METHODS AND SYSTEMS FOR DATA TRAFFIC CONTROL AND ENCRYPTION

• US 20160119294A1
• Filed: 05/21/2014
• Published: 04/28/2016
• Est. Priority Date: 05/21/2014
• Status: Active Grant

• Current Assignee: R2 Solutions LLC (Acacia Research Corporation)
• Original Assignee: Yahoo! Inc. (Apollo Global Management, Inc.)
• Inventors: Gashinsky, Igor, Petach, Matthew Nicholas, Batta, Nitin, LaCroix, Brian
• Granted Patent: US 10,277,559 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

Methods, systems and programming for data traffic control and encryption. In one example, data traffic is received from a first node to be sent to a second node. The health of an encryption pathway between the first node and the second node is determined. The data traffic is sent to the second node over the network without going through the encryption pathway when the encryption pathway is not healthy.

Claims

1. A method implemented on at least one machine each of which has at least one processor, storage, and a communication platform connected to a network for data traffic control, the method comprising:

receiving data traffic from a first node to be sent to a second node;

determining the health of an encryption pathway between the first node and the second; and

sending the data traffic to the second node over the network without going through the encryption pathway when the encryption pathway is not healthy.

2. The method of claim 1, further comprising sending the data traffic to the second node over the network through the encryption pathway when the encryption pathway is healthy.

3. The method of claim 1, wherein the health of the encryption pathway between the first node and the second node is determined at a regular interval.

4. A system having at least one processor, storage, and a communication platform connected to a network for data traffic control, the system comprising:

a health checking module configured to determine the health of an encryption pathway between a first node and a second node; and

a routing module configured to send data traffic received from the first node to the second node over the network without going through the encryption pathway when the encryption pathway is not healthy.

5. The system of claim 4, wherein the routing module is further configured to send the data traffic to the second node over the network through the encryption pathway when the encryption pathway is healthy.

6. The system of claim 4, wherein the heath of the encryption pathway between the first node and the second node is determined by the health checking module at a regular interval.

7. A non-transitory machine-readable medium having information recorded thereon for data traffic control, wherein the information, when read by the machine, causes the machine to perform the following:

receiving data traffic from a first node to be sent to a second node;

determining the health of an encryption pathway between the first node and the second; and

sending the data traffic to the second node over the network without going through the encryption pathway when the encryption pathway is not healthy.

8. A system for data traffic control comprising:

means for determining the health of an encryption pathway between a first node and a second node; and

means for sending data traffic received from the first node to the second node over the network without going through the encryption pathway when the encryption pathway is not healthy.

9. A method implemented on at least one machine each of which has at least one processor, storage, and a communication platform connected to a network for encryption pathway health check, the method comprising:

encrypting first data at a first node;

sending the encrypted first data to a second node over the network through an encryption pathway;

decrypting the encrypted first data to generate second data at the second node;

encrypting the second data at the second node;

sending the encrypted second data to the first node over the network through the encryption pathway;

decrypting the encrypted second data to generate third data at the first node; and

comparing the first data with the third data at the first node to determine the health of the encryption pathway between the first node and the second node.

10. The method of claim 9, wherein the encryption pathway between the first node and the second node is healthy if the first data matches the third data according to at least one criterion.

11. The method of claim 9, wherein the first data is at least one of a test message and normal data traffic.

12. A system having at least one processor, storage, and a communication platform connected to a network for encryption pathway health check, the system comprising:

a first encrypting module of a first node configured to encrypt first data;

a first routing module of the first node configured to send the encrypted first data to a second node over the network through an encryption pathway;

a second decrypting module of the second node configured to decrypt the encrypted first data to generate second data;

a second encrypting module of the second node configured to encrypt the second data;

a second routing module of the second node configured to send the encrypted second data to the first node over the network through the encryption pathway;

a first decrypting module of the first node configured to decrypt the encrypted second data to generate third data; and

a comparing module of the first node configured to compare the first data with the third data at the first node to determine the health of the encryption pathway between the first node and the second node.

13. The system of claim 12, wherein the encryption pathway between the first node and the second node is healthy if the first data matches the third data according to at least one criterion.

14. The system of claim 12, wherein the first data is at least one of a test message and normal data traffic.

15. A non-transitory machine-readable medium having information recorded thereon for encryption pathway health check, wherein the information, when read by the machine, causes the machine to perform the following:

encrypting first data at a first node;

sending the encrypted first data to a second node over the network through an encryption pathway;

decrypting the encrypted first data to generate second data at the second node;

encrypting the second data at the second node;

sending the encrypted second data to the first node over the network through the encryption pathway;

decrypting the encrypted second data to generate third data at the first node; and

comparing the first data with the third data at the first node to determine the health of the encryption pathway between the first node and the second node.

16. A system for encryption pathway health check comprising:

means for encrypting first data at a first node;

means for sending the encrypted first data to a second node over the network through an encryption pathway;

means for decrypting the encrypted first data to generate second data at the second node;

means for encrypting the second data at the second node;

means for sending the encrypted second data to the first node over the network through the encryption pathway;

means for decrypting the encrypted second data to generate third data at the first node; and

means for comparing the first data with the third data at the first node to determine the health of the encryption pathway between the first node and the second node.

17. A method implemented on at least one machine each of which has at least one processor, storage, and a communication platform connected to a network for encryption pathway health check, the method comprising:

receiving encrypted first data from a node over the network through an encryption pathway;

decrypting the encrypted first data to generate second data;

encrypting the second data; and

sending the encrypted second data to the node over the network through the encryption pathway.

