Secure data transmission using undiscoverable or black data

• US 20060195402A1
• Filed: 03/06/2006
• Published: 08/31/2006
• Est. Priority Date: 02/27/2002
• Status: Abandoned Application

• Current Assignee: Imagine Software LLC
• Original Assignee: Imagine Software LLC
• Inventors: Cochran, William, Malina, Richard
• Application Number:
  US11/368,959
• Publication Number:
  US 20060195402A1
• Time in Patent Office: Days
• US Class Current: 705/50
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Methods and systems of encrypting data. One method includes establishing data that includes discoverable or “white” data and undiscoverable or “black” data. Black data is generally unrecognizable. For example, it may be random data. White data generally has recognizable content or is transmitted in a recognizable format. A first key and a second key are created or established, such that the second key is substantially underivable from the first key. The discoverable or white data is encrypted with the first key and the undiscoverable or black data is encrypted with the second key. In subsequent communications or transactions, at least one of the first key and the second key is mutated.

Claims

1. A method of encrypting data, the method comprising:

establishing first data including first discoverable data and first undiscoverable data;

establishing a first key and a second key, the second key being substantially underivable from the first key;

encrypting the first discoverable data with the first key; and

encrypting the first undiscoverable data with the second key

2. The method of claim 1 further comprising mutating at least one of the first key and the second key, establishing second data including second discoverable data and second undiscoverable data, encrypting the second discoverable data with the first key, and encrypting the second undiscoverable data with the second key.

3. The method of claim 1 further comprising establishing a third key.

4. The method of claim 3 wherein establishing a third key includes establishing a third key based on at least one of the first key and the second key.

5. The method of claim 3 wherein establishing a third key includes establishing a third key by performing an exclusive OR of a fourth key and at least one of the first key and the second key.

6. The method of claim 3 further comprising encrypting at least a portion of the discoverable data with the third key.

7. The method of claim 6 further comprising mutating the third key.

8. The method of claim 1 wherein encrypting the discoverable data with a first key includes encrypting the discoverable data and a result of encrypting the undiscoverable data with the second key with the first key.

9. The method of claim 1 wherein encrypting the undiscoverable data with a second key includes encrypting the undiscoverable data and a result of encrypting the discoverable data with the first key with the second key.

10. The method of claim 1 further comprising establishing an identifier.

11. The method of claim 10 further comprising appending the identifier to at least one of a result of encrypting the discoverable data with the first key and a result of encrypting the undiscoverable data with the second key.

12. The method of claim 11 further comprising mutating the identifier.

13. The method of claim 1 further comprising generating a hash of at least a portion of the data.

14. The method of claim 13 further comprising encrypting the hash with the second key.

15. A system for encrypting data including discoverable data and undiscoverable data, the system comprising:

a sender having a first key and a second key, the second key being substantially underivable from the first key, the sender configured to encrypt the discoverable data with the first key, to encrypt the undiscoverable data with the second key, and to receive at least one of a mutated first key and a mutated second key.

16. The system of claim 15 further comprising an authenticator configured to establish the first key and the second key.

17. The system of claim 16 wherein the authenticator is further configured to establish the mutated first key and the mutated second key.

18. The system of claim 15 wherein the sender further has a third key.

19. The system of claim 18 wherein the third key is based on at least one of the first key and the second key.

20. The system of claim 18 wherein the third key is based on the result of an exclusive OR of a fourth key and at least one of the first key and the second key.

21. The system of claim 18 wherein the sender is further configured to encrypt at least a portion of the discoverable data with the third key.

22. The system of claim 21 wherein the sender is further configured to receive a mutated third key.

23. The system of claim 15 wherein the sender is further configured to encrypt the discoverable data and a result of encrypting the undiscoverable data with a second key with the first key.

24. The system of claim 15 wherein the sender is further configured to encrypt the undiscoverable data and a result of encrypting the discoverable data with the first key with the second key.

