System, apparatus and method for tunnel-based hardware-based cryptography

Abstract

A data processing apparatus (102) having a key memory (123), a key USB subunit (132), a cryptography unit (122), ethernet ports (130), and a tunnel creation unit (142). The key USB subunit (132) enables reception of cryptography keys from a user. The cryptography unit (122) encrypts first data to generate second data and decrypts the second data to generate the first data. The ethernet ports (130) facilitate exchange of the first data and the second data between a first external device (104), the cryptography unit (122), and a second external device (106). The tunnel creation unit (142) creates a tunnel between the first system (100) and the second system (200). The tunnel facilitates the transfer of data packets from the first external device (104) of system 100 and the first external device of the second system (200).

Description

[0001] SYSTEM, APPARATUS AND METHOD FOR TUNNEL-BASED HARDWARE-BASED CRYPTOGRAPHY

[0002] TECHNICAL FIELD

[0003] The present disclosure relates generally to data security. More particularly, the present disclosure relates to a system, an apparatus, and a method for tunnel-based hardwarebased cryptography.

[0004] BACKGROUND

[0005] Cryptography of critical data has become a part of our daily life with applications such as access authentication via digital signature, timestamping of critical documents, secure private communications, digital money transfer, and the like.

[0006] The performance of a cryptography system relies completely on the methodology used for encryption and decryption of the data. Some commonly used state of the art encryption techniques includes block ciphers such as the Advanced Encryption Standards (AES), stream ciphers such as Riveset Cipher 4 (RC4), integer-based cryptography such as Rivest-Shamir-Adleman (RSA), Elliptic-Curve Cryptography, and the like. The state of art encryption decryption systems completely relies on cryptography of data using software defined protocols. Specifically, the encryption of data that is to be physically handed over through a Universal Serial Bus (USB) drive or a flash drive is particularly done through software-based systems and approaches.

[0007] However, the software defined functionality and protocols for a cryptography system is prone to attacks, and thus there is a possibility of compromising the information contents of the critical data. Thus, there is a need for a system, an apparatus, and a method capable of providing secure encryption and decryption of critical data, which demands a need for improvised technical solution that overcomes the aforementioned problems.

[0008] SUMMARY In an aspect of the present disclosure, disclosed is a data processing apparatus. The apparatus includes a key memory, a key USB subunit, a cryptography unit, an ethernet port, and a tunnel creation unit. The key memory is configured to store a list cryptography keys. The key USB subunit is coupled to the key memory and configured to enable reception of one or more cryptography keys from a user. The one or more cryptography keys are added to the list of cryptography keys to generate an updated list of cryptography keys. The cryptography unit is configured to (i) encrypt first data provided by way of a first external device to generate second data based on a cryptography key that is randomly selected from the updated list of cryptography keys and (ii) decrypt the second data to generate the first data based on the cryptography key. The ethernet port is configured to facilitate exchange of (i) the first data between the first external device and the cryptography unit and (ii) the second data between the cryptography unit and a second external device. The tunnel creation unit is configured to create a tunnel between the first external device, the cryptography unit, and the second external device such that the ethernet port facilitates exchange of the first and second data through the tunnel, such that in the key USB subunit, the cryptography unit, and the ethernet port are implemented on at least one of, a Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuits (ASICs).

[0009] In some aspects of the present disclosure, the tunnel creation unit is further configured to (i) enable the ethernet port and (ii) authenticate the first and second external devices (104, 106) prior to creation of the tunnel.

[0010] In some aspects of the present disclosure, the tunnel created between the first external device, the cryptography unit, and the second external device utilizes a proprietary tunnelling protocol implemented within the data processing apparatus to ensure secure and efficient exchange of the first and second data through the ethernet port.

[0011] In some aspects of the present disclosure, the apparatus further includes a network layer stack configured to manage the data flow between the secure tunnel creation unit and the second ethernet port, such that the network layer stack includes hardware- implemented network layer 3 and layer 2 functionalities and supports ARP request and response handling.

[0012] In some aspects of the present disclosure, the apparatus further includes an encryption engine configured to perform hardware-based encryption of plain data received from the first ethernet port and to send the resulting cipher data to the second ethernet port, such that the encryption engine utilizes a randomly generated key from the key manager for each new session.

[0013] In some aspects of the present disclosure, the cryptography unit is further configured to dynamically generate a new cryptography key for each encryption session, such that the new cryptography key is used to encrypt data received from the first external device and decrypt data received from the second external device.

[0014] In some aspects of the present disclosure, the apparatus further includes a tamper controller that is configured to (i) detect one or more interferences with the data processing apparatus based on a set of tamper conditions, and (ii) erase critical data associated with the data processing apparatus, when at least one tamper condition of the set of tamper conditions is true.

[0015] In some aspects of the present disclosure, the apparatus further includes a secure boot controller that is configured to securely boot the key USB subunit, the cryptography unit, and the tunnel creation unit without any software or firmware, using a predefined context stored in a secure memory.

[0016] In some aspects of the present disclosure, the boot controller is further configured to stop one or more operations of at least one of, the key USB subunit, the cryptography unit, the interface controller, the hardware interface, and the ethernet port when at least one tamper condition of the set of tamper conditions is true.

[0017] In some aspects of the present disclosure, the critical data associated with the data processing apparatus includes at least one of, the list of cryptography keys, the updated list of cryptography keys, and a set of predefined context protocols stored in the boot controller. In some aspects of the present disclosure, the cryptography unit is further configured to (i) encrypt each cryptography key of the list of cryptography keys and each cryptography key of the one or more cryptography keys prior to storage in the key memory, and (ii) decrypt, prior to the generation of the second data, the key that is randomly selected from the updated list of cryptography keys.

