Encryption using destination addresses in a TDMA satellite communications network

• US 4,418,425 A
• Filed: 08/31/1981
• Issued: 11/29/1983
• Est. Priority Date: 08/31/1981
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Fennel, John W. Jr., Heinz, Miles T. Jr.
• Primary Examiner(s): Cangialosi, Sal
• Application Number:
  US06/297,607
• Time in Patent Office: 820 Days
• Field of Search: 370/104, 375/2.1, 375/2.2, 455/26-30, 455/12, 178/22.15, 178/22.17
• US Class Current: 380/33
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner

Abstract

An encryption system is disclosed which is based on channel destination addresses for a time division multiple access (TDMA) satellite communications network. A superframe initialization vector is transmitted from a master station to all other stations in the network. A plurality of frame initialization vectors is sequentially generated at each station in an encryption engine, from the superframe initialization vector, using a key which is common only to authorized users within the network. Each data channel is initialized with encryption bits produced by exclusive ORing the channel destination address and the frame initialization vector for the frame in which that channel is to be transmitted, and then passing the output of the exclusive OR through the encryption engine using either the same key or a second, different key. These encryption bits are combined with the channel data in an exclusive OR circuit for TDMA transmission via the satellite transponder to the receiving stations. The decryption process at the receiving stations parallels the encryption process at the transmitting stations, so that clear-text data is output only at the destination addressed where the intended recipient has the same key as the transmitter. The system enables the synchronization of encryption engines at separate, geographically remote stations and permits the decryption of encrypted channels at anytime within a TDMA frame.

Claims

1. In a TDMA satellite communications network having a master station and a plurality of subsidiary earth stations, each communicating through a satellite transponder in a plurality of TDMA frames grouped into superframes, each said station including a TDMA communications controller having a plurality of input/output ports for transferring channels of data from respective, local data users to a TDMA output to said satellite transponder and transferring said channels of data via a TDMA input from said satellite transponder to said respective local users on a time interleaved basis during periodic TDMA frames, an encryption/decryption system for said network, comprising:

a superframe initialization vector generator in said master station, having an output connected to said TDMA output thereof, for transmitting a superframe synchronization vector once during each superframe;

a first encryption engine in each of said stations, having an input connected to said TDMA input thereof, for receiving said superframe synchronization vector and encrypting it with a key, forming a first frame initialization vector prior to a first transmit frame of a transmit superframe, to be used for said first transmit frame;

a frame initialization vector buffer in each of said stations, having an input connected to said first encryption engine, for storing frame initialization vectors output therefrom;

a transmit address array buffer in each of said stations, for storing a plurality of destination addresses, each respectively corresponding to each of said plurality of channels of data to be transmitted;

a first exclusive-OR circuit in each of said stations, having a first input connected to said frame initialization vector buffer and a second input connected to said transmit address array buffer, and an output connected to said input of said first encryption engine, for generating a plurality of channel units of exclusive-OR bits from said first initialization vector and said plurality of destination addresses, each said channel unit corresponding to each of said channels of data to be transmitted;

said first encryption engine receiving each of said plurality of channel units of exclusive-OR bits and encrypting it with a key, forming a corresponding plurality of channel units of encryption bits;

a transmit crypto bit buffer in each of said stations, having an alternate A/B storage cycle, with an input connected to said output of said first encryption engine, and an output, for storing said plurality of channel units of encryption bits on a first side during the transmit frame immediately preceding said first transmit frame;

a second exclusive-OR circuit in each of said stations, having a first input connected to the output of said transmit crypto bit buffer and an output connected to said TDMA output;

a transmit burst buffer in each of said stations having an alternate A/B storage cycle, with a data input connected to a transmit bus common to the data outputs of all of said ports and an output connected to a second input of said second exclusive-OR circuit, for storing, in clear-text form, said plurality of channels of data on a first side during said transmit frame immediately preceding said first transmit frame;

said transmit burst buffer bursting said plurality of clear-text data channels from said first side thereof during said first transmit frame, to said second input of said second exclusive-OR circuit synchronously with said transmit crypto bit buffer bursting said plurality of channel units of encryption bits from said first side thereof to said first input of said second exclusive-OR circuit;

said second exclusive-OR circuit outputting to said TDMA output a resultant plurality of encrypted data channels, each of which is transmitted to said satellite transponder with a corresponding destination address.

