Abstract: The embodiments protect an IC against Design-For-Test (DFT) or other test mode attack. Secrets in ROM or PROM are secured. One embodiment for securing information on an IC includes receiving a ROM read command, writing data from a plurality of ROM address locations to an encryption logic in response to receiving the ROM read command, and writing an encryption logic output of the encryption logic to a test control logic, the encryption logic output representing the data from the plurality of ROM address locations. Writing the data from the plurality of ROM address locations to the encryption logic may also include writing the data from the plurality of ROM address locations to a multiple input shift register (MISR) in response to the ROM read command, and writing an MISR output to the test control logic, the MISR output representing the data from the plurality of ROM address locations.

Abstract: A method for processing video content is disclosed. The method comprises: receiving, in a hardware device connected in operation to a computer, encrypted, encoded video content; decrypting the encrypted, encoded video content to form decrypted, encoded video content; decoding a first portion of the decrypted, encoded video content to form a decrypted, decoded video content portion; re-encrypting the decrypted, decoded video content portion to form a re-encrypted, decoded video content portion; re-encrypting a second portion of the decrypted, encoded video content to form a re-encrypted, encoded video content portion; and outputting the re-encrypted, decoded video content portion and the re-encrypted, encoded video content portion to the computer.

Abstract: A cartridge preferably for use with a game console. The cartridge comprises a ROM, a non-volatile memory, a processor and an encryption unit. An application running on the console may read data from the ROM, read data from the non-volatile memory, and write data in the non-volatile memory. Data to be written in the non-volatile memory is encrypted by the encryption unit, but data to be read is returned in encrypted form for decryption by a decryption function of the game application. Data may also be received encrypted to be decrypted and returned. The encryption or decryption unit may also receive data from the non-volatile memory and send it to the interface. The invention improves on the prior art copy protection as a hacker must reverse engineer the game application in order to copy it, if the encryption unit is unknown. The invention also provides an optical medium equipped with a RFID circuit.

Abstract: A method for handling an encrypted message received on an electronic device that has not been encrypted using a current public key. The portable electronic device automatically generates a reply message to the sender in response to determining that the message has not been encrypted with the current public key. The reply message may contain the current public key of the recipient device, and may request the sender to resend the message encrypted with the current public key.

Abstract: The rate at which packets are provided to a cryptographic engine of a cryptographic system may be adjusted using a feedback mechanism to increase the output of the cryptographic system. Data is classified and queued on a per class/flow basis and stored in input queues prior to being processed by the cryptographic engine. A class based queue scheduler is implemented to select data from the input queues to be transmitted to the cryptographic engine. The cryptographic engine operates in processing cycles. At each cycle, an amount of data is transferred from the input queues to a cryptographic engine input queue. A cryptographic accelerator in the cryptographic engine processes the data on the cryptographic engine input queue during the cycle. The output rate of the cryptographic accelerator is measured during the cycle and this value is used as feedback to determine how much data should be passed to the cryptographic engine for a subsequent cycle.

Abstract: A method for protecting software of a mobile terminal is provided in the disclosure, wherein an encryption chip is mounted in the mobile terminal. The method includes: when the mobile terminal is turned on, whether or not the encryption chip is invalid is detected; when it is not invalid, the encryption chip authenticates the software of the mobile terminal through interaction with a main chip; when the authentication is not passed, the encryption chip controls a functional module of the mobile terminal through a hardware protection circuit. An apparatus for protecting software of a mobile terminal is also provided in the present disclosure. The solution of the disclosure can prevent the software of the mobile terminal from being cracked and protect the functions of the mobile terminal from illegal usage, thus the security of the mobile terminal is greatly improved and the interests of operators and manufacturers are protected.

Abstract: A device management system for managing a device based on management information is presented. The system includes a device monitoring unit for obtaining management information from a device, a relay server coupled to the device monitoring unit over a network, and a management server, coupled to the relay server over a network, configured to manage the device based on the management information. The device monitoring unit obtains the management information from the device and transmits the obtained management information without encryption. Upon receiving the management information, the relay server encrypts and transmits to the management server the received management information.

