art as described above, an embodiment of the present invention encrypts data transmitted using various private networks and public networks to encrypt and prevent hacking, eavesdropping, and eavesdropping in advance. And a decoding system and method.

According to an aspect of the present invention for solving the above problems, a data encryption and decryption system is provided. The data encryption and decryption system is a data encryption unit for transmitting encrypted data through the communication network to a second terminal connected through a communication network, the data connection between the first terminal and the communication network receives the data from the first terminal And an encryption module for generating a session key required to generate the encrypted data by encrypting the encryption key, wherein the encryption module generates a first public key and transmits the first public key to the first public key. And receiving a second public key that is a response to the session, and generating the session key using a public key algorithm, which is a method of generating the session key using the received second public key.

The encryption module, when receiving the call packet from the first terminal, transmits the reprocessed call packet including the first public key to the communication network, and then sends the reprocessed response packet including the second public key. Receive and use the reprocessed response packet to generate the session key.

The reprocessed call packet further includes at least one of an encryption ID represented by a random value of a specific length in a payload and a serial number of the encryption module, wherein the serial number is a unique value that can distinguish the encryption module. Can be.

The encryption module may generate a first private key together with the first public key, and generate the session key using the first private key and the second public key after receiving the second public key. .

The session key may be generated in the case of TCP communication, configuring the TCP communication before performing the transmission of the data.

The encryption module further uses a packet key generated by using header information for each data packet of the data to generate the encrypted data, wherein the packet key includes header information of the data and a serial number of the encryption module. And generated using at least one of a preset key set by a user, wherein the header information includes at least one of an IP address of the first terminal, an IP address of the second terminal, and a packet ID for each packet. The number may be a unique value that can distinguish the encryption module.

The packet key may be generated using a sequence ID which is a value representing a sequence of the TCP communication in the case of TCP communication.

The encryption module may include a 1-1 input / output unit configured to receive the data from the first terminal; A first security unit connected to the 1-1 input / output unit and generating the encrypted data and the session key; And a first input / output unit connected to the first security unit and receiving the encrypted data and transmitting the encrypted data to the communication network, wherein the non-address network device generates the session key without setting an IP address. Can be.

According to one aspect of the present invention, a data encryption and decryption system is provided. The data encryption and decryption system is a data decryption unit for receiving encrypted data through a communication network from a first terminal connected to a communication network, the second terminal and the communication network is connected between the communication network and transfer the encrypted data from the communication network An encryption module for generating a session key required for receiving and decrypting to generate decrypted data, wherein the encryption module is a response to the first public key after receiving a first public key from the communication network. A second public key is generated, and the session key is generated using a public key algorithm, which is a method of transmitting the second public key to the communication network and generating the session key.

When receiving the reprocessed call packet including the first public key from the communication network, the encryption module generates the session key using the reprocessed call packet and delivers a response packet from the second terminal. Receive and send a reprocessed response packet containing the second public key to the communication network.

The reprocessed response packet may include at least one of an encryption ID represented by a random number having a specific length in a payload and a serial number of the encryption module, and the serial number may be a unique value for distinguishing an encryption module. have.

The encryption module may generate a second private key together with the second public key, and generate the session key using the second private key and the first public key after receiving the first public key. .

The encryption module further uses a packet key generated by using header information for each data packet of the encrypted data to generate the decrypted data, wherein the packet key includes the header information of the encrypted data and the encryption. Generated using at least one of a serial number of an encryption module that generates the generated data and a user-configured setting key, wherein the header information is an IP address of the first terminal, an IP address of the second terminal, and a packet for each packet. Including an ID, the serial number may be a unique value for distinguishing the encryption module.

The encryption module may include a 2-1 input / output unit configured to receive the encrypted data from the communication network; A second security unit connected to the 2-1 input / output unit and generating the decrypted data and the session key; And a 2-2 input / output unit connected to the second security unit and transferring the decrypted data to the second terminal, wherein the non-address network device generates the session key without setting an IP address. Can be.

According to one aspect of the present invention, a data encryption and decryption system is provided. The data encryption and decryption system includes a data encryption unit for transmitting encrypted data through a communication network and a data decryption unit for receiving the encrypted data through the communication network, the first terminal and the communication network being connected to each other. A first encryption module configured to receive data from a first terminal and encrypt the data to generate a session key required for generating the encrypted data; And a second encryption module connected between a second terminal and the communication network to generate the session key required to receive the decrypted data from the communication network and to decrypt and generate decrypted data. Generate a first public key in the module and transmit it to the communication network, and after receiving the first public key in the second encryption module, generate a second public key that is a response to the session key and the generated first public key The session key is generated by using a public key algorithm, which is a method of transmitting the second public key to the communication network and generating the session key by the first encryption module receiving and using the second public key.

When the first encryption module receives the call packet from the first terminal, the first encryption module transmits the reprocessed call packet including the first public key to the communication network, and then reprocesses the second packet to include the second public key. Receive a packet, generate the session key using the reprocessed response packet, and the second encryption module uses the reprocessed call packet when receiving the reprocessed call packet from the communication network The session key may be generated, the response packet may be received from the second terminal, and the reprocessed response packet may be transmitted to the communication network.

