Interface device

• US 20030058274A1
• Filed: 03/14/2001
• Published: 03/27/2003
• Est. Priority Date: 11/17/2000
• Status: Abandoned Application

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Hill, Jake, Onion, Peter J.
• Application Number:
  US09/805,376
• Publication Number:
  US 20030058274A1
• Time in Patent Office: Days
• US Class Current: 345/751
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it

Abstract

The present invention relates to an interface device and, in particular an interface device for providing communication security services. The problem of providing communication security services to, for example, a pair of host computers that must communicate over an insecure public network is a widely addressed one. It is known to provide cryptographic functionality to a host computer such that data traffic transmitted by the host computer can be secured. However a major weakness of known methods is that such cryptographic processing is either carried out on the host or such that, following passing the data to be secured to an additional cryptographic accelerator device plugged into the host, the cryptographically processed data is passed back to the host before subsequent transmission. Both such methods give rise to a situation where, in the event of the host operating system being subverted, the original data and the cryptographically processed data are able to be simultaneously gathered on the host, giving rise to the classic “known plaintext” attack on the cryptographic key used in the encryption operation. According to the present invention however, an interface device is provided comprising a first interface for receiving data from a first zone in a first zone data format; means for processing said received data through performance of a cryptographic operation on at least a portion thereof; a second interface for sending said processed data to a second zone in a second zone data format; and means arranged to pass said processed data exclusively from said processing means to said second interface. In this way, in enforcing a unidirectional flow of information through the device and isolating all the necessary functionality (including, for example, the cryptographic key) on the device, the problems of the prior art are advantageously avoided.

Claims

1. An interface device comprising:

a first interface for receiving data from a first zone in a first zone data format;

means for processing said received data through performance of a cryptographic operation on at least a portion thereof;

a second interface for sending said processed data to a second zone in a second zone data format; and

means arranged to pass said processed data exclusively from said processing means to said second interface;

2. An interface device as claimed in claim 1 further comprising:

means arranged to convert said received data in said first zone data format into at least one data format other than said first zone data format prior to said data processing.

3. An interface device as claimed in claim 1 or claim 2 further comprising:

means arranged to transform the data format of said received data from said first zone at least twice prior to said data processing.

4. An interface device as claimed in any preceding claim in which said first zone data format is packetised data, further comprising:

means for reading at least one item of identification data from each packet;

wherein

said processing means is arranged to process each respective packet in dependence on the or each corresponding item of identification data.

5. An interface device as claimed in claim 4 further comprising:

a store for storing one or more rules, each rule being linked with at least one of item of identification data;

wherein

said processing means is arranged to process each packet in dependence upon the rule linked with the corresponding item(s) of identification data.

6. An interface device as claimed in any preceding claim wherein one of the first and second interfaces is suitable for connection to a host such that the data format utilised by such a connected interface is one utilised by the host.

7. An interface device as claimed in claim 6 when depending on claim 5 in which, in response to receiving at least one control packet including at least an item of control identification data and control instructions through the interface not connected to the host and reading said item of control identification data from a control packet, said processing means is arranged to change said rules in said store in dependence upon said corresponding control instructions.

8. An interface device comprising:

a first interface for receiving data from a first authorised party in a first data format;

means for processing said received data through performance of a computational operation on at least a portion thereof;

a second interface for sending said processed data to a second authorised party in a second data format;

means arranged to pass said processed data exclusively from said processing means to said second interface;

wherein said operation performed by said processing means is such that if said sent processed data is intercepted by an unauthorised party, the recovery of said received data from said processed data is computationally unfeasible.

9. A method of operating an interface device comprising:

receiving data at a first interface from a first zone in a first zone data format;

processing said received data through performance of a cryptographic operation on at least a portion thereof;

passing said processed data exclusively from said processing means to a second interface; and

sending said processed data from said second interface to a second zone in a second zone data format.

10. A method of operating an interface device as claimed in claim 9 further comprising:

converting said received data in said first zone data format into at least one further data format prior to said processing.

11. A method of operating an interface device as claimed in claim 9 or claim 10 further comprising transforming the data format of said received data from said first zone at least twice prior to said processing.

12. A method of operating an interface device comprising:

receiving data at a first interface from a first authorised party in a first data format;

processing said received data through performance of a computational operation on at least a portion thereof;

passing said processed data exclusively to a second interface;

sending said processed data from said second interface to a second authorised party in a second data format;

wherein said performance of said computational operation is such that if said sent processed data is intercepted by an unauthorised party, the recovery of said received data from said processed data is computationally unfeasible.