Abstract: A wireless receiver and methods for storing content from RF signals received by the wireless receiver are provided. The wireless receiver includes a microprocessor and an RF receiver configured to operably communicate with the microprocessor. The RF receiver is configured to receive an RF signal having digital content therein. The wireless receiver further includes a detachable memory device configured to operably communicate with the microprocessor. The detachable memory device has a unique serial number stored therein. The microprocessor is configured to retrieve the unique serial number from the detachable memory device. The microprocessor is further configured to receive the digital content from the RF receiver and to encrypt the digital content utilizing the unique serial number to obtain encrypted digital content. The microprocessor is further configured to store the encrypted digital content on the detachable memory device.

Abstract: The invention describes a method for hardening a security mechanism against physical intrusion and substitution attacks. A user establishes a connection between a network peripheral device and a network via a security mechanism. The security mechanism includes read only memory (ROM) that contains code that initiates operation of the mechanism and performs authentication functions. A persistent memory contains configuration information. A volatile memory stores user and device identification information that remains valid only for a given session and is erased thereafter to prevent a future security breach. A tamper-evident enclosure surrounds the memory elements, which if breached, becomes readily apparent to the user.

Abstract: A computer-implemented method for detecting rootkits is disclosed. The computer-implemented method may include sending periodic security communications from a privileged-processor-mode region of a computing device. The computer-implemented method may also include identifying at least one of the periodic security communications. The computer-implemented method may further include determining, based on the periodic security communications, whether the privileged-processor-mode region of the computing device has been compromised. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Systems, methods, computer programs, and devices are disclosed herein for deploying a local trusted service manager within a secure element of a contactless smart card device. The secure element is a component of a contactless smart card incorporated into a contactless smart card device. An asymmetric cryptography algorithm is used to generate public-private key pairs. The private keys are stored in the secure element and are accessible by a trusted service manager (TSM) software application or a control software application in the secure element. A non-TSM computer with access to the public key encrypts and then transmits encrypted application data or software applications to the secure element, where the TSM software application decrypts and installs the software application to the secure element for transaction purposes.

Abstract: A device for the secured start-up of a computer installation comprising a first connection interface to the computer installation and a second connection interface to an external data medium unit separate from the computer installation and which contains data and executable codes for a start-up program of the computer installation. The device also includes means for securing the use of data and executable codes and for transmitting data and executable codes of the start-up program from the external data medium unit via the second connection interface to the computer installation via the first connection interface, and after executing the means of security, to start-up the computer installation using transmitted executable codes and data.

Abstract: A system and method for protecting computing systems, and more particularly a system and method which a dedicated hardware component configured to communicate with a protection program. A computer hardware subsystem includes a memory comprising content. The content is at least a list of files which have been modified within a predetermined period of time. The list of files is a subset of files of a hard drive. A dedicated hardware component is configured to track the files which have been modified and provide a location of the files to the memory. A communication link between the dedicated hardware component and a protection program provides the protection program with the subset of files of the hard drive as referenced by the memory content.

Abstract: A method of operating a virtual machine includes determining a virtual machine signature, receiving an execution request from an application, and determining an application signature based on the request. The method further includes validating the application signature to the virtual machine signature and executing the application based on the validation.

Abstract: A digital escrow pattern is provided for network data services including searchable encryption techniques for data stored in a cloud, distributing trust across multiple entities to avoid a single point of data compromise. In one embodiment, a key generator, a cryptographic technology provider and a cloud services provider are each provided as separate entities, enabling a publisher of data to publish data confidentially (encrypted) to a cloud services provider, and then expose the encrypted data selectively to subscribers requesting that data based on subscriber identity information encoded in key information generated in response to the subscriber requests, e.g., a role of the subscriber.

Abstract: One aspect of the present invention is a method of playing multi-media content through a personal computer. The personal computer includes a processor and memory, with the memory having software instructions stored therein. The processor executes the instructions to carry-out the method. The method includes: receiving data representing multi-media content at the personal computer; receiving at the personal computer an initial set of data representing a base set of usage rights that is associated with the multi-media content, wherein the initial set of data defines a first set of rights that is permissible without upgrading or renewing the base set of usage rights; and upon receiving a request to perform an action involving the multi-media content, checking the initial set of data representing the base set of usage rights to determine whether the action is permissible, and providing an option to a user through the personal computer to contact a remote computer to negotiate for an upgraded set of usage rights.

