Itt Manufacturing Enterprises, Inc.

Exelis Inc.

Secturion Systems, Inc.

Harris Corporation

Corrent Corporation

Lee Noehring

Chad W Mercer

Richard J Takahashi

Steve J Brown

Jordan Anderson

Sean Little

Kevin J Osugi

Nhu-Ha Yup

Michael Dean Collins

David K Cassetti

Gregg Lahti

Satish N Anand

David Allan Schollmeyer

Darren L Parker

Bryan Doi

Michael Privett

Darren Parker

Systems and methods to securely send or write data to a cloud storage or server. In one embodiment, a method includes: establishing a connection to a client using a client-side transport protocol; receiving, over the connection, data from the first client; decrypting, using a client session key, the received data to provide first decrypted data; encrypting the first decrypted data using a stored payload key (that is associated with the client) to provide first encrypted data; encrypting, using a cloud session key, the first encrypted data using a remote-side transport protocol to provide second encrypted data; and sending the second encrypted data to the cloud storage or server.

Cloud storage using encryption gateway with certificate authority identification

Systems and methods to send or write data or file objects to a remote cloud storage or data server using an encryption gateway. In one embodiment, a communication system includes: an encryption gateway configured to receive TLS (or an equivalent security) encrypted data in a payload from a client application, to terminate the client TLS connection, and to extract the payload and encrypt the payload data with keys from the key manager. The encryption gateway establishes a TLS connection and inserts the encrypted-authenticated data into the TLS payload and sends or writes the TLS encrypted data to a remote cloud storage or data server for storage. The system further includes a key manager configured to provide at least one key to the encryption gateway for encryption of the data in the payload.

Client(s) to cloud or remote server secure data or file object encryption gateway

Methods and systems are provided for a programmable parallel computation and data manipulation accelerator that may be used, for example, in cryptographic calculations. They allow acceleration of a broad variety of cryptographic algorithms and/or portions of algorithms, and are not algorithm specific. This system comprises a butterfly and inverse butterfly multiplexing permuter network and a lookup table. This system may allow replication of input registers, 'expansion,' so that an individual bit may be used in multiple calculations in parallel, accelerating completion of the cryptographic algorithm. The system may allow 'diffusion' of the expanded bits through the system's butterfly and inverse butterfly network, and may provide for &#x201c;confusion&#x201d; of the resulting bits through the system's lookup table. In some implementations, the system may allow completion of a computation within an algorithm within one clock cycle.

Method and system for a programmable parallel computation and data manipulation accelerator

A combination firmware and hardware cryptographic core architecture is provided for encrypting, decrypting and authenticating data. The core provides flexibility to change and add new cryptographic protocols, while providing increased performance by loading new firmware into a microcontroller that programs behavior of various components in the core. The core combines a microcontroller programmable by firmware, and flexible aligner, insertion and removal controllers programmed by the microcontroller that process, manage and manipulate an incoming data stream as it moves through the core. The firmware may be reprogrammed upon an enhancement or change to a protocol while still realizing performance benefits of the hardware. Reprogramming the microcontroller allows it to change the way the aligner, insertion and removal controllers manipulate the data stream as it enters various components. Such systems provide redesign time savings compared to hardware cryptographic core architectures, and improved speed and throughput compared to software cryptographic core architectures.

Method and system for cryptographic processing core

A firmware cipher component is provided which can be configured and programmed to efficiently implement a broad range of cryptographic ciphers while accelerating their processing. This firmware cipher component allows an ASIC to support multiple cipher algorithms while accelerating the operations beyond speeds conventionally achieved by software or firmware only solutions. This system combines cryptographic specific custom instructions with hardware based data manipulation accelerators. The cryptographic specific custom instructions and hardware accelerators may support both block and stream ciphers. Thus, the system may be reconfigured, allowing the cipher algorithm to change without halting the system. Further, embedding the Firmware Programmable Cipher within an ASIC may allow future capabilities to be supported in secure applications.

Method and system for embedded high performance reconfigurable firmware cipher

An apparatus and method for updating security association database entries in a system having multiple security channels by selectively granting access to the entries by a plurality of the multiple security channels that may need to update the same entry using a first-come, first-served scheme. The apparatus includes a controller circuit that functions to carry out the method which, for each of the multiple security channels, includes determining whether another of the security channels has a higher priority to access a particular security association database entry. If no other channel has a higher priority, then the channel requesting access to the entry retrieves it from its address location, modifies it, and writes the modified entry back to its address location. The controller prevents other channels from simultaneously, or substantially simultaneously, retrieving and modifying the same entry.

Apparatus and method for resolving security association database update coherency in high-speed systems having multiple security channels

A system and method for controlling a flow of data from a network interface controller (NIC) to a host processor coupled to the NIC. Data such as IP packets are received by the NIC and may be transmitted to the host processor for further processing such as firewall processing. The NIC is in communication with the host processor using, for example, a software driver running on the host processor. The NIC may monitor the processing load on the host processor as it handles packet data received from the NIC. As the processing load increases, the NIC may begin to throttle the quantity of packets being sent to the host processor in order to avoid overloading the host processor. The throttling may be governed by a heuristic throttling function.

System and method for controlling a flow of data a network interface controller to a host processor

A method for establishing a secure communication channel for information flow between two or more computers communicating via an interconnected computer network, and a system for implementing the method, in response to receiving a security association data structure from one of the computers. The received security association data structure is stored in a memory region having a specific memory address value, and the specific memory address value is assigned as the security parameter index value associated with the received inbound security association data structure. Additionally, a method of processing information received over a previously established secure communication channel, and a system for implementing the method, in response to receiving a data packet that includes an encrypted data portion, and a header portion that includes a security parameter index value. A memory region is located using the security parameter index value as an address pointer. The encrypted data portion of the received data packet is then processed based on a security association data structure stored in the located memory region.

Method for establishing a security association between two or more computers communicating via an interconnected computer network

A system for processing a data packet to determine if a replay condition exists for the data packet, wherein the data packet comprises a sequence number for comparison to a highest sequence number. The processing system includes a mask register to store a mask value, wherein the mask value provides an indication of prior receipt by the system of a plurality of data packets, and a shifter comprising an input coupled to receive the mask value from the mask register, wherein the shifter is operable to shift a binary value by a number of bit positions, the number determined by a difference between the sequence number and the highest sequence number.

System and method for anti-replay processing of a data packet

A packet processing system is embodied on an ASIC is optimized for processing IPSec security protocol packets in a hardware configuration. Embedded RISC processors operate with hardware support modules providing for IPSec packet processing at OC24 data rates and greater. IPSec packets are received through a streaming interface and buffered in an external memory. When the entire packet is in external memory, portions are buffered in a local memory for crypto-processing. As portions of the packets complete processing, the portions are buffered to an output portion of the external memory associated with the channel. When an entire packet competes processing, portions are buffered to a local memory for streaming. The hardware accordingly reduces the involvement of the RISC processors and significantly increases channel throughput providing for high-speed IPSec packet processing.

Growing community of inventors

Peoria, AZ, United States of America

Lee Noehring