The present invention relates to computer network communication systems, and more particularly to computer network communication systems wherein the data transmitted between terminals is encrypted.
Computer networks provide a user friendly way by which computer operators can receive data from, or transmit data to remote locations. The process by which a user will interact with a remote location hides the user from the operation of other processes, each of which will accomplish some activity necessary for the transmission of the data. Each of these processes is referred to as a "layer." There are seven layers in the commonly used Open Systems Interconnection (OSI) Reference Model, each of which is listed below:
1. Physical transmission of data to the network (physical layer).
2. Error-free transmission of packets over individual data links (data link layer).
3. Subdivision of files into packets, logging packets over available links, and ordering of received packets (network layer).
4. Mapping of the agreed-on service on the transmission facilities available (transport layer).
5. File and destination identification (session layer).
6. Data translation (presentation layer).
7. User Interface (application layer).
The rules implemented at each end of the transmission or segment of transmission for accomplishment of any one of these or similar activities is called a protocol. Each protocol is expressed in such a way as to hide all lower-layer activities.
Each layer N (where the value of N ranges from 1 to 7 in the OSI Reference Model) provides services to its user, layer N+1. To accomplish this, layer N uses the functions made available to it by layer N-1. For example, network layer 3 provides service to transport layer 4, using functions provided to it by data link layer 2.
The internal structure of these layers above or below layer N are not know by layer N. Each layer includes a process at each end of the transmission and implements the activities necessary to offer and enhance the service to the layer above. The protocol for layer N is a set of rules implemented by the processes at that layer. Control information and data are exchanged across the interface between layers N and N+1. This can be either control for layer N at either end of the transmission or data destined for layer N+1 at the other end. The process, therefore, has two interfaces, one at each layer above and below and one with the corresponding process at the other end of the transmission.
Whatever information is placed in the message (or packet) by one layer of protocol is treated as data by, and is transparent to, lower layers of protocol. At the transmitting end, layer N-1 adds header (and possibly trailer) characters to the packet that will provide control information as needed by the layer N-1 receiving process to implement layer N-1 protocol. Similar header characters may have been added to the packet by layer N. To layer N-1 these header (and trailer) characters are treated just as if they were part of the original packet. If there exists a layer N-2, still another header may be added to the packet as it is passed down to this layer at the transmitting end. Header characters also include routing information necessary to deliver the packet to its intended destination, information about the data contained in the packet, e.g. indicating that the data is part of a file transfer, electronic mail, etc.
There is no single set of protocols used in all networks. Some may use more than the seven layers described here, some fewer.
There are currently many networks in use on various pieces of hardware and with various operating systems. These networks may have differing data transfer rates, size of transmitted packet and other differences which cause compatibility problems. Fortunately, a few standards have evolved which allow these divergent systems to communicate. The development of the Internet Protocol (IP), which usually operates at the network layer, is one of these.
With the advent of the IP, computer systems throughout the world can now communicate with each other. Because of the great distances separating these machines, the physical wiring and interconnections that make up a network's physical layer are not under any given organization's control. In fact, leased lines from telephone companies carry much of the traffic of these networks. This presents security problems because there are many points on any given network that can be tapped, essentially allowing the person tapping into the network to "listen in" to the data transmitted over the lines, or to information such as the source, destination, and type of data contained in a packet.
A solution to these problems would be to encrypt each packet sent over the non-secured lines, preventing unauthorized persons tapped into the signal from understanding the transmission. However, this approach cannot work in open systems like those using the Internet Protocol because routing functions are performed by switches or gateways which are physically distributed along the network. These gateways force all routing information (present in the header portions of a packet) to be in clear, machine-readable Internet Protocol form. They therefore prohibit the encryption of an entire packet before transmission into a communications channel.
Because of the requirement that the routing information contained in the header remain intact, prior attempts to provide secure communications between distant computer systems have focused on encrypting data before it is sent over the network.
For example, users can manually encrypt data, or use a utility program to encrypt data before it is broken up into packets and sent over the network. However, there are three problems with this approach. First, users are required to perform a separate step before each transmission of data, breaking the seamless integration of the network and the operating system. Because of this separate step, users can become lazy or forget to encrypt data before it is sent. Second, this approach is impractical in situations other than simple file transfer where there is repeated interaction between computer systems connected to a network. Manual encryption in these situations is not a viable option because it would slow these network services immensely. Third, even though the data itself may be encrypted, one tapped into the network could still get information from the unencrypted header fields, such as the source, destination, and type of data contained in the packet.
Another method of providing secure communications is to have the operating system encrypt and decrypt all data coming in and out. While this solves the problem of forgetful or lazy users, it creates another one: the system can only communicate with like systems. Different systems or networks cannot communicate. In addition, an operating system upgrade is required to secure the communications, and information contained in the unencrypted header fields can still be understood by one tapped into the network.
Yet another approach to providing security is to physically confine the network to prevent unauthorized access. However, typically only the military has the resources to own and confine a physically large network, and in so doing they eliminate the advantages of tying into the outside world.
On a smaller scale, some systems attempt to encrypt all packets and thus define a sub-network. However, the end result will typically have one of two flaws: either the users are deprived of a robustness and utility of the network and thus are constrained as if they were not connected to the network at all, or security is compromised if access to the entire network is allowed. In general, all of these solutions to the problem of providing secure communications eliminate much of the functionality which make networks useful in the first place.
Accordingly, it is an object of the present invention to provide transparent, secure communications between computer systems or LANs connected to an open network, while allowing full access to other computer systems or LANs connected to the open network.
Additional objects, advantages and novel features of the present invention will be set forth in part in the description which follows and in part become apparent to those skilled in the art upon examination of the following, or may be learned by practice of the invention. The objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations which are pointed out in the appended claims.