[0018] In some aspects of the present disclosure, a method is disclosed. The method includes a step of storing, by way of a key memory, a list of cryptography keys. The method further includes a step of enabling, by way of a key USB subunit coupled to the key memory, reception of one or more cryptography keys from a user. The one or more cryptography keys are added to the list of cryptography keys to generate an updated list of cryptography keys. The method further includes a step of exchanging, by way of an ethernet port, first and second data between a first external device, a second external device, and a cryptography unit. The method further includes a step of encrypting, by way of the cryptography unit, the first data provided by the first external device to generate the second data based on a cryptography key that is randomly selected from the updated list of cryptography keys. The method further includes a step of decrypting, by way of the cryptography unit, the second data to generate the first data, based on the cryptography key. The key USB subunit, the cryptography unit and the ethernet port are implemented on at least one of, a Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuits (ASICs).

[0019] In some aspects of the present disclosure, the first and second data is exchanged between the first external device, the second external device, and the cryptography unit by way of a hardware interface such that the hardware interface is implemented on at least one of, a Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuits (ASICs).

[0020] In some aspects of the present disclosure, the method further includes detecting, by way of a tamper controller, a tamper on a data processing apparatus, based on a set of tamper conditions, and (ii) erasing, by way of the tamper controller, critical data associated with the data processing apparatus, when at least one condition of the set of tamper conditions is true.

[0021] In some aspects of the present disclosure, the set of tamper conditions includes at least one of, (i) a predefined number of wrong authentication attempts by the user, (ii) press of an emergency button by the user to generate an emergency signal, and (iii) a physical damage to the data processing apparatus.

[0022] In some aspects of the present disclosure, the bidirectional encryption / decryption process within the hardware-based encryption system begins with key management and loading facilitated by the Key USB Subunit and Key Memory. The Encryption keys are stored in the key memory, and when a user initiates a secure communication session, they load the necessary keys via the Key USB port. This updates the list of cryptography keys stored in the system's memory. Following key initialization, the tunnel Creation Unit may orchestrates the establishment of a secure tunnel between the communicating devices, enabling authentication and creating a secure channel for data exchange. When data is received from the first external device (PT), the Cryptography Unit may select a random encryption key from the updated list, encrypts the data, and generates cipher data. This encrypted data is transmitted over the secure tunnel to the second external device (CT). Upon receiving the encrypted data (CT), the Cryptography Unit in the second device decrypts it using the corresponding encryption key, obtained based on the information exchanged during tunnel establishment. This bidirectional encryption / decryption process ensures that data is securely transmitted and received between the two devices, maintaining confidentiality and integrity throughout the communication.

[0023] BRIEF DESCRIPTION OF DRAWINGS

[0024] The above and still further features and advantages of aspects of the present disclosure becomes apparent upon consideration of the following detailed description of aspects thereof, especially when taken in conjunction with the accompanying drawings, and wherein: FIG. 1 illustrates a block diagram of a system for tunnel-based hardware-based cryptography, in accordance with an exemplary aspect of the present disclosure; and

[0025] FIG. 2 illustrates a flow chart of a method for the tunnel-based hardware-based cryptography, in accordance with an exemplary aspect of the present disclosure.

[0026] To facilitate understanding, like reference numerals have been used, where possible, to designate like elements common to the figures.

[0027] DETAILED DESCRIPTION

[0028] Various aspect of the present disclosure provides a system, an apparatus, and a method for tunnel-based hardware-based cryptography. The following description provides specific details of certain aspects of the disclosure illustrated in the drawings to provide a thorough understanding of those aspects. It should be recognized, however, that the present disclosure can be reflected in additional aspects and the disclosure may be practiced without some of the details in the following description.

[0029] The various aspects including the example aspects are now described more fully with reference to the accompanying drawings, in which the various aspects of the disclosure are shown. The disclosure may, however, be embodied in different forms and should not be construed as limited to the aspects set forth herein. Rather, these aspects are provided so that this disclosure is thorough and complete, and fully conveys the scope of the disclosure to those skilled in the art. In the drawings, the sizes of components may be exaggerated for clarity.

[0030] It is understood that when an element is referred to as being “on,” “connected to,” or “coupled to” another element, it can be directly on, connected to, or coupled to the other element or intervening elements that may be present. As used herein, the term “and / or” includes any and all combinations of one or more of the associated listed items.

[0031] The subject matter of example aspects, as disclosed herein, is described with specificity to meet statutory requirements. However, the description itself is not intended to limit the scope of this patent. Rather, the inventor / inventors have contemplated that the claimed subject matter might also be embodied in other ways, to include different features or combinations of features similar to the ones described in this document, in conjunction with other technologies. Generally, the various aspects including the example aspects relate to a system, a data processing apparatus, and the method for hardware-based cryptography.

[0032] As mentioned, there is a need for a system, an apparatus, and a method capable of providing secure encryption and decryption of critical data. The present aspects, therefore: provides a system, a data processing apparatus, and a method that provides secure encryption and decryption of critical data to overcome the aforementioned problems.

[0033] The aspects herein and the various features and advantageous details thereof are explained more fully with reference to the non-limiting aspects that are illustrated in the accompanying drawings and detailed in the following description. Descriptions of well-known components and processing techniques are omitted so as to not unnecessarily obscure the aspects herein. The examples used herein are intended merely to facilitate an understanding of ways in which the aspects herein may be practiced and to further enable those of skill in the art to practice the aspects herein. Accordingly, the examples should not be construed as limiting the scope of the aspects herein.

[0034] FIG. 1 illustrates a block diagram of the system for tunnel-based hardware-based cryptography (hereinafter referred to and denoted as “the system 100”), in accordance with an exemplary aspect of the present disclosure. The system 100 may be adapted to transfer data among various devices. Specifically, the system 100 may be adapted to facilitate hardware-based data transfer among various devices. The system 100 may not require any coding or algorithm to facilitate data transfer among various devices. The system 100 may therefore advantageously eliminates the usage of the algorithms that may otherwise required for data transfer and thereby the system 100 may advantageously eliminates the risk of manipulation / modification in coding or algorithms that may alter any protocol in data transfer among various devices. Thus, the system 100 may facilitate secure exchange of data among various devices. The system 100 may facilitate secure data exchange in defense and government agencies and financial institutions. The system 100 may facilitate secure data exchange in secure video conferencing.

