US 5,455,862 AGranted

Apparatus and method for encrypting communications without exchanging an encryption key

AssigneeCrest Industries, Inc.

InventorJohn D. Hoskinson

Life of this patent

Estimating the term…

Loading patent…

Abstract

An encryption/decryption unit (EDU) and method for determining a data encryption key used in encrypting and decrypting data transmitted over a non-secure communication link. Each EDU includes a central processing unit (CPU) that controls its operation, random access memory (RAM) in which one or more sets of seed keys are stored, and a data encryption standard (DES) coprocessor that implements a data encryption algorithm developed by the U.S. National Bureau of Standards. The CPU includes special circuitry enabling it to operate in an encrypted mode so that it cannot be interrogated to discover the program or data stored therein. Each EDU randomly generates a pointer, bytes of which determine the number of times that a loop is repeated in which values (initially determined by two of the seed keys) are XORed together and encrypted using one of the seed keys to determine a portion of the data encryption key (DEK). The pointer is encrypted, along with other information, producing an encrypted key header that is transmitted to the other EDU establishing the link. Upon receiving the encrypted key header, it is decrypted, and the decrypted pointer is used by the receiving EDU to determine the portion of the DEK developed by the other EDU. The two portions of the DEK are then logically combined at each EDU to produce the final DEK, which is then used during the current communication session for encrypting data exchange between the two EDUs.

Claims25

Dependent claims

A method for establishing secure communications between a first station and a second station that are coupled together by an unsecure communication link, comprising the steps of:

(a) providing the first and the second stations with a plurality of seed keys that are common to both stations, but are not publicly known;
(b) at the first station, randomly selecting a first pointer value, and at the second station, randomly selecting a second pointer value;
(c) at each station, cyclically and repetitively encrypting a succession of values using one of the seed keys as an encryption key, each encrypted value determining a new value that is then encrypted, a first value of the succession of values that is initially thus encrypted being determined as a function of at least one of the plurality of seed keys, encryption of the succession of values occurring for a number of times determined as a function of the first pointer value at the first station, and as a function of the second pointer value at the second station, a last encrypted value thus determined at the first station corresponding to a first portion of a session data encryption key, and a last encrypted value thus determined at the second station corresponding to a second portion of the session data encryption key, said first and second portions of the session data encryption keys being temporarily stored at the respective stations;
(d) using one of the seed keys as an encryption key, encrypting the first pointer at the first station and the second pointer at the second station, to produce a first encrypted header at the first station and a second encrypted header at the second station, respectively;
(e) interchanging the first and the second encrypted headers between the first and the second stations;
(f) using said one seed key, decrypting the first encrypted header at the second station and the second encrypted header at the first station to recover the first and second pointers, respectively;
(g) repeating step (c), to determine the first portion of the session data encryption key as a function of the first pointer at the second station, and to determine the second portion of the session data encryption key as a function of the second pointer at the first station, respectively;
(g) at each station, combining the first and second portions of the session data encryption key to determine a final session data encryption key;
and
(h) using the final session data encryption key at each station to encrypt and decrypt data exchanged between the two stations.

7 more elements

A method for ensuring secure communications between two sites, comprising:

(a) randomly selecting a pointer;
(b) providing a plurality of seed keys, each having their own initial value;
(c) using one of the seed keys, encrypting a value initially determined by another seed key to produce an encrypted value, said encrypted value being used to determine a successive value that replaces a previous value;
(d) repeating step (c) for a number of times determined as a function of the pointer, each successive value that is encrypted replacing the encrypted value previously determined, the encrypted value last produced comprising a portion of a session data encryption key;
(e) encrypting the pointer with one of the seed keys to produce a locally encrypted pointer;
(f) transmitting the locally encrypted pointer to another site;
(g) receiving a remotely encrypted pointer from another site;
(h) decrypting the remotely encrypted pointer received from the other site;
(i) using the pointer that was decrypted in step (h), repeating steps (c) and (d) to determine a different portion of the session data encryption key;
(j) logically combining the portions of the session data encryption key to form a complete session data encryption key;
and
(k) using the complete session data encryption key to encrypt and decrypt data sent and received between the two sites.

9 more elements

Apparatus for encrypting and decrypting data, comprising:

(a) encryption processor means for encrypting and decrypting data using an encryption key that is input thereto;
(b) control means, coupled to the encryption processor means, for controlling the operation of the encryption processor means, said control means controlling input to the encryption processor means of data from an external source for encryption and decryption and supplying the encryption processor means with the encryption key for use in encrypting and decrypting the data to produce an output signal in response to programmed instructions that cause the control means to automatically randomly select a pointer and to process a plurality of seed keys in repetitive cycles for a number of times determined as a function of the pointer, said seed keys initially being predefined, at least one of the seed keys being used as an encryption key that is input to the encryption processor by the control means to encrypt a temporary value derived as a function of at least one other seed key to produce a new temporary value for use in a next cycle, a last encrypted value thus produced comprising a part of a session data encryption key;
and
(c) non-volatile memory means, coupled to the control means, for storing the plurality of seed keys, which are initially predefined, and for storing the programmed instructions, said programmed instructions also causing the control means to:
(i) encrypt the pointer that was randomly selected to form an encrypted pointer;
(ii) transmit the encrypted pointer to a remote site;
(iii) input a different encrypted pointer received from the remote site to the encryption processor means for decryption using one of the plurality of seed keys, producing a different pointer;
(iv) determine a different part of the session data encryption key as a function of the different pointer that was decrypted and the plurality of the seed keys that are predefined, using the encryption processor means;
and
(v) logically combine the part of the session data encryption key determined locally with the different part of the session data encryption key determined as a function of the different pointer, to form a complete session data encryption key, said complete session data encryption key being input to the encryption processor means for encrypting and decrypting data during a communication session with the remote site.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 08/160,897Filed 2 Dec 1993
Granted: 3 Oct 1995
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 9/0844
Involving Diffie-Hellman or related key agreement protocols: with user authentication or key authentication, e.g. ElGamal, MTI,…
H04L 9/16
Using a plurality of keys or algorithms: the keys or algorithms being changed during operation
H04L 2209/34
Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication…
H04L 2209/60
Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication…