Digital Equipment Corporation

Amar Gupta

William R Hawe

Charles W Kaufman

Butler W Lampson

Mark F Kempf

Barry A Spinney

Joseph J Tardo

Morrie Gasser

G Paul Koning

Gregory M Waters

B J Herbison

Ching S Lee

A technique to facilitate decryption processing of information packets transmitted over a communication network after encryption in accordance with a specific network protocol, the details of which may be subject to later change as standards are developed or modified. Programmable registers are used in the decryption process to hold information for identifying an incoming information packet as being subject to the specific protocol and requiring decryption, and identifying a starting location of a data field to be decrypted. Specifically one programmable register contains a first offset locating an identifier field in the packet, in which a cryptographic identifier will be found if the packet is one conforming to the protocol; another programmable register contains a cryptographic identifier value that will be found in the identifier field if decryption is to be performed, and a third programmable register contains a second offset to locate the beginning of a data field to be decrypted.

Method and apparatus for end-to-end encryption of a data packet in a

A decryption method, and associated cryptographic processor, for performing in-line decryption of information frames received from a communication network through a first in-line processing stage. As an information packet is streamed into the cryptographic processor, a determination is made to an acceptable level of probability whether the packet contains data that should be decrypted. The decision whether or not decrypt is made by analyzing the incoming packet header, recognizing a limited number of packet formats, and further parsing the packet to locate any encrypted data and to make sure that the packet is not a segment of a larger message. Falsely decrypted packets are looped back through the cryptographic processor, to regenerate the data that was falsely decrypted. Decryption and encryption are performed in such a manner that a false decryption is completely reversible without loss of data. Special treatment is provided for packets containing data that cannot be divided into an integral number of standard blocks required for decryption processing.

Probabilistic cryptographic processing method

Cryptographic apparatus, and a related method for its operation, for in-line encryption and decryption of data packets transmitted in a communication network. A full-duplex cryptographic processor is positioned between two in-line processing entities of a network architecture. For example, in a fiber distributed data interface (FDDI) network, the processor is positioned between a media access control (MAC) sublayer and a ring memory controller (RMC). Incoming information packets are analyzed to decide whether or not they contain encrypted data and, if they do, are subject to decryption before forwarding. Outbound information packets have their data portions encrypted if called for, and are usually forwarded toward the network communication medium. Cryptographic processing in both directions is performed in real time as each packet is streamed through the processor. The processing of outbound information packets includes using optional data paths for looping of the processed information back in a reverse direction, to permit the host system to perform local encryption or decryption for various purposes.

Pipelined cryptography processor and method for its use in communication

A method and corresponding apparatus for encoding and decoding additional status bits into an existing frame status byte transmitted as part of a packet of information in a communication network. The described scheme provides for the encoding and decoding of two additional status bits, without having to modify the packet format. In the disclosed embodiment of the invention, the additional status bits are used to convey information to a node processor concerning decryption processing of a received information packets.

Frame status encoding for communication networks

A method for selective disclosure of the identity of a communication protocol under which an information packet originated, but without incorrectly identifying the protocol in a header accompanying the packet. If there is a need to conceal the identity of the underlying source protocol, a special anonymous protocol identifier is used, instead of the real protocol identifier, in the header of an encrypted information packet. Network monitors can then still provide accurate information concerning traffic on the network, without having this information distorted by the use of incorrect communication protocols. If there is a desire to reveal the underlying protocol, a subnetwork protocol frame format is used to store the protocol identity and signify whether the packet is encrypted. A packet that is of a non-subnetwork protocol can be encapsulated with a subnetwork header containing a special code signifying that there is an encapsulated packet and containing the original protocol identifier.

Encryption with selective disclosure of protocol identifiers

A method and related cryptographic processing apparatus for handling information packets that are to be cryptographically processed prior to transmission onto a communication network, or that are to be locally cryptographically processed and looped back to a node processor. A special cryptographic preamble is included in each information packet that is to be subject to cryptographic processing. The cryptographic preamble contains an offset value pointing to the starting location of information that is to be processed, and completely defines the type of cryptographic processing to be performed. The cryptographic processor can then perform the processing as specified in the preamble without regard to a specific protocol. If the packet is to be transmitted onto the network, the preamble is stripped from the packet after cryptographic processing, so that the formats of packets transmitted onto the network will be unaffected by the preamble. Cryptographic processing modes include encryption of data for outbound transmission, encryption of a cipher key for loopback to the node processor, encryption or decryption of data for loopback to the node processor, and computation of an integrity check value for loopback to the node processor.

Growing community of inventors

Northboro, MA, United States of America

Amar Gupta