[0035] The system 100 may include a data processing apparatus 102, a first external device 104, a second external device 106, and a third external device 108 such that the first through third external devices 104- 108 may be coupled to the data processing apparatus 102.

[0036] The data processing apparatus 102 may be implemented using a digital design hardware (such as a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuits (ASICs), and the like) and does not include any microcontroller for operation. In other words, the data processing apparatus 102 is a completely hardware-based apparatus and does not include any software / algorithm / program / code driven unit. The data processing apparatus 102 may include a user interface 110, one or more data ports 112 (hereinafter interchangeably referred to as “the data ports”), a key port 114, a tamper controller 116, a boot controller 118, an interface unit 120, a cryptography unit 122, a key memory 123, and a tunnel creation unit 142. The tunnel creation unit 142 may be configured to establish the secure tunnel between the first system 100 and a second system 200. The system 200 may replicate the system 100 in architecture and functionality, utilizing similar hardware and / or software components for secure communication and encryption. Both the systems 100 and 200 may employ a hardwarebased approach to ensure robust data confidentiality and integrity.

[0037] In the hardware-based encryption system, the data packet formation and transmission adhere to the layers of the OSI (Open Systems Interconnection) model, delineating a structured approach to communication. Beginning with the Physical Layer (Layer 1), data packets are transmitted as electrical signals over the physical medium, such as ethernet cables. The Data Link Layer (Layer 2) may be responsible for framing data into frames, adding MAC addresses for source and destination identification, and managing error detection and correction mechanisms. At the Network Layer (Layer 3), data packets may be routed between different networks, with network addresses like IP addresses added to facilitate routing. Ensuring reliable end-to-end communication, the Transport Layer (Layer 4) segments data into smaller units, providing mechanisms for error detection, retransmission, and flow control. Finally, the upper layers, including the Session, Presentation, and Application Layers (Layers 5-7) may handle session establishment, data formatting, and application-specific protocols, respectively. Within this system, these OSI layers interact with components such as the Cryptography Unit, Tunnel Creation Unit, and Data Ports to ensure that data packets undergo encryption, decryption, and secure transmission through established tunnels, maintaining the integrity and confidentiality of communication.

[0038] The bidirectional encryption / decryption process within the hardware-based encryption system begins with key management and loading facilitated by the Key USB Subunit 114 and Key Memory 123. The Encryption keys may be stored in the key memory, and when a user initiates a secure communication session, they load the necessary keys via the Key USB port 114. This updates the list of cryptography keys stored in the system's memory. Following key initialization, the Tunnel Creation Unit 142 may orchestrate the establishment of a secure tunnel between the communicating devices that may enable authentication and creating a secure channel for data exchange. When data may be received from the first external device (PT), the Cryptography Unit 122 may select a random encryption key from the updated list, encrypts the data, and generates cipher data. This encrypted data is transmitted over the secure tunnel to the second external device (CT). Upon receiving the encrypted data (CT), the cryptography unit 122 in the second device decrypts it using the corresponding encryption key, obtained based on the information exchanged during tunnel establishment. This bidirectional encryption / decryption process ensures that data is securely transmitted and received between the two devices, maintaining confidentiality and integrity throughout the communication.

[0039] In some aspects of the present disclosure, the encrypted data when received from the second external device 106 through the second ethernet port 130b, the system 100, by way of the data processing apparatus 102, may perform a comprehensive message integrity check to ensure the data has not been altered during transit. Specifically, the cryptography unit 122 may verify the integrity of the received data by checking the message authentication codes (MACs) that were included with the encrypted data packets. Additionally, the system 100 may perform an external parameters parity check, comparing parameters such as packet sequence numbers, timestamps, and other metadata to ensure consistency and detect any discrepancies that could indicate tampering or data corruption. This process helps to maintain the integrity and authenticity of the data throughout the communication process. While sending data from the first external device 104 through the first ethernet port 130a, the system 100 includes additional message authentication information with each data packet. The cryptography unit 122 may generate and append MACs to the encrypted data packets. Along with the MACs, the system incorporates external parameters such as sequence numbers and timestamps to facilitate the parity check on the receiving end. This duallayer security approach, combining message authentication codes and external parameters parity checks, ensures that both the data and its associated metadata are protected against unauthorized alterations, thereby enhancing the overall security and reliability of the communication process between the first and second external devices. In some aspects of the present disclosure, the system 100 may employ a standard encryption technique implemented entirely in hardware, ensuring robust security where key length and encryption parameters are customizable based on specific security requirements. This hardware-based implementation guarantees that the technique itself may not be altered or tampered with by unauthorized parties. By leveraging this hardware-based encryption mechanism, the system 100 maintains strict control over cryptographic operations, mitigating the risk of vulnerabilities associated with software-based implementations.

[0040] Message authentication may ensure the integrity and authenticity of transmitted data in the hardware-based encryption system. The message authentication mechanisms may include digital signatures or message authentication codes (MACs), that may play a vital role in confirming that data packets have not been tampered with during transmission and originated from a trusted source. By including details about how the system implements message authentication, such as the use of cryptographic techniques to generate and verify message authentication codes.

[0041] In some aspects of the present disclosure, the encrypted data when received from the second external device 106 through the second ethernet port 130b, the system 100, by way of the data processing apparatus 102, performs a message integrity check to ensure the data has not been tampered with during transit. Specifically, the cryptography unit 122 verifies the integrity of the received data by checking the message authentication codes (MACs) that were included with the encrypted data packets. While sending data from the first external device 104 through the first ethernet port 130a, the system 100 includes additional message authentication information with each data packet. The cryptography unit 122 generates and appends MACs to the encrypted data packets. This MAC information is used to authenticate and verify the integrity of the data upon reception by the second external device 106, ensuring that any tampering or corruption during transmission can be detected and mitigated.