The reprocessed call packet further includes at least one of an encryption ID represented by a random number of a specific length in a payload and a serial number of the first encryption module, wherein the reprocessed response packet is specified in a payload. At least one of an encryption ID represented by a random value of a length and a serial number of the second encryption module, wherein the serial number may be a unique value for distinguishing an encryption module.

The first encryption module generates a first private key together with the first public key, generates the session key using the first private key and the second public key after receiving the second public key. The second encryption module generates a second private key together with the second public key, and generates the session key using the second private key and the first public key after receiving the first public key. can do.

The first encryption module further uses a packet key generated by using header information for each data packet of the data to generate the encrypted data, and the second encryption module is further configured to generate the decrypted data. The packet key generated by using the header information for each packet of data of the encrypted data is further used, wherein the packet key includes header information of the data, a serial number of the first encryption module, and a user-defined key. The header information includes at least one of an IP address of the first terminal, an IP address of the second terminal, and a packet ID for each packet, and the serial number identifies the encryption module. Can be a unique value.

The first encryption module may include: a 1-1 input / output unit configured to receive the data from the first terminal; A first security unit connected to the 1-1 input / output unit and generating the encrypted data and the session key; And a first input / output unit connected to the first security unit and receiving the encrypted data and transmitting the encrypted data to the communication network, wherein the first non-address generates the session key without setting an IP address. A network device, wherein the second encryption module comprises: a 2-1 input / output unit configured to receive the encrypted data from the communication network; A second security unit connected to the 2-1 input / output unit and generating the decrypted data and the session key; And a second input / output unit connected to the second security unit and transferring the decrypted data to the second terminal, wherein the second non-address generates the session key without setting an IP address. It may be a network device.

Data encryption and decryption system and method according to an embodiment of the present invention, by performing the encryption and decryption of data has the effect of preventing hacking, eavesdropping, eavesdropping and the like through a variety of private or public networks.

In addition, the data encryption and decryption system and method according to an embodiment of the present invention, a key that can be generated in the process of directly sharing the encryption key by encrypting or decrypting data using a session key for encryption through public key exchange It is effective to prevent leakage.

In addition, the data encryption and decryption system and method according to an embodiment of the present invention, hackers can not connect to the terminal by using a non-address network device that does not need to set an IP address or account in the network device connected to each terminal For example, there is an effect that a kind of virtual private network occurs.

1 is a block diagram of a data encryption and decryption system according to an embodiment of the present invention.

2 is a flow chart for a) generating a session key using the system of FIG. 1 in accordance with an embodiment of the present invention, and b) a non-address, another embodiment of the system of FIG. 1 used to generate a session key. A block diagram of a network device and c) a diagram illustrating an example of a method for generating a session key using a non-addressed network device.

3 is a flow chart illustrating a) a method of encrypting and decrypting data using an encryption key, b) a detailed flow chart of the step of encrypting data and transmitting it to a communication network, and c) a detail of the step of decrypting and outputting encrypted data. Flowchart.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like elements throughout the specification.

1 is a block diagram of a data encryption and decryption system according to an embodiment of the present invention. Referring to FIG. 1, in the data encryption and decryption system 1 according to an embodiment of the present invention, a data encryption unit 10 is connected to a data decryption unit 20 through a communication network 30. Here, the data encryption unit 10 and the data decryption unit 20 may change roles depending on a terminal to which data is to be transmitted.

That is, for example, when data is to be transmitted from the first terminal 11 to the second terminal 21, the first terminal 11 and the first encryption module 13 are set as the data encryption unit 10 and The second terminal 21 and the second encryption module 23 may be set as the data decryption unit 20. When the second terminal 21 intends to transmit data from the second terminal 21 to the first terminal 11, the first terminal 11 and the first encryption module 13 may be set as the data decryption unit 20, and the first terminal 21 and the second encryption module 23 may be set as the data encryption unit 10.

In addition, the communication network 30 may include a dedicated network or a public network, and may include a wired network such as the Internet or PSTN or a wireless network such as Zigbee or Bluetooth.

Hereinafter, for convenience of description, the first terminal 11 and the first encryption module 13 may use the data encryption unit 10 to encrypt the data, and the second terminal 21 and the second encryption module 23 may use the data. Although it is defined as the data decoding unit 20 to decode, it is obvious that the definition may be changed according to the transmission direction of the data as described above.

The first terminal 11 may transmit data to the second terminal 21 through the communication network 30. In this case, in order to prevent eavesdropping or hacking of data, the data encryption and decryption system 1 according to an embodiment of the present invention may include a first encryption module 13 and a second terminal connected to the first terminal 11. And a second encryption module 23 connected to 21, and may exchange session keys used for encrypting and decrypting data using the first encryption module 13 and the second encryption module 23. 1, the

terminals

11 and 21 and the

encryption modules

13 and 23 are represented as being connected externally, but the present invention is not limited thereto, and the

encryption modules

13 and 23 may be used. May be embedded in the

terminals

11 and 21 as software or hardware, respectively.

As described above, in order to encrypt and transmit data from the first terminal 11 to the second terminal 21, a session key is required. In addition, when the key itself is shared through the communication network 30, the session key may be leaked to the outside due to hacking or eavesdropping of the communication network. When the session key used to encrypt and decrypt data is leaked to the outside, even if the data is encrypted and transmitted by the data encryption unit 10, since the data can be decrypted from the outside through the leaked session key, the data encryption unit 10 And the data decryption unit 20 may generate a session key using a public key exchange algorithm.