18. The method of claim 17, wherein the first data is at least one of a test message and normal data traffic.

19. A system having at least one processor, storage, and a communication platform connected to a network for encryption pathway health check, the system comprising:

a routing module configured to receive encrypted first data from a node over the network through an encryption pathway;

a decrypting module configured to decrypt the encrypted first data to generate second data; and

an encrypting module configured to encrypt the second data, wherein

the routing module sends the encrypted second data to the node over the network through the encryption pathway.

20. The system of claim 19, wherein the first data is at least one of a test message and normal data traffic.

21. A non-transitory machine-readable medium having information recorded thereon for encryption pathway health check, wherein the information, when read by the machine, causes the machine to perform the following:

receiving encrypted first data from a node over the network through an encryption pathway;

decrypting the encrypted first data to generate second data;

encrypting the second data; and

sending the encrypted second data to the node over the network through the encryption pathway.

22. A method implemented on at least one machine each of which has at least one processor, storage, and a communication platform connected to a network for encryption pathway health check, the method comprising:

encrypting first data;

sending the encrypted first data to a node over the network through an encryption pathway;

receiving encrypted second data from the node over the network through the encryption pathway, wherein the second data is decrypted from the encrypted first data;

decrypting the encrypted second data to generate third data; and

comparing the first data with the third data to determine the health of the encryption pathway to the node.

23. The method of claim 22, wherein the encryption pathway to the node is healthy if the first data matches the third data according to at least one criterion.

24. The method of claim 22, wherein the first data is at least one of a test message and normal data traffic.

25. A system having at least one processor, storage, and a communication platform connected to a network for encryption pathway health check, the system comprising:

an encrypting module configured to encrypt first data;

a routing module configured to send the encrypted first data to a node over the network through an encryption pathway and receive encrypted second data from the node over the network through the encryption pathway, wherein the second data is decrypted from the encrypted first data;

a decrypting module configured to decrypt the encrypted second data to generate third data; and

a comparing module configured to compare the first data with the third data to determine the health of the encryption pathway to the node.

26. The system of claim 25, wherein the encryption pathway to the node is healthy if the first data matches the third data according to at least one criterion.

27. The system of claim 25, wherein the first data is at least one of a test message and normal data traffic.

28. A non-transitory machine-readable medium having information recorded thereon for encryption pathway health check, wherein the information, when read by the machine, causes the machine to perform the following:

encrypting first data;

sending the encrypted first data to a node over the network through an encryption pathway;

receiving encrypted second data from the node over the network through the encryption pathway, wherein the second data is decrypted from the encrypted first data;

decrypting the encrypted second data to generate third data; and

comparing the first data with the third data to determine the health of the encryption pathway to the node.

29. A method implemented on at least one machine each of which has at least one processor, storage, and a communication platform connected to a network for data traffic encryption, the method comprising:

providing a first encryption key to a first node and a second node;

providing a second encryption key to the first node and the second node, wherein the second encryption key is encrypted based on the first encryption key when it is provided to the first and second nodes; and

establishing between the first node and the second node an encryption pathway through which the first node and the second node communicate via the second encryption key.

30. The method of claim 29, wherein the first encryption key is randomly generated for the first and second nodes.

31. The method of claim 29, wherein an existing second encryption key is replaced by a new second encryption key at a first regular interval.

32. The method of claim 29, wherein a third encryption key is encrypted based on the second encryption key and provided to the first node and the second node.

33. The method of claim 32, wherein an existing third encryption key is replaced by a new third encryption key at a second regular interval.

34. The method of claim 32, wherein data traffic between the first node and the second node is encrypted based on the third encryption key when the encryption pathway is healthy.

35. A system having at least one processor, storage, and a communication platform connected to a network for data traffic encryption, the system comprising:

a key generating module configured to provide a first encryption key and a send encryption key to a first node and a second node, wherein the second encryption key is encrypted based on the first encryption key when it is provided to the first and second nodes; and

a data traffic module configured to establish between the first node and the second node an encryption pathway through which the first node and the second node communicate via the second encryption key.

36. The system of claim 35, wherein the first encryption key is randomly generated for the first and second nodes.

37. The system of claim 35, wherein an existing second encryption key is replaced by a new second encryption key at a first regular interval.

38. The system of claim 35, wherein the key generating module is further configured to provide a third encryption key to the first node and the second node, the third encryption key being encrypted based on the second encryption key.

39. The system of claim 38, wherein an existing third encryption key is replaced by a new third encryption key at a second regular interval.

40. The system of claim 38, wherein data traffic between the first node and the second node is encrypted based on the third encryption key when the encryption pathway is healthy.

41. A non-transitory machine-readable medium having information recorded thereon for data traffic encryption, wherein the information, when read by the machine, causes the machine to perform the following:

providing a first encryption key to a first node and a second node;

providing a second encryption key to the first node and the second node, wherein the second encryption key is encrypted based on the first encryption key when it is provided to the first and second nodes; and

establishing between the first node and the second node an encryption pathway through which the first node and the second node communicate via the second encryption key.

42. A system for data traffic encryption comprising:

means for providing a first encryption key and a second encryption key to a first node and a second node, wherein the second encryption key is encrypted based on the first encryption key when it is provided to the first and second nodes; and

means for establishing between the first node and the second node an encryption pathway through which the first node and the second node communicate via the second encryption key.