Context-agile encryption for high speed communication networks

Abstract

IntroductionDifferent applications have different security requirements for data privacy, data integrity, and authentication. Encryption is one technique that addresses these requirements. Encryption can protect proprietary information as it passes from one end of a complex computer network to the other, even through untrusted intermediate systems, such as on the Internet. Encryption technology has many other uses including encrypting disk files and producing digital signatures.These various applications often have different needs. For example, certain applications may be able to tolerate long times to encrypt/decrypt information, but may also need to protect that information for a long period of time. Other applications, dealing with data that is sensitive while useful, but quickly becomes stale, might benefit from short encryption/decryption times that may accompany a less cryptographically robust algorithm. Digital signature systems typically demand rapid generation or verification of signatures. Depending on how frequently a signature must be verified, the system may need to be optimized for rapid signature generation or rapid signature verification. Efficient high speed communication systems, being of a real-time nature, often require encryption systems that optimize throughput while minimizing network traffic delay. Additional requirements may include minimizing error magnification, deterring message playback attacks, interoperability between faster and slower encryptors/decryptors, and quick recovery from cryptographic synchronization loss. This paper discusses context-agile hardware for end-to-end encryption systems designed for use in high speed communications networks, such as those employing Asynchronous Transfer Mode (ATM) technology. Section 2 compares ATM switch designs with ATM encryptor designs and defines three types of agile encryption to meet the varying needs regarding keys, cryptographic robustness, algorithms, and other characteristics. The application area and advantages are outlined for each type of agility. Section 3 discusses implementation issues, such as high-speed context-switching and the potential effects on ATM Quality of Service (QoS). Section 4 briefly covers management

ATM Network Security

“…This can be an arbitrary combination of DES, TripleDES, and plaintext communication, respectively ECB and CBC operational mode for each VC and communication direction transmit or receive. Providing arbitrary combinations of encryption algorithms (DES or TripleDES) and operational modes (ECB or CBC) is referred to as algorithm agile encryption [28], robustness agile encryption respectively [29]. HADES employs on-chip session key storage and management blocks which utilise CAM techniques to identify a certain encryption context, and random access memory (RAM) techniques to store the session keys and the initialisation vectors (IV s).…”

ATM Security

“…In [9], algorithm-agile encryption is introduced, where the encryption unit not just switches between keys, it even enables different encryption algorithms to be applied to different VCs. Finally, the concept of a ATM confidentiality system for 10 Gbps OC-192 is discussed in [10].…”

A 155 Mbps Triple-DES Network Encryptor

“…Further requirements may even strive for assigning different encryption algorithms to each VC, such as DES and Triple-DES, which is referred to as algorithm-agile encryption [8]. Actually, the encryption unit presented in this paper allows to uniquely assign the encryption context including the operational mode to each connection which is called context-agile encryption [6].…”