2A illustrates a method of generating a session key for data encryption and decryption using the system of FIG. 1 according to an embodiment of the present invention. Referring to FIG. 2A, in the method S200 of generating a session key for data encryption and decryption according to an embodiment of the present invention, the first encryption module transmits the reprocessed call packet to the communication network (S210). The second encryption module generates a session key using the reprocessed call packet (S220), the second encryption module transmits the reprocessed response packet to the communication network (S230), and the first encryption module reconstructs Generating a session key using the processed response packet (S240).

First, the first encryption module transmits the reprocessed call packet to the communication network (step S210).

The first terminal generates a call packet for performing a TCP connection with the second terminal and delivers it to the first encryption module. In this case, the call packet is a packet provided to generate a session key before transmitting data in earnest, and does not include data that the first terminal wants to transmit by encrypting.

The first encryption module receives the call packet from the first terminal and generates a first private key. The first private key is a random number generated randomly in the first encryption module and is a value used for generating a session key in the first encryption module without being transmitted to the second encryption module through the communication network. Thereafter, the first encryption module generates a specific value k using the first address and the second address included in the header portion of the call packet. In this case, the first address and the second address are respectively represented as IP addresses of the first terminal and the second terminal, and the IP address of the terminal to which data is to be transmitted is represented by the first address, and the IP address of the terminal to which data is to be represented by the second address. Can be.

After generating the specific value k, the first encryption module generates the first public key by combining y, the first stored private value, and the specific value k. The generated first public key may be included in the payload of the call packet and transferred to the second encryption module.

Meanwhile, the payload of the call packet may be reprocessed in the first encryption module to include information for generating a session key. The payload of the call packet includes at least one of an encryption ID, a serial number capable of specifying a first encryption module, and a first public key. In this case, the encryption ID may be a random number having a specific length indicating that the packet has been reprocessed, and the serial number may be a value generated to distinguish the first encryption module.

Next, the second encryption module generates a session key using the reprocessed call packet (step S220).

The second encryption module receives the packet from the communication network. At this time, the second encryption module checks whether the encryption ID is included in the payload of the received packet. If the encryption ID is not included in the payload, the second encryption module may determine that the packet is not a packet transmitted from the first encryption module and drop the packet.

In addition, if it is confirmed that the payload includes the encryption ID, the second encryption module may determine that the packet as a reprocessed call packet transmitted from the first encryption module, and use it to generate a session key. The second cryptographic module generates a second private key upon receipt of the reprocessed call packet, the second private key being a randomly generated random value in the second cryptographic module, which is not transmitted to the first cryptographic module through the communication network. It is used to generate a session key in the second encryption module.

Thereafter, the second encryption module generates a specific value k using the first address and the second address included in the header portion of the packet. In this case, preferably, the second encryption module may further use the port value to generate a specific value k, and the generated specific value k may be the same as the specific value k generated in the first encryption module. This is because the first address, the second address, and the port value used to generate the specific value k, respectively, in the first and second encryption modules are the same.

Meanwhile, the second encryption module may generate a session key by combining the first public key included in the payload, the decimal value y stored in the device, and the second private key. The payload portion of the call packet is deleted, transformed into the same call packet generated by the first terminal, and the packet is transmitted to the second terminal.

Next, the second encryption module transmits the reprocessed response packet to the communication network (step S230).

After receiving the call packet from the second encryption module, the second terminal generates a response packet that is a response to the call packet, and the response packet is delivered to the second encryption module. In this case, the second encryption module may generate a second public key by combining y, a second stored private value, and a specific value k.

The second encryption module may reprocess the response packet such that at least one of an encryption ID, a serial number capable of specifying the second encryption module, and a second public key is included in the payload of the response packet, and the reprocessed response packet Can be transmitted to the network.

Finally, the first encryption module generates a session key using the reprocessed response packet (step S240).

The first encryption module receives the packet from the communication network and checks whether the encryption ID is included in the payload of the packet. When the encryption ID is not included in the payload, the first encryption module may determine that the packet is not a packet transmitted from the second encryption module and drop the packet.

In addition, if the payload includes the encryption ID, the first encryption module may determine the packet as a reprocessed response packet and use it to generate a session key. The first encryption module may generate a session key by combining the second public key included in the payload of the reprocessed response packet, the previously stored decimal value y, and the first private key. The payload portion of the response packet may be deleted and transformed into the same response packet generated by the second terminal, and then the packet may be delivered to the first terminal.

On the other hand, the method (S200) for generating a session key for data encryption and decryption according to an embodiment of the present invention described above is performed before performing data transmission in the case of TCP communication to generate a new session key for each communication It can increase security. Also, in case of UDP communication, if the communication is disconnected for more than the preset time, if the communication status changes compared to the current communication, such as when a new communication is configured or when the communication program to be used is changed, the session key is renewed. By setting to generate, security against session hijacking may be increased.

In addition, as a session key generation algorithm that uses a public key to generate a session key as in an embodiment of the present invention, a Diffie Hellman algorithm is typically used, but this is only one example. All algorithms that can generate the session key for encryption are allowed.