Abstract: Systems, methods, computer programs, and devices are disclosed herein for deploying a local trusted service manager within a secure element of a contactless smart card device. The secure element is a component of a contactless smart card incorporated into a contactless smart card device. An asymmetric cryptography algorithm is used to generate public-private key pairs. The private keys are stored in the secure element and are accessible by a trusted service manager (TSM) software application or a control software application in the secure element. A non-TSM computer with access to the public key encrypts and then transmits encrypted application data or software applications to the secure element, where the TSM software application decrypts and installs the software application to the secure element for transaction purposes.

Abstract: Disclosed are interconnectable personal computer architectures comprising secure, portable and persistent computing environments that provide secure computing sessions with persistence. The computing environments are implemented using a secure non-computing client device, such as a USB device, that interfaces with a host computer and, optionally, a trusted server. The secure non-computing client device is used to instantiate a secure BIOS and a secure cold or warm boot of the host computer, from the client device, in a host protected area of the host computer, or from the trusted server. The client device comprises a security device, such a trusted platform module, that encrypts and decrypts data transferred between the client apparatus and the host computer to provide a sealed computing environment on the host computer. The client device may implement keyboard logger attack prevention. The client device may also implement a high assurance guard to protect applications.

Abstract: Systems for encoding and reading RFID tags on a collection of items are shown. One embodiment of the invention includes a plurality of items, where each item possesses an item identifier string, and a plurality of RFID tags, where an RFID tag is affixed to each of the items and each RFID tag is encoded with a code word element generated using at least all of the item identifier strings. In many embodiments, the collection is a plurality of goods contained within a case, pallet, container or storage area.

Abstract: A digital escrow pattern is provided for backup data services including searchable encryption techniques for backup data, such as synthetic full backup data, stored at remote site or in a cloud service, distributing trust across multiple entities to avoid a single point of data compromise. In one embodiment, an operational synthetic full is maintained with encrypted data as a data service in a cryptographically secure manner that addresses integrity and privacy requirements for external or remote storage of potentially sensitive data. The storage techniques supported include backup, data protection, disaster recovery, and analytics on second copies of primary device data. Some examples of cost-effective cryptographic techniques that can be applied to facilitate establishing a high level of trust over security and privacy of backup data include, but are not limited to, size-preserving encryption, searchable-encryption, or Proof of Application, blind fingerprints, Proof of Retrievability, and others.

Abstract: An anti-virus system for enforcing a virus monitoring and scanning process, the anti-virus and firewall system comprises a master CPU card, a plurality of slave CPU cards and a programmable logic. The master CPU card is used for controlling the virus monitoring and scanning process and dividing the virus monitoring and scanning process into a plurality of sub-processes. The plurality of slave CPU cards are controlled by the master CPU card in a software level and a hardware level, each of the plurality of slave CPU cards receives and processes one of the plurality of sub-processes then sends back to the master CPU card. The programmable logic controlled by the master CPU card for monitoring and controlling said plurality of slave CPU cards at a hardware level.

Abstract: An authentication token management system securely manages an authentication token. Hardware based security extensions on a client are used to dynamically instantiate two dynamic secure virtual machines, a registration initiation module (RIM) and a registration completion module (RCM). A public key and a corresponding private key are generated, and the RIM seals the private key to the RCM. A request for an authentication token is signed by the hardware based security extensions and transmitted to the server. This request comprises at least the public key. In response, an authentication token encrypted with the public key is received. The RCM unseals the private key, and uses it to decrypt the received authentication token. The RCM then seals the authentication token to at least one additional dynamic secure virtual machine, which can use it to perform additional functionalities, such as data signing, encryption, generation and/or verification.

Abstract: A method of performing a cryptographic operation including: receiving a plurality of binary input values; splitting the binary input values into a plurality of non-binary digits of base r, where r is an integer greater than 2 and not equal to a power of 2; and performing, by a cryptographic block on each of the plurality of non-binary digits, a different modulo r operation to generate at least one output digit) of base r.

Abstract: A highly configurable kernel supports a wide variety of content protection systems. The kernel may reside in a host that interacts with a secure processor maintaining content protection clients. After establishing communication with the secure processor, the host receives messages from content protection clients requesting rules for message handling operations to support client operations. This flexible configuration allows for dynamic reconfiguration of host and secure processor operation.

