Patent ID: 8250356

Claim:
A cryptographic system having an operating system (OS), the system comprising: an IP stack modifying an outbound message by adding an IPSec protocol header to a message from a secure network to produce an outbound message; a dummy cryptographic module performing no encryption, and supplied with the modified outbound message from the IP stack and providing the IP stack with rules used for outbound encryption; a key database containing keys, the key database in a first protected memory region protected by the OS from access by the IP Stack; and a second hardware cryptographic module within a second protected memory region protected by the OS from access by the IP Stack and supplied with the modified outbound message from the IP stack and supplied with second rules used for encrypting the outbound message, the second hardware cryptographic module encrypting the modified outbound message to produce an encrypted outbound message using an encryption rule from the header, the second hardware cryptographic module retrieving an encryption key from the key database based on the second rules, the second hardware cryptographic module sending the encrypted outbound message to an unsecure network.