Distributed information system having automatic invocation of key management negotiations protocol and method

• US 5,010,572 A
• Filed: 04/27/1990
• Issued: 04/23/1991
• Est. Priority Date: 04/27/1990
• Status: Expired due to Fees

• Current Assignee: Apani Networks
• Original Assignee: Hughes Aircraft Company (Rtx Corporation)
• Inventors: Zmuda, James E., Bathrick, Erwin W.
• Primary Examiner(s): Tarcza, Thomas H.
• Assistant Examiner(s): SWANN, TOD R
• Application Number:
  US07/515,819
• Time in Patent Office: 361 Days
• Field of Search: 380/21, 380/23, 380/24, 380/25, 380/43, 380/44, 380/45, 380/46, 380/47, 364/246.7, 364/252.3, 364/246.9, 364/252.4, 364/918.7, 364/958.1, 364/958.2, 364/969, 364/969.1
• US Class Current: 713/162
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061

Abstract

The invention is an improved distributed information system which automatically provides for the transmission of security protocol data units between end-users of a distributed information system. The invention compares the address and security key of a received security protocol data unit to stored end-system addresses and security key information and, in the absence of an existing end-system address and security key, automatically initiates negotiation of a security key between end-systems and then confirms the negotiated security key and initiates a security protocol transmission of the data unit. A method af automatic invoking secure communications between end-systems of a distributed information system is also disclosed.

Claims

1. In a distributed information system which includes a plurality of end-systems each of which includes data unit transmitting and receiving means having a security protocol and a corresponding security protocol key from one end-system to another end-system, the improvement comprising:

secure address storage means for storing a set of end-system addresses and corresponding end-system security protocol keys;

protocol address storage means for storing a set of end-system addresses requiring security protocol data transfers;

data unit receiver means for receiving a data unit and for generating a data unit transfer request signal which includes an end-system address and data unit security protocol;

intermediate storage means for storing a received data unit in response of a data transfer request signal and outputting the stored data unit to the end-system transmitting and receiving means in response to a transfer enable signal;

automatic key management processor means responsive to the data unit transfer request signal for comparing the received data unit security key and end-system address to the set of end system address and security protocol keys, and for generating the transfer enable signal in response to a match therebetween, and in the absence of a match therebetween, comparing the received data unit address to the end-system addresses from the protocol address storage means and generating a security key protocol request signal in response to a match therebetween, and for generating the transfer enable signal in response to the absence of a match between the data unit address and an address in the set of addresses stored in the protocol address storage means;

security key negotiating means responsive to the security key protocol request signal for negotiating a security key with another end-system and for generating a security key negotiation confirm signal upon completion of a negotiation;

means responsive to the security key negotiation confirm signal for storing the security key for the another end-system in the one system secure address store storage means;

and wherein each end-system is responsive to the security key negotiation confirm signal and is adapted to generate the transfer enable signal, and wherein the end-system data unit transmitting and receiving means are responsive to the transfer enable signal and are adapted to transfer the data unit corresponding to the security protocol of the received data unit, and wherein the security key negotiation comprises a fully encrypted negotiation exchange.

2. The system of claim 1 wherein the transmitting and receiving means include means for performing security protocol data transfer.

3. The system of claim 2 wherein the automatic key negotiation means further includes means for disposing of data unit in response to the absence of the security key protocol confirm signal.

4. A method of automatic invoking secure communications between end-systems of a distributed information system, said method comprising the steps of;

(a) storing a set of end-system addresses and corresponding security keys and security protocol specifications;

(b) storing a set of end-system addresses that includes the addresses of all end-systems requiring security protocols for a secure data transfer;

(c) generating a data that includes an end-system address and security protocol specification, and generating a data transfer request signal in response thereto;

(d) comparing the generated end-system address and protocol specification to the set of end-system addresses and protocol specifications in response to the data transfer signal, and generating a transmit enable signal in response to a match therebetween;

(e) comparing the data unit specification to the set of end-system addresses requiring a security protocol;

(f) generating an automatic invocation of key management request signal in response to the absence of a match between the data unit specification to the set of end-system addresses requiring a security protocol;

(g) performing an encrypted security key negotiation between the end-systems in response to the invocation of the key management request signal and generating a security key confirm signal in response to completion thereof;

(h) generating a transfer enable signal a response to the security key confirm signal;

(i) performing a security protocol data transfer in accordance with the appropriate security protocol specification in response to the transfer enable signal;

(j) generating the transfer enable signal in the absence of a match between the data unit address and an end-system address for which a security protocol is required;

(k) storing a negotiated security key in the set of stored end-system addresses and corresponding security keys and protocol specifications in response to the security key negotiation confirm signal; and

(l) storing a received data unit in an intermediate storage means during the performance of steps (b) through (g).