Encrypting method and apparatus enabling multiple access for multiple services and multiple transmission modes over a broadband communication network

Claim 3

The method in accordance with claim 1, said method encrypting partially in software and partially in hardware, said method further comprising the steps of: utilizing said identifying pattern of bits as a unique encrypting variable for a portion of encryption performed in software; and utilizing said identifying pattern of bits as a unique encrypting variable for a portion of encryption performed in hardware.

Claim 4

The method in accordance with claim 2 further comprising the steps of: creating a permanent key, said permanent key being mutually generated and mutually authenticated between said source and said destination; utilizing said permanent key to generate a connection key, said connection key mutually generated and mutually authenticated between said source and said destination; encrypting said identifying pattern of bits in software, said connection key operable as an encrypting key, said encrypting process producing a series of cryptovariables; sending cryptosync to a high speed engine, said high speed engine operable to encrypt said cryptosync, said high speed engine providing a rapid keystream generation output; and sending said cryptovariables to said high speed engine, said cryptovariables operable as keys for encryption of said cryptosync within said high speed engine.

Claim 5

The method in accordance with claim 3 wherein said connection key is replaced with a unique mutually generated and authenticated connection key for each new connection between said source and said destination.

Claim 6

The method in accordance with claim 3 wherein said connection key is replaced with a unique mutually generated and authenticated connection key whenever a specific duration of time has expired.

Claim 7

The method in accordance with claim 3 wherein each of said cryptovariables is replaced after a specified number of keystream bytes generated from said high speed engine with each of said cryptovariables.

Claim 8

The method in accordance with claim 1 further comprising the steps of: incorporating said identifying pattern of bits as a cryptosync stream; dividing said cryptosync stream into a multiplicity of frame counter packets; assigning each of said multiplicity of frame counter packets to each of a multiplicity of downstream frames; broadcasting each of said multiplicity of downstream frames to a plurality of destinations; reformatting said multiplicity of frame counter packets into said cryptosync stream at said plurality of destinations; and utilizing said cryptosync stream at each of said plurality of destinations as a broadcast clock, said broadcast clock utilized for decryption of said transmitted digital signal.

Claim 9

The method in accordance with claim 7 wherein broadcast of each of said multiplicity of frame counter packets is transported within a region of downstream frame structure dedicated to transport of asynchronous data.

Claim 10

The method in accordance with claim 7 wherein broadcast of each of said multiplicity of frame counter packets is transported within a fast control field (FCF), said FCF being a subdivided portion of said region of downstream frame structure dedicated to transport control and messaging information.

Claim 13

The method in accordance with claim 10, said method including a first portion of encryption performed in software and a second portion of encryption performed in hardware, said method further comprising the steps of: encrypting said unique bit pattern with a secret connection key as said first portion; utilizing said unique bit pattern as a pseudo-frame counter, said pseudo-frame counter an input to a pseudorandom feedback shift register (PFSR); transforming said unique bit pattern within said PFSR into a high speed engine (HSE) cryptosync; inputting said HSE cryptosync to a device implementing said second portion of encryption, said device comprising a high speed engine (HSE); utilizing said first portion of encryption output as an input to said HSE; generating an encryption keystream from said HSE, said encryption keystream formulated by encrypting said HSE cryptosync with said first portion of encryption output as said key; and utilizing said encryption keystream to encrypt a stream of plaintext from said source into a stream of ciphertext, said ciphertext to be transmitted to said destination.

Claim 14

The method in accordance with claim 11 wherein said HSE cryptosync further comprises an input associating individual subframe identities with a unique combination of bits within said HSE cryptosync.

Claim 15

The method in accordance with claim 11 wherein said PFSR output is utilized to extend said PFSR uniqueness across a downstream subframe by acting as a scrambler.

Claim 16

The method in accordance with claim 11 wherein said PFSR output is utilized to pre-spread input to said HSE, said pre-spreading reducing computational loading of said HSE.

