Skeleton Network: Physical Corner Stone for The Towering Cyber House

• US 20190327219A1
• Filed: 06/18/2019
• Published: 10/24/2019
• Est. Priority Date: 10/14/2016
• Status: Active Grant

• Current Assignee: Gideon Samid
• Original Assignee: Gideon Samid
• Inventors: Samid, Gideon
• Granted Patent: US 10,523,642 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 9/0656 Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

This invention establishes a physical corner stone to build upon it a towering cyber space—creating a baseline which is out of bounds for remote hackers, and is tamper resistant to hands on attackers—intended to survive even a catastrophic breach of the host network, and subsequently serve as a leverage to recover from the attack. Foundational security for critical infrastructure.

Claims

1. A system comprised of a network of communicating elements, where the network is called “

skeleton network” and

the elements are called “

skeleton stations”

, and where every skeleton station is comprised of a physical-entry computer (PEC), and a data access box (DAB), and where the DAB is a secure enclosure as described in U.S. patent application Ser. No. 15/293,352 with the shared key fitted inside the DAB, and where all remote data that comes into the skeleton station is first routed through the DAB where it is decrypted before it is routed to the PEC, and where the PEC is limited to physical and local data entry, except as to data entry from the DAB; and

in addition, each skeleton station is constructed to send messages to other skeleton stations by first encrypting these message through the DAB by routing the plaintext version of these messages in a hard wired mode to the DAB and routing the outcome of the DAB, the ciphertext version, to a target skeleton station in the skeleton network.

2. A system as in claim 1 where the cipher used is one where the size of the key may be set to be as large as desired, and where as long as the total bit count of all the messages processed in the DAB is equal or less than the number of bits in the key in the DAB, the ciphertexts cannot be cryptanalyzed to deduce the key in the DAB, nor can the respective plaintexts be determined, as is the case for Vernam Cipher, and for the ciphers expressed in US patent applications:

Ser. No. 14/714,328, PCT/US2017/060188, US20170250796A1, #62813281 and in U.S. Pat. No. 6,823,068; and

where the DAB includes a data use monitor that counts the number of bits processed by the DAB, so that when that count reaches the bit size of the key in the DAB, a key-erasure apparatus is activated, and the key is erased.

3. A system as in claim 1 where the skeleton stations are fitted as nodes within a host network that carries the communication between and among skeleton stations, and where the nodes of the host network which are not skeleton stations can receive messages from the skeleton stations but they cannot send information to the skeleton stations.

4. A system as in claim 1 where the skeleton stations are joined with a computing device which serves as a node of the host network but is not a skeleton station, called “

regular node”

, and where the regular node and the skeleton station comprise a skeleton administration post managed by a human controller who can pass information from the PEC to the regular node back and forth, using physical means.

5. A system as in claim 1 where the DAB operates either to encrypt messages, or to decrypt messages, but not both in the same DAB.

6. A system as in claim 1 where skeleton stations are fitted to either encrypt messages to be sent out to another skeleton station, or to decrypt messages sent from another skeleton station, but cannot perform both encryption and decryption.

7. A method used with the system in claim 1 where skeleton stations communicate over exposed channels while preventing a remote attacker from compromising the communication by using cryptographic keys which are all secured in a secure enclosure, and are all erased when they are used to process data of bit count larger than the bit count of the processing key.

8. A method used with the system in claim 3 where the host network is divided into “

offline communication zones”

(OCZ), such that each regular node in the host network is close enough to establish an offline shared key with a skeleton station