Cryptographic device with detachable data planes

摘要

A system for performing encryption and/or decryption may include a parent cryptographic device. The parent cryptographic device may be configured to receive a first cryptographic key. The parent cryptographic device may be configured to determine one or more session keys based on the first cryptographic key and/or internally generated random data bits. The parent cryptographic device may be configured to insert the one or more session keys onto one or more child cryptographic devices that are operably connected to the parent cryptographic device. The one or more child cryptographic devices may be configured to receive the one or more session keys from the parent cryptographic device, and perform one or more of encryption or decryption of communications exchanged with another child cryptographic device of the one or more child cryptographic devices. The one or more child cryptographic devices may perform encryption/decryption after separation from the parent cryptographic device.

主权项

1. A system for performing one or more of encryption and/or decryption, the system comprising:
a parent cryptographic device comprising:
a key fill port,a microprocessor circuit configured to:
interface to a key fill device via the key fill port,authenticate with the key fill device, andreceive a first cryptographic key from the key fill device,determine one or more session keys based on the first cryptographic key,a memory configured to store the first cryptographic key, wherein the memory is configured with one or more anti-tamper hardware mechanisms, andat least one interface configured to insert the one or more session keys onto one or more child cryptographic devices that are functionally connected to the parent cryptographic device; and at least a first child cryptographic device of the one or more child cryptographic devices, wherein at least the first child cryptographic device comprises:
a configuration interface configured to receive the one or more session keys from the parent cryptographic device, anda programmable logic device configured to perform one or more of encryption or decryption of communications exchanged with at least a second child cryptographic device.