[0042] The user interface 110 may include an input interface 110a for receiving one or more inputs from the user. The input interface 110a may be further configured to enable the user to select and / or provide one or more inputs for registration and / or authentication of the user to use one or more functionalities of the system 100. In some embodiments of the present disclosure, the input interface 110a may be configured to enable the user to provide inputs to enable password protection for logging-in to the system 100. In some embodiments of the present disclosure, the input interface 110a may be configured to enable the user to provide one or more inputs for a key input authentication of the user. The key input authentication may facilitate the user to input one or more cryptography keys to the data processing apparatus 102 (specifically to be stored in the key memory 123). Examples of the input interface 110a may include, but are not limited to, a touch interface, a mouse, a keyboard, a motion recognition unit, a gesture recognition unit, a voice recognition unit, or the like. Aspects of the present disclosure are intended to include or otherwise cover any type of the input interface 110a including known, related art, and / or later developed technologies.

[0043] The user interface 110 may further include an output interface 110b for displaying (or presenting) one or more outputs (such as notifications generated by the system 100) to the user. Examples of the output interface 110b may include, but are not limited to, a digital display, an analog display, a touch screen display, a graphical user interface, an LED display, an LCD display, an array of LEDs, a light pen, an appearance of a desktop, and / or illuminated characters. Aspects of the present disclosure are intended to include and / or otherwise cover any type of the output interface 110b including known and / or related, or later developed technologies.

[0044] Furthermore, the user interface 110 may include an emergency button 110c, such that the emergency button 110c, when pressed by the user, may be configured to generate an emergency signal to facilitate the user to provide an input to the data processing apparatus 102 regarding a tamper condition of the data processing apparatus 102. Examples of the emergency button 110c may include but are not limited to, push-pull button, twist release button, key release button, touch-sensitive button, and the like. Aspects of the present disclosure are intended to include and / or otherwise cover any type of the emergency button 110c including known and / or related, or later developed technologies.

[0045] In some aspects of the present disclosure, the bidirectional encryption / decryption process within the hardware-based encryption system begins with key management and loading facilitated by the Key USB Subunit 114 and Key Memory 123. The Encryption keys are stored in the key memory, and when a user initiates a secure communication session, they load the necessary keys via the Key USB port 114. This updates the list of cryptography keys stored in the system's memory. Following key initialization, the tunnel Creation Unit 142 may orchestrates the establishment of a secure tunnel between the communicating devices, enabling authentication and creating a secure channel for data exchange. When data is received from the first external device (PT), the cryptography Unit 122 may select a random encryption key from the updated list, encrypts the data, and generates cipher data. This encrypted data is transmitted over the secure tunnel to the second external device (CT). Upon receiving the encrypted data (CT), the Cryptography Unit 122 in the second device decrypts it using the corresponding encryption key, obtained based on the information exchanged during tunnel establishment. This bidirectional encryption / decryption process ensures that data is securely transmitted and received between the two devices, maintaining confidentiality and integrity throughout the communication.

[0046] The data ports 112 may be configured to enable the first and second external devices 104 and 106 to connect with the interface unit 120. Preferably, the data ports 112 may include a first data port 112a and a second data port 112b. The first data port 112a may be configured to connect the first external device 104 to the interface unit 120 such that the data processing apparatus 102 receives the first data (i.e., plain text data) for processing (i.e., encryption) from the first external device 104, or provide the first data after processing (i.e., decryption) to the first external device 104. The second data port 112b may be configured to connect the second external device 106 to the interface unit 120 such that the data processing apparatus 102 may receive the second data (i.e., cipher text data) for processing (i.e., decryption) from the second external device 106, or provide the second data after processing (i.e., encryption) to the second external device 106.

[0047] The tamper controller 116 may be implemented on at least one of, a Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuits (ASICs). The tamper controller 116 may be coupled to the boot controller 118, the interface unit 120, and the key memory 123, and may be configured to detect one or more interferences with the data processing apparatus 102 based on a set of tamper conditions. The tamper controller 116 may further be configured to erase critical data of the data processing apparatus 102, when at least one tamper condition of the set of tamper conditions is true.

[0048] In some aspects of the present disclosure, the set of tamper conditions may include at least one of, a predefined number of wrong authentication attempts by the user, press of an emergency button 110c by the user to generate the emergency signal, and a physical damage to the data processing apparatus 102.

[0049] In some aspects of the present disclosure, the critical data of the data processing apparatus 102 may include at least one of, the list of cryptography keys, the updated list of cryptography keys, and a set of predefined context protocols that may be stored in the boot controller 118.

[0050] In some aspects of the present disclosure, the tamper controller 116 may include a sensing unit (not shown) such that the sensing unit may include a plurality of sensors that may be configured to determine the physical damage to the data processing apparatus 102. In some aspects of the present disclosure, the sensing unit may be configured to determine opening of a lid of the data processing apparatus 102. Examples of the plurality of sensors for determination of the physical damage to the data processing apparatus 102 may include, but are not limited to, a proximity sensor, a pressure sensor, an inertial sensor, an impact sensor, a shock sensor, a load cell sensor, and the like. Aspects of the present disclosure are intended to include and / or otherwise cover any type of the sensors, without deviating from the scope of the present disclosure.

[0051] The boot controller 118 may include a context unit 124 and a boot initiation unit 126. The context unit 124 may be configured to store a set of pre-defined context protocols (i.e., set of hardware-based protocols to enable boot-up of various components of the data processing apparatus 102).

[0052] The boot initiation unit 126 may be configured to generate one or more boot signals for initiation of various components of the data processing apparatus 102 (such as the user interface 110, the data ports 112, the key port 114, the tamper controller 116, the interface unit 120, the cryptography unit 122, and the key memory 123) based on the set of predefined context protocols stored in the context unit 124. Specifically, the boot signal may initiate one or more operations of at least one of, the key USB subunit 132, the cryptography unit 122, the interface controller 128, the hardware interface 134, and an ethernet port 130.

