Encapsulation of secure encrypted data in a deployable, secure communication system allowing benign, secure commercial transport

• US 7,533,259 B2
• Filed: 11/04/2003
• Issued: 05/12/2009
• Est. Priority Date: 09/15/2003
• Status: Expired due to Fees

• Current Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Original Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Inventors: Anspach, Steve
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): Lemma; Samson B
• Application Number:
  US10/699,834
• Publication Number:
  US 20050060539A1
• Time in Patent Office: 2,016 Days
• Field of Search: 713/150, 713/160, 713/153, 380/37, 380/257
• US Class Current: 713/160
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

Sensitive, Type 1 KIV-encrypted data is encapsulated into IP packets in a remotely deployed, secure communication system. The IP packets are addressed to a matching IP encapsulator/decapsulator device over the public Internet or other IP protocol network, that then passes it to a similar Type 1 KIV device for decryption. Thus, sensitive, encrypted data is made to appear as if it were any other commercial network data, cloaking it in the vast and busy world of the Internet. The present invention is embodied in a system that provides secure Voice-Over-IP (VOIP), video and data network functionality in a single, small size deployable case, to a remote user. Most importantly, the embodiment allows for the routing of bulk encrypted (i.e., secure) data over a public network, e.g., the Internet.

Claims

1. A method of cloaking encrypted data, comprising:

receiving one of voice over IP (VoIP) data, voice over frame relay (VoFR), or voice over ATM (VoATM) data routed by a data router adapted to output a serial data stream;

encrypting said serial data stream into encrypted data using a Type 1 encryption unit;

encapsulating said encrypted data into IP packets;

forming a first tunnel for an overall IP link;

forming a second tunnel between a first IP encapsulator and

a second IP encapsulator; and

transmitting said IP packets of encrypted data on a public IP network.

2. The method of cloaking encrypted data according to claim 1, wherein:

said public network is an Internet.

3. The method of cloaking encrypted data according to claim 1, wherein:

said IP packets are transmitted via an ISDN router.

4. The method of cloaking encrypted data according to claim 1, wherein:

said IP packets are transmitted over a satellite terminal.

5. The method of cloaking encrypted data according to claim 1, wherein said Type 1 encryption unit comprises:

a KIV type encryption unit.

6. The method of cloaking encrypted data according to claim 5, wherein said Type 1 KIV-type encryption unit comprises:

a KIV-7 encryption unit.

7. The method of cloaking encrypted data according to claim 1, wherein:

said data is a synchronous serial data stream.

8. The method of cloaking encrypted data according to claim 7, wherein:

said synchronous serial data stream is an RS-530 data stream.

9. The method of cloaking encrypted data according to claim 1, further comprising:

combining data from two voice sources into said routed data.

10. Apparatus for cloaking encrypted data in a deployable, secure communication terminal, comprising:

means for receiving one of voice over IP (VoIP) data, voice over frame relay (VoFR), or voice over ATM (VoATM) data routed by a data router adapted to output a serial data stream;

means for encrypting said serial data stream into encrypted data using a Type 1 encryption unit;

means for encapsulating said encrypted data into IP packets;

means for forming a first tunnel for an overall IP link; and

means for forming a second tunnel between a first IP encapsulator and a second IP encapsulator; and

means for transmitting said IP packets of encrypted data on a public IP network.

11. The apparatus for cloaking encrypted data in a deployable, secure communication terminal according to claim 10, wherein:

said public network is an Internet.

12. The apparatus for cloaking encrypted data in a deployable, secure communication terminal according to claim 10, wherein:

said IP packets are transmitted via an ISDN router.

13. The apparatus for cloaking encrypted data in a deployable, secure communication terminal according to claim 10, wherein:

said IP packets are transmitted over a satellite terminal.

14. The apparatus for cloaking encrypted data in a deployable, secure communication terminal according to claim 10, wherein said Type 1 encryption unit comprises:

a KIV type encryption unit.

15. The apparatus for cloaking encrypted data in a deployable, secure communication terminal according to claim 14, wherein said Type 1 KIV-type encryption unit comprises:

a KIV-7 encryption unit.

16. The apparatus for cloaking encrypted data in a deployable, secure communication terminal according to claim 10, wherein:

said data is a synchronous serial data stream.

17. The apparatus for cloaking encrypted data in a deployable, secure communication terminal according to claim 16, wherein:

said synchronous serial data stream is an RS-530 data stream.

18. The apparatus for cloaking encrypted data in a deployable, secure communication terminal according to claim 10, further comprising:

means for combining data from two voice sources into said routed data.

19. The apparatus for cloaking encrypted data in a deployable, secure communication terminal according to claim 18, wherein said means for combining data from two voice sources comprises:

a voice-enabled router.

20. A secure communications device, comprising:

means for receiving one of voice over IP (VoIP) data, voice over frame relay (VoFR), or voice over ATM (VoATM) data stream routed by a data router adapted to output a serial data stream;

means for encrypting said serial data stream using a Type 1 encryption unit, into an encrypted data stream;

means for encapsulating said encrypted data stream for transmission to another secure communications device using IP protocol;

means for forming a first tunnel for an overall IP link;

means for forming a second tunnel between a first IP encapsulator and a second IP encapsulator; and

means for routing said encapsulated, encrypted data stream over an Internet.

21. The secure communications device according to claim 20, wherein said means for routing comprises:

an Ethernet to ISDN router.

22. The secure communications device according to claim 20, wherein said means for encrypting comprises:

A KIV-7 encryption unit.

23. The secure communications device according to claim 20, wherein:

said means for encapsulating converts a RS-530 synchronous serial data stream into an IP data stream.