# US 11,115,398 B2 · Methods and devices for preserving relative timing and ordering of data packets in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,398 B2 - Document ID: US11115398B2 - Status: Granted - Kind: B2 - Application number: 16/564,555 - Filed: 2019-09-09 - Published: 2019-12-26 - Granted: 2021-09-07 - Earliest claimed: 2017-03-08 - Assignees: ABB Power Grids Switzerland AG - Applicants: ABB Power Grids Switzerland AG - Inventors: Wolfgang Spahn; Walter Binz - Web page: https://patentgrep.com/patent/US11115398B2 ## CPC - H04L 63/0457: {wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption (cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065)} - G06F 21/602: {Providing cryptographic facilities or services} - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - H04L 9/0662: {with particular pseudorandom sequence generator} - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 45/38: {Flow based routing} - H04L 47/22: Traffic shaping - H04L 47/365: {Dynamic adaptation of the packet size} - H04L 49/3018: {Input queuing} - H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding} - H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 45/50: using label swapping, e.g. multi-protocol label switch [MPLS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A packet network includes packet engines that perform packet handling. Cipher engines are provided separately from the packet engines for encryption and/or authentication operations. To preserve relative timing and ordering of data packets, a packet engine performs pre-shaping of data traffic, wherein the packet engine inserts dummy packets into a data flow. The packet engine provides the pre-shaped data traffic to a cipher engine. ## Claims ### Claim 1 A method, comprising: pre-shaping data traffic to produce a pre-shaped data traffic, wherein the pre-shaping the data traffic includes inserting dummy packets into a data flow; performing encryption or authentication operations on the pre-shaped data traffic, wherein the pre-shaping the data traffic contributes to preserving of relative timing and ordering of data packets transmitted in a packet network; and using at least part of the dummy packets for management channel transmissions or for Encryption Key Exchange (EKE). ### Claim 2 (depends on 1) The method of claim 1, wherein the performing the encryption or authentication operations is without insertion of additional packets into the pre-shaped data traffic. ### Claim 3 (depends on 1) The method of claim 1, wherein the inserting the dummy packets into the data flow comprises the following steps performed in response to a start-up ora new user input: generating a memory image and writing the memory image as a template to memory; fetching the memory image from the memory at a repetition interval; and inserting the memory image into the data flow. ### Claim 4 (depends on 1) The method of claim 1, wherein the dummy packets comprise empty section Signaling Communication Channel (SCC) packets. ### Claim 5 (depends on 4) The method of claim 4, further comprising deleting SCC packets that exit an encrypted or authenticated data flow. ### Claim 6 (depends on 1) The method of claim 1, wherein the pre-shaping the data traffic further comprises enlarging an inter-packet gap. ### Claim 7 (depends on 6) The method of claim 6, wherein the enlarging the inter-packet gap comprises inserting additional bytes into the data flow, or delaying transmission of a data packet in the data flow. ### Claim 8 (depends on 6) The method of claim 6, wherein the enlarging the inter-packet gap comprises enlarging a data packet into the inter-packet gap in response to the performing the encryption or authentication operations. ### Claim 9 (depends on 6) The method of claim 6, wherein a size of the enlarged inter-packet gap is configurable. ### Claim 10 (depends on 6) The method of claim 6, further comprising determining a size of the enlarged inter-packet gap, the determining comprising: traversing all configured paths in the packet network; using the one of the configured paths requiring a maximum inter-packet gap to determine the enlarged inter-packet gap; and building a register byte sequence and writing the register byte sequence into a register to trigger a delayed transmission of data packets. ### Claim 11 (depends on 1) The method of claim 1, further comprising performing a time stamping operation on the pre-shaped data traffic before the encryption or authentication operations. ### Claim 12 (depends on 1) The method of claim 1, wherein the performing the encryption or authentication operations operates outside a time stamping context, wherein the pre-shaping the data traffic operates inside the time stamping context, and wherein operating inside the time stamping context corresponds to operating in accordance with a time stamping protocol. ### Claim 13 (depends on 1) The method of claim 1, wherein the packet network is a packet network of an industrial automation control system, automation of high voltage lines, steering of high-speed trains, or controlling air traffic. ### Claim 14 (depends on 1) The method of claim 1, wherein the inserting the dummy packets into the data flow comprises inserting the dummy packets into the data flow at a repetition interval. ### Claim 15 (depends on 1) The method of claim 1, wherein the pre-shaping the data traffic is performed by a packet engine circuit, and wherein the performing the encryption or authentication operations is performed by a cipher engine circuit. ### Claim 16 (depends on 1) The method of claim 1, wherein the performing the encryption or the authentication operations on the pre-shaped data traffic comprises: performing encryption operations on the pre-shaped data traffic; and performing authentication operations on the pre-shaped data traffic. ### Claim 17 (depends on 1) The method of claim 1, wherein the inserting the dummy packets into the data flow comprises inserting the dummy packets into the data flow at a repetition interval. ### Claim 18 A packet engine for handling data packets in a packet network, the packet engine comprising: a first circuitry couplable to a second circuitry, the first circuitry configured to: control pre-shaping of data traffic to produce a pre-shaped data traffic, wherein the pre-shaping the data traffic includes inserting dummy packets into a data flow and wherein the pre-shaped data traffic can be outputted to the second circuitry so that the second circuitry can perform encryption or authentication operations on the pre-shaped data traffic; and contribute to preserving of relative timing and ordering of data packets transmitted in the packet network by the pre-shaping of the data traffic; and an interface, wherein the first circuitry is couplable to the second circuitry via the interface, and wherein the first circuitry is configured to enlarge an inter-packet gap at the interface. ### Claim 19 (depends on 18) The packet engine of claim 18, wherein the first circuitry is configured to contribute to the preserving of relative timing and ordering of data packets by preserving an unchanged time difference between a start of consecutive data packets and preserving an unchanged order of data packets. ### Claim 20 (depends on 18) The packet engine of claim 18, wherein the first circuitry is configured to insert the dummy packets into the data flow at a repetition interval. ### Claim 21 (depends on 18) The packet engine of claim 18, wherein the first circuitry and the second circuitry is a same circuitry. ### Claim 22 (depends on 18) The packet engine of claim 18, wherein the first circuitry is coupled to the second circuitry. ### Claim 23 (depends on 18) The packet engine of claim 18, wherein at least part of the dummy packets is used for management channel transmissions or Encryption Key Exchange (EKE). ### Claim 24 A system, comprising: a first circuitry configured to: pre-shape data traffic by inserting dummy packets into a data flow at a repetition interval to produce a pre-shaped data traffic, and contribute to, by pre-shaping the data traffic, preserving of relative timing and ordering of data packets transmitted in a packet; and a second circuitry configured to: perform encryption or authentication operations on the pre-shaped data traffic, and contribute to preserving an unchanged time difference between a start of consecutive data packets and preserving an unchanged order of data packets. ### Claim 25 (depends on 24) The system of claim 24, wherein the first circuitry and the second circuitry is a same circuitry. ### Claim 26 (depends on 24) The system of claim 24, wherein at least part of the dummy packets is used for management channel transmissions or Encryption Key Exchange (EKE). ### Claim 27 (depends on 24) The system of claim 24, further comprising an interface, wherein the first circuitry is couplable to the second circuitry via the interface, and wherein the first circuitry is configured to enlarge an inter-packet gap at the interface. ### Claim 28 A method, comprising: generating a pre-shaped set of data packets comprising one or more dummy packets and an original set of data packets, wherein the generating the pre-shaped set of data packets comprises inserting the dummy packets into the original set of data packets; and generating a secured set of data packets from the pre-shaped set of data packets, a number of packets associated with the secured set of data packets is equal in size to a number of packets associated with the pre-shaped set of data packets, and the secured set of data packets comprises one or more of an encrypted, decrypted or authenticated replacement of the original set of data packets, wherein the generating the pre-shaped set of data packets and the generating the secured set of data packets contributes to preserving of relative timing and ordering of data packets transmitted in a packet network. ### Claim 29 (depends on 28) The method of claim 28, wherein the generating the secured set of data packets comprises inserting information corresponding to management channel transmissions or a signal for Encryption Key Exchange (EKE) into the one or more dummy packets of the pre-shaped set of data