JP2011135259A - Encryption system, communication equipment, encryption method, and encryption program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an encryption system for preventing a CFM PDU from being intercepted or monitored by another apparatus not to be managed, etc. <P>SOLUTION: The encryption system includes communication equipment 10 having a function of managing the CFM PDU. The communication equipment 10 includes; an encrypting means 11 for encrypting a prescribed part of the CFM PDU when the CFM PDU is transmitted; and a decoding means 12 for decoding a prescribed part of the received CFM PDU when the CFM PDU is received. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an encryption system, an encryption method, and an encryption program for encrypting data transmitted and received in a communication network. The present invention also relates to a communication device provided in the encryption system.

  In general, in fault management based on connectivity fault management (hereinafter referred to as CFM) defined in IEEE Std 802.1ag-2007, CFM Protocol Data Unit (hereinafter referred to as CFM PDU) is handled in plain text.

  Further, for example, as related technologies, Patent Documents 1 and 2 describe a method of encrypting data to be transmitted and received.

JP 2007-89028 A JP 2003-198532 A

  However, since the state of the network to be managed is easily understood in the plaintext CFM PDU, there is a possibility that the state of the line is known to the competitor when the line is borrowed from another carrier.

  Hereinafter, the problem will be described using an example in which the carrier 2 illustrated in FIG. 1 constructs a network using the network of the carrier 1. In the example shown in FIG. 1, all frames of carrier 2 pass through the bridge network of carrier 1. Specifically, it is assumed that the carrier 2 bridge 12a transmits the generated CFM PDU to the carrier 2 bridge 15a. In this case, the CFM PDU transmitted by the carrier 2 bridge 12a reaches the target carrier 2 bridge 15a via the carrier 1 bridge 13a and the carrier 1 bridge 14a. Therefore, the carrier 1 bridge 13a and the carrier 1 bridge 14a can intercept the CFM PDU transmitted by the carrier 2 bridge 12a. That is, the carrier 1 can know the network failure state of the carrier 2 from the CFM PDU transmitted by the carrier 2 via the route 111 or the route 112.

  IEEE Std 802.1ag-2007 or ITU-TY. On 1731, in such a case, the carrier 1 bridge is defined to pass through the CFM. However, the carrier 1 bridge can easily intercept the CFM. Therefore, it is a problem for the carrier 2 network that the operation information of the carrier 2 network is known to the carrier 1 related parties.

  For the above reasons, there is a problem that the transmitted CFM PDU can be monitored from a device that is not managed by CFM.

  In the methods described in Patent Document 1 and Patent Document 2, the fields after SFD are encrypted. Therefore, in the case where an Ethernet (registered trademark) device exists between encryption devices, an encrypted frame is not stored. There may be a case where the frame is discarded without being recognized as an Ethernet frame. Therefore, although it can be applied in the case where the cryptographic devices face each other, it cannot be applied in a network configuration in which other devices are installed between the devices as described above.

  Accordingly, an object of the present invention is to provide an encryption system encryption method and an encryption program that can prevent CFM PDUs from being intercepted or monitored. Moreover, an object of this invention is to provide the communication apparatus with which an encryption system is provided.

  An encryption system according to the present invention includes a communication device having a CFM PDU management function, and the communication device includes an encryption unit for encrypting a predetermined part of the CFM PDU, and the CFM PDU when transmitting the CFM PDU. And decoding means for decoding a predetermined part of the received CFM PDU when received.

  When transmitting a CFM PDU, the communication apparatus according to the present invention encrypts a predetermined part of the CFM PDU and, when receiving the CFM PDU, decrypts the predetermined part of the received CFM PDU. And a means for converting.

  The encryption method according to the present invention is characterized in that when a CFM PDU is transmitted, a predetermined part of the CFM PDU is encrypted, and when the CFM PDU is received, the predetermined part of the received CFM PDU is decrypted. .

  An encryption program according to the present invention receives an encryption process for encrypting a predetermined part of a CFM PDU and a CFM PDU when it is transmitted to a computer having a CFM PDU management function when transmitting the CFM PDU. And a decoding process for decoding a predetermined part of the CFM PDU.

  According to the present invention, CFM PDU can be prevented from being intercepted or monitored.

