Communication network intended for secure transmission of speech and data

• US 5,115,466 A
• Filed: 10/31/1990
• Issued: 05/19/1992
• Est. Priority Date: 11/13/1989
• Status: Expired due to Fees

• Current Assignee: Alcatel STK A/S
• Original Assignee: Alcatel STK A/S
• Inventors: Presttun, Kare
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US07/607,912
• Time in Patent Office: 566 Days
• Field of Search: 380/9, 380/21, 380/43, 380/49, 380/50, 379/93-95
• US Class Current: 380/257
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04Q 11/0428 Integrated services digital network, i.e. systems for transmission of different types of digitised signals, e.g. speech, data, telecentral, television signals
• CPC Class Codes: H04Q 2213/13095 PIN / Access code, authentication
• CPC Class Codes: H04Q 2213/13174 Data transmission, file transfer
• CPC Class Codes: H04Q 2213/13176 Common channel signaling, CCS7
• CPC Class Codes: H04Q 2213/13205 Primary rate access, PRI
• CPC Class Codes: H04Q 2213/13209 ISDN
• CPC Class Codes: H04Q 2213/1322 PBX
• CPC Class Codes: H04Q 2213/13339 Ciphering, encryption, security
• CPC Class Codes: H04Q 2213/13395 Permanent channel, leased line
• CPC Class Codes: H04Q 3/622 Circuit arrangements therefor

Abstract

This invention relates to a communication network intended for secure transmission of speech and data, including different types of subscriber terminals (10-15) and switching modules (4-6), and where the network further comprise crypto devices to undertake encryption/decryption of information transmitted through the network. At least one of the crypto devices is constituted by a crypto-pool device (7,8,9) having a number of crypto modules (CM) physically separated from the switching modules (4,5,6). Each crypto-pool (7,8,9; 20) is provided with a managing device (MA, 26) for communicating with a ciphering key distribution authority through standardized communication protocols and distribute keys to the relevant CM through a control path (25) of the crypto-pool. Each crypto-pool has access to an authentication server (AS, 16; 41,43) providing a directory of security certificates necessary in the authentication process when initiating a network connection.

Claims

1. Communication network for secure transmission of information, comprising:

at least three subscriber terminals,

at least two switching modules including a first switching module associated with a first and second said subscriber terminal and a second switching module associated with a third said switching module,

subscriber lines to connect each of the subscriber terminals with its associated said switching module,

at least one transmission link connecting the switching modules to each other to thereby form a switched network, and

at least two cryptographic devices, including a first cryptographic device associated with the first switching module and a second cryptographic device associated with the second switching module, to undertake encryption/decryption of at least some of the information transmitted through the switched network between the first switching module and the second switching module,

wherein;

the first cryptographic device is physically separated from said first switching module,

the first cryptographic device uses standardized interface and communication protocols, to communicate with said first switching module and, via said first switching module, with said first and second subscriber terminals,

said first cryptographic device is a crypto-pool device comprising a plurality of cryptographic modules for simultaneous encryption/decryption of respective different information being transmitted between the associated said first switching module and one or more other said switching modules, each said cryptographic module providing a non-secure communication path via said first switching module to a currently designated one of said at least two subscriber terminals, and a secure communication path via said first switching module, said switched network and a currently designated said second switching module to a currently designated said second cryptographic device.

2. Network according to claim 1, wherein each crypto-pool device further comprises a managing device for communicating with a ciphering key distribution authority through said standardized communication protocols and for distributing ciphering keys to the relevant cryptographic module through a control path of the crypto-pool.

3. Network according to claim 1, wherein each crypto-pool device has access to an authentication server providing a directory of security certificates necessary in the authentication process and encryption key exchange, when initiating a network connection.

4. Network according to claim 1, wherein the crypto-pool devices are arranged in a public ISDN environment having a number of ISPABX switches.

5. Network according to claim 4, wherein the crypto-pool may be activated indirectly to accessing an ISPABX service through an end-to-end D-channel or a dedicated B-channel.

6. Network according to claim 1, wherein the crypto-pool device may be activated both from a subscriber terminal without a security module and from a subscriber terminal with a security module.

7. Network according to claim 1, wherein the crypto-pool may be activated directly by an attached PABX or ISPABX, so that no subscriber terminal is aware of any associated crypto-pool usage.

8. Network according to claim 1, wherein the crypto-pool may be activated directly by a security module at a subscriber terminal attached to the same ISPABX as said crypto-pool.

9. Network according to claim 1, wherein the standardized communication channels which can be handled by one or more of said crypto modules are:

B-channel 64 kbit/sec

H₀ -channel 384 kbit/sec

H₁₁ -channel 1536 kbit/sec

H₁₂ -channel 1920 kbit/sec.

10. Network according to claim 1, wherein

one of the subscriber terminals is a non-secure terminal and another one of the subscriber terminals is a secure terminal, and

the secure terminal and the crypto-pool each further comprise means for authenticating each other and exchanging session encryption keys,

whereby the non-secure terminal can communicate with the secure terminal through the crypto-pool without any weakening of existing security.