Modular cryptographic device providing enhanced interface protocol features and related methods

• US 7,711,963 B2
• Filed: 03/23/2004
• Issued: 05/04/2010
• Est. Priority Date: 03/23/2004
• Status: Expired due to Fees

• Current Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Original Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Inventors: Dellmo, Russell Wayne, Yancy, Bruce Wayne
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): ALMEIDA, DEVIN E
• Application Number:
  US10/806,937
• Publication Number:
  US 20050216726A1
• Time in Patent Office: 2,233 Days
• Field of Search: None
• US Class Current: 713/189
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic

Abstract

A cryptographic device may include a cryptographic module and a communications module coupled thereto. The cryptographic module may include a user network interface and a cryptographic processor coupled thereto. The communications module may include a network communications interface coupled to the cryptographic processor. The cryptographic processor may communicate with the user network interface using a predetermined protocol, and the cryptographic processor may also communicate with the network communications interface using the predetermined protocol.

Claims

1. A cryptographic device comprising:

a cryptographic module and a communications module removably coupled thereto;

said cryptographic module comprising a user network interface and a cryptographic processor coupled thereto;

said communications module comprising a network communications interface coupled to said cryptographic processor;

said cryptographic processor communicating with said user network interface using a Media Independent Interface (MII) and a serial interface, and said cryptographic processor communicating with said network communications interface using the MII and the serial interface;

said cryptographic module and said communications module communicating using the MII to transfer encrypted data therebetween and using the serial interface to transfer communications module configuration operations therebetween.

2. The cryptographic device of claim 1 wherein said user network interface and said network communications interface both comprise Local Area Network (LAN) interfaces.

3. The cryptographic device of claim 1 wherein said cryptographic processor comprises:

a host network processor communicating with said user network interface using the MII; and

a cryptography circuit communicating with said host network processor using the MII.

4. The cryptographic device of claim 1 wherein said cryptographic processor further comprises:

an encrypted data buffer circuit coupled between said user network interface and said cryptography circuit; and

an unencrypted data buffer circuit coupled between said cryptography circuit and said network communications interface.

5. The cryptographic device of claim 4 wherein communications to and from said encrypted data buffer and said unencrypted data buffer use the MII.

6. The cryptographic device of claim 1 wherein said communications module comprises a predetermined one from among a plurality of interchangeable communications modules each for communicating over a different communications media.

7. The cryptographic device of claim 1 wherein said network communications interface comprises a wireless LAN (WLAN) communication circuit.

8. The cryptographic device of claim 1 wherein said network communications interface comprises a wireline communication circuit.

9. The cryptographic device of claim 1 wherein said network communications interface comprises a fiber optic communication circuit.

10. The cryptographic device of claim 1 wherein said user network interface comprises an Ethernet interface.

11. A cryptographic device comprising:

a cryptographic module and a communications module coupled thereto;

said cryptographic module comprising a user Local Area Network (LAN) interface and a cryptographic processor coupled thereto;

said communications module comprising a network LAN interface coupled to said cryptographic processor;

said cryptographic processor communicating with said user network interface using a Media Independent Interface (MII) and a serial interface, and said cryptographic processor communicating with said network LAN interface using the MII and the serial interface;

said cryptographic module and said communications module both operating using at least one unique external media access control (MAC) address, and at least one fixed internal MAC address;

said cryptographic module and said communications module communicating using the MII to transfer encrypted data therebetween and using the serial interface to transfer communications module configuration operations therebetween.

12. The cryptographic device of claim 11 wherein said cryptographic processor comprises:

a host network processor communicating with said user LAN interface using the MII; and

a cryptography circuit communicating with said host network processor using the MII.

13. The cryptographic device of claim 11 wherein said cryptographic processor further comprises:

an encrypted data buffer circuit coupled between said user LAN interface and said cryptography circuit; and

an unencrypted data buffer circuit coupled between said cryptography circuit and said network communications interface.

14. The cryptographic device of claim 11 wherein communications to and from said encrypted data buffer and said unencrypted data buffer use MII.

15. The cryptographic device of claim 11 wherein said communications module is removably coupled to said cryptographic module;

and wherein said communications module comprises a predetermined one from among a plurality of interchangeable communications modules each for communicating over a different communications media.

16. The cryptographic device of claim 11 wherein said network LAN interface comprises a wireless LAN (WLAN) communication circuit.

17. The cryptographic device of claim 11 wherein said network LAN interface comprises a wireline LAN communication circuit.

18. The cryptographic device of claim 11 wherein said network LAN interface comprises a fiber optic LAN communication circuit.

