Systems, and methods for transferring data between secure networks through less secure networks
AssigneeOvsecure Ltd.
InventorOleg Vaisband
Life of this patent
Estimating the term…
Abstract
The disclosure relates to systems, methods and computer readable for generating double encryption of data through discrete modules that are air gapped at every stage. Furthermore, the transceivers disclosed can operate in “off-line” mode which can be adapted to communicate with any network access terminal regardless of the intermediate connecting network.
Claims41
A system for transferring data between secure location through less secure network, the system comprising:
- a. a first secure network;
- b. a first transceiver having at least an upstream encryption module configured to encrypt data using a first encryption key in communication with the first secure network, and a downstream encryption module configured to encrypt the encrypted data from the upstream encryption module using a second encryption key, the downstream encryption module being in communication with the less secure network
- c. a first shared non-volatile memory module, in communication with the upstream encryption module and the downstream encryption module of the first transceiver, wherein under no circumstances is the first shared non-volatile memory is in communication with both the upstream encryption module and the downstream encryption module of the first transceiver;
- d. a second secure network;
- e. a second transceiver having at least an upstream encryption module configured to decrypt data using a first encryption key in communication with the second secure network and a downstream encryption module configured to decrypt the data encrypted by the first transceiver and received from the less secure network using the second encryption key, the downstream encryption module being in communication with the less secure network
- f. a second shared non-volatile memory module, in communication with the upstream encryption module and the downstream encryption module of the second transceiver, wherein under no circumstances is the second shared non-volatile memory in communication with both the upstream encryption module and the downstream encryption module of the second transceiver, wherein the upstream encryption module and the downstream encryption module of each of the first and second transceivers, each comprises:
- i. a main central processing unit (CPU);
- ii. a power module;
- iii. a local memory;
- and
- iv. a dedicated encryption key memory.
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
A method for transferring data between at least two secure networks through a less secure network implemented in a computerized system comprising a first secure network;
- a first transceiver having at least an upstream encryption module configured to encrypt data using a first encryption key in communication with the first secure network and a downstream encryption module configured to encrypt the encrypted data from the upstream encryption module using a second encryption key, the downstream encryption module being in communication with the less secure network;
- a first programmable resource router in communication with the upstream encryption module and the downstream encryption module of the first transceiver, wherein the first programmable resource router is manually activated;
- a first shared non-volatile memory module, in communication with the upstream encryption module and the downstream encryption module, wherein under no circumstances is the first shared non-volatile memory in communication with both the upstream encryption module and the downstream encryption module of the first transceiver;
- a second secure network;
- a second transceiver having at least an upstream encryption module configured to decrypt data using a first encryption key in communication with the second secure network and a downstream encryption module configured to decrypt the data received from the less secure network using the second encryption key, the downstream encryption module being in communication with the less secure network a second programmable resource router in communication with the upstream encryption module and the downstream encryption module of the second transceiver, wherein the second programmable resource router is manually activated;
- a second shared non-volatile memory module, in communication with the upstream encryption module and the downstream encryption module, wherein under no circumstances is the second shared non-volatile memory in communication with both the upstream encryption module and the downstream encryption module of the second transceiver, and wherein the upstream encryption module and the downstream encryption module of each of the first and second transceivers, each comprises:
- a main central processing unit (CPU);
- a power module;
- a local memory;
- and a dedicated encryption key memory, the method comprising:
- a. a sending user, using the first programmable resource router, selectably powering the upstream encryption module of the first transceiver;
- b. transferring the data from the first secure network to the upstream encryption module of the first transceiver;
- c. using a first encryption key, encrypting the transferred data;
- d. transferring the encrypted data to the first shared non-volatile memory module of the first transceiver;
- e. using the first programmable resource router, selectably powering off the upstream encryption module of the first transceiver, thereby eliminating access from the upstream encryption module of the first transceiver to the first shared non-volatile memory of the first transceiver;
- f. the sending user, using the first programmable resource router, selectably powering the downstream encryption module of the first transceiver;
- g. transferring the encrypted data from the first shared non-volatile memory module of the first transceiver to the downstream encryption module of the first transceiver;
- h. using a second encryption key, encrypting the encrypted data received from the first shared non-volatile memory module of the first transceiver, thereby doubly encrypting the data received from the first secure network;
- i. transferring the doubly encrypted data to the less secure network;
- j. a receiving user, upon receiving indication of the data being sent through the less secure network, using the second programmable resource router, selectably powering the downstream encryption module of the second transceiver;
- k. using the second encryption key, decrypting the doubly encrypted data received from the less secure network thereby generating a once encrypted data;
- l. transferring the data to the second shared non-volatile memory module of the second transceiver;
- m. using the second programmable resource router, selectably powering off the downstream encryption module of the second transceiver, thereby eliminating access from the downstream encryption module of the second transceiver to the second shared non-volatile memory of the second transceiver;
- n. the receiving user, using the second programmable resource router, selectably powering the upstream encryption module of the second transceiver;
- o. transferring the once encrypted data from the second shared non-volatile memory module of the second transceiver to the upstream encryption module of the second transceiver;
- p. using the first encryption key, decrypting the once encrypted transferred data;
- thereby completely decrypting the transferred data;
- and
- q. transferring the completely decrypted data to the second secure network.
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
(canceled)
A network terminal device for secured data transfer comprising:
- a. a programmable network resource router;
- b. a shared memory module;
- c. an upstream encryption module in communication with a secure network, the programmable network resource router and the shared memory module;
- and
- d. a downstream encryption module in communication with a less secure network, the programmable network resource router and the shared memory module,
- wherein the programmable network resource router is programmed to only enable communication between the upstream encryption and the shared memory, or the downstream encryption module and the memory, but not both simultaneously, and wherein data transferred between the secured network and the less secured network is double encrypted.
(canceled)
(canceled)
(canceled) local memory having thereon a processor readable medium with a set of executable instructions configured to cause the processor to:
- a. receive the encrypted data from the shared non-volatile memory;
- b. using the second encryption key stored on the dedicated encryption key memory of the downstream encryption module, encrypt the encrypted data;
- and
- c. transfer the doubly encrypted data to the less secure network.
(canceled)
(canceled)
(canceled)
Dependencies are inferred from the claim text.