[0053] The boot initiation unit 126 may further be configured to stop one or more operations of at least one of, the various components of the data processing apparatus 102 (such as the user interface 110, the data ports 112, the key port 114, the tamper controller 116, the interface unit 120, the cryptography unit 122, and the key memory 123) when at least one tamper condition of the set of tamper conditions is true. Specifically, the boot initiation unit 126 may be configured to receive information of a tamper condition of the set of tamper conditions from the tamper controller 116, and generate an alert signal corresponding to the tamper condition to be transmitted to the various entities of the data processing apparatus 102. Preferably, the alert signal may disable (or stop) one or more operations of at least one of, the key USB subunit 132, the cryptography unit 122, the interface controller 128, the hardware interface 134, and the ethernet port 130. The interface unit 120 may include an interface controller 128, an ethernet port 130, a key USB subunit 132, a hardware interface 134, and a sequence controller 136. In some aspects of the present disclosure, the interface controller 128 may be configured to receive the one or more inputs from the user for the authentication of the user to enable the data processing apparatus 102 to perform at least one of, the encryption of the first data, and the decryption of the second data. The interface controller 128 may further be configured to authenticate the user based on the one or more inputs received by the user by way of the user interface 110. Furthermore, the interface controller 128 may be configured to verify the one or more inputs for key input authentication of the user. In some aspects of the present disclosure, to verify the one or more inputs for the key input authentication, the interface controller 128 may be configured to compare the one or more inputs for key input authentication with a set of predefined key input inputs. Furthermore, the interface controller 128 may be configured to control one or more operations of the user interface 110 to enable reception of one or more inputs from the user and / or provide (displaying or presenting) one or more outputs (or notifications) to the user. In some aspects of the present disclosure, the interface controller 128 may be implemented on at least one of, a Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuits (ASICs).

[0054] The Ethernet port 130 functions as a crucial component for managing data exchange within the hardware-based encryption system. It is configured to facilitate the exchange of the first data between the first external device 104 and the cryptography unit 122. Specifically, for encryption purposes, the Ethernet port 130 enables the first data port 112a to receive data from the first external device 104. Conversely, for decryption tasks, it allows the first data port 112a to transmit data to the first external device 104. Similarly, for the second external device 106, the Ethernet port 130 enables the second data port 112b to provide data for encryption and receive decrypted data. Additionally, the Ethernet port 130 may be tasked with initializing either the first external device 104 or the second external device 106. Furthermore, it generates one or more completion signals corresponding to data transfer activities with the external devices. Given its pivotal role in governing data exchange and device initialization, it may be more accurately termed as the Ethernet / Top Sequence Controller.

[0055] The key port 114 may be configured to enable the third external device 108 to connect with the interface unit 120. The key port 114, upon the key input authentication of the user, may further enable the user to provide the one or more cryptography keys to the interface unit 120 such that the one or more cryptography keys may be added to the key memory 123 to generate an updated list of cryptography keys in the key memory 123.

[0056] In some aspects of the present disclosure, when the key input authentication of the user is true, the key USB subunit 132 may be configured to enable reception of one or more cryptography keys from the user to be added to the list of the cryptography keys for generation of the updated list of cryptography keys. The updated list of cryptography keys may be stored in the key memory 123. In some aspects of the present disclosure, the key USB subunit 132 may further be configured to select a cryptography key randomly from the updated list of cryptography keys stored in the key memory 123 for encryption of the first data and / or decryption of the second data.

[0057] The hardware interface 134 may be implemented on at least one of, a Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuits (ASICs). The hardware interface 134 may be configured to enable exchange of the first and second data between the ethernet port 130 and the cryptography unit 122. In some aspects of the present disclosure, the hardware interface 134 may be configured to enable exchange of the cryptography key that is randomly selected from the updated list of cryptography keys to the cryptography unit 122. The hardware interface 134 being implemented on at least one of the Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuits (ASICs) may provide data exchange with a very low (or zero) latency.

[0058] The sequence controller 136, upon bootup of the interface unit 120, may be configured to perform one or more specification checks on the various components of the interface unit 120 (i.e., the interface controller 128, the ethernet port 130, the key USB subunit 132, and the hardware interface 134) and the first through third external devices 104- 108. The sequence controller 136 may further be configured to enable the various components of the interface unit 120 in a pre-defined sequence for encryption of the first data and / or decryption of the second data. The cryptography unit 122 may include an encryption engine 138, and a decryption engine 140. The encryption engine 138 may be configured to encrypt the first data to generate the second data based on the cryptography key that is randomly selected from the list of updated cryptography keys stored in the key memory 123. The decryption engine 140 may be configured to decrypt the second data to generate the first data, based on the cryptography key that is randomly selected from the list of updated cryptography keys. Preferably, the cryptography unit 122 may be configured to encrypt the first data and / or decrypt the second data using Advanced Encryption Standards-256 (AES-256). In some aspects of the present disclosure, the cryptography unit 122 may be configured to encrypt each cryptography key of the list of cryptography keys and each cryptography key of the one or more cryptography keys prior to storage in the key memory 123. The cryptography unit 122, prior to the generation of the second data, may further be configured to decrypt, the cryptography key that is randomly selected from the list of cryptography keys.

[0059] The tunnel creation unit 142 may be configured to establish a tunnel between the first system 100 and the second system 200. The first system 100 and the second system 200 may be connected to each other by way of the ethernet port. The tunnel between the first system 100 and the second tunnel 200 may facilitate the transfer of the data through the tunnel that may be formed between the first system 100 and the second system 200.

[0060] In some aspects of the present disclosure, the system 100 may be configured to facilitate header construction for sharing key related information to the first and second external devices 104, 106.

