US4924513A — Apparatus and method for secure transmission of d…

Claim 1

Independent Claim 330 words

An encryption controller connected between a source node and an unsecured data transmission channel for transmitting data packets from the source node in a secure manner over the unsecured channel, the encryption controller comprising: transceiver means, coupled to the unsecured channel, for exchanging data packets between the unsecured channel and the encryption controller; receiver means for receiving an encrypted data packet from the source node for transmission over the unsecured channel to a destination node; data packet memory means for storing the unencrypted data packet received from the source node; means, responsive to the receipt of the unencrypted data packet, for forming a key request data packet for transmission via the transceiver means over the unsecured channel to a key distribution node, to request assignment of an association key for use in encrypting data packets to be transmitted from the source node to the destination node, the key request data packet including an address identifying the destination node; decryption means for decrypting a message portion of an association open data packet received via the transceiver means over the unsecured channel from the key distribution node with a first master encryption key unique to the encryption controller, the message portion of the association open data packet being encrypted according to the first master encryption key and including an association key and a message field containing the association key encrypted according to a second master encryption key unique to the destination node; means for assembling an association setup data packet for transmission via the transceiver means over the unsecured channel to the destination node, the association setup data packet having a message portion that includes the encrypted message field from the association open data packet containing the association key encrypted according to the second master encryption key; and encryption means for encrypting the unencrypted data packet stored in the data packet memory means according to the association key for transmission via the transceiver means over the unsecured channel to the destination node.

Claim 2

Dependent Claim 330 words

An encryption controller connected between a source node and an unsecured data transmission channel for transmitting data packets from the source node in a secure manner over the unsecured channel, the encryption controller comprising: transceiver means, coupled to the unsecured channel, for exchanging data packets between the unsecured channel and the encryption controller; receiver means for receiving an encrypted data packet from the source node for transmission over the unsecured channel to a destination node; data packet memory means for storing the unencrypted data packet received from the source node; means, responsive to the receipt of the unencrypted data packet, for forming a key request data packet for transmission via the transceiver means over the unsecured channel to a key distribution node, to request assignment of an association key for use in encrypting data packets to be transmitted from the source node to the destination node, the key request data packet including an address identifying the destination node; decryption means for decrypting a message portion of an association open data packet received via the transceiver means over the unsecured channel from the key distribution node with a first master encryption key unique to the encryption controller, the message portion of the association open data packet being encrypted according to the first master encryption key and including an association key and a message field containing the association key encrypted according to a second master encryption key unique to the destination node; means for assembling an association setup data packet for transmission via the transceiver means over the unsecured channel to the destination node, the association setup data packet having a message portion that includes the encrypted message field from the association open data packet containing the association key encrypted according to the second master encryption key; and encryption means for encrypting the unencrypted data packet stored in the data packet memory means according to the association key for transmission via the transceiver means over the unsecured channel to the destination node.

Claim 3

Dependent Claim 46 words

The encryption controller of claim 1 further comprising: means, coupled to the data packet memory means, for calculating an integrity code check of each of the data packets to be transmitted over the unsecured channel and for including the integrity code check in the data packet.

Claim 4

Dependent Claim 37 words

The encryption controller of claim 1 wherein the receiver means includes concentrator means for connecting a plurality of source nodes to the encryption controller for receiving unencrypted data packets from each of the plurality of source nodes.

Claim 5

Dependent Claim 115 words

The encryption controller of claim 3 wherein the unencrypted data packet includes an address identifying the source node; and the encryption controller further comprises means, responsive to the receipt of the unencrypted data packet, for comparing the address identifying the source node in the unencrypted data packet with the actual source node from which the unencrypted data packet was received, and means, responsive to the comparing means, for assembling an auditable event data packet indicating an attempted security violation, for transmission via the transceiver means over the unsecured channel to the key distribution node, when the address identifying the source node in the encrypted data packet and the actual source node are not the same.

