US6708273B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Apparatus and method for implementing IPSEC transforms within an integrated circuit
Assignee: Thales DIS CPL USA Inc
•
Filing: 1999-02-25
•
Granted: 2004-03-16
•
Expires: 2019-02-25
Abstract
Abstract A secure communication platform on an integrated circuit is a highly integrated security processor which incorporates a general purpose digital signal processor (DSP), along with a number of high performance cryptographic function elements, as well as a PCI and PCMCIA interface. The secure communications platform is integrated with an off-the-shelf DSP so that a vendor who is interested in digital signal processing could also receive built-in security functions which cooperate with the DSP. The integrated circuit includes a callable library of cryptographic commands and encryption algorithms. An encryption processor is included to perform key and data encryption, as well as a high performance hash processor and a public key accelerator.
Inventors
- 👤 Timothy Ober
- 👤 Peter Reed
- 👤 Robert W. Doud
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-05 10:56
CPC Classifications
G; G06; G06F; G06F8/00; G06F8/60; G06F21/00; G06F21/70; G06F21/71; G06F21/72; G06F21/74; G06F21/78; G06F21/79; G06F21/82; G06F9/00; G06F9/06; G06F9/46; G09; G09C; G09C1/00; H; H04; H04L; H04L63/00; H04L63/04; H04L63/0428; H04L63/0485; H04L63/16; H04L63/164; H04L9/00; H04L9/06; H04L9/0618; H04L9/0625; H04L9/0643; H04L9/065; H04L9/08; H04L9/088; H04L2209/00; H04L2209/04; H04L2209/12; H04L2209/125; H04L2209/20; H04L2209/56
Claims Analysis
Total Claims: 52
Claim 1
Independent Claim
280 words
A circuit for encrypting, decrypting, hashing and monitoring data streams in a processor comprising: at least one register circuit, electronically linked to the processor, for storing configuration bits, status bits, and control bits; a first memory circuit for storing data, electronically linked to the processor; a first pad insertion circuit, electronically linked to the first memory circuit, for counting data that is transferred into the first memory circuit and comparing a first data count to a first preset value and when the first data count does not end at an eight byte boundary, data bits are added so that data transferred into the first memory circuit ends at the eight byte boundary; an encryption and decryption circuit, for performing encryption and decryption operations, electronically linked to the first memory circuit; a pad consume and verify circuit, electronically linked to the first memory circuit, for counting data exiting the encryption and decryption circuit and comparing a second data count to a second preset value so that data bits added in the pad insertion circuit can be removed; a context storage circuit, electronically linked to the encryption and decryption circuit, for providing security association data for use in encryption and decryption; a second memory circuit for storing data, electronically linked to the processor; a second pad insertion circuit, electronically linked to the second memory circuit, for counting data that is transferred into the second memory circuit and comparing a third data count to a third preset value and adding data bits after all data has been counted and the third data count is less than the preset value; and a hash circuit for hashing data, electronically linked to the second memory circuit.
Claim 2
Dependent Claim
280 words
A circuit for encrypting, decrypting, hashing and monitoring data streams in a processor comprising: at least one register circuit, electronically linked to the processor, for storing configuration bits, status bits, and control bits; a first memory circuit for storing data, electronically linked to the processor; a first pad insertion circuit, electronically linked to the first memory circuit, for counting data that is transferred into the first memory circuit and comparing a first data count to a first preset value and when the first data count does not end at an eight byte boundary, data bits are added so that data transferred into the first memory circuit ends at the eight byte boundary; an encryption and decryption circuit, for performing encryption and decryption operations, electronically linked to the first memory circuit; a pad consume and verify circuit, electronically linked to the first memory circuit, for counting data exiting the encryption and decryption circuit and comparing a second data count to a second preset value so that data bits added in the pad insertion circuit can be removed; a context storage circuit, electronically linked to the encryption and decryption circuit, for providing security association data for use in encryption and decryption; a second memory circuit for storing data, electronically linked to the processor; a second pad insertion circuit, electronically linked to the second memory circuit, for counting data that is transferred into the second memory circuit and comparing a third data count to a third preset value and adding data bits after all data has been counted and the third data count is less than the preset value; and a hash circuit for hashing data, electronically linked to the second memory circuit.
Claim 3
Dependent Claim
36 words
A circuit for encrypting, decrypting, hashing and monitoring data streams in a processor as defined in claim 1 , wherein the second pad insertion circuit adds data bits so that the second memory circuit is full.
