Apparatus and method for encrypting and decrypting

• US 10,389,523 B2
• Filed: 12/28/2016
• Issued: 08/20/2019
• Est. Priority Date: 01/15/2016
• Status: Active Grant

• Current Assignee: Industry-Academic Cooperation Foundation, Dankook University
• Original Assignee: Industry-Academic Cooperation Foundation Yonsei University
• Inventors: Kim, Joonmo, Choi, Younggeun
• Primary Examiner(s): Parsons, Theodore C
• Assistant Examiner(s): Louie, Howard H.
• Application Number:
  US15/392,033
• Publication Number:
  US 20170250804A1
• Time in Patent Office: 965 Days
• CPC Class Codes: G06F 7/588 Random number generators, i.e. based on natural stochastic processes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

An encryption/decryption device connected to a communications entity includes: a key storage unit configured to store predetermined keys; a processing unit configured to receive a first key among the predetermined keys from the key storage unit and to encrypt data based on the received first key; a data port unit configured to receive data to be encrypted from the communications entity, to transfer the received data to the processing unit, if the data transferred to the processing unit is encrypted by the processing unit based on the first key, to receive the encrypted data from the processing unit, and to transfer the encrypted data received from the processing unit to the communications entity; and a connection unit configured to physically connect the encryption/decryption device with another encryption/decryption device. The predetermined keys are generated when the connection unit is connected to a connection unit included in the another encryption/decryption device.

Claims

1. An encryption/decryption device connected to a communications entity, the device comprising:

a connection unit;

a data port unit configured to communicate with the communications entity;

a key storage unit configured to generate a plurality of predetermined keys when the encryption/decryption device is connected to another encryption/decryption device through the connection unit and store the plurality of predetermined keys, the plurality of predetermined keys being shared with the another encryption/decryption device;

a random number generation unit configured to generate random numbers; and

a processing unit configured to;

receive data from the communications entity through the data port unit,

generate an identifier including a predetermined number of bits,

combine the received data with the identifier, and

encrypt the combined data using a first key selected from among the plurality of predetermined keys,

wherein the encrypted, combined data is transmitted to the communications entity through the data port unit,

wherein values of some of the bits of the identifier are determined based on at least two different keys among the predetermined keys and values of a remainder of the predetermined number of bits of the identifier are determined based on the random numbers generated by the random number generation unit,

wherein the identifier indicates the first key is used for encrypting data among the predetermined keys.

2. The encryption/decryption device according to claim 1, wherein the key storage unit is connected to the processing unit via a key bus but is not connected to the data port unit via the key bus, and wherein the key bus is a path through which the first key is transferred to the processing unit.

3. The encryption/decryption device according to claim 1, wherein the predetermined keys stored in the key storage unit included in the encryption/decryption device have the same values as keys stored in another key storage unit included in the another encryption/decryption device.

4. The encryption/decryption device according to claim 1, further comprising:

a protection unit configured to recognize that an abnormal action is made to the encryption/decryption device, and to delete the predetermined keys stored in the key storage unit upon recognizing that the abnormal action is made.

5. The encryption/decryption device according to claim 1, wherein the predetermined keys are modifiable to new keys.

6. The encryption/decryption device according to claim 5, wherein, the predetermined keys are modifiable to the new keys which are generated based on a predetermined value known to the encryption/decryption device and the another encryption/decryption device.

7. An encryption/decryption method using an encryption/decryption device connected to a communications entity, the method comprising:

generating a plurality of predetermined keys when the encryption/decryption device is physically connected to another encryption/decryption device through a connection unit included in the encryption/decryption device;

storing the plurality of predetermined keys, the plurality of predetermined keys being shared with the another encryption/decryption device;

generating random numbers;

receiving data from the communications entity;

generating an identifier including a predetermined number of bits;

combining the received data with the identifier;

encrypting the combined data using a first key among the plurality of predetermined keys; and

transferring the encrypted, combined data to the communications entity,

wherein values of some of the bits of the identifier are determined based on at least two different keys among the predetermined keys and values of a remainder of the predetermined number of bits of the identifier are determined based on the generated random numbers,

wherein the identifier indicates the first key is used for encrypting data among the predetermined keys.

8. The encryption/decryption method according to claim 7, wherein the predetermined keys stored in the key storage unit included in the encryption/decryption device have the same values as keys stored in another key storage unit included in the another encryption/decryption device.

9. The encryption/decryption method according to claim 7, further comprising:

recognizing that an abnormal action is made to the encryption/decryption device; and

deleting the predetermined keys stored in the key storage unit upon recognizing that the abnormal action is made.

10. The encryption/decryption method according to claim 7, further comprising:

modifying the predetermined keys to a plurality of new keys.

11. The encryption/decryption method according to claim 10, wherein said modifying the predetermined keys to the new keys comprises generating the new keys based on a predetermined value known to both of the encryption/decryption device and the another encryption/decryption device and modifying the predetermined keys to the new keys.