Claim 6

Dependent Claim 64 words

The encryption controller of claim 1, further comprising: association memory means for storing association records of the source node and various destination nodes, the association records including association keys corresponding to the various destination nodes; and search means, responsive to the receipt of the unencrypted data packet, for searching the association memory means to locate a valid association key corresponding to the destination node.

Claim 7

Dependent Claim 33 words

The encryption controller of claim 5, further comprising: means, coupled to the association memory means, for periodically disabling certain association keys stored in the association memory means thereby rendering those association keys invalid.

Claim 8

Dependent Claim 144 words

The encryption controller of claim 1, further comprising: secure memory means for storing encryption keys for use in encrypting and decrypting data packets transmitted and receive over the unsecured data transmission channel; means for formulating an initialization request data packet for transmission via the transceiver means over the unsecured channel to a key distribution node, the initialization request data packet including an identification of the encryption controller; second decryption means for decrypting a message portion of an initialization data packet received via the transceiver means from the key distribution node over the unsecured channel with an initialization key stored in the secure memory means, the message portion of the initialization data packet being encrypted according to the initialization key and including the first master encryption key unique to the encryption controller, and for storing the first master encryption key in the secure memory means.

Claim 9

Dependent Claim 24 words

The encryption controller of claim 7, further comprising: a numerical keypad, coupled to the secure memory means, for manual entry of the initialization key.

Claim 10

Dependent Claim 33 words

The encryption controller of claim 7, further comprising: means, coupled to the secure memory means, for erasing the encryption keys stored in the secure memory means when the encryption controller is physically compromised.

Claim 11

Dependent Claim 95 words

The encryption controller of claim 1, further comprising: second decryption means for decrypting a first identifier exchange data packet received via the transceiver means over the unsecured channel from the destination node with the association key, the identifier exchange data packet being encrypted according to the association key; and second encryption means, responsive to the second decryption means, for encrypting a second identifier exchange data packet according to the association key, for transmission via the transceiver means over the unsecured channel to the destination node, when the first identifier exchange data packet is successfully decrypted.

Claim 12

Independent Claim 298 words

A method of operating an encryption controller connected between a source node and an unsecured data transmission channel for transmitting data packets from the source node in a secure manner over the unsecured channel, the method comprising the steps of: receiving an unencrypted data packet from the source node for transmission over the unsecured channel to a destination node; storing the unencrypted data packet received from the source node; forming a key request data packet including an address identifying the destination node; transmitting the key request data packet over the unsecured channel for receipt by a key distribution node to request assignment of an association key for use in encrypting data packets to be transmitted from the source node to the destination node; receiving an association open data packet sent from the key distribution node over the unsecured channel, the association open data packet having a message portion encrypted according to a first master encryption key unique to the encryption controller, the message portion of the association open data packet including an association key and a message field containing the association key encrypted according to a second master encryption key unique to the destination node; decrypting the message portion of the association open data packet including the association key with the first master encryption key; assembling an association setup data packet having a message portion that includes the encrypted message field from the association open data packet containing the association key encrypted according to the second master encryption key; transmitting the association setup data packet over the unsecured channel for receipt by the destination node; encrypting the unencrypted data packet stored in the data packet memory means according to the association key; and transmitting the encrypted data packet over the unsecured channel for receipt by the destination node.

Claim 13

Independent Claim 298 words

A method of operating an encryption controller connected between a source node and an unsecured data transmission channel for transmitting data packets from the source node in a secure manner over the unsecured channel, the method comprising the steps of: receiving an unencrypted data packet from the source node for transmission over the unsecured channel to a destination node; storing the unencrypted data packet received from the source node; forming a key request data packet including an address identifying the destination node; transmitting the key request data packet over the unsecured channel for receipt by a key distribution node to request assignment of an association key for use in encrypting data packets to be transmitted from the source node to the destination node; receiving an association open data packet sent from the key distribution node over the unsecured channel, the association open data packet having a message portion encrypted according to a first master encryption key unique to the encryption controller, the message portion of the association open data packet including an association key and a message field containing the association key encrypted according to a second master encryption key unique to the destination node; decrypting the message portion of the association open data packet including the association key with the first master encryption key; assembling an association setup data packet having a message portion that includes the encrypted message field from the association open data packet containing the association key encrypted according to the second master encryption key; transmitting the association setup data packet over the unsecured channel for receipt by the destination node; encrypting the unencrypted data packet stored in the data packet memory means according to the association key; and transmitting the encrypted data packet over the unsecured channel for receipt by the destination node.

