POLICY-ENABLED ENCRYPTION KEYS HAVING COMPLEX LOGICAL OPERATIONS

• US 20170251022A1
• Filed: 02/22/2017
• Published: 08/31/2017
• Est. Priority Date: 02/26/2016
• Status: Active Grant

• Current Assignee: Fornetix LLC
• Original Assignee: Fornetix LLC
• Inventors: White, Charles, Edwards, Stephen
• Granted Patent: US 10,860,086 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 1/324 by lowering clock frequency
• CPC Class Codes: G06F 1/3296 by lowering the supply or operating voltage
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H02M 1/14 Arrangements for reducing ripples from dc input or output
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068

Abstract

Examples described herein relate to a system for orchestrating a security object, including a memory and processor configured to define a plurality of complex policies in a database, wherein the complex policies comprises one or more of EQUAL policy, ONE-OF policy, MEMBER OF policy, NULL policy, NOT-NULL policy, GREATER-THAN policy, GREATER-THAN-OR-EQUAL-TO policy, LESS-THAN policy, or LESS-THAN-OR-EQUAL-TO policy, receive the security object and at least one object attribute associated with the security object, determine acceptability of the security object based, at least in part, on the at least one object attribute and at least one of the plurality of complex policies corresponding to the at least one object attribute, and distribute the security object to at least one communication device associated with the processor when the security object is determined to be acceptable, wherein the at least one communication device establishes communication based, at least in part, on the security object.

Claims

1. A method for evaluating an encryption key based on complex policies, the method comprising:

defining complex policies for evaluating a key attribute of the encryption key, wherein the complex policies comprises one or more of EQUAL policy, ONE-OF policy, MEMBER OF policy, NULL policy, NOT-NULL policy, GREATER-THAN policy, GREATER-THAN-OR-EQUAL-TO policy, LESS-THAN policy, or LESS-THAN-OR-EQUAL-TO policy; and

evaluating the encryption key based on the key attribute and the complex policies.

2. The method of claim 1, wherein the complex policies are more complex than BOOLEAN policies.

3. The method of claim 1, wherein the EQUAL policy is used to evaluate whether the key attribute of the encryption key is equivalent or identical to a policy value.

4. The method of claim 1, wherein the ONE-OF policy is used to evaluate whether the key attribute of the encryption key is a member of a set.

5. The method of claim 1, wherein the MEMBER-OF policy is used to evaluate a parentage of the key attribute of the encryption key.

6. The method of claim 1, wherein:

the NULL policy is used to evaluate whether the key attribute of the encryption key is set to NULL; and

the NOT-NULL policy is used to evaluate whether the key attribute of the encryption key is set to a non-NULL value.

7. The method of claim 1, wherein:

the GREATER-THAN policy is used to evaluate whether the key attribute of the encryption key is greater than a policy value; and

the GREATER-THAN-OR-EQUAL-TO policy is used to evaluate whether the key attribute of the encryption key is greater than or equal to a policy value.

8. The method of claim 1, wherein:

the LESS-THAN policy is used to evaluate whether the key attribute of the encryption key is less than a policy value; and

the LESS-THAN-OR-EQUAL-TO policy is used to evaluate whether the key attribute of the encryption key is less than or equal to a policy value.

9. The method of claim 1, wherein the key attribute comprises a descriptive string attribute.

10. The method of claim 1, wherein the key attribute comprises one or more of a key size, creation, deletion, date created, date deleted, object group, encryption mask, name, key name.

18. The system of claim 1, wherein:

the GREATER-THAN policy is used to evaluate whether the key attribute of the encryption key is greater than a policy value; and

the GREATER-THAN-OR-EQUAL-TO policy is used to evaluate whether the key attribute of the encryption key is greater than or equal to a policy value.

19. The system of claim 1, wherein:

the LESS-THAN policy is used to evaluate whether the key attribute of the encryption key is less than a policy value; and

the LESS-THAN-OR-EQUAL-TO policy is used to evaluate whether the key attribute of the encryption key is less than or equal to a policy value.

20. The system of claim 1, wherein the complex policies are more complex than BOOLEAN policies.

11. A non-transitory computer-readable medium comprising computer-readable instructions such that, when executed, causes a processor to:

define complex policies for evaluating a key attribute of the encryption key, wherein the complex policies comprises one or more of EQUAL policy, ONE-OF policy, MEMBER OF policy, NULL policy, NOT-NULL policy, GREATER-THAN policy, GREATER-THAN-OR-EQUAL-TO policy, LESS-THAN policy, or LESS-THAN-OR-EQUAL-TO policy; and

evaluate the encryption key based on the key attribute and the complex policies.

12. The non-transitory computer-readable medium of claim 11, wherein the complex policies are more complex than BOOLEAN policies.

13. A system for orchestrating a security object, the system comprising:

a memory; and

a processor configured to

define a plurality of complex policies in a database, wherein the complex policies comprises one or more of EQUAL policy, ONE-OF policy, MEMBER OF policy, NULL policy, NOT-NULL policy, GREATER-THAN policy, GREATER-THAN-OR-EQUAL-TO policy, LESS-THAN policy, or LESS-THAN-OR-EQUAL-TO policy;

receive the security object and at least one object attribute associated with the security object;

determine acceptability of the security object based, at least in part, on the at least one object attribute and at least one of the plurality of complex policies corresponding to the at least one object attribute; and

distribute the security object to at least one communication device associated with the processor when the security object is determined to be acceptable, wherein the at least one communication device establishes communication based, at least in part, on the security object.

14. The system of claim 13, wherein the EQUAL policy is used to evaluate whether the key attribute of the encryption key is equivalent or identical to a policy value.

15. The system of claim 13, wherein the ONE-OF policy is used to evaluate whether the key attribute of the encryption key is a member of a set.

16. The system of claim 13, wherein the MEMBER-OF policy is used to evaluate a parentage of the key attribute of the encryption key.

17. The system of claim 13, wherein:

the NULL policy is used to evaluate whether the key attribute of the encryption key is set to NULL; and

the NOT-NULL policy is used to evaluate whether the key attribute of the encryption key is set to a non-NULL value.