packets. ### Claim 30 (depends on 28) The method of claim 28, wherein the generating the secured set of data packets comprises generating the encrypted, decrypted, or authenticated replacement of the original set of data packets without insertion of additional packets into the pre-shaped set of data packets. ### Claim 31 (depends on 28) The method of claim 28, wherein the dummy packets comprise empty section Signaling Communication Channel (SCC) packets, and wherein the method further comprises deleting the empty section SCC packets from the secured set of data packets. ### Claim 32 (depends on 28) The method of claim 28, wherein generating the pre-shaped set of data packets comprises generating an enlarged inter-packet gap corresponding to inserting one or more data bytes between successive packets of the original set of data packets on a physical layer. ### Claim 33 (depends on 28) The method of claim 28, further comprising performing time stamping before generating the secured set of data packets, wherein the performing the time stamping is in accordance with a time stamping protocol. ### Claim 34 (depends on 28) The method of claim 28, wherein the original set of data packets corresponds to a packet network of an industrial automation control system, automation of high voltage lines, steering of high speed trains, or controlling air traffic. ### Claim 35 A computer program product, comprising a non-transitory computer usable storage having a computer readable program code embodied therein, the computer readable program code adapted to be executed to implement a method, the method comprising: generate a pre-shaped set of data packets comprising one or more dummy packets and an original set of data packets, wherein the generating the pre-shaped set of data packets comprises inserting the dummy packets into the original set of data packets; and generate a secured set of data packets from the pre-shaped set of data packets, a number of packets associated with the secured set of data packets is equal in size to a number of packets associated with the pre-shaped set of data packets, and the secured set of data packets comprises one or more of an encrypted, decrypted or authenticated replacement of the original set of data packets, wherein the generating the pre-shaped set of data packets and the generating the secured set of data packets contributes to preserving of relative timing and ordering of data packets transmitted in a packet network. ### Claim 36 (depends on 35) The computer program product of claim 35, wherein to generate the secured set of data packets comprises inserting the dummy packets into the original set of data packets. ### Claim 37 (depends on 35) The computer program product of claim 35, wherein to generate the secured set of data packets comprises performing one or more of encryption, decryption, or authentication of the original set of data packets without insertion of additional packets into the pre-shaped set of data packets. ### Claim 38 (depends on 35) The computer program product of claim 35, wherein to generate the pre-shaped set of data packets comprises delaying transmission of a data packet of the original set of data packets. ### Claim 39 (depends on 35) The computer program product of claim 35, wherein to generate the pre-shaped set of data packets comprises performing one or more of encryption, decryption, or authentication of the original set of data packets, by enlarging the original set of data packets into an inter-packet gap. ### Claim 40 (depends on 35) The computer program product of claim 35, wherein at least a subset of the dummy packets is used for management channel transmissions or Encryption Key Exchange (EKE). ### Claim 41 A computer program product, comprising a non-transitory computer usable storage having a computer readable program code embodied therein, the computer readable program code adapted to be executed to implement a method, the method comprising: pre-shape data traffic to produce a pre-shaped data traffic, wherein the pre-shaping the data traffic includes inserting dummy packets into a data flow; perform encryption or authentication operations on the pre-shaped data traffic, wherein the pre-shaping the data traffic contributes to preserving of relative timing and ordering of data packets transmitted in a packet network; and use at least part of the dummy packets for management channel transmissions or for Encryption Key Exchange (EKE). ### Claim 42 (depends on 41) The computer program product claim 41, wherein to perform the encryption or authentication operations comprises performing the encryption or authentication without insertion of additional packets into the pre-shaped data traffic. ### Claim 43 (depends on 41) The computer program product of claim 41, wherein to insert the dummy packets into the data flow comprises performing in response to a start-up or a previously presented user input: generate a memory image and write the memory image as a template to memory; fetch the memory image from the memory at a repetition interval; and insert the memory image into the data flow.