Encapsulation of secure encrypted data in a deployable, secure communication system allowing benign, secure commercial transport

• US 8,850,179 B2
• Filed: 09/14/2007
• Issued: 09/30/2014
• Est. Priority Date: 09/15/2003
• Status: Expired due to Fees

• Current Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Original Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Inventors: Anspach, Steve, Heyliger, Brian, Kasson, Greg, West, Jeff, Luke, Salazar
• Primary Examiner(s): POWERS, WILLIAM S
• Application Number:
  US11/898,724
• Publication Number:
  US 20090077375A1
• Time in Patent Office: 2,573 Days
• Field of Search: None
• US Class Current: 713/150
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

Sensitive, Type 1 KIV-encrypted data is encapsulated into IP packets in a remotely deployed, secure communication system. The IP packets are addressed to a matching IP encapsulator/decapsulator device over the public Internet or other IP protocol network, that then passes it to a similar Type 1 KIV device for decryption. Thus, sensitive, encrypted data is made to appear as if it were any other commercial network data, cloaking it in the vast and busy world of the Internet. The present invention is embodied in a system that provides secure Voice-Over-IP (VoIP), video and data network functionality in a single, small size deployable case, to a remote user. Most importantly, the embodiment allows for the routing of bulk encrypted (i.e., secure) data over a public network, e.g., the Internet.

Claims

1. A method of cloaking an encrypted serial data stream, comprising:

formulating, with an encryption device associated with a portable secure communication system, an encrypted serial data stream;

establishing, prior to transmission over a non-secure IP network, a serial data path connecting an encryption device output and an Internet Protocol (IP) encapsulator input;

encapsulating, with said IP encapsulator associated with said portable secure communication system, said encrypted serial data stream into IP packets;

establishing a first data tunnel between said IP encapsulator and a first remote IP encapsulator;

establishing a second data tunnel between said IP encapsulator and a second remote IP encapsulator; and

transmitting said IP packets of encrypted serial data over a non-secure IP network using said data tunnel and said second data tunnel.

2. The method of cloaking an encrypted serial data stream according to claim 1, wherein:

said public network is an Internet.

3. The method of cloaking an encrypted serial data stream according to claim 1, wherein:

said IP packets are transmitted via an ISDN router.

4. The method of cloaking an encrypted serial data stream according to claim 1, wherein:

said IP packets are transmitted over a satellite terminal.

5. The method of cloaking an encrypted serial data stream according to claim 1, further comprising:

encrypting data using a Type 1 encryption unit.

6. The method of cloaking an encrypted serial data stream according to claim 5, wherein said Type 1 encryption unit comprises:

a KIV type encryption unit.

7. The method of cloaking an encrypted serial data stream according to claim 6, wherein said Type 1 KIV-type encryption unit comprises:

a KIV-7 encryption unit.

8. The method of cloaking an encrypted serial data stream according to claim 1, wherein said serial data stream of encrypted data comprises:

Voice over IP (VoIP) data.

9. The method of cloaking an encrypted serial data stream according to claim 1, wherein:

said encrypted serial data stream is a synchronous serial data stream.

10. The method of cloaking an encrypted serial data stream according to claim 9, wherein:

said synchronous encrypted serial data stream is an RS-530 data stream.

11. The method of cloaking an encrypted serial data stream according to claim 1, further comprising:

combining data from two voice sources; and

encrypting said combined data stream into said encrypted serial data stream before said encapsulating.

12. Apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal, comprising:

means for formulating, with an encryption device associated with a portable secure communication system, an encrypted serial data stream;

means for establishing, prior to transmission over a non-secure IP network, a serial data path connecting an encryption device output and an Internet Protocol (IP) encapsulator input;

means for encapsulating, with said IP encapsulator associated with said portable secure communication system, said encrypted serial data stream into IP packets;

means for establishing a first data tunnel between said IP encapsulator and a first remote IP encapsulator, and a second data tunnel between said IP encapsulator and a second remote IP encapsulator; and

means for transmitting said IP packets of encrypted serial data over a non-secure IP network.

13. The apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal according to claim 12, wherein:

said public network is an Internet.

14. The apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal according to claim 12, wherein:

said IP packets are transmitted via an ISDN router.

15. The apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal according to claim 12, wherein:

said IP packets are transmitted over a satellite terminal.

16. The apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal according to claim 12, further comprising:

means for encrypting data using a Type 1 encryption unit.

17. The apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal according to claim 16, wherein said Type 1 encryption unit comprises:

a KIV type encryption unit.

18. The apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal according to claim 17, wherein said Type 1 KIV-type encryption unit comprises:

a KIV-7 encryption unit.

19. The apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal according to claim 12, wherein said serial data stream of encrypted data comprises:

Voice over IP (VoIP) data.

20. The apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal according to claim 12, wherein:

said encrypted serial data stream is a synchronous serial data stream.

21. The apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal according to claim 20, wherein:

said synchronous encrypted serial data stream is an RS-530 data stream.

22. The apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal according to claim 12, further comprising:

means for combining data from two voice sources; and

means for encrypting said combined data stream into said encrypted serial data stream before said encapsulating.

23. The apparatus for cloaking an encrypted serial data stream in a deployable, portable secure communication terminal according to claim 22, wherein said means for combining data from two voice sources comprises:

a voice-enabled router.