It is explanatory drawing which shows the example which the carrier 2 constructs | assembles a network using the network of the carrier 1. FIG. It is a block diagram which shows an example of a structure of the apparatus to which the encryption method by this invention is applied. It is explanatory drawing which shows the structural example of the encryption system in 1st Embodiment. It is a flowchart which shows the operation example when a communication apparatus receives a data frame from the Active SAP side. It is a flowchart which shows the operation example when a communication apparatus transmits a data frame to the Active SAP side. It is explanatory drawing which shows an example of the frame format of CFM PDU which a communication apparatus produces | generates and transmits. It is explanatory drawing which shows the structural example of the encryption system in 2nd Embodiment. It is a block diagram which shows the minimum structural example of an encryption system.

Embodiment 1. FIG.
Embodiments of the present invention will be described below with reference to the drawings. FIG. 2 is a block diagram showing an example of the configuration of a communication apparatus to which the encryption method according to the present invention is applied. As shown in FIG. 2, a communication apparatus (hereinafter, apparatus 2a) to which an encryption method is applied includes a Passive SAP unit 21a, an Active SAP unit 22a, a CFM PDU multiplexing unit 23a, a CFM PDU encryption unit 24a, A CFM PDU control unit 25a, a CFM PDU decryption unit 26a, a CFM PDU demultiplexing unit 27a, an encryption key storage unit 28a, and a CFM setting storage unit 29a are included. The device 2a is specifically realized by a network device such as a switching hub that operates according to a program.

  Specifically, the Passive SAP unit 21a is realized by a network interface unit of a network device that operates according to a program. The Passive SAP unit 21a has a function of passing data frames and CFM PDUs that are not managed by the apparatus 2a (unprocessed CFM PDUs).

  Specifically, the Active SAP unit 22a is realized by a network interface unit of a network device that operates according to a program. The Active SAP unit 22a has a function of exchanging CFM PDUs generated or processed by the device 2a.

  Specifically, the CFM PDU multiplexing unit 23a is realized by a CPU of a network device that operates according to a program. The CFM PDU multiplexing unit 23a has a function of multiplexing the CFM PDU generated by the device 2a on the data frame received by the Passive SAP unit 21a.

  Specifically, the CFM PDU encryption unit 24a is realized by a CPU of a network device that operates according to a program. The CFM PDU encryption unit 24a has a function of encrypting the CFM PDU generated by the device 2a using the encryption key stored in the encryption key storage unit 28a. The CFM PDU encryption unit 24a encrypts the CFM PDU using, for example, AES (Advanced Encryption Standard) as an encryption method.

  Specifically, the CFM PDU control unit 25a is realized by a CPU of a network device that operates according to a program. The CFM PDU control unit 25a has a function of processing the received CFM PDU. The CFM PDU control unit 25a has a function of generating a CFM PDU to be transmitted. The CFM PDU control unit 25a has a function of reading and writing CFM setting data stored in the CFM setting storage unit 29a.

  Specifically, the CFM PDU decoding unit 26a is realized by a CPU of a network device that operates according to a program. The CFM PDU decryption unit 26a has a function of decrypting the CFM PDU received by the Active SAP unit 22a using the encryption key stored in the encryption key storage unit 28a.

  Specifically, the CFM PDU demultiplexing unit 27a is realized by a CPU of a network device that operates according to a program. The CFM PDU demultiplexing unit 27a confirms the Ether type and the Maintenance Domain Level (hereinafter referred to as MD Level), and outputs the same frame as the Ether type CFM and MD Level to the device 2a to the CFM PDU decoding unit 26a. The other SAP frame 21a has a function of separating or discarding the other frames.

  Specifically, the encryption key storage unit 28a is realized by a storage device such as a magnetic disk device, an optical disk device, or a memory. The encryption key storage unit 28a stores encryption keys used by the CFM PDU encryption unit 24a and the CFM PDU decryption unit 26a.

  Specifically, the CFM setting storage unit 29a is realized by a storage device such as a magnetic disk device, an optical disk device, or a memory. The CFM setting storage unit 29a stores CFM setting data such as MD Level and Maintenance Domain Name.

