Per unit time message authentication code
A system for securely transmitting data between two devices is disclosed. Each device comprises an interface, an encryption module, a decryption module and a message authentication code (MAC) generator. The encryption and decryption modules may utilize a stream cipher, while the MAC generator utilizes a hashing algorithm. A MAC is transmitted after a predetermined amount of time, regardless of the amount of activity on the interface. The device receiving the MAC compares it to the MAC that it generated to ensure that they match. This guarantees that a breach of integrity can be detected in a reasonable amount of time and addressed accordingly. This system may utilize an interface having bidirectional data signals or unidirectional data signals.
1 . A system for securely transmitting data between a first device and a second device, comprising:
the first device, comprising:
an interface to transmit and receive data from the second device;
a first encryption module to encrypt outgoing data before it is transmitted over the interface;
a first decryption module to decrypt data received from the second device and create incoming data; and
a first message authentication code (MAC) generator, wherein the first MAC generator comprises a hashing algorithm that utilizes the outgoing data transmitted by the first device and the incoming data received by the first device over the interface during a predetermined time period to compute a first MAC;
wherein the outgoing data and the incoming data are arranged sequentially in a data buffer, and when the data buffer reaches a predetermined length, the first MAC generator computes a hash;
wherein the first device transmits the first MAC to the second device based on expiration of a timer; and
the second device, comprising:
the interface to transmit and receive data from the first device;
a second encryption module to encrypt transmit data before it is transmitted over the interface;
a second decryption module to decrypt data received from the second device and create received data;
a second message authentication code (MAC) generator, wherein the second MAC generator comprises the hashing algorithm that utilizes the data transmitted by the second device and the received data; and
a verifier to compare the first MAC received from the first device to a second MAC generated by the second MAC generator.
2 . The system of claim 1 , wherein the first encryption module, the second encryption module, the first decryption module and the second decryption module implement a stream cipher.
3 . The system of claim 2 , wherein the stream cipher is AES-CTR.
4 . The system of claim 1 , wherein the hashing algorithm is GHASH.
5 . The system of claim 1 , wherein gaps between transmissions on the interface are filled in the data buffer.
6 . The system of claim 5 , wherein static data are used to fill the data buffer during the gaps.
7 . The system of claim 5 , wherein the first device comprises a first pseudorandom number generator, and wherein pseudorandom numbers are used to fill the data buffer during the gaps.
8 . The system of claim 1 , wherein upon expiration of the timer, if the data buffer has less than the predetermined length, a remainder of the data buffer is filled with static data.
9 . The system of claim 1 , wherein the first device comprises a first pseudorandom number generator, and wherein upon expiration of the timer, if the data buffer has less than the predetermined length, a remainder of the data buffer is filled with pseudorandom numbers.
10 . A method of securely transmitting and receiving data on an interface, comprising:
encrypting, by a first encryption module at a first device, outgoing data before it is transmitted over the interface;
decrypting, by a first decryption module at the first device, data received from a second device and creating incoming data; and
computing, by a first message authentication code (MAC) generator at the first device, a first message authentication code (MAC) using a hashing algorithm that utilizes the outgoing data transmitted by the first device and the incoming data received by the first device over the interface during a predetermined time period;
wherein the outgoing data and the incoming data are arranged sequentially in a data buffer, and when the data buffer reaches a predetermined length, the first MAC generator computes a hash;
transmitting the MAC from the first device to the second device when a timer expires;
encrypting, by a second encryption module at the second device, transmit data before it is transmitted over the interface;
decrypting, by a second decryption module at the second device, data received from the second device and creating received data;
computing, by a second message authentication code (MAC) generator at the second device, a second message authentication code (MAC) using a hashing algorithm that utilizes the data transmitted by the second device and the received data;
and
comparing the first MAC received from the first device to the second MAC generated by the second MAC generator.
11 . The method of claim 10 , wherein static data is inserted in the data buffer when the interface is idle.
12 . The method of claim 10 , wherein pseudorandom numbers are inserted in the data buffer when the interface is idle.
13 . The method of claim 10 , wherein the outgoing data transmitted and the incoming data received on the interface is encrypted using a stream cipher.
14 . The method of claim 13 , wherein the method further comprises:
utilizing the stream cipher to encrypt the MAC prior to transmitting.
15 . The method of claim 13 , wherein the incoming data received on the interface is decrypted before being arranged in the data buffer.
16 . The method of claim 13 , wherein outgoing data to be transmitted is arranged in the data buffer prior to being encrypted.
17 . The method of claim 10 , wherein the timer is started when data is detected on the interface to time the predetermined time period.