Claim 14

Dependent Claim 38 words

The method of claim 11, further comprising the step of: calculating an integrity code check of each of the data packets to be transmitted over the unsecured channel and including the integrity code check in the data packet.

Claim 15

Dependent Claim 110 words

The method of claim 11, wherein the encryption controller is connected to a plurality of source nodes, and unencrypted data packet includes an address identifying the source node, the method further comprising the steps of: comparing the address identifying the source node in the unencrypted data packet with the actual source node from which the unencrypted data packet was received; assembling an auditable event data packet indicating an attempted security violation when the address identifying the source node in the unencrypted data packet and the actual source node are not the same, and transmitting the auditable event data packet over the unsecured channel for receipt by the key distribution node.

Claim 16

Dependent Claim 64 words

The method of claim 11, further comprising the steps of: storing association records of the source node and various destination nodes in an association memory, the association records including association keys corresponding to the various destination nodes; and searching the association memory to locate a valid association key corresponding to the destination node when the unencrypted data packet is received from the source node.

Claim 17

Dependent Claim 26 words

The method of claim 14, further comprising the steps of: periodically disabling certain association keys stored in the association memory thereby rendering those association keys invalid.

Claim 18

Dependent Claim 147 words

The method of claim 11, further comprising the steps of: storing encryption keys in a secure memory for use in encrypting and decrypting data packets transmitted and received over the unsecured channel; formulating an initialization request data packet including an identification of the encryption controller; transmitting the initialization request data packet over the unsecured channel for receipt by a key distribution node; receiving an initialization data packet sent from the key distribution node over the unsecured channel, the initialization data packet having a message portion encrypted according to an initialization key stored in the secure memory means, the message portion of the initialization packet including the first master encryption key unique to the encryption controller; and decrypting the message portion of the initialization data packet including the first master encryption key with the initialization key and storing the first master encryption key in the secure memory means.

Claim 19

Dependent Claim 22 words

The method of claim 16, further comprising the step of: manually entering the initialization key for storage in the secure memory means.

Claim 20

Dependent Claim 27 words

The method of claim 16, further comprising the step of: erasing the encryption keys stored in the secure memory means when the encryption controller is physically compromised.

Claim 21

Dependent Claim 89 words

The method of claim 11, further comprising the steps of: receiving a first identifier exchange data packet sent from the destination node over the unsecured channel, the identifier exchange data packet being encrypted according to the association key; decrypting the first identifier exchange data packet with the association key; encrypting a second identifier exchange data packet with the association key when the first identifier exchange data packet is successfully decrypted; and transmitting the encrypted second identifier exchange data packet over the unsecured data for receipt by the destination node.

Annuity Stage	Window Opens	Payment Deadline	Surcharge Period Until	Estimated Fee	Status
3.5 Years (Year 4)	1993-05-07	1993-11-06	1994-05-08	$2000.00	Window Closed / Lapsed
7.5 Years (Year 8)	1997-05-07	1997-11-06	1998-05-08	$3760.00	Window Closed / Lapsed
11.5 Years (Year 12)	2001-05-07	2001-11-06	2002-05-08	$7700.00	Window Closed / Lapsed

Apparatus and method for secure transmission of data over an unsecure transmission channel

Abstract

Inventors

Bibliographic Details

Claims Analysis

References Cited (Backward Citations)

USPTO Annuity & Maintenance Windows

Assigned Categories & Tags

Assign Category Tag