Meanwhile, such a session key generation algorithm may be implemented through a data encryption and decryption system using a non-address network device, which is another embodiment of the system of FIG. 1. The non-address network device refers to a network device for which an IP address or MAC address, etc. necessary for communication for transmitting and receiving data is not set or an account is not required.

Referring to FIG. 2B, the first encryption module 13 of the data encryption and decryption system 2 according to an embodiment of the present invention may include a first-first input / output unit 131, a first security unit 133, and a first security module 133. It may be replaced by the first non-address network device 130 including the 1-2 input and output unit 135, the second encryption module 23, the 2-1 input and output unit 231, the second security unit 233 ) And the second non-address network device 230 including the second input / output unit 235. Since the first and second non-address network devices do not have IP addresses, the first and second non-address network devices cannot directly penetrate from the outside through a communication network or the like, and thus are devices having high safety from hacking into the device.

Through this, data transmitted from the

terminals

11 and 21 may be encrypted or decrypted using a session key generated through public key exchange between non-address network devices 130 and 230 independently of the

terminals

11 and 21. In addition, by using the non-address network devices 130 and 230, the same effect as that of the communication using the virtual private network may be generated.

Hereinafter, a method of generating the session key disclosed in FIG. 2A using a non-address network device will be described in more detail with reference to FIGS. 2B and 2C. In addition, for convenience of description, it is defined to use the Diffie Hellman algorithm, which is one of a kind of public key algorithm using a public key as an encryption and decryption method used in the system, but the present invention is not limited thereto and encrypts by exchanging the public key. And various public key algorithms capable of performing decryption operations. In addition, in order to help the understanding of the system of the present invention, only the process of transmitting data from the first terminal to the second terminal will be described, and the description of the reverse process will be omitted. However, it can be said that the process of transmitting data from the second terminal to the first terminal can have the same process and effect in the reverse order of the description disclosed below.

2B and 2C, a data encryption and decryption system 2 using a non-address network device according to an embodiment of the present invention may include a first terminal 11, a first non-address network device 130, and a communication network. 30, the second terminal 21, and the second non-address network device 230.

Here, the first terminal 11 may have a first address, the second terminal 21 may have a second address, and the first terminal 11 and the second terminal 21 may each have different accounts. .

The first non-address network device 130 and the second non-address network device 230 must hold the same session key for encrypting and decrypting data. However, when the session key is directly shared, since the session key data is not encrypted, session key information may be leaked through hacking or eavesdropping, and thus encryption information may be attacked. Therefore, the first non-address network device 130 and the second non-address network device 230 may perform a process of generating the same session key in each device through public key exchange before sharing data.

2C illustrates an example of TCP communication using a Diffie Hellman algorithm in a method for generating a session key by a data encryption and decryption system using a non-address network device according to an embodiment of the present invention.

Referring to FIG. 2C, the first terminal 11 has a first address represented by 192.168.123.10, is connected to the first non-address network device 130, and the second terminal 21 is represented by 192.168.456.7. The second address and is connected to the second non-address network device 230.

First, the first terminal 11 generates a call packet for performing a TCP connection with the second terminal 21 and transmits it to the first non-address network device 130. The call packet is a packet provided to generate a session key before the data is transmitted in earnest, and preferably, the first packet 11 does not include data to be encrypted and transmitted.

The first non-address network device 130 receives a call packet from the first terminal 11 through the 1-2 input / output unit 135 and generates a first private key in the first security unit 133. The first private key is a random number generated randomly by the first security unit 133, and is not transmitted to the second non-address network device 230 through the communication network 30, and the session is performed by the first non-address network device 130. Required value for generating a key. Thereafter, the first security unit 133 generates a specific value k using the first address and the second address included in the header portion of the call packet. At this time, preferably, the first security unit 133 may further use the port value to generate a specific value k.

After generating the specific value k, the first security unit 133 generates the first public key by combining y, the first private key, and the specific value k, which are previously stored decimal values. The generated first public key may be included in the payload of the call packet and transferred to the second non-address network device 230.

Meanwhile, the payload of the call packet may be reprocessed by the first security unit 133 to include information for generating a session key. The payload of the call packet includes at least one of an encryption ID, a serial key value of the first non-address network device 130, and a first public key. In this case, the encryption ID is a random value of a specific length indicating that the packet is reprocessed, and the serial key value may be generated for each non-address network device and may be generated to distinguish the non-address network device.

The reprocessed call packet is transmitted to the communication network via the 1-1 input / output unit 131 and is delivered to the second non-address network device 230. When the second security unit 233 of the second non-address network device 230 receives the packet through the 2-1 input / output unit 231, the second security unit 233 confirms whether an encryption ID is included in the payload of the corresponding packet. In this case, when the encryption ID is not included in the payload, the second security unit 233 may determine that the packet is not a packet transmitted from the first non-address network device 130 and drop the packet.

In addition, when it is confirmed that the payload includes the encryption ID, the second security unit 233 may determine that the packet is a packet transmitted from the first non-address network device 130 and use it to generate a session key. When the second security unit 233 receives the reprocessed call packet, the second security key generates a second private key, and the second private key is a random number generated randomly by the second security unit 233, and is generated through the communication network 30. It is used to generate a session key at the second non-address network device 230 without being forwarded to the first non-address network device 130.