Claim 17

The method in accordance with claim 11 wherein said PFSR output is utilized to cryptoinitialize said HSE.

Claim 18

The method in accordance with claim 11 further comprising the steps of: encrypting said secret connection key to generate a plurality of cryptovariables within said first portion of encryption; periodically replacing a previous cryptovariable with a unique new cryptovariable; and transmitting a mini-message to said destination, said mini-message used to notify said destination of a utilization of said unique new cryptovariable.

Claim 19

The method in accordance with claim 16 wherein said mini-message is a predecessor mini-message, said predecessor mini-message transmitted prior to said utilization of said unique new cryptovariable.

Claim 20

The method in accordance with claim 16 wherein said mini-message is a successor mini-message, said successor mini-message transmitted subsequent to said utilization of said unique new cryptovariable.

Claim 21

The method in accordance with claim 16 wherein said mini-message is transmitted within a fast control field.

Claim 22

The method in accordance with claim 11, said method operable for transmission of synchronous transfer mode (STM) protocol data units (PDUs), said method further comprising the steps of: sampling said encryption keystream designated for encryption of said STM PDUs; writing a plurality of STM PDU encryption keystream sample values to at least one table, said at least one table configured as a pseudo-shift register; reading said plurality of STM PDU encryption keystream sample values from said at least one table after an appropriate temporal delay, said appropriate temporal delay chosen to compensate for context switching overhead and cryptoalgorithm latency encountered with STM PDU transmission; encrypting STM PDU plaintext with said plurality of STM PDU encryption keystream sample values, said sample values having been read from at least one table after said appropriate temporal delay; and transmitting a plurality of encrypted STM PDUs to said destination for subsequent decryption.

Claim 23

The method in accordance with claim 20 wherein said at least one table is implemented as a first table and a second table; said first table used for writing to while said second table is being read from; and said first table used for reading from while said second table is being written to.

Claim 24

The method in accordance with claim 20 wherein said at least one table is implemented with one table, said table providing said appropriate temporal delay by performing as a pseudo-shift register.

Claim 25

The method in accordance with claim 10, said method encompassing bi-directional data transfer between a common source and a plurality of destinations, said method further comprising the steps of: mutually authenticating said common source with each of said plurality of destinations; and mutually generating a shared secret permanent key between said common source and each of said plurality of destinations.

Claim 26

The method in accordance with claim 23, said method featuring an asymmetric encrypting/decrypting exchange for mutual authentication and shared secret permanent key generation, further comprising the steps of: transmitting at least one encrypted authenticating message from said common source to each of said plurality of destinations; transmitting encrypted authenticating return messages from each of said plurality of destinations to said common source over a separate plain old telephone service (POTS) return; utilizing encryption/decryption functions using squaring operations at each of said plurality of destinations; and utilizing encryption/decryption functions using square root operations at said common source.

Claim 27

The method in accordance with claim 23, said method featuring an asymmetric encrypting/decrypting exchange for mutual authentication and shared secret permanent key generation over a two-way broadband transmission medium, further comprising the steps of: transmitting downstream encrypted authenticating messages from said common source to each of said plurality of destinations over said two-way broadband transmission medium; transmitting return upstream encrypted authenticating messages from each of said plurality of destinations to said common source over said two-way broadband transmission medium; utilizing encryption/decryption functions using squaring operations at each of said plurality of destinations; and utilizing encryption/decryption functions using square root operations at said common source.

Claim 30

The method in accordance with claim 26, said method encompassing bi-directional data transfer between said headend and said plurality of cable modems, said method further comprising the steps of: mutually authenticating said headend with each of said plurality of cable modems; and mutually generating a shared secret permanent key between said headend and each of said plurality of cable modems.

Claim 31

The method in accordance with claim 27 wherein said headend is operable to select an appropriate level of security.