2. The encryption/decryption system of claim 1, which further comprises:

said first encryption engine directly encrypting said first frame initialization vector with a key, forming a second frame initialization vector during said first transmit frame, to be used for an immediately succeeding second transmit frame;

said first exclusive-OR circuit generating a second plurality of channel units of exclusive OR bits during said first transmit frame, from said second frame initialization vector and said plurality of destination addresses;

said first encryption engine encrypting said second plurality of channel units of exclusive OR bits with a key, forming a second plurality of channel units of encryption bits during said first transmit frame;

said transmit crypto bit buffer storing said second plurality of channel units of encryption bits on a second side thereof during said first transmit frame;

said transmit burst buffer storing a second plurality of channels of data on a second side thereof during said first transmit frame;

said transmit burst buffer bursting said second plurality of data channels from said second side thereof to said second exclusive-OR circuit during a second transmit frame which immediately succeeds said first transmit frame synchronously with said transmit crypto bit buffer bursting said second plurality of channel units of encryption bits from said second side thereof to said second exclusive-OR circuit;

said second exclusive-OR circuit outputting to said TDMA output a resultant second plurality of encrypted data channels, each of which is transmitted to said satellite transponder with a corresponding destination address.

3. The encryption/decryption system of claim 2, which further comprises:

said first encryption engine directly encrypting an n^th frame initialization vector with a key, forming an n+1^th frame initialization vector during an n^th transmit frame, to be used for an immediately succeeding n+1^th transmit frame;

said first exclusive-OR circuit generating an n+1^th plurality of channel units of exclusive OR bits during said n^th transmit frame, from said n+1^th frame initialization vector and said plurality of destination addresses;

said first encryption engine encrypting said n+1^th plurality of channel units of exclusive OR bits with a key, forming an n+1^th plurality of channel units of encryption bits during said n^th transmit frame;

said transmit crypto bit buffer storing said n+1^th plurality of channel units of encryption bits on one of said sides thereof during said n^th transmit frame;

said transmit burst buffer storing an n+1^th plurality of channels of data on a corresponding one of said sides thereof during said n^th transmit frame;

said transmit burst buffer bursting said n+1^th plurality of data channels from said one side thereof to said second exclusive-OR circuit during said n+1^th transmit frame which immediately succeeds said n^th transmit frame synchronously with said transmit crypto bit buffer bursting said n+1^th plurality of channel units of encryption bits from said corresponding one side thereof to said second exclusive-OR circuit;

said second exclusive-OR circuit outputting to said TDMA output a resultant n+1^th plurality of encrypted data channels, each of which is transmitted to said satellite transponder with a corresponding destination address.

4. The encryption/decryption system of claim 1, which further comprises:

a second encryption engine in each of said stations, having an input connected to said TDMA input thereof, for receiving said superframe synchronization vector and encrypting it with a key, forming said first frame initialization vector prior to a first receive frame of a receive superframe, to be used for said first receive frame;

a receive frame initialization vector buffer in each of said stations, having an input connected to said second encryption engine, for storing frame initialization vectors output therefrom;

a receive address array buffer in each of said stations, for storing a plurality of receive destination addresses, each respectively corresponding to each of a plurality of channels of data to be received from said satellite transponder;

a third exclusive-OR circuit in each of said stations, having a first input connected to said receive frame initialization vector buffer and a second input connected to said receive address array buffer, and an output connected to said input of said second encryption engine, for generating a plurality of receive channel units of exclusive OR bits from said first frame initialization vector and said plurality of receive destination addresses, each said receive channel unit corresponding to each of said channels of data to be received from said satellite transponder;