Thereafter, the second security unit 233 generates a specific value k using the first address and the second address included in the header portion of the packet. At this time, preferably, the second security unit 233 may further use the port value to generate a specific value k, and the generated specific value k may be the same value as the specific value k generated by the first security unit 133. This is because the first address, the second address, and the port value used by the first and

second security units

133 and 233 to generate the specific value k are the same.

Meanwhile, the second security unit 233 may generate a session key by combining the first public key included in the payload, the decimal value y stored in the device, and the second private key, and reprocess after generating the session key. The payload portion of the call packet is deleted and transformed into a call packet generated by the first terminal 11, and then the packet is transferred to the second terminal 21 using the second-2 input / output unit 235.

Next, after receiving the call packet, the second terminal 21 generates a response packet that is a response to the call packet, and the response packet is returned to the second security unit 233 through the second-2 input / output unit 235. Is passed to. In this case, the second security unit 233 generates a second public key by combining y, a second stored private value, a second private key, and a specific value k.

The second security unit 233 may reprocess the response packet such that at least one of the encryption ID, the serial key value of the second non-address network device 230, and the second public key is included in the payload of the response packet. The processed response packet is transmitted to the communication network through the 2-1 input / output unit 231 and delivered to the first non-address network device 130.

The first non-address network device 130 receives the reprocessed response packet through the 1-1 input / output unit 131 and checks whether an encryption ID is included in the payload. In this case, when the encryption ID is not included in the payload, the first security unit 133 may determine that the packet is not a packet transmitted from the second non-address network device 230 and drop the packet.

If the payload includes the encryption ID, the first security unit 133 determines that the packet is a packet transmitted from the second non-address network device 230 and uses the packet to generate a session key. . The first security unit 133 may generate a session key by combining the second public key included in the payload, y, which is a previously stored decimal value, and the first private key. The response packet may be reprocessed after generating the session key. After deleting the payload portion of the packet, the packet is transformed into a response packet generated by the second terminal 21 and then transmitted to the first terminal 11 using the 1-2 input / output unit 135.

The session key generation process described above using FIG. 2C is performed before performing data transmission in the case of TCP communication, thereby increasing security by generating a new session key for each data. In the case of UDP communication, if the communication is disconnected for more than a preset time, a new communication key is generated when the communication status changes compared to the current communication, such as when a new communication is configured or when the communication program to be used is changed. It can also increase security.

Meanwhile, the data encryption and decryption system and method according to an embodiment of the present invention may perform data encryption and decryption using a packet key in addition to the above-described session key. The above-described session key is a key used to encrypt or decrypt a data bundle, and the packet key is a key used to encrypt or decrypt each data packet.

Since the packet key encrypts or decrypts each data packet, even if one packet key is leaked, another packet key is used in the next data packet, thereby having a higher security against key leakage.

A packet key generated to perform data encryption and decryption according to an embodiment of the present invention is generated by the first encryption module 13 and the second encryption module 23 of FIG. 1 using header information for each data packet. Can be. The packet key generated by the first encryption module 13 encrypts data transmitted from the first terminal 11 in packet units, and the packet key generated by the second encryption module 23 is encrypted from the communication network 30. It is used to receive data and decrypt the data.

The first encryption module 13 may use the header information and the additional information of the data packet to generate the packet key. Here, the header information may be at least one of a first address (originating IP address), which is an IP address of a first terminal, a second address (destination IP address), and a packet ID, which is an IP address of a second terminal. It may be at least one of a number or a setting key.

At this time, the serial number is a value generated to distinguish the first encryption module, and the setting key is a specific key that changes according to the user's setting. In addition, in the case of TCP communication, the first encryption module may further use the sequence ID of the TCP packet to generate the packet key.

Among the information used to generate the packet key, the first address, the second address, the serial number of the first encryption module, and the configuration key are fixed values that do not change during the communication session. However, the packet ID is an ID generated to distinguish the packets, and in the case of TCP communication, since the sequence ID is a change value that changes every time the communication session is reconfigured, data is generated using a different packet key for each data packet and communication session. Because it can encrypt, high security can be maintained.

Meanwhile, the second encryption module 23 generates a packet key for decrypting the data. In this case, the second encryption module 23 may receive the encrypted data from the communication network 30 and generate a packet key for decrypting the data using the received header data and additional information for each data packet.

The header information may be at least one of a first address (originating IP address), a second address (destination IP address), and a packet ID, and the additional information may be at least one of a serial number or a setting key.

At this time, the serial number is the serial number of the first encryption module, the second encryption module 230 may obtain the serial number of the first encryption module before receiving the encrypted data from the communication network 30, in particular, TCP In the case of communication, the communication session may be acquired and stored in advance in the step of configuring the communication session. The setting key may be the same key as the first encryption module set by the user as a specific key that changes according to the setting of the user. Further, in the case of TCP communication, the second encryption module may further use the sequence ID of the TCP packet to generate the packet key.

Meanwhile, the first and second encryption modules for generating the packet key may be replaced with the first and second non-address network devices, respectively, as in the example of the system for generating the session key described above with reference to FIG. 2B.