Abstract: In a device authentication control method and device, when a connection device is connected to a network mounted on a boat, it is determined whether or not the connection device corresponds to an authentication-free device. If the connection device does not correspond to an authentication-free device, an authenticating action is performed on the connection device. If the connection device does correspond to an authentication-free device, the connection device is exempted from the authenticating action. In this way, when a connection device does not correspond to an authentication-free device, an authenticating action is performed, but when the connection device corresponds to an authentication-free device, the connection device is exempted from an authenticating action. As a result, it is possible to handle specific connection devices as authentication-free.

Abstract: A method of scanning data for viruses in a computer device, the device having a browser for rendering the data for use. The method comprises storing the data in a buffer memory accessible to said browser and creating an instance of a browser plugin, said plugin providing a virus scanning function or providing a route to a virus scanning function. The data is scanned for viruses using the instance of the plugin and, if no viruses are detected in the data, it is returned to the browser for rendering. If a virus is detected in the data, rendering of the data is inhibited.

Abstract: The invention includes a method and apparatus for providing secure remote access to enterprise networks. An apparatus includes a network interface module adapted for maintaining a secure network connection with a network device independent of a power state of a host computer associated with the apparatus a storage module for storing information associated with the secure connection, and a processor coupled to the network interface and the memory where the processor is adapted for automatically initiating the secure connection without user interaction.

Abstract: An architecture is presented that facilitates secure token generation and transmission capabilities in a mobile device. The system comprises at least one software application that includes a secure token assigned to a specific user and a memory module that communicates with an external processor. A security processor, non-volatile memory component and volatile memory component are integrated to form the memory module that communicates with the external processor. The memory module creates a secure execution environment for the execution of application agents associated with the software application and the secure token. The security processor of the system communicates with the software application and external processor to manage generation, authentication, confidentiality, and transmission of the secure token. And, the non-volatile memory allows the introduction of new tokens and the removal of old tokens.

Abstract: A network switch automatically detects undesired network traffic and mirrors the undesired traffic to a security management device. The security management device determines the source of the undesired traffic and redirects traffic from the source to itself. The security management device also automatically sends a policy to a switch to block traffic from the source.

Abstract: A security system for a computer operating system comprising a processor (37) that is independent of the host CPU (13) for controlling access between the host CPU (13) and a security partition formed in the storage device (21) for storing the operating system. A program memory (41) that is independent of the computer memory and the storage device (21) unalterably stores and provides computer programs for operating the processor (37) in a manner so as to control access to the security partition in the storage device (21). All data access by the host CPU (13) to the data storage device (21) is blocked before initialization of the security system and is intercepted immediately after the initialization under the control of the processor (37). The processor (37) effects independent control of the host CPU (13) and configuration of the computer (11) to prevent unauthorised access to the security partition on the storage device (21) during the interception phase.

Abstract: A method and system for securing a handheld computing device is described. A personal encryption device may be physically connected to a handheld computing device. Responsive to the connection, a main screen user interface may be displayed on a display of the handheld computing device. The main screen user interface may include at least one cryptography option for a user of the handheld computing device. A user-defined input representative of selection of a first cryptography option of the at least one cryptography option may be received, and at least one cryptography process associated with the selected first cryptography option may be implemented by the handheld computing device and personal encryption device. The cryptography options may include encryption, decryption, digital signatures, and digital signature verification.

Abstract: Methods and systems for binding a removable trusted platform module (TPM) subsystem module to an information handling system to provide a core root of trust for the information handling system without requiring soldering down or other hard and permanent (non-removable) attachment of a TPM device to the information handling system planar (e.g., motherboard). The removable TPM subsystem module may be a plug-in module that may be removed from the information handling system planar (e.g., motherboard), while at the same time maintaining the transitive chain of trust, and being capable of remotely attesting its trusted state. An information handling system platform may be provided that has the capability and flexibility of supporting multiple TPMs on the same system planar.

Abstract: An intrusion detection system (IDS) comprises a network processor (NP) coupled to a memory unit for storing programs and data. The NP is also coupled to one or more parallel pattern detection engines (PPDE) which provide high speed parallel detection of patterns in an input data stream. Each PPDE comprises many processing units (PUs) each designed to store intrusion signatures as a sequence of data with selected operation codes. The PUs have configuration registers for selecting modes of pattern recognition. Each PU compares a byte at each clock cycle. If a sequence of bytes from the input pattern match a stored pattern, the identification of the PU detecting the pattern is outputted with any applicable comparison data. By storing intrusion signatures in many parallel PUs, the IDS can process network data at the NP processing speed. PUs may be cascaded to increase intrusion coverage or to detect long intrusion signatures.