Claim 4
Dependent Claim
37 words
A circuit for encrypting, decrypting, hashing and monitoring data streams in a processor as defined in claim 1 , wherein the encryption and decryption circuit includes Data Encryption Standard (DES) and Triple Data Encryption Standard (TDES) circuits.
Claim 5
Dependent Claim
33 words
A circuit for encrypting, decrypting, hashing and monitoring data streams in a processor as defined in claim 1 , wherein the hash circuit includes Message Digest (MD5) and Secure Hash Algorithm (SHA-1) circuits.
Claim 6
Independent Claim
122 words
A method of implementing parallel Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing plaintext data in an encrypt memory and in a hash memory; loading the fetched context data stored in the registers into an encryption circuit and into a hash circuit; loading the plaintext data into the encryption circuit and into the hash circuit; encrypting the plaintext data in the encryption circuit to generate ciphertext data; hashing the plaintext data in the hash circuit to generate a hash digest; and storing the ciphertext data in the encrypt memory and the hash digest in a register.
Claim 7
Independent Claim
122 words
A method of implementing parallel Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing plaintext data in an encrypt memory and in a hash memory; loading the fetched context data stored in the registers into an encryption circuit and into a hash circuit; loading the plaintext data into the encryption circuit and into the hash circuit; encrypting the plaintext data in the encryption circuit to generate ciphertext data; hashing the plaintext data in the hash circuit to generate a hash digest; and storing the ciphertext data in the encrypt memory and the hash digest in a register.
Claim 8
Dependent Claim
64 words
A method as defined in claim 5 , further comprising the step of: padding the plaintext data stored in the encrypt memory and the plaintext data stored in the hash memory to generate padded plaintext data, wherein the plaintext data used in the steps of loading the plaintext data, encrypting the plaintext data and hashing the plaintext data includes a padded portion of data.
Claim 9
Dependent Claim
41 words
A method as defined in claim 5 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the ciphertext data stored in the encrypt memory; and storing the initialization vector in a register.
Claim 10
Dependent Claim
41 words
A method as defined in claim 6 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the ciphertext data stored in the encrypt memory; and storing the initialization vector in a register.
Claim 11
Dependent Claim
41 words
A method as defined in claim 7 , wherein the ciphertext data stored in the encrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the ciphertext data.
Claim 12
Dependent Claim
41 words
A method as defined in claim 8 , wherein the ciphertext data stored in the encrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the ciphertext data.
Claim 13
Independent Claim
122 words
A method of implementing parallel Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing ciphertext data in a decrypt memory and in a hash memory; loading the fetched context data stored in the registers into a decryption circuit and into a hash circuit; loading the ciphertext data into the encryption circuit and into the hash circuit; decrypting the ciphertext data in the decryption circuit to generate plaintext data; hashing the ciphertext data in the hash circuit to generate a hash digest; and storing the plaintext data in the decrypt memory and the hash digest in a register.
Claim 14
Independent Claim
122 words
A method of implementing parallel Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing ciphertext data in a decrypt memory and in a hash memory; loading the fetched context data stored in the registers into a decryption circuit and into a hash circuit; loading the ciphertext data into the encryption circuit and into the hash circuit; decrypting the ciphertext data in the decryption circuit to generate plaintext data; hashing the ciphertext data in the hash circuit to generate a hash digest; and storing the plaintext data in the decrypt memory and the hash digest in a register.
Claim 15
Dependent Claim
31 words
A method as defined in claim 11 , further comprising the steps of: verifying pad bytes for correct pad properties; and discarding a padded portion of data from the plaintext data.
Claim 16
Dependent Claim
41 words
A method as defined in claim 11 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the plaintext data stored in the decrypt memory; and storing the initialization vector in a register.
Claim 17
Dependent Claim
41 words
A method as defined in claim 12 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the plaintext data stored in the decrypt memory; and storing the initialization vector in a register.
Claim 18
Dependent Claim
41 words
A method as defined in claim 13 , wherein the plaintext data stored in the decrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the plaintext data.
Claim 19
Dependent Claim
41 words
A method as defined in claim 14 , wherein the plaintext data stored in the decrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the plaintext data.
