Encryption/decryption device for secure communications between a protected network and an unprotected network and associated methods

1. A device for secure communications between a protected network and an unprotected network, the device comprising:

a first logic device configured as a plaintext unit;

a second logic device configured as a ciphertext unit; and

a third logic device configured as a cryptographic unit connected between the plaintext unit and the ciphertext unit;

the first logic device comprising a red egress directional component configured to interface with the protected network to perform encapsulation of data from the protected network to define outgoing datagrams, and comprising a red ingress directional component operable to perform decapsulation of incoming datagrams from the cryptographic unit;

the second logic device comprising a black ingress directional component configured to interface with the unprotected network to perform routing of incoming encrypted datagrams from the unprotected network to the cryptographic unit, and comprising a black egress directional component operable to perform routing of outgoing encrypted datagrams from the cryptographic unit to the unprotected network;

the third logic device operable to perform encryption of outgoing datagrams from the plaintext unit, and operable to perform decryption of incoming encrypted datagrams from the ciphertext unit to define the incoming datagrams.

2. The device according to claim 1 , further comprising:

a plaintext unit input/output processor operable to control the plaintext unit;

a ciphertext unit input/output processor operable to control the ciphertext unit; and

a cryptographic unit control processor operable to control the cryptographic unit.

3. The device according to claim 2 , further comprising:

a plaintext unit network interface configured to interface the plaintext unit with the protected network; and

a ciphertext unit network interface configured to interface the ciphertext unit with the unprotected network.

4. The device according to claim 1 , wherein each of the first and second logic devices comprises a field-programmable gate array (FPGA).

5. The device according to claim 4 , wherein the cryptographic unit comprises a third FPGA.

6. The device according to claim 1 , wherein the plaintext unit, ciphertext unit and cryptographic unit operate in accordance with the High Assurance Internet Protocol Interoperability Specification (HAIPIS).

7. A device for secure communications between a protected network and an unprotected network, the device comprising:

a first logic device configured as a plaintext unit;

a second logic device configured as a ciphertext unit; and

a third logic device configured as a cryptographic unit connected between the plaintext unit and the ciphertext unit;

the first logic device comprising a field-programmable gate array (FPGA) comprising a red egress directional component configured for interfacing with the protected network to perform encapsulation of data from the protected network to define outgoing datagrams, and comprising a red ingress directional component operable to perform decapsulation of incoming datagrams from the third logic device;

the second logic unit configured to interface with the unprotected network;

the third logic unit operable to perform encryption of outgoing datagrams from the plaintext unit, and operable to perform decryption of incoming encrypted datagrams.

8. The device according to claim 7 , further comprising:

a plaintext unit input/output processor operable to control the plaintext unit;

a ciphertext unit input/output processor operable to control the ciphertext unit; and

a cryptographic unit control processor operable to control the cryptographic unit.

9. A method of making an encryption/decryption device for secure communications between a protected network and an unprotected network, the method comprising:

providing a first logic device configured as a plaintext unit;

providing a second logic device configured as a ciphertext unit; and

connecting a third logic device configured as a cryptographic unit between the plaintext unit and the ciphertext unit;

providing the first logic device (LD) comprising a red egress directional component for interfacing with the protected network to perform encapsulation of data from the protected network to define outgoing datagrams, and comprising a red ingress directional component to perform decapsulation of incoming datagrams from the cryptographic unit;

providing the second LD comprising a black ingress directional component for interfacing with the unprotected network to perform routing of incoming encrypted datagrams from the unprotected network to the cryptographic unit, and comprising a black egress directional component to perform routing of outgoing encrypted datagrams from the cryptographic unit to the unprotected network; and

connecting the third logic device to perform encryption of outgoing datagrams from the plaintext unit, and to perform decryption of incoming encrypted datagrams from the ciphertext unit to define the incoming datagrams.

10. The method according to claim 9 , further comprising:

providing a plaintext unit input/output processor to control the plaintext unit;

providing a ciphertext unit input/output processor to control the ciphertext unit; and

providing a cryptographic unit control processor to control the cryptographic unit.

11. The method according to claim 10 , further comprising:

providing a plaintext unit network interface to interface the plaintext unit with the protected network; and

providing a ciphertext unit network interface to interface the ciphertext unit with the unprotected network.

12. The method according to claim 9 , wherein providing each of the first and second LDs comprises providing a field-programmable gate array (FPGA).

13. The method according to claim 12 , wherein providing the cryptographic unit comprises providing a third FPGA.