US 5416842

US5416842A — Method and apparatus for key-management scheme for use with internet protocols at site firewalls

• Assignee: Sun Microsystems, Inc. (original assignee); inventor Ashar Aziz.
• Filing/priority date: 1994-06-10 (application US08/258,344). Publication/grant date: 1995-05-16. Status: Expired – Lifetime; anticipated expiration 2014-06-10.
• Source: https://patents.google.com/patent/[US5416842](/patent/US5416842)/en

Purpose. The patent addresses key management for encrypting Internet Protocol (IP) data packets between site firewalls, applying the SKIP scheme to secure traffic at the IP layer rather than at the application or transport layers. Encrypting inter-site traffic at the IP layer is said to deny a would-be cracker the ability to detect source and destination addresses of communicating nodes, and because encryption runs only firewall-to-firewall, only the firewall servers need to participate in the SKIP scheme. A further stated requirement accommodated is secure remote-user access to a protected network across the Internet without changes to client applications.

Plain-language scope (as described). A first node (I) on a private network sends a data packet, with IP data and a destination address for node J, to firewall FWA, which is coupled to a public network such as the Internet. FWA holds a secret a and public value α^a mod p; FWB holds secret b and α^b mod p. FWA obtains a Diffie-Hellman (DH) certificate for FWB, determines α^b mod p, computes α^ab mod p, and derives key K_ab. A transient key K_p is generated randomly and configured for use with a predetermined number of packets; K_p encrypts the packet, which FWA encapsulates in a transmission packet bearing an unencrypted destination address for FWB. FWB obtains a DH certificate for FWA, computes α^ab mod p, derives K_ab, and uses it to decrypt K_p. The remote firewall decrypts the encapsulated packet and sends it in the clear to the destination node on its interior side.

What the excerpt does not establish. The supplied text omits claim language (claims are referenced only in the description/abstract counts), the full specification, drawing contents, and detailed cryptographic parameters. It does not establish litigation, ownership transfers, validity, or prior art beyond classifications and keyword listings.