  The apparatus 2a in the present embodiment uses the configuration shown in FIG. 2 to decode and process the MD Level CFM PDU to which the own apparatus belongs received by the Active SAP unit 22a. Further, the device 2a encrypts the CFM PDU transmitted from the own device and transmits the encrypted CFM PDU from the Active SAP unit 22a. The device 2a transmits the data frame received by the passive SAP unit 21a to the active SAP unit 22a. Also, the device 2a transmits the data frame received by the Active SAP unit 22a to the Passive SAP unit 21a except for the CFM PDU. Further, the device 2a decodes the CFM PDU received by the Active SAP unit 22a when the own device and the MD Level are the same, and performs the discard processing when the MD Level is lower than the own device. When the MD Level is high, the light passes through the Passive SAP unit. In this embodiment, the expression “transparent” is used. Specifically, the data frame received by the Active SAP 22a is directly transmitted from the Passive SAP 21a to the outside, or the data frame received by the Passive SAP 21a is directly transmitted by the Active SAP 22a. Sending to the outside.

  By the above processing, the data frame from the Active SAP unit to the Passive SAP unit direction and from the Passive SAP unit to the Active SAP unit direction is not affected. In addition, since only MD Level CFM PDUs to which the own device belongs are encrypted and decrypted, network devices that are not managed on the network cannot interpret CFM PDUs transmitted and received by the device 2a. Unable to intercept fault conditions.

  Next, an encryption system using the above apparatus will be described with reference to FIG. FIG. 3 is an explanatory diagram illustrating a configuration example of the encryption system according to the first embodiment.

  As shown in FIG. 3, the encryption system in the present embodiment includes a user equipment 31a, a carrier 2 bridge 32a, a carrier 1 bridge 33a, a carrier 1 bridge 34a, a carrier 2 bridge 35a, and a user equipment 36a. Including.

  In the example shown in FIG. 3, apparatuses to which the encryption method according to the present invention is applied are a carrier 2 bridge 32a and a carrier 2 bridge 35a having the configuration of FIG. 2, and operate as a maintenance association end point (hereinafter referred to as MEP). An example is shown. In addition, the user device 31a and the user device 36a are set with an MD level higher than the MD level of the carrier 2, and operate as MEPs. In addition, the carrier 1 bridge 33a and the carrier 1 bridge 34a are set with an MD level lower than the MD level of the carrier 2, and operate as MEPs.

  In the present embodiment, normal data frames whose Ether type is other than CFM are bidirectionally communicated between user devices (between 31a and 36a) in the carrier 2 bridge (32a and 35a) and the carrier 1 bridge (33a and 34a). Transparent without being encrypted.

  The user devices 31a and 36a transmit and receive bidirectional CFM PDUs between the user devices (between 31a and 36a) without encryption. Further, the carrier 2 bridges 32a and 35a and the carrier 1 bridges 33a and 34a are not encrypted with the IEEE Std 802.1ag-2007 or ITU-T Y. Process according to 1731.

  The carrier 2 bridges 32a and 35a are configured to transfer a bidirectional CFM PDU between the carrier 2 bridges (between 32a and 35a) to IEEE Std 802.1ag-2007 or ITU-T Y. After being generated according to 1731, it is encrypted and transmitted. When receiving the CFM PDU belonging to its own MD Level, the carrier 2 bridges 32a and 35a decode the IEEE Std 802.1ag-2007 or ITU-T Y.Y. Process according to 1731. When the carrier 1 bridges 33a and 34a receive the CFM PDU, the IEEE 1st 802.1ag-2007 or ITU-T Y. Process according to 1731 (Transparent with reference to MD Level).

  The carrier 1 bridges 33a and 34a transmit and receive bidirectional CFM PDUs between the carrier 1 bridges (between 33a and 34a) without encryption.

  Next, the operation of the encryption system in this embodiment will be described. FIG. 4 is a flowchart illustrating an operation example when the communication apparatus receives a data frame from the active SAP unit side. FIG. 5 is a flowchart illustrating an operation example when the communication apparatus transmits a data frame to the active SAP unit side. FIG. 6 is an example of a CFM PDU frame format generated and transmitted by the apparatus of the present invention.

  First, the operation when the communication apparatus according to this embodiment receives a data frame will be described with reference to FIGS. When the data frame is transmitted to the communication device, Active SAP unit 22a receives the data frame (step S4001 in FIG. 4), and outputs the received data frame to CFM PDU demultiplexing and multiplexing unit 27a.

  Next, the CFM demultiplexing unit 27a checks the Ether type of the data frame output from the Active SAP unit 22a (step S4002).