[0061] The system 100 may employ a secure boot mechanism that initializes without interruptions or firmware dependencies. The system 100 may distinguish between super users, who manage key updates and system operations, and normal users, who perform encryption and decryption tasks after authentication. Customizable user roles can be added as needed. The device features dual Ethernet ports for data transfer: one for plain-text input and another for cipher-text output, utilizing customizable encryption techniques that may apply multiple encryption layers (N-layers) to the data, enhancing security per user requirements. Encrypted data packets may traverse public networks through a secure tunnel established and maintained by the hardware, introducing minimal latency and embodying a "bump in the wire" approach. A tamperproof mechanism ensures that sensitive data, such as keys and contexts, may be erased when an unauthorized access is detected.

[0062] The Ethernet flow controller verifies peripheral connections and internet connectivity upon boot-up, while the user interface block manages the device's display, keypad, and token-based authentication. The secure tunnel building block handles tunnel protocol stack implementation, peer authentication, and data encryption / decryption. The network layer stack manages data flow and ARP requests / responses, while the key- USB subsystem handles key loading and storage. The encryption and decryption engines perform hardware-based data encryption and decryption, respectively, using session-specific keys generated by the key manager. The secure boot controller ensures a secure startup of essential subsystems, and the tamper controller triggers data erasure if tampering is detected. The headers used in this system contain essential address and protocol information, facilitating correct packet direction and secure communication. By maintaining precise synchronization and employing dynamic key generation, the Ethernet Encryption System ensures robust security and integrity in data transfer over Ethernet networks.

[0063] In some aspects of the present disclosure, the cryptography unit 122 may facilitate to have N-layer encryption. The N-layer encryption as used herein refers to multiple layers of encryption. For example, if N=l, there is a single layer of encryption. In some other examples, if N=2, there are 2 layers of encryption and the like. The value of the “N” may be decided based on security grade requirements. Similarly for decryption for multiple layers, the decryption may happen as many times as per the value of “N” is chosen. In encryption cycle, the system 100 may receive the data packet from the ethernet port 130, encrypts the plain data packet, and then transmits the encrypted data packet to the ethernet port 130 in a proprietary format which means the data packets undergo N-layer encryption. Similarly, in decryption cycle, the system 100 may receive the data from the second ethernet port 130b and decrypts the data packet for N layers, and transmits the data packet to the first ethernet port 130a. The first ethernet port 130a as mentioned herein is PT ethernet port and the second ethernet port 130b as mentioned herein is CT ethernet port.

[0064] The system 100 may facilitate encryption and / or decryption of the data parallelly together. In some preferred aspects of the present disclosure, the cryptography unit 122 may facilitate two layers of encryption. For example, the cryptography unit 122 may facilitate data encryption and tunnel encryption. The cryptography unit 122 may facilitate data encryption of the first data based on the cryptography key that may be randomly selected from the list of updated cryptography keys stored in the key memory 123. The first layer of encryption may eliminate visibility of the first data to external network since the first data is encrypted. The cryptography unit 122 may facilitate tunnel encryption. The tunnel may have a custom technique which may be derived from IPsec protocols. The cryptography unit 122 may require unique keys that may be generated dynamically during the tunnel encryption. The first data may be again encrypted by way of the second layer of the multiple layers of encryption. In other words, the first data may be again encrypted with tunnel encryption parameters. Thus, the second layer of encryption may advantageously provide an additional layer of security to the first data.

[0065] In some aspects of the present disclosure, the system 100 may include a network layer stack unit that may facilitate to manage data flow between the tunnel creation unit 142 and the ethernet port 130. The network layer stack unit may have network layer 3 and layer 2 that is implemented in hardware. The network layer stack unit also exhibits functionality of ARP request and response for a link partner that is designed and implemented in hardware logic. The first through third external devices 104-108 may be storage devices and may be configured to store first data, second data, and one or more cryptography keys, respectively. Preferably, the first data may be a plain text data. In some aspects of the present disclosure, the first data (i.e., the plain text data) may be generated by decryption of the second data. Preferably, the second data may be a cipher text data. In some aspects of the present disclosure, the second data (i.e., the cipher text data) may be generated by encryption of the first data. Specifically, the one or more cryptography keys may be used for encryption of the first data and / or decryption of the second data. Examples of the first through third external devices 104-108 may include, but are not limited to a Read-Only Memory (ROM), a Random- Access Memory (RAM), a flash memory, a removable storage drive, a hard disk drive (HDD), a solid-state memory, a magnetic storage drive, a Programmable Read Only Memory (PROM), an Erasable PROM (EPROM), and / or an Electrically EPROM (EEPROM). Aspects of the present disclosure are intended to include or otherwise cover any type of the first through third external devices 104-108 including known, related art, and / or later developed storage devices. Preferably, the first through third external devices 104-108 may be Universal Serial Bus (USB) storage devices.

[0066] In operation, the data processing apparatus 102 may be configured to enable the user to provide the one or more inputs for authentication and / or key input authentication of the user. Upon key input authentication of the user, the data processing apparatus 102 may be configured to receive the one or more cryptography keys from the user. The data processing apparatus 102 may further be configured to add the one or more cryptography keys to the list of cryptography keys to generate the updated list of cryptography keys, that is stored in the key memory 123. Upon authentication of the user, the data processing apparatus 102 may be configured to receive the first / second data from the first or second external devices 104-106 for encryption or decryption, respectively. The data processing apparatus 102, upon reception of the first or second data, may be configured to select the cryptography key randomly from the updated list of cryptography keys stored in the key memory 123 for encryption of the first data and / or decryption of the second data. The data processing apparatus 102 may further be configured to provide the first or second data to the cryptography unit 122 for encryption or decryption, respectively. Upon encryption and decryption of the first or second data, the data processing apparatus 102 may be configured to generate the second or first data, respectively. Furthermore, the data processing apparatus 102 may be configured to provide the second or first data to the second or first external devices 104-106, respectively. Parallelly, the system 100, by way of the tamper controller configured to detect one or more interferences on the data processing apparatus 102, based on the set of tamper conditions. Upon detection of at least one tamper condition of the set of tamper conditions, the data processing apparatus 102 may be configured to erase the critical data of the data processing apparatus 102.