The first non-address network device 130 transmits data to be encrypted from the first terminal 11 to the first security unit 133 through the 1-2 input / output unit 135. The first security unit 133 may include at least one of at least one of a first address (originating IP address), a second address (destination IP address), and a packet ID from the header information of the received data, and at least one of a serial number or a setting key as additional information. A packet key is generated using one piece of information. In this case, the first security unit 133 may generate a packet key using all of the first address, the second address, the packet ID, the serial number, and the setting key.

The serial number is the ID value of the non-address network device that is generated to identify the non-address network device. The serial number is generated by combining a time value at the moment the power is supplied to the first non-address network device 130 and a random number of specific digits. Since the generated serial number is not a fixed value for each device, the first non-address network device 130 may be rebooted as needed to irregularly change the serial number of the device, thereby preventing the leakage of the serial number. have.

In addition, the setting key is a key that can be arbitrarily set by the user. The setting key may generate an encryption group by setting the same setting key value to devices to which the user wants to perform encrypted communication, thereby increasing security capability. In addition, in the case of TCP communication, the first security unit 133 may further use the sequence ID of the TCP communication session generated for data transmission to generate a packet key.

The packet key generated by the first non-address network device 130 is used by the first security unit 133 to encrypt the packet. That is, when a packet key is generated using the header information of the A data packet, the first security unit 133 encrypts the A data packet using the a packet key and communicates with the communication network through the 1-1 input / output unit 131. An encrypted A data packet can be transmitted at 30.

The encrypted data packet is transmitted to the second non-address network device 230 through the communication network 30. The second non-address network device 230 receives the encrypted data packet through the 2-1 input / output unit 231 and transmits the encrypted data packet to the second security unit 233.

The second security unit 233 may generate a packet key for decrypting data using the header information of the encrypted data packet. The second security unit 233 may include at least one of a first address (originating IP address), a second address (destination IP address), and a packet ID from the header information of the encrypted data packet, and a serial number or setting key which is additional information. A packet key is generated using at least one information. In this case, the second security unit 133 may generate a packet key using all of the first address, the second address, the packet ID, the serial number, and the setting key.

At this time, the serial number of the additional information used to generate the packet key in the second security unit 233 may be a serial number of the first non-address network device 130, the second security unit 233 is a communication in TCP communication In the process of exchanging signals to form a communication network defined by the session configuration step, the serial number of the first non-address network device 130 may be obtained and stored to generate a packet key. In addition, in the case of TCP communication, the first security unit 133 may further use the sequence ID of the TCP communication session generated for data transmission to generate a packet key.

Therefore, the packet information and additional information used by the second security unit 233 to generate the packet key are the same as the information used by the first security unit 133 to generate the packet key. If the encrypted A data packet is generated and transmitted by generating the packet key, the second security unit 233 generates the same a packet key generated by the first security unit 133 by using the header information of the encrypted A data packet. As a result, the encrypted A data packet can be decrypted.

Meanwhile, the data encryption and decryption system according to an embodiment of the present invention may encrypt or decrypt data in the same manner as the flowchart shown in FIG. 3A. Hereinafter, a data encryption and decryption method will be described based on the first encryption module and the first terminal. However, the present invention is not limited thereto, and the second encryption module and the second terminal may also encrypt and decrypt data in the same manner. Can be done. In addition, the first encryption module and the second encryption module may be set to perform only one of encryption and decryption.

Referring to FIG. 3A, the data encryption and decryption method 300 according to an embodiment of the present invention includes setting a data encryption level (S310), determining whether data is transmitted from a terminal (S320), and data. And transmitting the encrypted data (S330), determining whether the encrypted data is received from the communication network (S340), and decrypting and outputting the encrypted data (S350).

First, the user sets the data encryption level (step S310). When the first encryption module performs data encryption by changing a setting of the first encryption module, the user may set a data encryption level such that the first encryption module uses at least one of a session key and a packet key for data encryption. . The setting in step S310 may not be applied in the process of decrypting data since the decryption level is determined according to the degree of encryption of the received data when the first encryption module decrypts the data.

In this case, when the user is configured to use the session key, the first encryption module may directly generate the session key as described with reference to FIG. 2 or may receive the previously generated session key from the outside.

Next, the first encryption module determines whether data is transmitted from the first terminal (step S320). When receiving the data from the first terminal, the first encryption module performs step S330 of encrypting the data and transmitting the data to the communication network, and determining whether to receive the encrypted data from the communication network if the data is not received from the terminal. Can be done.

In operation S330, the first encryption module encrypts data and transmits the data to the communication network, as illustrated in FIG. 3B, confirming whether a session key is held in operation S331, and checking whether packet key usage is set in operation S332. Encrypting the data using both the session key and the packet key (S333), encrypting the data using the session key (S334), encrypting the data using the packet key (S335), and encrypting the data. Transmitting to the communication network (S336).

In order to encrypt data and transmit it to the communication network, the first encryption module first checks whether a session key is held (step S331). In this case, if it is determined in step S310 that the session key is held, it is checked whether the packet key is used or not (step S332), and if it is determined that the session key is not held, data is encrypted using only the packet key. (Step S335).

Next, the first encryption module checks whether the packet key is set for use (step S332). If the first encryption module does not set the packet key to be used in step S310, the first encryption module encrypts the data using only the session key (step S334). If the packet key is set to use the packet key, the first encryption module uses both the session key and the packet key to encrypt the data. Encrypt (step S333).