  If it is determined in step S4002 that the Ether type is other than CFM, the CFM demultiplexing unit 27a outputs the data frame to the Passive SAP unit 21a (step S4006). Thereafter, the Passive SAP unit 21a transmits the data frame output from the CFM demultiplexing unit 27a to the outside.

  If it is determined in step S4002 that the Ether type is CFM, the CFM demultiplexing unit 27a performs MD Level check on the CFM data frame (step S4003).

  If it is determined in step S4003 that the MD level is lower than that of the own apparatus, the CFM demultiplexing unit 27a performs processing for discarding the CFM PDU (step S4009).

  If it is determined in step S4003 that the MD level is higher than that of the own apparatus, the CFM demultiplexing unit 27a outputs the CFM PDU to the passive SAP unit 21a (step S4007). Thereafter, the Passive SAP unit 21a transmits the data frame output from the CFM demultiplexing unit 27a to the outside.

  If it is determined in step S4003 that the MD level is the same as that of the own apparatus, the CFM demultiplexing unit 27a outputs the CFM PDU to the CFM PDU decoding unit 26a. Next, the CFM PDU decryption unit 26a decrypts the portion from the Version field to the End TLV of the CFM PDU shown in FIG. 6 using the encryption key stored in the encryption key storage unit 28a (step S4004).

  Next, the CFM PDU decoding unit 26a outputs the decoded CFM PDU to the CFM PDU control unit 25a. Thereafter, the CFM PDU control unit 25a performs IEEE Std 802.1ag-2007 or ITU-T Y. The process according to 1731 is executed (step S4005).

  Next, the operation when the communication apparatus according to this embodiment transmits a data frame will be described with reference to FIGS. 2, 5, and 6.

  First, the CFM PDU control unit 25a uses IEEE Std 802.1ag-2007 or ITU-T Y. According to 1731, a CFM PDU is generated (step S5001). Then, the CFM PDU control unit 25a outputs the generated CFM PDU to the CFM PDU encryption unit 24a.

  Next, the CFM PDU encryption unit 24a encrypts the CFM PDU from the Version field of the CFM PDU shown in FIG. 6 to the End TLV using the encryption key stored in the encryption key storage unit 28a (step S5002). Then, the CFM PDU encryption unit 24a outputs the encrypted CFM PDU to the CFM PDU multiplexing unit 23a.

  Next, the CFM PDU multiplexing unit 23a outputs the data frame output by the Passive SAP unit 21a and the encrypted CFM PDU output by the CFM PDU encryption unit 24a to the Active SAP unit 22a. Thereafter, the Active SAP unit 22a transmits the data frame output from the CFM PDU multiplexing unit 23a and the encrypted CFM PDU to the outside.

  As described above, in this embodiment, CFM PDU encryption is used in order to prevent a CFM PDU from being intercepted by a device not managed by CFM. As a result, the following effects can be obtained.

  (1) Since CFM management devices hold encryption keys and perform encryption and decryption, interception from devices that are not managed can be prevented.

  (2) Since the frame to be encrypted is only CFM PDU and data frames other than CFM are not encrypted, network devices installed between communication apparatuses to which the encryption method is applied have encryption and decryption functions. There is no need to do.

  (3) In order to change the encryption part of the CFM PDU from the Version field to the End TLV, this device transmits / receives by means of a device set with a lower MD Level than this device installed between communication devices to which the encryption method is applied. CFM PDUs to be discarded are not discarded.

Embodiment 2. FIG.
Next, a second embodiment of the encryption system according to the present invention will be described. FIG. 7 is an explanatory diagram illustrating a configuration example of the encryption system according to the second embodiment.

  As shown in FIG. 7, the encryption system in this embodiment includes a user equipment 31a, a carrier 2 bridge 32a, a carrier 1 bridge 33a, a carrier 1 bridge 34a, a carrier 2 bridge 35a, and a carrier 2 bridge 36a. And user equipment 37a.

  In the present embodiment, an example is shown in which a carrier 2 bridge 35a having the same configuration as that in FIG. 2 operates as a maintenance domain intermediate point (hereinafter referred to as MIP). The carrier 2 bridge 32a and the carrier 2 bridge 36a operate as MEPs. The carrier 2 bridges 32a, 35a, and 36a are the same MD Level.

