Cryptographic device with detachable data planes

• US 9,515,823 B2
• Filed: 08/30/2013
• Issued: 12/06/2016
• Est. Priority Date: 08/30/2013
• Status: Active Grant

• Current Assignee: L3 Technologies, Inc. (L3Harris Technologies, Inc.)
• Original Assignee: L-3 Communications Corporation (L3Harris Technologies, Inc.)
• Inventors: Costantini, Frank A., Winslow, Richard Norman
• Primary Examiner(s): Holder, Bradley
• Application Number:
  US14/015,443
• Publication Number:
  US 20160156462A1
• Time in Patent Office: 1,194 Days
• US Class Current: 1/1
• CPC Class Codes: H04B 7/18506 Communications with or from aircraft, i.e. aeronautical mobile service
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement

Abstract

A system for performing encryption and/or decryption may include a parent cryptographic device. The parent cryptographic device may be configured to receive a first cryptographic key. The parent cryptographic device may be configured to determine one or more session keys based on the first cryptographic key and/or internally generated random data bits. The parent cryptographic device may be configured to insert the one or more session keys onto one or more child cryptographic devices that are operably connected to the parent cryptographic device. The one or more child cryptographic devices may be configured to receive the one or more session keys from the parent cryptographic device, and perform one or more of encryption or decryption of communications exchanged with another child cryptographic device of the one or more child cryptographic devices. The one or more child cryptographic devices may perform encryption/decryption after separation from the parent cryptographic device.

Claims

1. A system for performing one or more of encryption and/or decryption, the system comprising:

a parent cryptographic device comprising;

a key fill port,

a microprocessor circuit configured to;

interface to a key fill device via the key fill port,

authenticate with the key fill device, and

receive a first cryptographic key from the key fill device,

determine one or more session keys based on the first cryptographic key,

a memory configured to store the first cryptographic key, wherein the memory is configured with one or more anti-tamper hardware mechanisms, and

at least one interface configured to insert the one or more session keys onto one or more child cryptographic devices that are functionally connected to the parent cryptographic device; and

at least a first child cryptographic device of the one or more child cryptographic devices, wherein at least the first child cryptographic device comprises;

a configuration interface configured to receive the one or more session keys from the parent cryptographic device, and

a programmable logic device configured to perform one or more of encryption or decryption of communications exchanged with at least a second child cryptographic device.

2. The system as in claim 1, wherein the parent cryptographic device comprises a plurality of interfaces configured to simultaneously configure the first and second child cryptographic devices.

3. The system as in claim 1, wherein the microprocessor circuit of the parent cryptographic device is implemented via one or more of a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC).

4. The system as in claim 1, wherein the microprocessor circuit of the parent cryptographic device is configured to perform one of more control plane functions related to encryption and/or decryption, and at least the programmable logic device of the first child cryptographic device is configured to perform one or more data plane functions related to encryption and/or decryption.

5. The system as in claim 1, wherein the microprocessor circuit of the parent cryptographic device is configured to authenticate with at least the first child cryptographic device prior to inserting the one or more session keys onto the first child cryptographic device.

6. The system as in claim 1, wherein each of the first and second child cryptographic devices are inserted with at least one common session key.

7. The system as in claim 1, wherein the parent cryptographic device is configured to determine that an authenticated cryptographic ignition key (CIK) is interfaced to the parent cryptographic device prior to inserting the one or more session keys onto the one or more child cryptographic devices.

8. A method for performing one or more of encryption and/or decryption, the method comprising:

a parent cryptographic programmable logic device interfacing to a key fill device via a key fill port;

the parent cryptographic programmable logic device authenticating with the key fill device;

the parent cryptographic programmable logic device receiving a first cryptographic key from the key fill device;

the parent cryptographic programmable logic device determining one or more session keys based on the first cryptographic key;

the parent cryptographic programmable logic device storing the first cryptographic key in a memory that is configured with one or more anti-tamper hardware mechanisms;

the parent cryptographic programmable logic device inserting the one or more session keys onto one or more child cryptographic programmable logic devices that are functionally connected to the parent cryptographic programmable logic device; and

a first child cryptographic programmable logic device of the one or more child cryptographic programmable logic devices receiving the one or more session keys from the parent cryptographic programmable logic device; and

the first child cryptographic programmable logic device performing one or more of encryption or decryption of communications exchanged with at least a second child cryptographic programmable logic device.

9. The method as in claim 8, wherein the parent cryptographic programmable logic device simultaneously configures the first and second child cryptographic programmable logic devices.

10. The method as in claim 8, wherein the parent cryptographic programmable logic device performs one or more control plane functions related to encryption and/or decryption, and at least the first child cryptographic programmable logic device performs one or more data plane functions related to encryption and/or decryption.

11. The method as in claim 8, wherein the parent cryptographic programmable logic device authenticates with at least the first child cryptographic programmable logic device prior to inserting the one or more session keys onto the first child cryptographic programmable logic device.

12. The method as in claim 8, wherein each of the first and second child cryptographic programmable logic devices are inserted with at least one common session key.

13. The method as in claim 8, wherein the parent cryptographic programmable logic device determines that an authenticated cryptographic ignition key (CIK) is interfaced to the parent cryptographic programmable logic device prior to inserting the one or more session keys onto the one or more child cryptographic programmable logic devices.

14. A system for performing one or more of encryption and/or decryption, the system comprising:

a parent cryptographic programmable logic device configured to;

interface to a key fill device,

authenticate with the key fill device,

receive a first cryptographic key from the key fill device,

determine one or more session keys based on the first cryptographic key,

store the first cryptographic key in a memory that is configured with one or more anti-tamper hardware mechanisms,

insert the one or more session keys onto one or more child cryptographic programmable logic devices that are functionally connected to the parent programmable logic cryptographic device; and

a first child cryptographic programmable logic device of the one or more child cryptographic programmable logic devices, the first child cryptographic programmable logic device configured to;

receive the one or more session keys from the parent cryptographic programmable logic device, and

perform one or more of encryption or decryption of communications exchanged with at least a second child cryptographic programmable logic device.

15. The system as in claim 14, wherein the parent cryptographic programmable logic device is configured to simultaneously configure the first and second child cryptographic programmable logic devices.

16. The system as in claim 14, wherein the parent cryptographic programmable logic device is implemented, at least in part, via one or more of a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC).

17. The system as in claim 14, wherein the parent cryptographic programmable logic device is configured to perform one of more control plane functions related to encryption and/or decryption, and at least the first child cryptographic programmable logic device is configured to perform one or more data plane functions related to encryption and/or decryption.

18. The system as in claim 14, wherein the parent cryptographic programmable logic device is configured to authenticate with at least the first child cryptographic programmable logic devices prior to inserting the one or more session keys onto the first child cryptographic programmable logic devices.

19. The system as in claim 14, wherein each of the first and second child cryptographic programmable logic devices are inserted with at least one common session key.

20. The system as in claim 14, wherein the parent cryptographic programmable logic device is configured to determine that an authenticated cryptographic ignition key (CIK) is interfaced to the parent cryptographic programmable logic device prior to inserting the one or more session keys onto the one or more child cryptographic programmable logic devices.