Claim 20
Independent Claim
130 words
A method of implementing pipeline Internet Protocol Security (IPsec) operations simultaneously within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing plaintext data in an encrypt memory; loading the fetched context data stored in the registers into an encryption circuit and into a hash circuit; loading the plaintext data into the encryption circuit; encrypting the plaintext data in the encryption circuit to generate ciphertext data; storing the ciphertext data in the encrypt memory and in the hash memory; loading the ciphertext data stored in the hash memory into the hash circuit; hashing the ciphertext data in the hash circuit into a hash digest; and storing the hash digest in a register.
Claim 21
Independent Claim
130 words
A method of implementing pipeline Internet Protocol Security (IPsec) operations simultaneously within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing plaintext data in an encrypt memory; loading the fetched context data stored in the registers into an encryption circuit and into a hash circuit; loading the plaintext data into the encryption circuit; encrypting the plaintext data in the encryption circuit to generate ciphertext data; storing the ciphertext data in the encrypt memory and in the hash memory; loading the ciphertext data stored in the hash memory into the hash circuit; hashing the ciphertext data in the hash circuit into a hash digest; and storing the hash digest in a register.
Claim 22
Dependent Claim
51 words
A method as defined in claim 17 , further comprising the step of: padding the plaintext data stored in the encrypt memory to generate padded plaintext data, wherein the plaintext data used in the steps of loading the plaintext data and encrypting the plaintext data includes a padded portion of data.
Claim 23
Dependent Claim
41 words
A method as defined in claim 17 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the ciphertext data stored in the encrypt memory; and storing the initialization vector in a register.
Claim 24
Dependent Claim
41 words
A method as defined in claim 18 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the ciphertext data stored in the encrypt memory; and storing the initialization vector in a register.
Claim 25
Dependent Claim
41 words
A method as defined in claim 19 , wherein the ciphertext data stored in the encrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the ciphertext data.
Claim 26
Dependent Claim
41 words
A method as defined in claim 20 , wherein the ciphertext data stored in the encrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the ciphertext data.
Claim 27
Independent Claim
126 words
A method of implementing pipeline Internet Protocol Security (IPsec) operations simultaneously within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing ciphertext data in a decrypt memory; loading the fetched context data stored in the registers into a decryption circuit and into a hash circuit; loading the ciphertext data into the decryption circuit; decrypting the ciphertext data in the decryption circuit to generate plaintext data; storing the plaintext data in the decrypt memory and in the hash memory; loading the plaintext data into the hash circuit; hashing the plaintext data in the hash circuit to generate a hash digest; and storing the hash digest in a register.
Claim 28
Independent Claim
126 words
A method of implementing pipeline Internet Protocol Security (IPsec) operations simultaneously within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing ciphertext data in a decrypt memory; loading the fetched context data stored in the registers into a decryption circuit and into a hash circuit; loading the ciphertext data into the decryption circuit; decrypting the ciphertext data in the decryption circuit to generate plaintext data; storing the plaintext data in the decrypt memory and in the hash memory; loading the plaintext data into the hash circuit; hashing the plaintext data in the hash circuit to generate a hash digest; and storing the hash digest in a register.
Claim 29
Dependent Claim
31 words
A method as defined in claim 23 , further comprising the steps of: verifying pad bytes for correct pad properties; and discarding a padded portion of data from the plaintext data.
Claim 30
Dependent Claim
41 words
A method as defined in claim 23 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the plaintext data stored in the decrypt memory; and storing the initialization vector in a register.
Claim 31
Dependent Claim
41 words
A method as defined in claim 24 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the plaintext data stored in the decrypt memory; and storing the initialization vector in a register.
Claim 32
Dependent Claim
41 words
A method as defined in claim 25 , wherein the plaintext data stored in the decrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the plaintext data.
Claim 33
Dependent Claim
41 words
A method as defined in claim 26 , wherein the plaintext data stored in the decrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the plaintext data.
Claim 34
Independent Claim
86 words
A method of implementing Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing ciphertext data in a decrypt memory; loading the fetched context data stored in the registers into a decryption circuit; loading the ciphertext data into the decryption circuit; decrypting the ciphertext data in the decryption circuit to generate plaintext data; and storing the plaintext data in the decrypt memory.
Claim 35
Independent Claim
86 words
A method of implementing Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing ciphertext data in a decrypt memory; loading the fetched context data stored in the registers into a decryption circuit; loading the ciphertext data into the decryption circuit; decrypting the ciphertext data in the decryption circuit to generate plaintext data; and storing the plaintext data in the decrypt memory.
Claim 36
Dependent Claim
31 words
A method as defined in claim 29 , further comprising the steps of: verifying pad bytes for correct pad properties; and discarding a padded portion of data from the plaintext data.
