Systems for providing secure communications using a protocol engine
AssigneeMassachusetts Institute of Technology
InventorsAnantha P. Chandrakasan, Chiraag Juvekar, Utsav Banerjee
Life of this patent
Estimating the term…
Abstract
Systems and methods for implementing confidential communications between nodes of a network provide reduced power consumption, require less memory, and provide improved security, relative to previously-known systems and method. Preferred embodiments implement protocol functions in hardware, as opposed to software, to yield some or all of the foregoing improvements. Some embodiments use a hashing circuit for multiple purposes, while maintaining its ability to compute successive intermediate hash values. Some embodiments improve security of systems using circuits configured to leverage a favorable data format.
Claims20
A system for providing secure communications between a client and a server on a network, the system comprising:
- a hashing circuit;
- a memory circuit;
- a fixed-logic protocol controller in data communication with the hashing circuit and the memory circuit, the fixed-logic protocol controller configured to execute a client-side handshake protocol;
- a cryptographic accelerator in data communication with the hashing circuit and the fixed-logic protocol controller, the cryptographic accelerator configured to encrypt outbound messages and to decrypt inbound messages;
- and
- a communications interface in operable communication with the network to transmit messages from the client to the server, and to receive messages from the server, wherein the cryptographic accelerator comprises a fixed-logic elliptic curve cryptography accelerator configured to operate on data in a zero-less signed digit format.
A system for providing secure communications between a client and a server on a network, the system comprising:
- a hashing circuit;
- a memory circuit;
- a fixed-logic protocol controller in data communication with the hashing circuit and the memory circuit, the fixed-logic protocol controller configured to execute a client-side handshake protocol;
- a cryptographic accelerator in data communication with the hashing circuit and the fixed-logic protocol controller, the cryptographic accelerator configured to encrypt outbound messages and to decrypt inbound messages;
- a communications interface in operable communication with the network to transmit messages from the client to the server, and to receive messages from the server;
- a programmable microprocessor separate from the fixed-logic protocol controller;
- and
- a clock gate circuit configured to controllably disable a clock signal to the programmable microprocessor when the fixed-logic protocol controller is executing a handshake with the server.
A system for providing secure communications between a client and a server on a network, the system comprising:
- a hashing circuit;
- a memory circuit;
- a fixed-logic protocol controller in data communication with the hashing circuit and the memory circuit, the fixed-logic protocol controller configured to execute a client-side handshake protocol;
- a cryptographic accelerator in data communication with the hashing circuit and the fixed-logic protocol controller, the cryptographic accelerator configured to encrypt outbound messages and to decrypt inbound messages;
- and
- a communications interface in operable communication with the network to transmit messages from the client to the server, and to receive messages from the server,
- wherein the hashing circuit is a fixed-logic circuit configured to execute a SHA2-256 hash protocol and the fixed-logic protocol controller is configured to:
- (a) use the hashing circuit to generate an intermediate hash value of a session hash from a set of messages;
- (b) store hash state data from the hashing circuit to the memory circuit, the hash state data representing the state of the hashing circuit at a first time and including at least the intermediate hash value;
- (c) use the hashing circuit for a secondary purpose, such secondary purpose leaving the hashing circuit in a second state;
- and subsequently
- (d) read the hash state data from the memory circuit;
- and
- (e) restore the hashing circuit to the state of the hashing circuit at the first time, so that the hashing circuit is configured to generate a subsequent hash value by operating on the intermediate hash value.
Dependencies are inferred from the claim text.