US 12,732,489 B1Granted

Protocol free encrypting device

AssigneeThe Government of the United States as represented by the Director, National Security Agency

InventorsJoshua E. Cline, Dan A. DeVries, William J. Layton, Zachary Smith, Brendan S. Surrusco, Andrew H. White, David F. Wiecek, Mitchell E. Buchman

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

The present invention provides an encrypting device including an encryption unit and a communications unit. Paired encrypting devices allow for communication of trusted data between trusted devices over an untrusted network. Data received by the encryption unit is encrypted and provided with a connectionless header for delivery to the communications unit. Data received by the communications units is provided with a complex header for delivery to the paired encrypting device. The encrypting devices may be implemented in hardware or may be virtualized on a server or a plurality of severs. Arrangement of the encrypting devices in a hub-and-spoke topology allows for communication amongst a plurality of trusted devices. The encrypting devices can be used to covert commercially available equipment suitable for high assurance environments.

Claims20

Dependent claims

A cryptographic system comprising:

a first cryptographic device including a first communications unit with a first addressable interface paired to a second communications unit of a second cryptographic device and a first cryptographic engine coupled to the first communications unit via a first connectionless interconnect and a first trusted element;
and
the second cryptographic device including the second communications unit with a second addressable interface paired to the first communications unit of the first cryptographic device and a second cryptographic engine coupled to the second communications unit via a second connectionless interconnect and a second trusted element, wherein the first and second cryptographic engines use a shared key, and wherein the pairing between the first communications unit of the first cryptographic device and the second communications unit of the second cryptographic device provides an encrypted tunnel across an untrusted network for the first and second trusted elements,
wherein communications within the first and second cryptographic devices are connectionless, and wherein communications between the first and second cryptographic devices across the untrusted network are connection-oriented.

1 more element

A first cryptographic device for enabling communication of trusted data between trusted elements over an untrusted network, the first cryptographic device comprising:

a first cryptographic engine, including a first passive interface for communicating with a first trusted element among the trusted elements and a second passive interface for communicating with a first communications unit, wherein the first cryptographic engine is configured to at least one of encrypt or decrypt native packets from the trusted elements with a shared key;
and
the first communications unit, including a first passive interface for connectionless communication with the first cryptographic engine and a second addressable interface for connection-oriented communication with a second communications unit of a second cryptographic device that is paired to the first cryptographic device, wherein the first communications unit further includes at least one of an untrusted device interface for communicating with an untrusted device and a storage interface for communicating with a storage device.

A method comprising:

at a first encrypting device including an encryption unit with first and second passive interfaces, a first communications unit with a first passive interface and a second addressable interface, and a connectionless interconnect that couples the second passive interface of the encryption unit to the first passive interface of the first communications unit:
obtaining a native packet from a trusted element at the first passive network interface of the encryption unit;
encrypting, via the encryption unit, the native packet using a shared encryption key;
adding, via the encryption unit, a connectionless header to the encrypted native packet to form an outgoing connectionless datagram;
sending, via the second passive interface of the encryption unit, the outgoing connectionless datagram to the first communications unit;
obtaining the outgoing connectionless datagram at the first passive interface of the first communications unit;
adding, via the first communications unit, a complex header to form a packet for delivery to a second communications unit of a second encrypting device, wherein the first communications unit of the first encrypting device is paired with the second communications unit of the second encrypting device;
and
sending, via the second addressable interface of the first communications unit, the packet to the second communications unit of the second encrypting device.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/797,911Filed 8 Aug 2024 · continuation
Priority: 12 Mar 2020
Granted: 8 Sep 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 63/0471
Wherein the data content is protected, e.g. by encrypting or encapsulating the payload: applying encryption by an intermediary, e.g. receiving…
G06F 21/602
Protecting data: providing cryptographic facilities or services
G06F 21/606
Protecting data: by securing the transmission between two devices or processes
H04L 45/74
Routing or path finding of packets in data switching networks: address processing for routing

Family

Application62/988,484Us provisional application · filed 12 Mar 2020
Application17/200,468Parent of this continuation · filed 12 Mar 2021
Application18/100,312Parent of this continuation · filed 23 Jan 2023
US 11,588,798 B1Parent of this continuation · filed 21 Feb 2023
US 12,088,569 B1Parent of this continuation
US 12,732,489 B1This patent

From the US filing history. Foreign family members aren’t listed.