Granted Patent B2

US 12,711,281 · App. 18/419,440 · Granted Aug 18, 2026

Inventor: Richard J. Takahashi (Layton, UT)

Assignee: Secturion Systems, Inc.

G06F21/72G06F21/60G06F21/602G06F21/76H04L63/0485

Abstract

Claims (38)

1 . A system comprising:

a plurality of cryptographic modules each configured to process packets and indicate when ready to process new packets by flagging a corresponding readiness indicator, wherein:

the packet processing includes encrypting a packet based on a security key associated with the packet;

a first interface coupled to the plurality of cryptographic modules and configured to receive an incoming packet, associate a first security key with the incoming packet, select a ready one of the plurality of cryptographic modules based on the corresponding readiness indicator, and route the incoming packet to the selected cryptographic module; and

a second interface coupling the plurality of cryptographic modules to a data storage.

2 . The system of claim 1 , wherein each of the plurality of cryptographic modules comprises at least one systolic-matrix array.

3 . The system of claim 1 , wherein the readiness indicator corresponds to a semaphore flag.

4 . The system of claim 3 , wherein the first interface selects the ready one of the plurality of cryptographic modules based on the semaphore flag.

5 . The system of claim 1 , wherein the readiness indicator corresponds to one or more packet header bits.

6 . The system of claim 5 , wherein the first interface selects the ready one of the plurality of cryptographic modules based on the one or more packet header bits.

7 . The system of claim 1 , wherein the first interface is further configured to:

receive the incoming packet on a port;

receive an outgoing packet from the selected cryptographic module corresponding to the incoming packet; and

route the outgoing packet to the port.

8 . The system of claim 7 , wherein the incoming packet is tagged to identify the port.

9 . The system of claim 7 , wherein the outgoing packet is tagged to identify the port.

10 . A system comprising:

a plurality of cryptographic modules each configured to process packets, wherein the packet processing includes encrypting a packet based on a security key associated with the packet, and wherein each cryptographic module is configured to execute a secure boot for verifying at least one systolic-matrix array of the cryptographic module; and

a first interface coupled to the plurality of cryptographic modules and configured to receive an incoming packet, associate a first security key with the incoming packet, select one of the plurality of cryptographic modules, and route the incoming packet to the selected cryptographic module.

11 . The system of claim 10 , wherein the secure boot is executed for verifying FPGA code for the at least one systolic-matrix array of the cryptographic module.

12 . The system of claim 11 , wherein the secure boot includes programming an FPGA of the cryptographic module with the verified FPGA code.

13 . The system of claim 10 , wherein each cryptographic module comprises a memory, coupled to the systolic-matrix array, for storing data generated during the packet processing.

14 . The system of claim 10 , wherein in response to detecting an anomaly during the secure boot, an alert is provided to a user.

15 . The system of claim 10 , wherein the secure boot is executed for verifying software or a processor of the cryptographic module.

16 . The system of claim 10 , further comprising a key manager coupled to the first interface.

17 . A method comprising:

flagging, by a ready cryptographic module of a plurality of cryptographic modules, a readiness indicator to indicate the ready cryptographic module is ready to process new packets;

receiving, by a first interface coupled to the plurality of cryptographic modules, an incoming packet;

selecting, by the first interface and based on the corresponding readiness indicator, the ready cryptographic module for processing the incoming packet;

routing, by the first interface, the incoming packet to the ready cryptographic module;

processing, by the ready cryptographic module, the incoming packet into a processed packet;

sending, by a second interface coupling the plurality of cryptographic modules to a data storage, the processed packet for storage.

18 . The method of claim 17 , wherein the readiness indicator corresponds to a semaphore flag or one or more packet header bits.

19 . The method of claim 17 , further comprising:

receiving, by the second interface from the data storage, the processed packet;

processing, by at least one of the plurality of cryptographic modules, the processed packet into an outgoing packet; and

sending, by the first interface, the outgoing packet.

20 . The method of claim 19 , wherein receiving the incoming packet and sending the outgoing packet uses a same port.

Assignments (1)

Continuity (6)

References Cited (400)