US 10,652,220 B1Granted

Systems and methods for secure data transport

AssigneeArchitecture Technology Corporation

InventorRanga S. Ramanujan

Life of this patent

Estimating the term…

Loading patent…

Abstract

Disclosed herein are embodiments of systems, methods, and products comprise a computing device, which provides a secure data transport service (SecureX) for data packets traversing from an end user device (EUD) to a mission network over untrusted networks. The disclosed SecureX module may be software product running on the EUD and on a SecureX appliance fronting the mission network. The SecureX module on the EUD compresses the data packets by removing header fields that are constant over the same packet flow and double encrypts the data packets with different cryptographic keys. The SecureX on the EUD transmits the double compressed encrypted data packets over the untrusted network. The SecureX appliance receives the double compressed encrypted data packets, decrypts the data packets and decompresses the data packets to recreate the original data packets. The SecureX appliance transmits the original data packets to the mission network.

Claims20

Dependent claims

A computer-implemented method, comprising:

compressing, by a first computer, a data packet by removing a portion of a header of the data packet to generate an inner layer compressed data packet;
encrypting, by the first computer, the inner layer compressed data packet with an inner layer cryptographic key to generate an inner layer compressed encrypted data packet;
compressing, by the first computer, the inner layer compressed encrypted data packet by removing a portion of a header of the inner layer compressed encrypted data packet to generate an outer layer compressed data packet;
encrypting, by the first computer, the outer layer compressed data packet with an outer layer cryptographic key to generate an outer layer compressed encrypted data packet;
transmitting, by the first computer, the outer layer compressed encrypted data packet to a secure network;
receiving, by a second computer interfacing the secure network, the outer layer compressed encrypted data packet to the secure network;
decrypting, by the second computer, the outer layer compressed encrypted data packet using the outer layer cryptographic key to derive the outer layer compressed data packet;
decompressing, by the second computer, the outer layer compressed data packet by adding header information derived by the second computer from a previous outer layer encrypted data packet to derive the inner layer compressed encrypted data packet;
decrypting, by the second computer, the inner layer compressed encrypted data packet using the inner layer cryptographic key to derive the inner layer compressed data packet;
decompressing, by the second computer, the inner layer compressed data packet by adding header information derived by the second computer from a previous data packet to derive the data packet;
and
transmitting, by the second computer, the data packet to the secure network.

9 more elements

A system comprising:

a first set of computer instructions stored in a user device, which when executed by a first processor of the user device cause the first processor to:
compress a data packet by removing a portion of a header of the data packet to generate an inner layer compressed data packet;
encrypt the inner layer compressed data packet with an inner layer cryptographic key to generate an inner layer compressed encrypted data packet;
compress the inner layer compressed encrypted data packet by removing a portion of a header of the inner layer compressed encrypted data packet to generate an outer layer compressed data packet;
encrypt the outer layer compressed data packet with an outer layer cryptographic key to generate an outer layer compressed encrypted data packet;
transmit the outer layer compressed encrypted data packet to a secure network;
a second set of computer instructions stored in a computer interfacing to the secure network, which when executed by a second processor of the computer cause the second processor to:
receive the outer layer compressed encrypted data packet to the secure network;
decrypt the outer layer compressed encrypted data packet using the outer layer cryptographic key to derive the outer layer compressed data packet;
decompress the outer layer compressed data packet by adding header information from a previous outer layer encrypted data packet to derive the inner layer compressed encrypted data packet;
decrypt the inner layer compressed encrypted data packet using the inner layer cryptographic key to derive the inner layer compressed data packet;
decompress the inner layer compressed data packet by adding header information derived by the second processor from a previous data packet to derive the data packet;
and
transmit the data packet to the secure network.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/975,610Filed 9 May 2018
Granted: 12 May 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/0478
Wherein the data content is protected, e.g. by encrypting or encapsulating the payload: applying multiple layers of encryption, e.g. nested…
H04L 63/0485
Wherein the data content is protected, e.g. by encrypting or encapsulating the payload: networking architectures for enhanced packet encryption…
H04L 47/2483
Traffic characterised by specific attributes, e.g. priority or QoS: involving identification of individual flows
H04L 63/0272
For separating internal from external traffic, e.g. firewalls: virtual private networks