25. The system of claim 15 wherein the sender further has an identifier.

26. The system of claim 25 wherein the sender is further configured to append the identifier to at least one of a result of encrypting the discoverable data with the first key and a result of encrypting the undiscoverable data with the second key.

27. The system of claim 26 wherein the sender is further configured to receive a mutated identifier.

28. The system of claim 15 wherein the sender is further configured to generate a hash of at least a portion of the discoverable data.

29. The system of claim 28 wherein the sender is further configured to encrypt the hash with the second key.

30. A storage device for storing data, the device configured to encrypt discoverable data with a first set of keys and undiscoverable data with a second set of keys, the second set of keys being substantially underivable from the first set of keys.

31. The storage device of claim 30 further configured to communicate with an authenticator to receive a mutation of at least one of the first set of keys or the second set of keys.

32. The storage device of claim 30 further configured to require authorization before activating.

33. The storage device of claim 32 wherein the authorization includes at least one of a password and a personal identification number.

34. A method of transmitting messages between an entity and an authenticator comprising:

establishing an identifier associated with the entity;

establishing a first key to encrypt only undiscoverable data, the first key known only to the entity and the authenticator;

establishing a second key to encrypt only discoverable data, the second key known only to the entity and the authenticator;

encrypting request parameters with the second key to create an encrypted request;

generating a hash of the request parameters;

encrypting the hash of the request parameters with the first key to create an encrypted request hash;

the entity sending the encrypted request and the encrypted request hash to the authenticator; and

mutating at least one of the first key and the second key.

35. The method of claim 34 wherein generating a hash of the request parameters includes generating a hash of the request parameters and the identifier.

36. The method of claim 35 further comprising appending the identifier to at least one of the encrypted message and the encrypted message hash.

37. The method of claim 36 further comprising establishing a key function that extracts a portion of the first key based on the identifier.

38. The method of claim 37 wherein encrypting the hash of the request parameters with the first key includes encrypting the hash of the request parameters with a result of the key function.

39. The method of claim 34 further comprising establishing an initialization vector based on the first key and the identifier.

40. The method of claim 39 wherein generating a hash of the request parameters includes generating a hash of the request parameters based on the initialization vector.

41. The method of claim 34 further comprising establishing an extraction function based on the first key and the identifier.

42. The method of claim 41 wherein generating a hash of the request parameters includes generating a hash of the request parameters and a result of the extraction function.

43. The method of claim 34 further comprising mutating the identifier to create a mutated identifier and sending the mutated identifier to the entity.

44. The method of claim 43 further comprising mutating the second key to create a mutated second key and encrypting the mutated second key and response parameters with the second key to create an encrypted response.

45. The method of claim 44 further comprising the generating a random mutation value.

46. The method of claim 45 wherein mutating at least one of the first key and the second key includes mutating at least one of the first key and the second key using the mutation value.

47. The method of claim 46 further comprising generating a hash of the mutated identifier, the mutated second key, the mutation value, and the response parameters.

48. The method of claim 47 wherein generating a hash of the mutated identifier, the mutated second key, the mutation value, and the response parameters includes generating a hash of the mutated identifier, the mutated second key, the mutation value, and the response parameters based on an initialization vector.

49. The method of claim 48 wherein generating a hash of the mutated identifier, the mutated second key, the mutation value, and the response parameters includes generating a hash of the mutated identifier, the mutated second key, the mutation value, the response parameters, and a result of the extraction function.

50. The method of claim 49 further comprising encrypting the mutation value and the hash of the mutated identifier, the mutated second key, the mutation value, and the response parameters with the first key to create an encrypted response hash.

51. The method of claim 50 wherein encrypting the mutation value and the hash of the mutated identifier, the mutated second key, the mutation value, and the response parameters with the first key includes encrypting the mutation value and the hash of the mutated identifier, the mutated second key, the mutation value, and the response parameters with a result of a key function.

52. The method of claim 51 further comprising appending the mutated identifier to at least one of the encrypted response and the encrypted response hash.

53. The method of claim 52 further comprising sending the encrypted response and the encrypted response hash to the entity.