19. The cryptographic device of claim 11 wherein said user LAN interface comprises an Ethernet interface.

20. A communications method comprising:

removably coupling a cryptographic module to a network device, the cryptographic module comprising a user network interface and a cryptographic processor coupled thereto;

providing a communications module comprising a network communications interface coupled to the cryptographic processor;

using the cryptographic processor to communicate with the user network interface and the network communications interface using a Media Independent Interface (MII) and a serial interface; and

using the network communications interface to communicate with a network;

using the cryptographic module and the communications module to communicate using the MII to transfer encrypted data therebetween and using the serial interface to transfer communications module configuration operations therebetween.

21. The method of claim 20 wherein the user network interface and the network communications interface both comprise LAN interfaces.

22. The method of claim 20 wherein the cryptographic processor comprises:

a host network processor communicating with the user network interface using the MII;

a cryptography circuit communicating with the host network processor using the MII;

an encrypted data buffer circuit coupled between the user network interface and the cryptography circuit; and

an unencrypted data buffer circuit coupled between the cryptography circuit and the network communications interface.

23. The method of claim 22 further comprising using the MII for communications to and from the encrypted data buffer and the unencrypted data buffer.

24. The method of claim 20 wherein the cryptographic module and the communications module both operate using at least one unique external media access control (MAC) address, and at least one fixed internal MAC address.

25. The method of claim 20 wherein the communications module comprises a predetermined one from among a plurality of interchangeable communications modules each for communicating over a different communications media.

26. The method of claim 20 wherein the network communications interface comprises at least one of a wireless Local Area Network (WLAN) communication circuit, a wireline communication circuit, and a fiber optic communication circuit.

27. A communications system comprising:

a plurality of network devices coupled together to define a network, and a cryptographic device removably coupled to at least one of said network devices;

said cryptographic device comprising a cryptographic module coupled to said at least one network device, and a communications module coupled to said cryptographic module;

said cryptographic module comprising a user network interface and a cryptographic processor coupled thereto;

said communications module comprising a network communications interface coupled to said cryptographic processor;

said cryptographic processor communicating with said user network interface using a Media Independent Interface (MII) and a serial interface, and said cryptographic processor communicating with said network communications interface using the MII and the serial interface;

said cryptographic module and said communications module communicating using the MII to transfer encrypted data therebetween and using the serial interface to transfer communications module configuration operations therebetween.

28. The communications system of claim 27 wherein said user network interface and said network communications interface both comprise Local Area Network (LAN) interfaces.

29. The communications system of claim 27 wherein said cryptographic processor comprises:

a host network processor communicating with said user network interface using the MII; and

a cryptography circuit communicating with said host network processor using the MII.

30. The communications system of claim 27 wherein said cryptographic processor further comprises:

an encrypted data buffer circuit coupled between said user network interface and said cryptography circuit; and

an unencrypted data buffer circuit coupled between said cryptography circuit and said network communications interface.

31. The communications system of claim 27 wherein communications to and from said encrypted data buffer and said unencrypted data buffer use the predetermined protocol.

32. The communications system of claim 27 and wherein said cryptographic module and said communications module both operate using at least one unique external media access control (MAC) address, and at least one fixed internal MAC address.

33. The communications system of claim 27 wherein said communications module comprises a predetermined one from among a plurality of interchangeable communications modules each for communicating over a different communications media.

34. The communications system of claim 27 wherein said network communications interface comprises at least one of a wireless LAN (WLAN) communication circuit, a wireline communication circuit, and a fiber optic communication circuit.

35. The communications system of claim 27 wherein said user network interface comprises an Ethernet interface.

36. A cryptographic module comprising:

a user network interface; and

a cryptographic processor removably coupled to said user network interface;

said cryptographic processor for communicating with said user network interface using a Media Independent Interface (MII) and a serial interface, and also for communicating with a network communications module using the MII and the serial interface;

said cryptographic module and said communications module communicating using the MII to transfer encrypted data therebetween and using the serial interface to transfer communications module configuration operations therebetween.

37. The cryptographic module of claim 36 wherein said user network interface comprises a Local Area Network (LAN) interface.

38. The cryptographic module of claim 36 wherein said cryptographic processor comprises:

a host network processor communicating with said user network interface using the MII; and

a cryptography circuit communicating with said host network processor using the MII.

39. The cryptographic module of claim 38 wherein said cryptographic processor further comprises:

an encrypted data buffer circuit coupled between said user network interface and said cryptography circuit; and

an unencrypted data buffer circuit coupled between said cryptography circuit and said network communications module.

40. The cryptographic module of claim 39 wherein communications to and from said encrypted data buffer and said unencrypted data buffer use the MII.

41. The cryptographic module of claim 36 and wherein said user network interface operates using at least one unique external media access control (MAC) address, and wherein said cryptographic processor operates using at least one fixed internal MAC address.