[0067] FIG. 2 illustrates a flow chart of a method 200 for hardware-based cryptography, in accordance with an aspect of the present disclosure. The method 200 may include following steps to facilitate hardware-based cryptography: -

[0068] At step 202, the system 100 may enable the user to provide one or more inputs. Specifically, the system 100, by way of the data processing apparatus 102, may enable the user to provide the one or more inputs. The input interface 110a of the user interface 110 may facilitate the user to provide the one or more inputs. The input interface 110a may be further configured to enable the user to select and / or provide one or more inputs for registration and / or authentication of the user to use one or more functionalities of the system 100.

[0069] At step 204, the system 100 may be configured to authenticate the user before allowing any key loading operations. Specifically, the system 100, by way of the data processing apparatus 102, may compare the user's authentication input with stored credentials to verify the user's identity. The user interface 110, through the input interface 110a, may facilitate this authentication process. Only upon successful comparison and verification, the authorized user is granted the ability to perform key loading into the key memory 123.

[0070] At step 206, the system 100 may be configured to enable to store a list of cryptography keys. Specifically, the system 100, by way of the key memory 123, may be configured to store the list of cryptography keys.

[0071] At step 207, the system 100 may be configured to enable reception of one or more cryptography keys from the user. Specifically, the system 100, by way of the key USB subunit 132 that may be coupled to the key memory 123, may enable reception of the one or more cryptography keys from the user. The one or more cryptography keys may be added to the list of cryptography keys to generate the updated list of cryptography keys.

[0072] At step 208, the system 100 may be configured to enable the user to provide the configuration inputs.

[0073] At step 209, the system 100 may be configured to establish the tunnel between the first device 104 of the first system 100 and the first device (not shown) of the second system 200. Specifically, the system 100 may be configured to establish the tunnel between the first device 104 of the first system 100 and the first device (not shown) of the second system 200 by way of the tunnel creation unit 142.

[0074] At step 210, the system 100 may be configured to exchange the first and second data between the first external device 104, the second external device 106, and the cryptography unit 122 by way of the ethernet port 130.

[0075] At step 212, the system 100 may be configured to encrypt the first data provided by the first external device 104 to generate second data. Specifically, the system 100, by way of the cryptography unit 122, may be configured to encrypt the first data provided by the first external device 104. The cryptography unit 122 may be configured to encrypt the first data based on the cryptography key that may be randomly selected from the updated list of cryptography keys. At step 214, the system 100 may be configured to decrypt the second data to generate the first data. Specifically, the system 100, by way of the cryptography unit 122, may be configured to decrypt the second data to generate the first data. The cryptography unit 122 may be configured to decrypt the second data based on the cryptography key that may be randomly selected from the updated list of the cryptography keys.

[0076] In some aspects of the present disclosure, prior to each abovementioned step (i.e., from steps 202 to 212), the data processing apparatus 102 may check (or detect) the tamper on the data processing apparatus 102 based on the set of tamper conditions. Specifically, the tamper controller 116 may detect or check the tamper on the data processing apparatus 102 based on the set of tamper conditions. The data processing apparatus 102 may further erase the critical data associated with the data processing apparatus 102, when at least one condition of the set of tamper conditions is true. Specifically, the tamper controller 116 may be configured to erase the critical data that may be associated with the data processing apparatus 102, when the at least one condition of the set of tamper conditions is true. In some aspects of the present disclosure, the set of tamper conditions includes at least one of, the predefined number of wrong authentication attempts by the user, the press of the emergency button 110c by the user to generate the emergency signal, and the physical damage to the data processing apparatus 102. In some aspects of the present disclosure, the critical data associated with the data processing apparatus 102 may include at least one of, the list of cryptography keys, the updated list of cryptography keys, and the set of predefined context protocols stored in the boot controller 118.

[0077] At step 216, the system 100 may be configured to periodically negotiate and monitor the session parameters.

[0078] The foregoing discussion of the present disclosure has been presented for purposes of illustration and description. It is not intended to limit the present disclosure to the form or forms disclosed herein. In the foregoing Detailed Description, for example, various features of the present disclosure are grouped together in one or more aspects, configurations, or aspects for the purpose of streamlining the disclosure. The features of the aspects, configurations, or aspects may be combined in alternate aspects, configurations, or aspects other than those discussed above. This method of disclosure is not to be interpreted as reflecting an intention the present disclosure requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed aspect, configuration, or aspect. Thus, the following claims are hereby incorporated into this Detailed Description, with each claim standing on its own as a separate aspect of the present disclosure.

[0079] Moreover, though the description of the present disclosure has included description of one or more aspects, configurations, or aspects and certain variations and modifications, other variations, combinations, and modifications are within the scope of the present disclosure, e.g., as may be within the skill and knowledge of those in the art, after understanding the present disclosure. It is intended to obtain rights which include alternative aspects, configurations, or aspects to the extent permitted, including alternate, interchangeable and / or equivalent structures, functions, ranges or steps to those claimed, whether or not such alternate, interchangeable and / or equivalent structures, functions, ranges or steps are disclosed herein, and without intending to publicly dedicate any patentable subject matter.

[0080] As one skilled in the art will appreciate, the system 100 includes a number of functional blocks in the form of a number of units and / or engines. The functionality of each unit and / or engine goes beyond merely finding one or more computer algorithms to carry out one or more procedures and / or methods in the form of a predefined sequential manner, rather each engine explores adding up and / or obtaining one or more objectives contributing to an overall functionality of the system 100. Each unit and / or engine may not be limited to an algorithmic and / or coded form, rather may be implemented by way of one or more hardware elements operating together to achieve one or more objectives contributing to the overall functionality of the system 100. Further, as it will be readily apparent to those skilled in the art, all the steps, methods and / or procedures of the system 100 are generic and procedural in nature and are not specific and sequential.