  The user equipment 31a and the user equipment 36a are set with an MD Level higher than the carrier 2MD Level, and operate as MEPs. Further, the carrier 1 bridge 33a and the carrier 1 bridge 34a are set with an MD level lower than the carrier 2MD level, and operate as MEPs.

  When receiving the CFM PDU belonging to the MD Level of the own device, the carrier 2 bridge 35a decodes the IEEE Std 802.1ag-2007 or ITU-T Y.Y. Process according to 1731.

  When transmitting the CFM PDU, the carrier 2 bridge 35a may use IEEE Std 802.1ag-2007 or ITU-T Y. After being generated according to 1731, it is encrypted and transmitted.

  Hereinafter, two examples will be given in the case where the carrier 2 bridge 32a transmits a CFM PDU to the carrier 2 bridge 36a when the carrier 2 bridge 35a operates as MIP.

  (1) When a CFM PDU that is the same MD Level as that of its own device is received from the carrier 2 bridge 32a (path 311 shown in FIG. 7), the carrier 2 bridge 35a decodes the CFM PDU, and IEEE Std 802.1ag-2007 Or ITU-TY. Process according to 1731. After that, the carrier 2 bridge 35a encrypts the CFM PDU again and transfers it to the carrier 2 bridge 36a (path 312). The carrier 2 bridge 35a generates and encrypts a CFM PDU to be returned to the transmission source, and transmits the encrypted CFM PDU to the transmission source carrier 2 bridge 32a (path 313).

  (2) When a CFM PDU having the same MD Level as that of its own device is received from the carrier 2 bridge 32a (path 314), the carrier 2 bridge 35a decodes the CFM PDU, and IEEE Std 802.1ag-2007 or ITU-T Y. Process according to 1731. After that, the carrier 2 bridge 35a encrypts the CFM PDU again and transfers it to the carrier 2 bridge 36a (path 315).

  As described above, in this embodiment, CFM PDU encryption is used in order to prevent a CFM PDU from being intercepted by a device not managed by CFM. As a result, the following effects can be obtained.

  (1) Since CFM management devices hold encryption keys and perform encryption and decryption, interception from devices that are not managed can be prevented.

  (2) Since the frame to be encrypted is only CFM PDU and data frames other than CFM are not encrypted, network devices installed between communication apparatuses to which the encryption method is applied have encryption and decryption functions. There is no need to do.

  (3) In order to change the encryption part of the CFM PDU from the Version field to the End TLV, this device transmits and receives by a device set with a lower MD Level than this device installed between communication devices to which the encryption method is applied. CFM PDUs to be discarded are not discarded.

  As described above, the encryption system according to the present invention has a function of encrypting and decrypting a specific CFM PDU as means for solving the conventional problems. In addition, in order to prevent CFM PDUs from being intercepted by devices other than the MD Level to which the device belongs, the device transmits the CFM PDU when encrypted, and receives the CFM PDU of the MD Level (managed) belonging to the device. If so, decrypt. As a result, the devices managed by CFM can interpret CFM PDUs, but devices that are not managed cannot be interpreted because they are encrypted, and the network failure status of the MD Level to which the device belongs can not be known. In addition, when there is no MD Level of the received CFM PDU, the device corresponding to the CFM PDU performs processing of discarding without transmitting it. For this reason, the encryption system according to the present invention avoids being discarded by setting the portion for encrypting the CFM PDU from the version field to the End TLV.

  From the above, it can be said that the present invention has the following characteristics. The present invention relates to CFM defined by IEEE Std 802.1ag-2007, ITU-T Y. Using the 0AM functions and mechanisms for Ethernet based networks defined in 1731, the device has a function of encrypting and decrypting only CFM PDUs in a managed network. Thus, according to the present invention, there is an effect that the CFM PDU indicating the state of the network to be managed by the device of the present invention is not intercepted and monitored by a device that is not the management target. In addition, according to the present invention, since encryption and decryption are performed only on the CFM PDU of MD Level to which the apparatus of the present invention belongs, it affects other CFM PDUs of MD Level and normal data frames. Absent.

  Next, the minimum configuration of the encryption system according to the present invention will be described. FIG. 8 is a block diagram illustrating a minimum configuration example of the encryption system. As shown in FIG. 8, the encryption system includes a communication device 10 as a minimum component. In addition, the communication device includes an encryption unit 11 and a decryption unit 12.