Abstract: An encoder according to the present invention embodiments employs a key expansion module to expand an encryption key by using logic and available clock cycles of an encryption process or loop. The key expansion module generates control signals to enable key expansion data to be injected at appropriate times into the encryption loop (e.g., during available clock cycles of the encryption loop) to perform the key expansion, thereby utilizing the resources of the encryption loop for key expansion. The key expansion module dynamically accounts for varying key lengths, and enables the encryption loop to combine the data being encrypted with proper portions of the expanded key. The use of encryption logic and available clock cycles of the encryption loop for the key expansion reduces the area needed by the encoder on a chip and enhances encoder throughput.

Abstract: A method for accessing data in a data storage system is presented. The method includes supplying a host computer that is in communication with the data storage system, where the data storage system includes a data storage medium and a holographic data storage medium. A first request is generated to access a directory encoded in the data storage medium and includes a first encryption key. The requested directory recites a listing of data files encoded in the holographic storage medium. If the first encryption key decrypts the directory, the directory is read and a data file encoded in the holographic data storage medium is identified. A second request is then generated to access the data file and includes a second encryption key. Finally, if the second encryption key decrypts the data file, then it is read.

Abstract: A method and apparatus are provided for combating malicious code. In one embodiment, a method for combating malicious code in a network includes implementing a resource-limiting technique to slow a propagation of the malicious code and implementing a leap-ahead technique in parallel with the resource-limiting technique to defend against the malicious code reaching a full saturation potential in the network.

Abstract: Database management and security is implemented in a variety of embodiments. In one such embodiment, data sets containing sensitive data elements are analyzed using aliases representing sensitive data elements. In another embodiment, the sensitive data elements are stored in an encrypted form for use from a secure access, while the alias is available for standard access.

Abstract: Various embodiments of a system and method for providing protection against malicious software programs are disclosed. The system and method may be operable to detect that a first window of a legitimate software program has been replaced by a second window of a malicious software program, e.g., where the second window includes features to mimic the first window in an effort to fool the user into inputting sensitive information into the second window. The method may operate to alert the user when the window replacement is detected.

Abstract: The present invention provides systems and methods for providing distributed, adaptive IP filtering techniques used in detecting and blocking IP packets involved in DDOS attacks through the use of Bloom Filters and leaky-bucket concepts to identify “attack” flows. In an exemplary embodiment of the present invention, a device tracks certain criteria of all IP packets traveling from IP sources outside a security perimeter to network devices within the security perimeter. The present invention examines the criteria and places them in different classifications in a uniformly random manner, estimates the amount of criteria normally received and then determines when a group of stored classifications is too excessive to be considered normal for a given period of time. After the device determines the criteria that excessive IP packets have in common, the device then determines rules to identify the packets that meet such criteria and filters or blocks so identified packets.

Abstract: A memory controller for a smart card including a non-volatile memory can include an internal circuit that is configured to perform cryptographic key processing responsive to a first clock and a non-volatile memory interface circuit for transferring/receiving a signal to/from the internal circuit in synchronization with the first clock and transferring/receiving the signal to/from an external device in synchronization with a second clock that is asynchronous relative to the first clock.

Abstract: A telephone conversation between one or several first telecommunication terminals in a packet oriented data network and telecommunication terminals in an analog and/or digital network is encrypted by a module which enables the use of protocols from a LAN network to a TDM network to carry out end-to-end encryption.

Abstract: The present invention provides systems and methods for secure transaction management and electronic rights protection. Electronic appliances such as computers equipped in accordance with the present invention help to ensure that information is accessed and used only in authorized ways, and maintain the integrity, availability, and/or confidentiality of the information. Such electronic appliances provide a distributed virtual distribution environment (VDE) that may enforce a secure chain of handling and control, for example, to control and/or meter or otherwise monitor use of electronically stored or disseminated information. Such a virtual distribution environment may be used to protect rights of various participants in electronic commerce and other electronic or electronic-facilitated transactions. Distributed and other operating systems, environments and architectures, such as, for example, those using tamper-resistant hardware-based processors, may establish security at each node.

