Method, apparatus and device for enciphering messages transmitted between interconnected networks

• US 5,583,940 A
• Filed: 09/23/1994
• Issued: 12/10/1996
• Est. Priority Date: 01/28/1992
• Status: Expired due to Fees

• Current Assignee: Electricitã© De France
• Original Assignee: Electricitã© De France
• Inventors: Herodin, Jean-Marc, Dherbecourt, Yves M. J., Vidrascu, Andrei
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/256,509
• Time in Patent Office: 809 Days
• Field of Search: 380/23, 380/25, 380/49, 380/9, 380/28, 380/29, 380/50, 380/59, 340/825.31, 340/825.34, 235/380, 235/382
• US Class Current: 713/151
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method of enciphering messages transmitted between at least two networks (2, 17) interconnected via at least one highway (8), the interconnected networks (2, 17) using the Internet protocol (IP, as network layer protocol and the TCP or UDP protocol, as transport layer protocol, the highway (8) using a specified network layer protocol, each message comprising a plurality of headers (73-76), including an IP header (75) and a TCP or UDP header (76, 80, 81), and data (77). The specified network layer protocol of the highway is the Internet protocol (IP). For each of the messages, at least a part (82, 83, 84, 85) of the TCP or UDP header (76, 80, 81) is enciphered at the same time as the data (77) and the IP header (75) is plain (non enciphered) to enable the transmission of the message by the highway according to the Internet protocol (IP).

Claims

1. A method for enciphering messages transmitted via at least one highway interconnecting at least two networks using an Internet protocol as a network layer protocol and one of a TCP or UDP protocol as a transport layer protocol and the highway using the Internet protocol as a network layer protocol to transmit the messages having a plurality of headers including an Internet header and one of a TCP or a UDP header and data comprising:

transmitting the messages via the highway with at least a part of one of the TCP or UDP header and the data being enciphered at the same time; and

transmitting the Internet header with the messages without enciphering on the highway.

2. A method according to claim 1 wherein:

enciphering the part of one of the TCP or UDP header and the data with a Data Encryption Standard with the part of one of the TCP or UDP header and the data comprising a string of bits having a length divisible by 64.

3. A method according to claim 2 wherein:

the Data Encryption Standard is used in a CBC mode with an initial vector required by the CBC mode modified as a function of time in order to avoid unauthorized replay.

4. A method according to claim 1 wherein:

the part of one of the TCP or UDP header comprises a checksum field of the TCP or UDP header.

5. A method of processing messages transmitted between first and second items of equipment contained respectively in interconnected first and second networks, each of the first and second networks including at least one sending equipment and one receiving equipment authorized to send and receive respectively messages enciphered by the method for enciphering according to claim 1 wherein each message is processed with the following steps:

verifying a presence of a first memory card to authenticate a first operator of the first item of equipment;

determining what protocol is being used between the first and second items of equipment, and if the protocol used is Internet network layer protocol searching for a first key associated with the sending equipment of the first item of equipment and for a second key associated with the receiving equipment of the second item equipment;

if the first and second keys exist, enciphering a message to be sent with the first key to obtain an enciphered message, and transmitting the enciphered message by the sending equipment of the first item of equipment and otherwise rejecting the message to be sent;

verifying a presence of a second memory card to authenticate a second operator of the second item of equipment; and

if the first and second keys exist, deciphering a received message with the second key and otherwise rejecting a received message.

6. An application of the method according to claim 1 further comprising:

protecting access to servers of computer network with the method for enciphering messages.

7. An interface apparatus connected between a highway and one of a network or an item of equipment, the highway using a specified network layer protocol, and permitting a transmission of messages via the highway between one of the network or the item of equipment to which the interface apparatus is connected and another one of the network or the item of equipment to which another interface apparatus is connected, each of the messages containing a plurality of headers including an Internet header and one of a TCP or UDP header and data comprising:

means for reading a memory card;

means for enciphering, for each of the messages, the data and at least a part of one of the TCP or UDP header to obtain enciphered data and an enciphered part of one of the TCP or UDP header and with the Internet header not being enciphered;

means for transferring an enciphered message comprising the Internet header, the enciphered data and the enciphered part of one of the TCP or UDP header, for routing of the enciphered message via the highway; and

means for identifying one of the networks or items of equipment associated with the interface apparatus.

8. An interface apparatus according to claim 7 further comprising:

means for deciphering received enciphered messages.

9. An interface apparatus according to claim 7 further comprising:

an item of equipment of a station or a server type associated with the interface apparatus via one of direct connection or a protected network.

10. An interface apparatus according to claim 7 further comprising:

means for authorizing or prohibiting an association between the interface apparatus and one of the network or item of equipment.

11. An interface apparatus according to claim 7 further comprising:

an item of equipment of the server type associated with the interface apparatus.

12. An application of the interface apparatus according to claim 7 further comprising:

a communication network coupled to the interface apparatus using a protocol of the Internet.