Digital Equipment Corporation

B J Herbison

Charles W Kaufman

Paul Ashley Karger

Bruce Eric Mann

Arnold Miller

Steve Lipner

Carter Lyman

Butler W Lampson

Morrie Gasser

William R Hawe

Mark F Kempf

Amar Gupta

Joseph J Tardo

A decryption method, and associated cryptographic processor, for performing in-line decryption of information frames received from a communication network through a first in-line processing stage. As an information packet is streamed into the cryptographic processor, a determination is made to an acceptable level of probability whether the packet contains data that should be decrypted. The decision whether or not decrypt is made by analyzing the incoming packet header, recognizing a limited number of packet formats, and further parsing the packet to locate any encrypted data and to make sure that the packet is not a segment of a larger message. Falsely decrypted packets are looped back through the cryptographic processor, to regenerate the data that was falsely decrypted. Decryption and encryption are performed in such a manner that a false decryption is completely reversible without loss of data. Special treatment is provided for packets containing data that cannot be divided into an integral number of standard blocks required for decryption processing.

Probabilistic cryptographic processing method

The nodes in a computer network utilize an encrypted key as a key identifier in a data packets transferred between nodes which eliminates the need for a receiving node to perform a memory look up operation to ascertain the key used to encrypt the data. Each node is provided with a master key that is unique to each node. When two nodes want to establish communications they first negotiate a shared key. This shared key is then encrypted under each nodes' master key. The nodes then exchange their respective encrypted key. The encrypted key of the receiving node is placed in the data packet to be sent by the transmitting node. Upon receiving a data packet, the receiving node decrypts the encrypted key to determine the shared key. This shared key is then used to decrypt encrypted data in the data packet.

Method for utilizing an encrypted key as a key identifier in a data

Apparatus and methods, readily adapted to interface with a standard data transmission network having an unsecure transmission channel, e.g., 'Ethernet,' for the provision of secure transmission of data over the network channel in a manner which is essentially transparent to the standard network devices and users, thereof, are provided. Various encryption keys are generated and utilized within the system to disguise or encrypt information transferrred between network nodes. The encryption keys are made known only to those network devices which are permitted to handle information encrypted with the encryption keys.

Apparatus and method for secure transmission of data over an unsecure

Apparatus and methods, readily adapted to interface with a standard data transmission network having an unsecure transmission channel, e.g., 'Ethernet,' for the provision of secure transmission of data over the network channel in a manner which is essentially transparent to the standard network devices and users thereof, are provided. Various encryption keys are generated and utilized within the system to disguise or encrypt information transferred between network nodes. The encryption keys are made known only to those network devices which are permitted to handle information encrypted with the encryption keys.

Growing community of inventors

Clinton, MA, United States of America

B J Herbison