Computer network encryption/decryption device

• US 5,640,456 A
• Filed: 07/10/1995
• Issued: 06/17/1997
• Est. Priority Date: 03/09/1993
• Status: Expired due to Term

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Uunet Technologies, Inc. (Verizon Communications Inc.)
• Inventors: Adams, Jr., Richard L., Hallenbeck, Peter D.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/500,071
• Time in Patent Office: 708 Days
• Field of Search: 380/9, 380/23, 380/25, 380/49, 380/50, 380/4, 380/10, 380/28, 380/29, 380/30
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A computer network encryption/decryption device includes at least one microprocessor, microprocessor support hardware, at least two network ports for connecting to upstream and downstream networks, memory hardware for storing program, configuration, and keylist data, and data encryption/decryption hardware. Both network ports have the same network address, making the device transparent to the local area network in which it is spliced. The device operates by selectively encrypting or decrypting only the data portion of a data packet, leaving the routing information contained in the header and trailer portions of the data packet unchanged.

Claims

1. A method for encrypting a first packet transmitted from a first computer network to a second computer network, wherein said first packet includes a header field containing information about the first packet and a data field containing data, said method comprising the steps of:

receiving said first packet from said first network;

extracting said information about the first packet from said header field of said first packet;

comparing said information about the first packet with matching criteria including a list of source addresses, a list of destination addresses, and key information, to determine if said first packet is to be encrypted; and

encrypting said first packet if said first packet is to be encrypted.

2. The method of claim 1 further including the step of:

transmitting a second packet to said second network if said first packet has been encrypted, said second packet comprising a second header field containing information about the second packet, and a second data field containing said encrypted first packet.

3. The method of claim 1 further including the step of:

transmitting said first packet to said second network if said first packet has not been encrypted.

4. A method for decrypting the data field of a second packet transmitted from a second computer network to a first computer network, wherein said second packet includes a header field containing information about the second packet and a data field containing data, said method comprising the steps of:

receiving said second packet from said second network;

extracting said information about the second packet from said header field of said second packet;

comparing said information about the second packet with matching criteria including a list of source addresses, destination addresses and key information, to determine if said data field of said second packets is to be decrypted; and

decrypting said data field of said second packet if said second packet is to be decrypted.

5. The method of claim 4 further including the step of:

transmitting a first packet to said first network if said data field of said second packet has been decrypted, said first packet comprising said decrypted data field of said second packet.

6. The method of claim 4 further including the step of:

transmitting said second packet to said first network if said data field of said second packet has not been decrypted.