[0081] Certain terms are used throughout the following description and claims to refer to particular features or components. As one skilled in the art will appreciate, different persons may refer to the same feature or component by different names. This document does not intend to distinguish between components or features that differ in name but not structure or function. While various aspects of the present disclosure have been illustrated and described, it will be clear that the present disclosure is not limited to these aspects only. Numerous modifications, changes, variations, substitutions, and equivalents will be apparent to those skilled in the art, without departing from the spirit and scope of the present disclosure, as described in the claims.

Claims

We Claim:

1. A data processing apparatus (102) comprising: a key memory (123) configured to store a list cryptography keys; a key USB subunit (132) coupled to the key memory (123) and configured to enable reception of one or more cryptography keys from a user, wherein the one or more cryptography keys are added to the list of cryptography keys to generate an updated list of cryptography keys; a cryptography unit (122) configured to (i) encrypt first data provided by way of a first external device (104) to generate second data based on a cryptography key that is randomly selected from the updated list of cryptography keys and (ii) decrypt the second data to generate the first data based on the cryptography key; and a first ethernet port (130a) and a second ethernet port (130b) configured to facilitate exchange of (i) the first data between the first external device (104) and the cryptography unit (122) and (ii) the second data between the cryptography unit (122) and a second external device (106); and a tunnel creation unit (142) configured to create a tunnel between the first system (100) and the second system (200).

2. The data processing apparatus (102) as claimed in claim 1, wherein the tunnel creation unit (142) is further configured to (i) enable the ethernet port (130) and (ii) authenticate the first and second external devices (104, 106) prior to creation of the tunnel.

3. The data processing apparatus (102) as claimed in claim 1, wherein the tunnel created between the first external device (104), the cryptography unit (122), and the second external device (106) utilizes a proprietary tunneling protocolimplemented within the data processing apparatus (102) to ensure secure and efficient exchange of the first and second data through the ethernet port (130).

4. The data processing apparatus (102) as claimed in claim 1, wherein the tunnel creation process includes authentication of the first system (100) and the second system (200).

5. The data processing apparatus (102) as claimed in claim 1, further comprising a network layer stack configured to manage the data flow between the secure tunnel creation unit (142) and the second ethernet port (130b), wherein the network layer stack includes hardware-implemented network layer 3 and layer 2 functionalities and supports ARP request and response handling.

6. The data processing apparatus (102) as claimed in claim 1, further comprising an encryption engine configured to perform hardware-based encryption of plain data received from the first ethernet port (130a) and to send the resulting cipher data to the second ethernet port (130b), wherein the encryption engine utilizes a randomly generated key from the key manager for each new session.

7. The data processing apparatus (102) as claimed in claim 1, wherein the cryptography unit (122) is further configured to dynamically generate a new cryptography key for each encryption session, such that the new cryptography key is used to encrypt data received from the first external device (104) and decrypt data received from the second external device (106).

8. The data processing apparatus (102) as claimed in claim 1, further comprising a tamper controller (116) configured to (i) detect one or more interferences with the data processing apparatus (102) based on a set of tamper conditions, and (ii) erase critical data associated with the data processing apparatus (102), when at least one tamper condition of the set of tamper conditions is true.

9. The data processing apparatus (102) as claimed in claim 1, further comprising a secure boot controller configured to securely boot the key USB subunit (132), the cryptography unit (122), and the tunnel creation unit (142) without any software or firmware, using a predefined context stored in a secure memory.

10. The data processing apparatus (102) as claimed in claim 1, wherein the boot controller (118) is further configured to stop one or more operations of at least one of, the key USB subunit (132), the cryptography unit (122), the interface controller (128), the hardware interface (134), and the ethernet port (130) when at least one tamper condition of the set of tamper conditions is true.

11. The data processing apparatus (102) as claimed in claim 1, wherein the critical data associated with the data processing apparatus (102) comprising at least one of, the list of cryptography keys, the updated list of cryptography keys, and a set of predefined context protocols stored in the boot controller (118).

12. The data processing apparatus (102) as claimed in claim 1, wherein the cryptography unit (122) is further configured to (i) encrypt each cryptography key of the list of cryptography keys and each cryptography key of the one or more cryptography keys prior to storage in the key memory (123), and (ii) decrypt, prior to the generation of the second data, the key that is randomly selected from the updated list of cryptography keys.

13. A method (200) for tunnel-based hardware-based cryptography comprising: authenticating (204), by way of a data processing apparatus (102), a user; storing (206), by way of a key memory (123), a list of cryptography keys; enabling (207), by way of a key USB subunit (132) coupled to the key memory (123), reception of one or more cryptography keys from a user, wherein the one or more cryptography keys are added to the list of cryptography keys to generate an updated list of cryptography keys;enabling (208) the user to provide configuration inputs; creating (209) a tunnel between a first system (100) and a second system (200); exchanging (210), by way of an ethernet port (130), first and second data between a first external device (104), a second external device (106), and a cryptography unit (122); encrypting (212), by way of the cryptography unit (122), the first data provided by the first external device (104) to generate the second data based on a cryptography key that is randomly selected from the updated list of cryptography keys; decrypting (214), by way of the cryptography unit (122), the second data to generate the first data, based on the cryptography key; and periodically negotiating (216) and monitoring session parameters.

14. The method (200) as claimed in claim 12, wherein the first and second data is exchanged between the first external device (104), the second external device (106), and the cryptography unit (122) by way of a hardware interface (134) such that the hardware interface (134) is implemented on at least one of, a Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuits (ASICs).

15. The method (200) as claimed in claim 12, further comprising (i) detecting, by way of a tamper controller (116), a tamper on a data processing apparatus (102), based on a set of tamper conditions, and (ii) erasing, by way of the tamper controller (116), critical data associated with the data processing apparatus (102), when at least one condition of the set of tamper conditions is true.

16. The method (200) as claimed in claim 14, wherein the set of tamper conditions comprising at least one of, (i) a predefined number of wrong authenticationattempts by the user, (ii) press of an emergency button (110c) by the user to generate an emergency signal, and (iii) a physical damage to the data processing apparatus (102).

Images