Claim 32

The method in accordance with claim 27, said method incorporating a process of mutually authenticating said headend to each of said plurality of cable modems, said method requiring the bilateral transmission of certificates between said headend and each of said plurality of cable modems, said method requiring generation of random numbers at said headend and each of said plurality of cable modems, said method further comprising the steps of: incorporating a random number generator at said headend; writing a unique random seed key within a nonvolatile memory component of each of said plurality of cable modems; generating a random number as required at the headend via said random number generator; publicly transmitting said random number to one of said plurality of cable modems; and one of said plurality of cable modems performing as a virtual random number generator by encrypting said random number with said unique random seed key.

Claim 33

A bi-directional broadband communications and data transfer encryption system having a plurality of cable modems, said plurality of cable modems interconnected with a headend via a transmission medium having a multiple access upstream channel and a broadcast downstream channel, comprising: a cryptosync clock at said headend, said cryptosync clock dividing time into a multiplicity of periodic units; a CV refresh unit, said CV refresh unit obtaining one input from said cryptosync clock and a second input from a connection key, said CV refresh unit encrypting said cryptosyne clock with said connection key, said CV refresh unit producing a cryptovariable output; a load subframe counter, said load subframe counter obtaining one input from said cryptosync clock, a second input of a subframe identifying number, and a third input of a subframe start indicator; a cryptosync pseudorandom feedback shift register (PFSR), said load subframe counter input to said PFSR, said PFSR providing initial prespreading of high speed engine cryptosync; a high speed engine (HSE), said HSE producing an keystream generator output, said HSE having a HSE cryptosync as a first input and said cryptovariable as a second input; said second input utilized as an encryption key for said first input; an XOR gate, said XOR gate performing a bit by bit "exclusive or" operation between said keystream generator output and a plaintext bytestream, said XOR gate producing a ciphertext bytestream output for transmission to said cable modem; and a broadcast clock, said broadcast clock consisting of the transmission of said headend cryptoclock to said plurality of cable modems, said broadcast clock utilized for decryption of said ciphertext bytestream at said plurality of cable modems.

Claim 34

A bi-directional broadband communications and data transfer encryption system having a plurality of cable modems, said plurality of cable modems interconnected with a headend via a transmission medium having a multiple access upstream channel and a broadcast downstream channel, comprising: a cryptosync clock at said headend, said cryptosync clock dividing time into a multiplicity of periodic units; a CV refresh unit, said CV refresh unit obtaining one input from said cryptosync clock and a second input from a connection key, said CV refresh unit encrypting said cryptosyne clock with said connection key, said CV refresh unit producing a cryptovariable output; a load subframe counter, said load subframe counter obtaining one input from said cryptosync clock, a second input of a subframe identifying number, and a third input of a subframe start indicator; a cryptosync pseudorandom feedback shift register (PFSR), said load subframe counter input to said PFSR, said PFSR providing initial prespreading of high speed engine cryptosync; a high speed engine (HSE), said HSE producing an keystream generator output, said HSE having a HSE cryptosync as a first input and said cryptovariable as a second input; said second input utilized as an encryption key for said first input; an XOR gate, said XOR gate performing a bit by bit "exclusive or" operation between said keystream generator output and a plaintext bytestream, said XOR gate producing a ciphertext bytestream output for transmission to said cable modem; and a broadcast clock, said broadcast clock consisting of the transmission of said headend cryptoclock to said plurality of cable modems, said broadcast clock utilized for decryption of said ciphertext bytestream at said plurality of cable modems.

Claim 35

The encryption system of claim 30 wherein said CV refresh unit is implemented in software.

Claim 36

The encryption system of claim 30 wherein said HSE is implemented in hardware.

Claim 37

The encryption system of claim 30 wherein encryption algorithms requiring utilization of a square root function are performed at the headend.

Claim 38

The encryption system of claim 30 wherein encryption algorithms requiring utilization of a square function are performed at said plurality of cable modems.