Abstract: The present invention provides systems and methods for secure transaction management and electronic rights protection. Electronic appliances such as computers equipped in accordance with the present invention help to ensure that information is accessed and used only in authorized ways, and maintain the integrity, availability, and/or confidentiality of the information. Such electronic appliances provide a distributed virtual distribution environment (VDE) that may enforce a secure chain of handling and control, for example, to control and/or meter or otherwise monitor use of electronically stored or disseminated information. Such a virtual distribution environment may be used to protect rights of various participants in electronic commerce and other electronic or electronic-facilitated transactions. Distributed and other operating systems, environments and architectures, such as, for example, those using tamper-resistant hardware-based processors, may establish security at each node.

Abstract: A key terminal apparatus includes a crypto-processing LSI that performs predetermined crypto-processing. Unique information identifying the crypto-processing LSI is embedded in the crypto-processing LSI. A predetermined master key corresponding to a predetermined key is embedded in the crypto-processing LSI. The crypto-processing LSI (a) receives an encrypted manufacturer key from the manufacturer key storage unit, (b) decrypts the encrypted manufacturer key using the predetermined master key to generate a manufacturer key, (c) generates a unique manufacturer key identical to the predetermined unique manufacturer key, based on the unique information embedded in the crypto-processing LSI and the generated manufacturer key, and (d) decrypts the received encrypted device key using the generated identical unique manufacturer key to generate a predetermined device key.

Abstract: Systems and methods for secure program execution are described. At least one embodiment includes a system for securely executing software comprising a host configured to accept a disc containing encrypted content to be accessed and store an encrypted program used to access the content on the disc. The system further comprises a secure coprocessor communicatively coupled to the host and configured to receive the encrypted program, decrypt and execute the encrypted program, and communicate an output generated by the program back to the host.

Abstract: A Personal Computer Memory Card International Association (PCMCIA) card is disclosed. The PCMCIA card may include a cryptographic module, a communications interface, and a processor. The cryptographic module may perform Type 1 encryption of data received from a computer into which the card is inserted. The cryptographic module may support High Assurance Internet Protocol Encryption (HAIPE). The communications interface may provide connectivity to a network adapter. The communications interface may include a Universal Serial Bus (USB) interface. The processor may detect whether a network adapter is coupled to the communications interface, identify a device driver that corresponds to the network adapter, and employ the device driver to provide operative communication between the cryptographic module and the network adapter. The PCMCIA card may contain a datastore that maintains a plurality device drivers. For example, the plurality of device drivers support any one of IEEE 802.x, Ethernet, V.

Abstract: Method for embedding a session secret, within an application instance, comprising the steps of generating an ephemeral session secret by a master application. Embedding, by master application, secret bytes, within application bytes of a slave application. Calculating said ephemeral session secret, by slave application, from said embedded secret bytes, when slave application is executed.

Abstract: In the field of computer software, obfuscation techniques for enhancing software security are applied to compiled (object) software code. The obfuscation results here in different versions (instances) of the obfuscated code being provided to different installations (recipient computing devices). The complementary code execution uses a boot loader or boot installer-type program at each installation which contains the requisite logic. Typically, the obfuscation results in a different instance of the obfuscated code for each intended installation (recipient) but each instance being semantically equivalent to the others. This is accomplished in one version by generating a random value or other parameter during the obfuscation process, and using the value to select a particular version of the obfuscating process, and then communicating the value along with boot loader or installer program software.

Abstract: Secure memory controlled access is described. In embodiment(s), memory stores encrypted data and the memory includes a secure memory partition to store cryptographically sensitive data utilized to control access to the encrypted data stored on the memory. Controller firmware can access the encrypted data stored on the memory, but is precluded from access to the secure memory partition and the cryptographically sensitive data. Secure firmware can access the cryptographically sensitive data stored on the secure memory partition to control access by the controller firmware to the encrypted data stored on the memory.

Abstract: An encryption device, a decryption device, an encryption method, and a decryption method effectively perform encryption and decryption by using a packet type judgment result. An encryption/decryption device includes a packet reception unit that acquires a packet, a first encryption engine that is formed by hardware and encrypts or decrypts a packet; and a second encryption engine that encrypts or decrypts a packet by using software. The encryption/decyption device also includes a head data identification unit that judges the real time feature of the acquired packet according to the header information on the acquired packet, and an encryption/decryption process judgment unit that decides the acquired packet encryption destination or decryption destination in accordance with the real time feature from the first encryption engine and the second encryption engine.