Apparatus and a method for secure communications for network computers

• US 6,922,785 B1
• Filed: 05/11/2000
• Issued: 07/26/2005
• Est. Priority Date: 05/11/2000
• Status: Expired due to Term

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: Gupta, Sanjay, Brewer, James Arthur
• Primary Examiner(s): Rones, Charles
• Assistant Examiner(s): ORTIZ DITREN, BELIX M
• Application Number:
  US09/569,499
• Time in Patent Office: 1,902 Days
• Field of Search: 713/153, 713/192, 713200-202, 713/151, 713/154, 713/176, 713/161, 380/28, 380/21, 380/47, 380 1- 2, 340/825.07, 340/824, 340/824.04, 710/15, 710/52
• US Class Current: 713/153
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 9/0625 with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI
• CPC Class Codes: H04L 9/302 involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes

Abstract

Encryption hardware built on a network interface card is provided by the present invention for encrypting data sent from a computer to a network. A block of data is retrieved from the network interface card, encrypted using encryption hardware, and inserted into a data packet. A flag is set in the packet header to indicate the encryption type. If the data packet is received by a system equipped with similar network interface card, decryption algorithm indicated by the flag is applied to the data using decryption hardware on the network interface card. The decrypted data is sent to re-assembly logic to rebuild the original message for the transmitted packets. The original message is sent to a computer memory via a system bus for further processing. If the data packet is received by a system not equipped with the network interface card, suitable software is provided to decrypt the data packet.

Claims

1. A method in a distributed data processing system for implementing secure network communication, the method comprising the data processing system implemented steps of:

receiving a block of data from a segmentation logic on a network interface card;

encrypting the block of data using encryption hardware built on the network interface card;

putting the encrypted data into a packet frame;

setting a flag in a header of the packet frame indicating an encryption algorithm, from a plurality of encryption algorithms, used to encrypt the block of data;

inserting a validation value for the encrypted data in a trailer of the packet frame; and

sending the packet over a network.

2. The method of claim 1, wherein the encryption hardware on the network interface card does not use a main central processing unit for a computer.

13. The method of claim 1, wherein the plurality of encryption algorithms includes Data Encryption Standard (DES) and Public Key Cryptography (RSA).

3. A method in a distributed data processing system for implementing secure network communication, the method comprising the data processing system implemented steps of:

receiving a block of data from a packet frame on a network interface card;

validating the data based on a validation value in a trailer of the packet frame;

detecting an encryption algorithm used to encrypt the block of data based on a flag in a header of the packet frame;

decrypting the block of data in decryption hardware built on the network interface card using the detected encryption algorithm; and

sending the decrypted data to a reassembly logic on the network interface card.

4. The method of claim 3, wherein the decryption hardware on the network interface card does not use a main central processing unit for a computer.

14. The method of claim 3, wherein the detected encryption algorithm includes one of Data Encryption Standard (DES) and Public Key Cryptography (RSA).

5. A data processing system for implementing secure network communication, the data processing system comprising:

a receiving means for receiving a block of data from a segmentation logic on a network interface card;

an encrypting means for encrypting the block of data using encryption hardware built on the network interface card;

a transfer means for transferring the encrypted data into a packet frame;

a flagging means for setting a flag in a header of the packet frame indicating an encryption algorithm, from a plurality of encryption algorithms, used to encrypt the block of data;

an inserting means for inserting a validation value for the encrypted data in a trailer of the packet frame; and

a sending means for sending the packet over a network.

6. The data processing system of claim 5, wherein the encryption hardware on the network interface card does not use a main central processing unit for a computer.

15. The data processing system of claim 5, wherein the plurality of encryption algorithms includes Data Encryption Standard (DES) and Public Key Cryptography (RSA).

7. A data processing system for implementing secure network communication, the data processing system comprising:

a receiving means for receiving a block of data from a packet fame on a network interface card;

a validating means for validating the data based on a validation value in a trailer of the packet frame;

a detecting means for detecting an encryption algorithm used to encrypt the block of data based on a flag in a header of the packet frame;

a decrypting means for decrypting the block of data in decryption hardware built on the network interface card using the detected encryption algorithm; and

a sending means for sending the decrypted data to a re-assembly logic on the network interface card.

8. The data processing system of claim 7, wherein the decryption hardware on the network interface card does not use a main central processing unit for a computer.

16. The data processing system of claim 7, wherein the detected encryption algorithm includes one of Data Encryption Standard (DES) and Public Key Cryptography (RSA).

9. A computer program product for implementing secure network communication, the computer program product comprising:

instructions for receiving a block of data from a segmentation logic on a network interface card;

instructions for encrypting the block of data using encryption hardware built on the network interface card;

instructions for putting the encrypted data into a packet frame;

instructions for setting a flag in a header of the packet frame indicating an encryption algorithm, from a plurality of encryption algorithms, used to encrypt the block of data;

instructions for inserting a validation value for the encrypted data in a trailer of the packet frame; and

instructions for sending the packet over a network.

10. The computer program product of claim 9, wherein the instructions for encryption on the network interface card does not use a main central processing unit for a computer.

12. The computer program product of claim 9, wherein the instructions for decryption on the network interface card does not use a main central processing unit for a computer.

17. The computer program product of claim 9, wherein the plurality of encryption algorithms includes Data Encryption Standard (DES) and Public Key Cryptography (RSA).

11. A computer program product for implementing secure network communication, the computer program product comprising:

instructions for receiving a block of data from a packet frame on a network interface card;

instructions for validating the data based on a validation value in a trailer of the packet frame;

instructions for detecting an encryption algorithm used to encrypt the block of data based on a flag in a header of the packet frame;

instructions for decrypting the block of data in decryption hardware built on the network interface card using the detected encryption algorithm; and

instructions for sending the decrypted data to a re-assembly logic on the network interface card.

18. The computer program product of claim 11, wherein the detected encryption algorithm includes one of Data Encryption Standard (DES) and Public Key Cryptography (RSA).