  In the encryption system with the minimum configuration shown in FIG. 8, the encryption unit 11 encrypts a predetermined part of the CFM PDU when transmitting the CFM PDU from the communication device 10. Then, when receiving the CFM PDU to be managed, the decrypting unit 12 decrypts the portion encrypted by the encrypting unit 11.

  Therefore, according to the encryption system with the minimum configuration, CFM PDUs can be prevented from being intercepted or monitored.

  In this embodiment, the characteristic configuration of the encryption system as shown in the following (1) to (5) is shown.

  (1) The encryption system includes a communication device (for example, realized by the device 2a) having a CFM PDU management function, and the communication device encrypts a predetermined part of the CFM PDU when transmitting the CFM PDU. Encryption means (for example, realized by the CFM PDU encryption unit 24a), and decryption means for decrypting a predetermined part of the received CFM PDU (for example, CFM PDU decryption) when receiving the CFM PDU Part 26a).

  (2) In the encryption system, the encryption unit may be configured to encrypt only the CFM PDU among the data frames transmitted by the communication device.

  (3) In the encryption system, the encryption means may be configured to encrypt from the Version field of the CFM PDU to the End TLV (for example, the encrypted part shown in FIG. 6).

  (4) The encryption system includes determination means (for example, realized by the CFM PDU demultiplexing unit 27a) for determining whether or not the data frame received by the communication device is a CFM PDU to be managed, and decrypting The means may be configured to decrypt the encrypted portion of the CFM PDU when the determining means determines that it is a CFM PDU to be managed.

  (5) In the encryption system, the determination unit is a CFM PDU to be managed when the data frame received by the communication device has an Ether type of CFM and the MD Level matches the MD Level of the communication device. It may be configured to determine.

  The present invention can be applied to a communication apparatus having an Ethernet interface.

(Supplementary note) An encryption program for causing a computer to execute a process of encrypting only a CFM PDU in a data frame transmitted by a communication device by an encryption process.

DESCRIPTION OF SYMBOLS 10 Communication apparatus 11 Encryption means 12 Decryption means 21a Passive SAP part 22a Active SAP part 23a CFM PDU multiplexing part 24a CFM PDU encryption part 25a CFM PDU control part 26a CFM PDU separation part 27a CFM PDU separation part 27a CFM PDU 28 Unit 29a CFM setting storage unit 31a, 36a User equipment 32a, 35a Carrier 2 bridge 33a, 34a Carrier 1 bridge

Claims (10)

A communication device having a CFM PDU management function;
The communication device
An encryption means for encrypting a predetermined part of the CFM PDU when transmitting the CFM PDU;
An encryption system comprising: decrypting means for decrypting a predetermined part of the received CFM PDU when a CFM PDU is received. The encryption system according to claim 1, wherein the encryption means encrypts only the CFM PDU among the data frames transmitted by the communication device. The encryption system according to claim 1 or 2, wherein the encryption means encrypts from the Version field of the CFM PDU to the End TLV. Determining means for determining whether or not the data frame received by the communication device is a CFM PDU to be managed;
The encryption system according to any one of claims 1 to 3, wherein when the determination unit determines that the determination unit is a CFM PDU to be managed, the decryption unit decrypts an encrypted part of the CFM PDU. . The determination unit determines that the data frame received by the communication device is a CFM PDU to be managed when the Ether type is CFM and the MD Level matches the MD Level of the communication device. Encryption system. An encryption means for encrypting a predetermined part of the CFM PDU when transmitting the CFM PDU;
A communication apparatus comprising: a decoding unit configured to decode a predetermined part of the received CFM PDU when a CFM PDU to be managed is received. The communication device according to claim 6, wherein the encryption means encrypts only the CFM PDU among the data frames transmitted by the communication device. When transmitting a CFM PDU, a predetermined part of the CFM PDU is encrypted,
An encryption method, comprising: decrypting a predetermined part of a received CFM PDU when a CFM PDU to be managed is received. The encryption method according to claim 8, wherein only the CFM PDU is encrypted among the data frames transmitted by the communication device. To a computer having a CFM PDU management function,
An encryption process for encrypting a predetermined part of the CFM PDU when transmitting the CFM PDU;
An encryption program for executing a decryption process for decrypting a predetermined portion of the received CFM PDU when a CFM PDU to be managed is received.

Images