Patent EP0464565A2 successfully refreshed from Google Patents.
EP0464565A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Cryptography processor and method with optional status encoding
Assignee: Digital Equipment Corp
•
Filing: 1991-06-24
•
Granted: —
•
Expires: 2011-06-24
Abstract
Abstract Cryptographic apparatus, and a related method for its operation, for in-line encryption and decryption of data packets transmitted in a communication network. A full-duplex cryptographic processor is positioned between two in-line processing entities of a network architecture. For example, in a fiber distributed data interface (FDDI) network, the processor is positioned between a media access control (MAC)(10) sublayer and a ring memory controller (RMC)(12). Incoming information packets are analyzed to decide whether or not they contain encrypted data and, if they do, are subject to decryption before forwarding. Outbound information packets have their data portions encrypted if called for, and are usually forwarded toward the network communication medium. Cryptographic processing in both directions is performed in real time as each packet is streamed through the processor. The processing of outbound information packets includes using optional data paths for looping of the processed information back in a reverse direction, to permit the host system to perform local encryption or decryption for various purposes.
Inventors
- 👤 Amar Gupta
- 👤 William R. Hawe
- 👤 Mark F. Kempf
- 👤 Ching Shui Lee
- 👤 Butler W. Lampson
- 👤 Barry A. Spinney
- 👤 Joseph J. Tardo
- 👤 Charles W. Kaufman
- 👤 B. J. Herbison
- 👤 Morrie Gasser
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-11-04 12:48
CPC Classifications
G; G09; G09C; G09C1/00; H; H04; H04L; H04L2209/00; H04L2209/12; H04L2209/125
Claims Analysis
Total Claims: 22
Claim 1
Independent Claim
108 words
A cryptographic processor for use in a communication network, the processor comprising: data encryption/decryption means (16) characterized by; first and second interface circuits (20, 22) connected between the data encryption/decryption means and two in-line processing entities in a network architecture; wherein the encryption/decryption means is characterized by a receive path, for decrypting incoming packets that contain encrypted data as they are received through the first interface circuit, and passing decrypted data for output through the second interface circuit, and a transmit path for encrypting data packets received through the second interface if encryption is called for; and wherein the cryptographic processor is insertable between the two processing entities.
Claim 2
Dependent Claim
39 words
A cryptographic processor as defined in claim 1, wherein the receive path includes: means for deciding whether an incoming packet contains encrypted data, which is to be decrypted; and means for locating the encrypted data within the received packet.
Claim 3
Dependent Claim
20 words
A cryptographic processor as defined in claim 1, wherein the transmit path includes: means for bypassing encryption if not required.
Claim 4
Dependent Claim
33 words
A cryptographic processor as defined in claim 1, wherein the transmit path includes: loopback means for routing a packet received from the second interface circuit back to the same interface circuit after processing.
Claim 5
Dependent Claim
52 words
A cryptographic processor as defined in claim 4, wherein: the processor further includes a third interface circuit, for connection of the transmit path to a node processor; and the transmit path further includes alternate loopback means, for routing a packet received from the second interface circuit back through the third interface circuit.
Claim 6
Dependent Claim
147 words
A cryptographic processor for use in a communications network, the processor comprising: data encryption/decryption means; first and second interface circuits connected between the data encryption/decryption means and two in-line processing stages in a network architecture; wherein the cryptographic processor is insertable between the two in-line processing stages without modification to any existing network protocols, and wherein the encryption/decryption means includes means for examining an incoming information packet as it is received in the form of a serial stream of information from the first in-line processing stage, means for determining to an acceptable level of probability whether the incoming information packet contains encrypted data and whether it should be decrypted, means that operate if it is determined that the packet should be decrypted, for finding the starting position of encrypted data, and means for passing the information packet, whether decrypted or not, to the second in-line processing state.
Claim 7
Dependent Claim
76 words
A cryptographic processor as defined in claim 6, wherein: the means for determining whether the incoming packet contains encrypted data includes means for identifying the packet format from knowledge of a limited number of packet formats that are generated by a corresponding number of network protocols; and if the packet format is identified, the means for finding the starting position of the encrypted data includes means for obtaining an offset value indicative of the starting position.
Claim 8
Dependent Claim
74 words
A cryptographic processor as defined in claim 7, and further comprising: means for subsequently determining in or after the second in-line processing stage that an information packet that was decrypted should not have been; means for passing the decrypted packet back from the second in-line processing stage for further cryptographic processing; and means within the encryption/decryption means, for re-encrypting the information packet to regenerate cleartext data that should not have been subjected to decryption.
Claim 9
Dependent Claim
28 words
A cryptographic processor as defined in claim 8, wherein: the encryption/decryption means performs decryption in such a manner that it is completely reversible in the means for re-encrypting.
Claim 10
Dependent Claim
121 words
A cryptographic processor as defined in claim 9, wherein: the encryption/decryption means includes means for recovering, on decryption, n bytes of cleartext integrity check value in the packet by exclusive ORing the last n bytes in the received packet with an n-byte integrity check value generated from the preceding data bytes, where n is a integer that depends on the specific cryptographic approach used; and in the event of a false decryption, the previously mentioned exclusive ORing operation of the encryption/decryption means results in the generation of false data, but the means for re-encrypting includes means for exclusive ORing the false data with the integrity check value, to regenerate the real cleartext data in the last n bytes of the packet.
