US 4,924,513 AGranted

Apparatus and method for secure transmission of data over an unsecure transmission channel

AssigneeDigital Equipment Corporation

InventorsB. J. Herbison, Carter Lyman, Paul Karger, Bruce Mann, Steve Lipner, Arnold Miller

Life of this patent

Estimating the term…

Loading patent…

Abstract

Apparatus and methods, readily adapted to interface with a standard data transmission network having an unsecure transmission channel, e.g., "Ethernet," for the provision of secure transmission of data over the network channel in a manner which is essentially transparent to the standard network devices and users, thereof, are provided. Various encryption keys are generated and utilized within the system to disguise or encrypt information transferrred between network nodes. The encryption keys are made known only to those network devices which are permitted to handle information encrypted with the encryption keys.

Claims19

Dependent claims

An encryption controller connected between a source node and an unsecured data transmission channel for transmitting data packets from the source node in a secure manner over the unsecured channel, the encryption controller comprising:

transceiver means, coupled to the unsecured channel, for exchanging data packets between the unsecured channel and the encryption controller;
receiver means for receiving an encrypted data packet from the source node for transmission over the unsecured channel to a destination node;
data packet memory means for storing the unencrypted data packet received from the source node;
means, responsive to the receipt of the unencrypted data packet, for forming a key request data packet for transmission via the transceiver means over the unsecured channel to a key distribution node, to request assignment of an association key for use in encrypting data packets to be transmitted from the source node to the destination node, the key request data packet including an address identifying the destination node;
decryption means for decrypting a message portion of an association open data packet received via the transceiver means over the unsecured channel from the key distribution node with a first master encryption key unique to the encryption controller, the message portion of the association open data packet being encrypted according to the first master encryption key and including an association key and a message field containing the association key encrypted according to a second master encryption key unique to the destination node;
means for assembling an association setup data packet for transmission via the transceiver means over the unsecured channel to the destination node, the association setup data packet having a message portion that includes the encrypted message field from the association open data packet containing the association key encrypted according to the second master encryption key;
and
encryption means for encrypting the unencrypted data packet stored in the data packet memory means according to the association key for transmission via the transceiver means over the unsecured channel to the destination node.

5 more elements

A method of operating an encryption controller connected between a source node and an unsecured data transmission channel for transmitting data packets from the source node in a secure manner over the unsecured channel, the method comprising the steps of:

receiving an unencrypted data packet from the source node for transmission over the unsecured channel to a destination node;
storing the unencrypted data packet received from the source node;
forming a key request data packet including an address identifying the destination node;
transmitting the key request data packet over the unsecured channel for receipt by a key distribution node to request assignment of an association key for use in encrypting data packets to be transmitted from the source node to the destination node;
receiving an association open data packet sent from the key distribution node over the unsecured channel, the association open data packet having a message portion encrypted according to a first master encryption key unique to the encryption controller, the message portion of the association open data packet including an association key and a message field containing the association key encrypted according to a second master encryption key unique to the destination node;
decrypting the message portion of the association open data packet including the association key with the first master encryption key;
assembling an association setup data packet having a message portion that includes the encrypted message field from the association open data packet containing the association key encrypted according to the second master encryption key;
transmitting the association setup data packet over the unsecured channel for receipt by the destination node;
encrypting the unencrypted data packet stored in the data packet memory means according to the association key;
and
transmitting the encrypted data packet over the unsecured channel for receipt by the destination node.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 07/338,234Filed 14 Apr 1989 · division
Priority: 25 Sep 1987
Granted: 8 May 1990
Term ends: Not estimatedThe source records don’t support an estimate.

Classification3 codes

H04L 9/083
Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely…:…
H04L 2209/60
Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication…
H04L
Digital communication