Method and apparatus for performing concryption

• US 5,479,512 A
• Filed: 04/28/1994
• Issued: 12/26/1995
• Est. Priority Date: 06/07/1991
• Status: Expired due to Term

• Current Assignee: EMC Corporation (Dell Technologies Inc.)
• Original Assignee: Security Dynamics Technologies, Inc. (Symphony Technology Group LLC)
• Inventors: Weiss, Kenneth P.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/234,213
• Time in Patent Office: 607 Days
• Field of Search: 380/4, 380/9, 380/21, 380/28, 380/43, 380/44, 380/46, 380/49, 380/50, 380/59, 380/30, 380/23, 380/25, 380/54, 235/380
• US Class Current: 380/28
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/4093 Monitoring of device authentication
• CPC Class Codes: G07C 9/215 the system having a variable access-code, e.g. varied as a function of time
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 9/06 the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]

Abstract

A method and apparatus for the integrated compression and encryption (concryption) of clear data and for the deconcryption of concrypted data to obtain the clear data for utilization. For concryption, the clear data and an encryption key are obtained, at least one compression step is performed and at least one encryption step is performed utilizing the encryption key. The encryption step is preferably performed on the final or intermediate results of a compression step, with compression being a multistep operation. For deconcryption, decompression and deencryption steps are performed on concrypted data in essentially the reverse order for the performance of corresponding compression and encryption steps during the concryption operation.

Claims

1. A method for utilizing a data processor to change the form of data comprising the steps of:

a) obtaining the data at the processor in clear form;

b) obtaining an encryption key at the processor;

c) the processor performing a multi-step compression operation on said clear-form data;

d) the processor automatically utilizing said encryption key in conjunction with the results as directly generated by the processor for a selected step of said compression operation in performing an encryption operation, the compression steps of step (c) and the encryption step of step (d) being integrated to be performed as parts of a single operation; and

e) the processor outputting the resulting compressed and encrypted version of the clear-form data.

2. A method as claimed in claim 1 wherein step (e) includes the step, of storing the resulting compressed and encrypted data in memory.

3. A method as claimed in claim 1 wherein step (e) includes the step of transmitting the resulting compressed and encrypted data.

4. A method as claimed in claim 1 wherein said encryption key is a code derived from a token.

5. A method as claimed in claim 4 wherein the code derived from a token is a one-time nonpredictable code.

6. A method as claimed in claim 1 wherein step (d) includes the steps performed by the processor of dividing the results of the selected step of the compression operation into a plurality of segments, selecting an encryption key for each segment and performing an encryption operation for each segment utilizing the corresponding encryption key.

7. A method as claimed in claim 6 wherein the step of selecting an encryption key includes the step of processing the obtained encryption key to form a separate encryption key for each of the plurality of segments.

8. A method as claimed in claim 6 wherein the step of selecting an encryption key includes the step of utilizing the same encryption key for all segments.

9. A method as claimed in claim 1 wherein step (d) includes the steps performed by the processor of dividing the results of the selected step of the compression operation into a plurality of segments, utilizing the obtained encryption key to perform an encryption operation for a first of said segments, and utilizing a selected function of at least a portion of the encryption operation for a given segment as the encryption key for performing an encryption operation on a succeeding segment.

10. A method as claimed in claim 9 wherein the data is text and wherein a segment is N lines of such text, where N is an integer.

11. A method as claimed in claim 1 wherein the encryption operation includes the step of the processor performing an exclusive ORing operation with the encryption key and the results of the selected step.

12. A method as claimed in claim 1 wherein step (b) includes the step of forming the encryption key by exclusive ORing a password for a system user with a code derived from a token in the possession of the user.

13. A method as claimed in claim 1 wherein step (c) includes the step of the processor performing an initial run-length encoding operation on the clear-form data and

wherein step (d) is performed on the results of the run-length encoding step.

14. A method as claimed in claim 1 wherein step (d) is performed on at least one element used in a compression step.

15. A method as claimed in claim 14 wherein the element on which encryption is performed is a table used in performing a compression step.

16. A method as claimed in claim 1 including the step of restoring the data to clear form for utilization, said restoring step including the steps of performing at least one decompression operation and at least one deencryption operation, said decompression and deencryption steps being performed in reverse order to the performance of steps (c) and (d).

17. A method for utilizing a data processor to concrypt data comprising the steps of:

the processor obtaining the data in clear form;

the processor performing a concryption operation on the clear data, said concryption operation including at least one compression step and at least one encryption step automatically performed in a selected sequence as an integral operation; and

the processor outputting the resulting concrypted data.

18. A method as claimed in claim 17 including the step performed at a data processor of deconcrypting the concrypted data to permit use thereof in clear form, the deconcrypting step including at least one decompression step and at least one deencryption step performed automatically in a sequence which is substantially the reverse of said selected sequence.

19. A method as claimed in claim 17 wherein an encryption step is performed on the results of at least one stage of a compression step.

20. A method as claimed in claim 17 wherein an encryption step is performed on at least one element used in a compression step.

21. Apparatus for utilizing a data processor to change the form of data comprising:

means for obtaining the data at the processor in clear form;

means for obtaining an encryption key at the processor;

means for performing at the processor a multi-step compression operation on said clear-form data;

means at the processor for automatically utilizing said encryption key in conjunction with the results as directly generated by the processor for a selected step of said compression operation in performing an encryption operation, the compression performed by the compression means and the encryption performed by the encryption means being integrated to be performed as parts of the same operations; and

means at the processor for outputting the resulting compressed and encrypted version of the clear-form data.

22. Apparatus as claimed in claim 21 wherein the means for performing an encryption operation includes means at the processor for dividing the results of the selected step of the compression operation into a plurality of segments, and means for performing an encryption operation for each segment utilizing the corresponding encryption key.

23. Apparatus as claimed in claim 22 wherein the means for selecting an encryption key includes means for processing the obtained encryption key to form a separate encryption key for each of the plurality of segments.

24. Apparatus as claimed in claim 21 wherein the means for performing an encryption operation includes means at the processor for dividing the results of the selected step of the compression operation into a plurality of segments, means for utilizing the obtained encryption key to perform an encryption operation for a first of said segments, and means for utilizing a selected function of at least a portion of the encryption operation for a given segment as the encryption key for performing an encryption operation on a succeeding segment.

25. Apparatus as claimed in claim 21 wherein the means for performing an encryption operation includes means at the processor for performing an exclusive ORing operation with the encryption key and the results of the selected step.

26. Apparatus as claimed in claim 21 wherein the means for performing a multistep compression operation includes means at the processor for performing an initial run-length encoding operation on the clear-form data;

and

wherein the encryption operation is performed on the results of the run-length encoding operation.

27. Apparatus as claimed in claim 21 including means for restoring the data to clear form for utilization, said means for restoring including means for performing at least one decompression operation and at least one deencryption operation, said decompression and deencryption operations being performed in reverse order to the performance of compression and encryption by said means for compressing and said means for encrypting, respectively.

28. Apparatus for utilizing a data processor to concrypt data comprising:

means for obtaining the data at the processor in clear form;

means for performing a concryption operation at the processor on the clear data, said concryption operation including means for performing at least one compression step and means for performing at least one encryption step, said compression and encryption steps being automatically performed in a selected sequence as an integrated operation; and

means for the processor outputting the resulting concrypted data.

29. Apparatus as claimed in claim 28 including means at a data processor for deconcrypting the concrypted data to permit use thereof in clear form, the means for deconcrypting including means for performing at least one decompression step and means for performing at least one deencryption step;

the decompression and deencryption steps being performed automatically in a sequence which is substantially the reverse of said selected sequence.