said second encryption engine receiving each of said plurality of receive channel units of exclusive OR bits and encrypting it with a key, forming a corresponding plurality of receive channel units of encryption bits;

a receive crypto bit buffer in each of said stations, having an alternate A/B storage cycle, with an input connected to said output of said second encryption engine, and an output, for storing said plurality of receive channel units of encryption bits on a first side at locations specified by said corresponding destination address, during the receive frame immediately preceding said first receive frame;

a fourth exclusive-OR circuit in each of said stations, having a first input connected to the output of said receive crypto bit buffer and an output connected to a receive bus common to the data inputs of all of said ports;

a receive burst buffer in each of said stations having an alternate A/B storage cycle, with a data input connected to said TDMA input and an output connected to a second input of said fourth exclusive-OR circuit, for storing said resultant plurality of encrypted data channels received from said satellite transponder, on a first side thereof at locations specified by said corresponding destination address, during the receive frame immediately preceding said first receive frame;

said receive burst buffer outputting said resultant plurality of encrypted data channels from said first side thereof during said first receive frame, to said second input of said fourth exclusive-OR circuit synchronously with said receive crypto bit buffer outputting said plurality of receive channel units of encryption bits from said first side thereof to said first input of said fourth exclusive-OR circuit;

said fourth exclusive-OR circuit outputting to said receive bus, said plurality of clear-text channels of data during said first receive frame.

5. The encryption/decryption system of claim 4, which further comprises:

said second encryption engine directly encrypting said first frame initialization vector with a key, forming a second frame initialization vector during said first receive frame, to be used for an immediately succeeding second receive frame;

said third exclusive-OR circuit generating a second plurality of receive channel units of exclusive OR bits during said first receive frame, from said second frame initialization vector and said plurality of receive destination addresses;

said second encryption engine encrypting said second plurality of receive channel units of exclusive OR bits with a key, forming a second plurality of receive channel units of encryption bits during said first receive frame;

said receive crypto bit buffer storing said second plurality of receive channel units of encryption bits on a second side thereof during said first receive frame;

said receive burst buffer storing a second resultant plurality of encrypted data channels on a second side thereof during said first receive frame;

said receive burst buffer outputting said second resultant plurality of encrypted data channels from said second side thereof to said fourth exclusive-OR circuit during a second receive frame which immediately succeeds said first receive frame synchronously with said receive crypto bit buffer outputting said second plurality of receive channel units of encryption bits from said second side thereof to said fourth exclusive-OR circuit;

said fourth exclusive-OR circuit outputting to said receive bus a second plurality of clear-text channels of data during each second receive frame.

6. The encryption/decryption system of claim 5, which further comprises:

said second encryption engine directly encrypting said n^th frame initialization vector with a key, forming an n+1^th frame initialization vector during an n^th receive frame, to be used for an immediately succeeding n+1^th receive frame;

said third exclusive-OR circuit generating an n+1^th plurality of receive channel units of exclusive OR bits during said n^th receive frame, from said n+1^th frame initialization vector and said plurality of receive destination addresses;

said second encryption engine encrypting said n+1^th plurality of receive channel units of exclusive OR bits with a key, forming an n+1^th plurality of receive channel units of encryption bits during said n^th receive frame;

said receive crypto bit buffer storing said n+1^th plurality of receive channel units of encryption bits on one of said sides thereof during said n^th receive frame;

said receive burst buffer storing an n+1^th resultant plurality of encrypted data channels on a corresponding one of said sides thereof during said n^th receive frame;

said receive burst buffer outputting said n+1^th resultant plurality of encrypted data channels from said one side thereof to said fourth exclusive-OR circuit during said n+1^th receive frame which immediately succeeds said n^th receive frame synchronously with said receive crypto bit buffer outputting said n+1^th plurality of receive channel units of encryption bits from said corresponding one side thereof to said fourth exclusive-OR circuit;

said fourth exclusive-OR circuit outputting to said receive bus an n+1^th plurality of clear-text channels of data during said n+1^th receive frame.