Authenticated sensor interface device

• US 9,473,300 B2
• Filed: 11/01/2012
• Issued: 10/18/2016
• Est. Priority Date: 11/03/2011
• Status: Active Grant

• Current Assignee: Battelle Savannah River Alliance LLC
• Original Assignee: Savannah River Nuclear Solutions LLS
• Inventors: Coleman, Jody Rustyn, Poland, Richard W.
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): Chiang, Jason C
• Application Number:
  US13/666,502
• Publication Number:
  US 20130117556A1
• Time in Patent Office: 1,447 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: H04B 10/00 Transmission systems employing electromagnetic waves other than radio-waves, e.g. infrared, visible or ultraviolet light, or employing corpuscular radiation, e.g. quantum communication
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18

Abstract

A system and method for the secure storage and transmission of data is provided. A data aggregate device can be configured to receive secure data from a data source, such as a sensor, and encrypt the secure data using a suitable encryption technique, such as a shared private key technique, a public key encryption technique, a Diffie-Hellman key exchange technique, or other suitable encryption technique. The encrypted secure data can be provided from the data aggregate device to different remote devices over a plurality of segregated or isolated data paths. Each of the isolated data paths can include an optoisolator that is configured to provide one-way transmission of the encrypted secure data from the data aggregate device over the isolated data path. External data can be received through a secure data filter which, by validating the external data, allows for key exchange and other various adjustments from an external source.

Claims

1. A system for providing secure transmission of data, the system comprising:

a data source configured to provide secure data;

a data aggregate device capable of receiving the secure data from the data source, the data aggregate device configured to encrypt the secure data into a plurality of independently encrypted data packets, the plurality of independently encrypted data packets comprising a first encrypted data packet and a second encrypted data packet, the data aggregate device configured to provide the first encrypted data packet over a first data path and the second encrypted data packet over a second data path, the first and second data paths being isolated from one another;

a first optoisolator disposed in first data path and a second optoisolator disposed in the second data path, each of the first and second optoisolators configured to provide one-way transmission of data over one of the first data path and second data path; and

a first data transmitter disposed in the first data path and a second data transmitter disposed in the second data path, each of the first and second data transmitters capable of receiving one of the plurality of independently encrypted data packets from one of the first and second optoisolators and transmitting one of the plurality of independently encrypted data packets to a remote device;

wherein the first encrypted data packet is encrypted for a first remote device using a first private key associated with the first remote device and the second encrypted data packet is encrypted independently from the first encrypted data packet for a second remote device using a second private key associated with the second remote device, wherein the first key is different from the second key.

2. The system of claim 1, wherein the data aggregate device, the first and second optoisolators, and the first and second data transmitters are provided in a tamper indicating enclosure.

3. The system of claim 1, wherein each of the first and second data transmitters is capable of storing at least one of the plurality of independently encrypted data packets in a memory.

4. The system of claim 1, wherein at least one of the first and second optoisolators is configured to provide for the one-way exchange of data using an optical signal.

5. The system of claim 1, wherein the data source is a sensor.

6. The system of claim 1, wherein the system further comprises at least one second data source configured to provide a uniquely changing code to the data aggregate device, the data aggregate device configured to associate the uniquely changing code with the plurality of independently encrypted secure data packets.

7. The system of claim 6, wherein the uniquely changing code is independently associated with each of the plurality of independently secure data packets.

8. A computer-implemented method for providing secure transmission of data, comprising:

receiving, at a data aggregate device, secure data from a data source;

encrypting, at the data aggregate device, the secure data to generate a first encrypted data packet and a second encrypted data packet such that the first encrypted data packet and the second encrypted data packet are encrypted independently;

transmitting the first encrypted data packet from the data aggregate device to a first isolated data path and the second encrypted data packet from the data aggregate device to a second isolated data path, each of the first and second isolated data paths comprising an optoisolator configured to provide one-way transmission data from the data aggregate device;

receiving the first encrypted data packet at a first data transmitter provided in the first isolated data path;

receiving the second encrypted data packet at a second data transmitter provided in the second isolated data path;

transmitting the first encrypted data packet from the first data transmitter provided in the first isolated data path to a first remote device over a first communication link; and

transmitting the second encrypted data packet from the second data transmitter provided in the second isolated data path to a second remote device over a second communication link;

wherein the first encrypted data packet is encrypted for a first remote device using a first private key associated with the first remote device and the second encrypted data packet is encrypted independently from the first encrypted data packet for a second remote device using a second private key associated with the second remote device, wherein the first key is different from the second key.