Linking encryption key management with granular policy

• US 10,348,485 B2
• Filed: 02/22/2017
• Issued: 07/09/2019
• Est. Priority Date: 02/26/2016
• Status: Active Grant

• Current Assignee: Fornetix LLC
• Original Assignee: Fornetix LLC
• Inventors: Stueve, Gerald J., Edwards, Stephen, Baquero, Lina M., White, Charles
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US15/439,839
• Publication Number:
  US 20170250799A1
• Time in Patent Office: 867 Days
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/008 involving homomorphic encryption
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

Examples describe herein relate to chaining operations under a molecular encryption scheme, including, but not limited to, defining a composite operation, wherein the composite operation comprises two or more separate operations, receiving input for the composite operation, invoking the composite operation for the input, performing the composite operation based on the input, and determining output corresponding to the input.

Claims

1. A method, comprising:

defining a composite operation, wherein the composite operation comprises two or more separate operations, wherein the two or more separate operations comprise at least one of an encryption management operation, an encryption operation, and a decryption operation and a second one of the encryption management operation, the encryption operation, and the decryption operation;

receiving input for the composite operation;

invoking the composite operation for the input;

performing the composite operation based on the input; and

determining output corresponding to the input.

2. The method of claim 1, wherein defining the composite operation comprises:

identifying the two or more separate operations for chaining into the composite operation;

storing the two or more separate operations; and

chaining the two or more separate operations into the composite operation.

3. The method of claim 2, wherein chaining the two or more separate operations into the composite operation comprises determining a relationship between the two or more separate operations.

4. The method of claim 3, wherein the relationship is one or more of a mathematical relationship, programmatic relationship, temporal relationship, or logical relationship.

5. The method of claim 1, wherein defining the composite operation further comprises:

defining logical constraints for the composite operation; and

defining failure operation for the composite operation.

6. The method of claim 1, wherein:

the input comprises a plurality of inputs; and

the output comprises a plurality of outputs, each of the plurality of outputs corresponds to one of the plurality of inputs.

7. The method of claim 6, wherein the plurality of outputs is released synchronously.

8. The method of claim 6, wherein the plurality of outputs is released asynchronously.

9. The method of claim 1, wherein two of the two or more separate operations are executed synchronously.

10. The method of claim 1, wherein two of the two or more separate operations are executed asynchronously.

11. The method of claim 1, further comprising recursively executing the composite operation, wherein the output is used as input for a subsequent iteration of the composite operation.

12. The method of claim 1, wherein the output is used as input for another composite operation, wherein the another composite operation comprises two or more separate operations.

13. The method of claim 1, wherein the encryption management operation corresponds to generating encryption keys.

14. The method of claim 13, wherein the encryption operation corresponds to encrypting data of the input using the encryption keys generated in the encryption management operation.

15. The method of claim 14, wherein the decryption operation corresponds to decrypting the encrypted data.

16. The method of claim 1, wherein

the composite operation comprises the encryption management operation, the encryption operation, and the decryption operation;

and

defining the composite operation comprises chaining the encryption management operation, the encryption operation, and the decryption operation in that order.

17. The method of claim 16, further comprising defining another composite operation by chaining the encryption management operation, the encryption operation, and the decryption operation in that order, wherein an output of the decryption operation of the composite operation is used as an input for the encryption management operation of the another composite operation.

18. A non-transitory computer-readable medium comprising computer-readable instructions such that, when executed, causes a processor to:

define a composite operation, wherein the composite operation comprises two or more separate operations, wherein the two or more separate operations comprise at least one of an encryption management operation, an encryption operation, and a decryption operation and a second one of the encryption management operation, the encryption operation, and the decryption operation;

receive input for the composite operation;

invoke the composite operation for the input;

perform the composite operation based on the input; and

determine output corresponding to the input.

19. A system, comprising:

a memory; and

a processor configured to;

define a composite operation, wherein the composite operation comprises two or more separate operations, wherein the two or more separate operations comprise at least one of an encryption management operation, an encryption operation, and a decryption operation and a second one of the encryption management operation, the encryption operation, and the decryption operation;

receive input for the composite operation;

invoke the composite operation for the input;

perform the composite operation based on the input; and

determine output corresponding to the input.

20. A system, comprising:

means for defining a composite operation, wherein the composite operation comprises two or more separate operations, wherein the two or more separate operations comprise at least one of an encryption management operation, an encryption operation, and a decryption operation and a second one of the encryption management operation, the encryption operation, and the decryption operation;

means for receiving input for the composite operation;

means for invoking the composite operation for the input;

means for performing the composite operation based on the input; and

means for determining output corresponding to the input.