Methods and systems for supplying encryption keys

• US 6,980,659 B1
• Filed: 06/02/2000
• Issued: 12/27/2005
• Est. Priority Date: 06/02/2000
• Status: Expired due to Term

• Current Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.), Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: BBN Technologies (Rtx Corporation)
• Inventors: Elliott, Brig Barnum
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US09/585,933
• Time in Patent Office: 2,034 Days
• Field of Search: 380/228, 380/247, 380/255, 380/262, 380/270, 380277-279, 380/44, 380/47, 380/283, 713168-172, 713192-194, 713/189
• US Class Current: 380/277
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A system encrypts information. The system includes a key storage module (135) configured to store encryption bits in a memory of the key storage module. The system further includes a communication device (105) configured to retrieve a quantity of encryption bits from the memory of the key storage module. The retrieval depletes a total amount of encryption bits stored in the key storage module. The communication device is further configured to encrypt data transmitted from the communication device using the quantity of retrieved encryption bits.

Claims

1. A method of encrypting information, comprising:

generating a first collection and a second collection of encryption bits in a key supply device;

supplying said first collection of encryption bits to a key storage module;

storing said first collection of encryption bits in a memory of said key storage module;

transporting said key storage module to a data production device;

connecting said key storage module to said data production device;

supplying said first collection of encryption bits from said module to said data production device;

deleting said first collection of encryption bits from said memory of said key storage module; and

encrypting data produced by said data production device using said first collection of encryption bits.

2. The method of claim 1, further comprising:

transporting said key storage module to said key supply device;

connecting said key storage module to said key supply device;

supplying said second collection of encryption bits from said key supply device to said key storage module; and

storing said second collection of encryption bits in the memory of the key storage module.

3. The method of claim 2, further comprising:

supplying power from said key supply device to said key storage module after said key storage module is connected with said key supply device.

4. The method of claim 1, further comprising:

supplying power from said data production device to said key storage module after said key storage module is connected with said data production device.

5. The method of claim 1, further comprising:

storing said encrypted data in a memory of said data production device.

6. The method of claim 1, wherein said data production device comprises a communication device.

7. The method of claim 6, further comprising:

transmitting said encrypted data from said communication device to another communication device.

8. A method of encrypting information, comprising:

receiving a fixed quantity of encryption bits within a key storage module;

retrieving a quantity of encryption bits from a memory of the key storage module connected to a port of a communication device, wherein said retrieval depletes a total amount of encryption bits stored in the key storage module;

determining whether said retrieval depletes said stored encryption bits below a predetermined amount; and

encrypting data transmitted from said communication device using said quantity of encryption bits.

9. The method of claim 8, further comprising:

signaling an encryption bit insufficiency condition when said retrieval depletes said stored encryption bits below said predetermined amount.

10. The method of claim 8, further comprising:

receiving a second quantity of encryption bits from a key supply device based on said determination.

11. A system for encrypting information, comprising:

a key storage module configured to;

store a fixed quantity of encryption bits in a memory of said key storage module; and

a communication device configured to;

retrieve a quantity of encryption bits from said memory of said key storage module, wherein said retrieval depletes from the fixed quantity of encryption bits stored in the key storage module, and

encrypt data transmitted from said communication device using said quantity of encryption bits;

wherein said key storage module is further configured to;

determine whether said retrieval depletes said stored encryption bits below a specified amount.

12. The system of claim 11, wherein said key storage module is further configured to:

signal an encryption bit insufficiency condition when said retrieval depletes said stored encryption bits below said specified amount.

13. The system of claim 11, wherein said key storage module is further configured to:

receive a second quantity of encryption bits from a key supply device based on said determination.

14. A computer-readable medium containing instructions for controlling at least one processor to perform a method of encrypting information at a communication device, the method comprising:

retrieving a quantity of encryption bits from a memory of a key storage module connected to a port of said communication device, wherein said retrieval depletes a total amount of encryption bits stored in the key storage module,

determining whether said retrieval depletes said stored encryption bits below a predetermined amount, and

encrypting data transmitted from said communication device using said quantity of encryption bits.

15. A method of encrypting information, comprising:

generating a first collection and a second collection of encryption bits in a key supply device;

supplying said first collection of encryption bits to a key storage module;

storing said first collection of encryption bits in a memory of said key storage module;

transporting said key storage module to a data production device;

connecting said key storage module to said data production device;

supplying said first collection of encryption bits from said module to said data production device;

deleting said first collection of encryption bits from said memory of said key storage module;

encrypting data produced by said data production device using said first collection of encryption bits;

transporting said key storage module to said key supply device;

connecting said key storage module to said key supply device;

supplying said second collection of encryption bits from said key supply device to said key storage module;

storing said second collection of encryption bits in the memory of the key storage module;

transporting said key storage module to the data production device;

connecting said key storage module to the data production device;

supplying the second collection of encryption bits from said module to said data production device;

deleting said second collection of encryption bits from the memory of said key storage module; and

encrypting data produced by said data production device using said second collection of encryption bits.

16. A method of encrypting information, comprising:

retrieving a quantity of encryption bits from a memory of a key storage module connected to a port of a communication device, wherein said retrieval depletes a total amount of encryption bits stored in the key storage module;

encrypting data transmitted from said communication device using said quantity of encryption bits;

determining whether said retrieval depletes said stored encryption bits below a predetermined amount;

receiving a second quantity of encryption bits from a key supply device based on said determination; and

storing said second quantity of encryption bits in said memory of said key storage module, wherein said second quantity of encryption bits replenishes a total amount of encryption bits stored in said key storage module.

17. A system for encrypting information, comprising:

a key storage module configured to;

store encryption bits in a memory of said key storage module; and

a communication device configured to;

retrieve a quantity of encryption bits from said memory of said key storage module, wherein said retrieval depletes a total amount of encryption bits stored in the key storage module, and

encrypt data transmitted from said communication device using said quantity of encryption bits;

wherein said key storage module is further configured to;

determine whether said retrieval depletes said stored encryption bits below a specified amount,

receive a second quantity of encryption bits from a key supply device based on said determination, and

store said second quantity of encryption bits in said memory, wherein said second quantity of encryption bits replenishes a total amount of encryption bits stored in said key storage module.