Claim 11
Dependent Claim
60 words
A cryptographic processor as defined in claim 7, wherein: the means for determining whether the incoming packet contains encrypted data and whether it should be decrypted, includes means for determining to an acceptable level of probability whether the packet is part of a message that has been segmented into multiple packets, and electing not to decrypt such a message segment.
Claim 12
Dependent Claim
59 words
A cryptographic processor as defined in claim 11, wherein the encryption/decryption means further comprises: means for passing each message segment on to the second in-line processing stage, without decryption, for further processing and reforming of the message segments into a complete message; and means for processing the complete message if returned from the second in-line processing stage for decryption.
Claim 13
Independent Claim
152 words
A method for cryptographically processing information packets received over a communication network, some of which may include encrypted data, the method comprising the steps of: examining an incoming information packet as it is received in the form of a serial stream of information from a first in-line processing stage; determining to an acceptable level of probability whether the incoming information packet contains encrypted data and whether it should be decrypted; if it is determined that the packet should be decrypted, finding the starting position of encrypted data in the incoming packet; temporarily storing encrypted data until a fixed-size block has been accumulated for further processing; initiating decryption of the accumulated fixed-size block; continuing to store incoming data to form subsequent blocks for decryption; bypassing decryption of a last block in the packet in the event that there are not enough data elements remaining in the packet to form a complete fixed-size block.
Claim 14
Dependent Claim
49 words
A method as defined in claim 13, and further comprising the steps of: re-encrypting all blocks of the received packet except the last, incomplete block; and concatenating the re-encrypted blocks with the incomplete block, to regenerate the packet data in the form in which is was received, before decryption.
Claim 15
Dependent Claim
68 words
A method as defined in claim 13, and further comprising the steps of: determining whether the reformed packet is part of a segmented message; if the reformed packet is part of a segmented message, temporarily storing the reformed packet until all other portions of the segmented message have been received; concatenating all segments of the segments of the segmented message; and decrypting the message as a single entity.
Claim 16
Independent Claim
77 words
A method of operation of cryptographic apparatus in a communication network having multiple node processors connected to communication medium, the method comprising the steps of: receiving a packet of information from the communication medium through a first interface circuit; deciding, while the packet is being received, whether it contains encrypted data; if the packet contains encrypted data, decrypting the data as it is being received; and transmitting the packet with decrypted data through a second interface circuit.
Claim 17
Dependent Claim
60 words
A method as defined in claim 16, and further comprising the steps of: receiving a transmittable packet of information through the second interface circuit; deciding from the content of the packet received from the second interface whether or not to cryptographically process data within the packet; cryptographically processing data in the transmittable packet if necessary; and forwarding the processed packet.
Claim 18
Dependent Claim
66 words
A method as defined in claim 17, wherein the step of forwarding the processed packet includes choosing from among the option of: forwarding the processed packet to the first interface circuit for transmission onto the communication medium; looping the processed packet back to the second interface circuit for further processing; and looping the processed packet back to a third interface circuit connected to a node processor.
Claim 19
Independent Claim
112 words
A method of encoding additional status information in a frame status field for use in a packet to be transmitted over a communication network, the method comprising the steps of: examining a count subfield of the frame status field to determine how many bit positions of a status subfield are being used; encoding as many additional status bits into the status subfield as will fit in unused bit positions; and if not all desired additional status bits can be encoded in the status subfield, encoding at least one additional status bit into a bit position of the count subfield that is not being used for particular count values stored in the subfield.
Claim 20
Dependent Claim
122 words
A method as in claim 13, including the step of encoding additional status information from a frame status field for use in a pipeline processing system in which there is a need to pass additional status from a processor in an intermediate state of the pipeline, the decoding step comprising the sub steps of: examining a count subfield of the frame status field to determine how many bit positions of a status subfield are being used; decoding as many additional status bits as are encoded into unused bit positions of the status subfield; and decoding at least one additional status bit from a bit position of the count subfield that is not being used for particular count values stored in the subfield.
Claim 21
Dependent Claim
115 words
Apparatus for encoding additional status information in a frame status field for use in a packet to be transmitted over a communication network, the apparatus comprising; means for examining a count subfield of the frame status field to determine how many bit positions of a status subfield are being used; means for encoding as many additional status bits into the status subfield as will fit in unused bit positions; and means operative if not all desired additional status bits can be encoded in the status subfield, for encoding at least one additional status bit into a bit position of the count subfield that is not being used for particular count values stored in the subfield.
Claim 22
Dependent Claim
106 words
A processor apparatus as in claim 6, including decoding means for encoding additional status information from a frame status field in a packet transmitted over a communication network, said decoding means comprising: means for examining a count subfield of the frame status field to determine how many bit positions of a status subfield are being used; means for decoding as many additional status bits as are encoded into unused bit positions of the status subfield; and means for decoding at least one additional status bit from a bit position of the count subfield that is not being used for particular count values stored in the subfield.
References Cited (Backward Citations)
US4510594A
Cited
EP0239749A2
Cited
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.