In this case, the packet key used to encrypt data in the first encryption module may be generated using header information for each data packet to be encrypted in the first encryption module.

Finally, the first encryption module transmits the encrypted data to the communication network in steps S333 to S335 (step S336).

On the other hand, when the first encryption module does not receive data from the terminal, the first encryption module determines whether it receives the encrypted data from the communication network (step S340). In this case, when it is determined that the first encryption module does not receive the encrypted data from the communication network, the first encryption module does not receive data from both the terminal and the communication network, and thus repeats step S320.

If it is determined that the first encryption module has received the encrypted data from the communication network, the first encryption module decrypts the received encryption data and transfers the received encryption data to the first terminal to output the data to the user (step S350).

The first encryption module decrypts and outputs the encrypted data (S350), as shown in FIG. 3C, confirming whether or not the session key is held (S351), and performing decryption of the data using the held session key. Step S352, checking whether the data packet is encrypted (S353), generating a packet key to perform decryption of the data packet (S354), and delivering and decrypting the decrypted data to the terminal (S355). Include.

Upon receiving the encrypted data from the communication network, the first encryption module first checks whether a session key is held (step S351). In this case, when it is determined in step S310 that the session key is held, the first encryption module decrypts the encrypted data received from the communication network using the held session key (step S352). In addition, if it is determined that the first encryption module does not hold the session key, the first encryption module may determine that the session key is not used in the process of encrypting the encrypted data received from the communication network, and may not perform step S352. have.

Next, the first encryption module checks whether the received data packet is encrypted (step S353). The first encryption module checks whether the encrypted data received from step S352 or the communication network is encrypted for each packet, and if it is determined that encryption for each packet is performed, the first encryption module generates a packet key to decrypt the corresponding data packet ( Step S354).

In addition, when the first encryption module confirms that the data packet is not encrypted, the first encryption module may not perform step S354. The data packet may preferably be data obtained by performing step S352, since the first encryption module needs to perform at least one data decryption process by receiving encrypted data through a communication network.

On the other hand, the first encryption module delivers the data that has performed at least one decryption step of step S352 or step S354 to the first terminal (step S355), and the first terminal outputs the received data to the user to decrypt the data. You can end the process.

The data encryption and decryption method according to an embodiment of the present invention illustrated in FIGS. 3A to 3C described above may be implemented through a data encryption and decryption system including the non-address network device shown in FIG. 2B. In this case, the first encryption module is replaced with the first non-address network device, and the first security unit may perform each step.

Although one embodiment of the present invention has been described above, the spirit of the present invention is not limited to the embodiments set forth herein, and those skilled in the art who understand the spirit of the present invention, within the scope of the same idea, the addition of components Other embodiments may be easily proposed by changing, deleting, adding, and the like, but this will also fall within the spirit of the present invention.

Claims

A data encryption unit for transmitting encrypted data through a communication network to a second terminal connected to a communication network,

An encryption module connected between a first terminal and the communication network and configured to generate a session key required for receiving data from the first terminal and encrypting the encrypted data to generate the encrypted data;

The encryption module generates a first public key and transmits it to the communication network and receives a second public key in response to the first public key from the communication network, and uses the received second public key to perform the session. And a data encryption and decryption system for generating the session key using a public key algorithm.
The method of claim 1,

The encryption module, when receiving the call packet from the first terminal, transmits the reprocessed call packet including the first public key to the communication network, and then sends the reprocessed response packet including the second public key. Receiving and generating the session key using the reprocessed response packet.
The method of claim 2,

The reprocessed call packet further includes at least one of an encryption ID represented by a random number of a specific length in a payload and a serial number of the encryption module,

The serial number is a data encryption and decryption system that is a unique value that can distinguish the encryption module.
The method of claim 1,

The encryption module generates a first private key together with the first public key and encrypts the session key using the first private key and the second public key after receiving the second public key. And decryption system.
The method of claim 1,

The session key, in the case of TCP communication, is a data encryption and decryption system configured to configure the TCP communication before performing the transmission of the data.
The method of claim 1,

The encryption module further uses a packet key generated using header information for each data packet of the data to generate the encrypted data.

The packet key is generated using at least one of the header information of the data, the serial number of the encryption module, and a preset key set by a user, and the header information is an IP address of the first terminal and the second terminal. At least one of an IP address and a packet ID per packet,

The serial number is a data encryption and decryption system that is a unique value that can distinguish the encryption module.
The method of claim 6,

And the packet key is further generated by using a sequence ID which is a value representing a sequence of the TCP communication in the case of TCP communication.
The method according to claim 1 or 6,

The encryption module,

A 1-1 input / output unit configured to receive the data from the first terminal;

A first security unit connected to the 1-1 input / output unit and generating the encrypted data and the session key or the packet key; And

And a first input / output unit connected to the first security unit and receiving the encrypted data and transmitting the encrypted data to the communication network.

And a non-address network device for generating the session key or the packet key without an IP address being set.
In the data decryption unit for receiving encrypted data through the communication network from a first terminal connected to a communication network,

An encryption module connected between a second terminal and the communication network and generating a session key required to receive and decrypt the encrypted data from the communication network to generate decrypted data,

After receiving the first public key from the communication network, the encryption module generates a second public key that is a response to the first public key, sends the second public key to the communication network and generates the session key. And a data encryption and decryption system for generating the session key using a public key algorithm.
The method of claim 9,

When receiving the reprocessed call packet including the first public key from the communication network, the encryption module generates the session key using the reprocessed call packet and delivers a response packet from the second terminal. Receiving and transmitting a reprocessed response packet containing the second public key to the communication network.
The method of claim 10,

The reprocessed response packet includes at least one of an encryption ID represented by a random number having a specific length in a payload and a serial number of the encryption module.

The serial number is a data encryption and decryption system that is a unique value that can distinguish the encryption module.
The method of claim 9,

The encryption module generates a second private key together with the second public key and encrypts the session key using the second private key and the first public key after receiving the first public key. And decryption system.
The method of claim 9,

The session key, in the case of TCP communication, is a data encryption and decryption system configured to configure the TCP communication before performing the transmission of the data.
The method of claim 9,

The encryption module further uses a packet key generated by using header information for each data packet of the encrypted data to generate the decrypted data.

The packet key is generated using at least one of header information of the encrypted data, a serial number of an encryption module that generates the encrypted data, and a setting key preset by a user, and the header information is generated by the first terminal. An IP address of the second terminal, a packet ID per packet,

The serial number is a data encryption and decryption system that is a unique value that can distinguish the encryption module.
The method of claim 14,

And the packet key is further generated by using a sequence ID which is a value representing a sequence of the TCP communication in the case of TCP communication.
The method according to claim 9 or 14,

The encryption module,

A 2-1 input / output unit configured to receive the encrypted data from the communication network;

A second security unit connected to the 2-1 input / output unit and generating the decrypted data and the session key or the packet key; And

And a 2-2 input / output unit connected to the second security unit and transferring the decrypted data to the second terminal.

And a non-address network device for generating the session key or the packet key without an IP address being set.
A data encryption unit for transmitting encrypted data through a communication network and a data decryption unit for receiving the encrypted data through the communication network,

A first encryption module connected between a first terminal and the communication network and generating a session key required for receiving data from the first terminal and encrypting the encrypted data to generate the encrypted data; And

A second encryption module connected between a second terminal and the communication network and generating the session key required to receive the decrypted data from the communication network and to decrypt and generate decrypted data,

A second public key generated by the first encryption module and transmitted to the network and received by the second encryption module after receiving the first public key, the second public key being a response to the session key and the generated first public key Generate a key and transmit the second public key to the communication network, and the first encryption module receives and uses the second public key to generate the session key. Generate data encryption and decryption system.
The method of claim 17,

When the first encryption module receives the call packet from the first terminal, the first encryption module transmits the reprocessed call packet including the first public key to the communication network, and then reprocesses the second packet to include the second public key. Receive a packet, generate the session key using the reprocessed response packet,

When receiving the reprocessed call packet from the communication network, the second encryption module generates the session key using the reprocessed call packet and receives a response packet from the second terminal to receive the reprocessed call packet. A data encryption and decryption system for transmitting a response packet to the communication network.
The method of claim 18,

The reprocessed call packet further includes at least one of an encryption ID represented by a random number of a specific length in a payload and a serial number of the first encryption module,

The reprocessed response packet includes at least one of an encryption ID represented by a random number having a specific length in a payload and a serial number of the second encryption module.

The serial number is a data encryption and decryption system that is a unique value that can distinguish the encryption module.
The method of claim 17,

The first encryption module generates a first private key together with the first public key, generates the session key using the first private key and the second public key after receiving the second public key. ,

The second encryption module generates a second private key together with the second public key, and generates the session key using the second private key and the first public key after receiving the first public key. Data encryption and decryption system.
The method of claim 17,

The session key, in the case of TCP communication, is a data encryption and decryption system configured to configure the TCP communication before performing the transmission of the data.
The method of claim 17,

The first encryption module further uses a packet key generated by using header information for each data packet of the data to generate the encrypted data.

The second encryption module further uses the packet key generated using header information for each data packet of the encrypted data to generate the decrypted data.

The packet key is generated using at least one of the header information of the data, the serial number of the first encryption module, and a preset key set by a user, and the header information is an IP address of the first terminal and the first key. 2 includes at least one of an IP address of the terminal and a packet ID for each packet,

The serial number is a data encryption and decryption system that is a unique value that can distinguish the encryption module.
The method of claim 22,

And the packet key is further generated by using a sequence ID which is a value representing a sequence of the TCP communication in the case of TCP communication.
The method of claim 17 or 22,

The first encryption module,

A 1-1 input / output unit configured to receive the data from the first terminal;

A first security unit connected to the 1-1 input / output unit and generating the encrypted data and the session key or the packet key; And

And a first input / output unit connected to the first security unit and receiving the encrypted data and transmitting the encrypted data to the communication network.

A first non-address network device generating the session key or the packet key without an IP address being set,

The second encryption module,

A 2-1 input / output unit configured to receive the encrypted data from the communication network;

A second security unit connected to the 2-1 input / output unit and generating the decrypted data and the session key or the packet key; And

And a 2-2 input / output unit connected to the second security unit and transferring the decrypted data to the second terminal.

And a second non-address network device for generating the session key or the packet key without an IP address being set.