Claim 37
Dependent Claim
41 words
A method as defined in claim 29 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the plaintext data stored in the decrypt memory; and storing the initialization vector in a register.
Claim 38
Dependent Claim
41 words
A method as defined in claim 30 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the plaintext data stored in the decrypt memory; and storing the initialization vector in a register.
Claim 39
Dependent Claim
42 words
A method as defined in claim 31 , where in the plaintext data stored in the decrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the plaintext data.
Claim 40
Dependent Claim
41 words
A method as defined in claim 22 , wherein the plaintext data stored in the decrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the plaintext data.
Claim 41
Independent Claim
86 words
A method of implementing Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing plaintext data in an encrypt memory; loading the fetched context data stored in the registers into an encryption circuit; loading the plaintext data into the encryption circuit; encrypting the plaintext data in the encryption circuit to generate ciphertext data; and storing the ciphertext data in the encrypt memory.
Claim 42
Independent Claim
86 words
A method of implementing Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing plaintext data in an encrypt memory; loading the fetched context data stored in the registers into an encryption circuit; loading the plaintext data into the encryption circuit; encrypting the plaintext data in the encryption circuit to generate ciphertext data; and storing the ciphertext data in the encrypt memory.
Claim 43
Dependent Claim
51 words
A method as defined in claim 35 , further comprising the step of: padding the plaintext data stored in the encrypt memory to generate padded plaintext data, wherein the plaintext data used in the steps of loading the plaintext data and encrypting the plaintext data includes a padded portion of data.
Claim 44
Dependent Claim
41 words
A method as defined in claim 35 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the ciphertext data stored in the encrypt memory; and storing the initialization vector in a register.
Claim 45
Dependent Claim
41 words
A method as defined in claim 36 , further comprising the steps of: creating an initialization vector (IV) using a predetermined number of bytes of the ciphertext data stored in the encrypt memory; and storing the initialization vector in a register.
Claim 46
Dependent Claim
41 words
A method as defined in claim 37 , wherein the ciphertext data stored in the encrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the ciphertext data.
Claim 47
Dependent Claim
41 words
A method as defined in claim 38 , wherein the ciphertext data stored in the encrypt memory includes a last portion having eight bytes, and wherein the initialization vector includes the eight bytes of the last portion of the ciphertext data.
Claim 48
Independent Claim
86 words
A method of implementing Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing ciphertext data in a hash memory; loading the fetched context data stored in the registers into a hash circuit; loading the ciphertext data into the hash circuit; hashing the ciphertext data in the hash circuit to generate a hash digest; and storing the hash digest in a register.
Claim 49
Independent Claim
86 words
A method of implementing Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing ciphertext data in a hash memory; loading the fetched context data stored in the registers into a hash circuit; loading the ciphertext data into the hash circuit; hashing the ciphertext data in the hash circuit to generate a hash digest; and storing the hash digest in a register.
Claim 50
Independent Claim
86 words
A method of implementing Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing plaintext data in a hash memory; loading the fetched context data stored in the registers into a hash circuit; loading the plaintext data into the hash circuit; hashing the plaintext data in the hash circuit to generate a hash digest; and storing the hash digest in a register.
Claim 51
Independent Claim
86 words
A method of implementing Internet Protocol Security (IPsec) operations within an integrated circuit comprising the steps of: initializing configuration and status registers; fetching context data from memory containing security associations; storing the fetched context data in registers; storing plaintext data in a hash memory; loading the fetched context data stored in the registers into a hash circuit; loading the plaintext data into the hash circuit; hashing the plaintext data in the hash circuit to generate a hash digest; and storing the hash digest in a register.
Claim 52
Dependent Claim
51 words
A method as defined in claim 42 , further comprising the step of: padding the plaintext data stored in the hash memory to generate padded plaintext data, wherein the plaintext data used in the steps of loading the plaintext data and hashing the plaintext data includes a padded portion of data.
References Cited (Backward Citations)
US4987595A
Cited
US5231668A
Cited
US5557346A
Cited
US5721777A
Cited
US5832207A
Cited
US5623545A
Cited
US5631960A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2007-03-16 | 2007-09-15 | 2008-03-16 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2011-03-16 | 2011-09-15 | 2012-03-16 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2015-03-16 | 2015-09-15 | 2016-03-16 | $7700.00 | Window Closed / Lapsed |