Apparatus and method for reducing transmission bandwidth and storage requirements in a cryptographic security system

• US 6,567,914 B1
• Filed: 04/27/2000
• Issued: 05/20/2003
• Est. Priority Date: 07/22/1998
• Status: Expired due to Term

• Current Assignee: Entrust Corp.
• Original Assignee: Entrust Technologies Limited
• Inventors: Van Oorschot, Paul, Just, Michael K.
• Primary Examiner(s): Hayes, Gail
• Assistant Examiner(s): Seal, James
• Application Number:
  US09/561,249
• Time in Patent Office: 1,118 Days
• Field of Search: 380/278, 713/163, 713/160
• US Class Current: 713/160
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

An apparatus and methods for facilitating a reduction in data transmission bandwidth removes unnecessary data relating to encryption keys prior to sending a message or storing the encrypted information for a recipient. Encrypted data, such as message data for multiple recipients, is analyzed to determine whether encryption related data for other recipients may be removed.

Claims

1. A method for reducing data transmission bandwidth comprising the steps of:

receiving data containing header data wherein the header data includes a plurality of cryptographic key packages associated with multiple recipients;

storing the received data;

receiving, from at least one of the multiple recipients, first key identification data associated with the at least one of the multiple recipients;

parsing the header data to determine whether at least one of the plurality of cryptographic key packages corresponds to the first key identification data;

removing at least some cryptographic key packages not corresponding to the first key identification data to produce a pruned response based on the received first key identification data; and

sending the pruned response to the at least one of the multiple recipients.

2. The method of claim 1 wherein at least one cryptographic key package includes at least one symmetric encryption key wrapped with an asymmetric encryption key.

3. The method of claim 1 wherein the data also contains message data and wherein the method further includes the step of re-storing the parsed header data with encrypted message data for future use.

4. The method of claim 1 wherein the step of removing at least some cryptographic key packages includes removing all cryptographic key packages except the cryptographic key package corresponding to the at least one of the multiple recipients.

5. The method of claim 1 including the step of decrypting, compressing, and re-encrypting the message data prior to restoring the encrypted message.

6. The method of claim 1 wherein the first key identification data includes one of at least transport header information and a cryptographic key package.

7. A method for reducing data transmission bandwidth comprising the steps of:

receiving data containing header data wherein the header data includes a plurality of cryptographic key packages associated with multiple recipients;

storing the received data;

retrieving, from a database, first key identification data associated with a predetermined recipient;

parsing the header data to determine whether at least one of the plurality of cryptographic key packages corresponds to the first key identification data;

removing at least some cryptographic key packages not corresponding to the first key identification data to produce a pruned response based on the received first key identification data; and

sending the pruned response to the predetermined recipient.

8. The method of claim 7 including the step of storing the pruned response.

9. The method of claim 7 wherein at least one cryptographic key package includes at least one symmetric encryption key wrapped with an asymmetric encryption key.

10. The method of claim 7 wherein the data also contains message data and wherein the method further includes the step of re-storing the parsed header data with encrypted message data for future use.

11. The method of claim 7 wherein the step of removing at least some cryptographic key packages includes removing all cryptographic key packages except the cryptographic key package corresponding to the predetermined recipient.

12. The method of claim 7 including the steps of decrypting, compressing, and re-encrypting the message data prior to restoring the encrypted message.

13. An apparatus for facilitating data bandwidth reduction comprising:

means for receiving data containing header data wherein the header data includes a plurality of cryptographic key packages associated with multiple recipients and for receiving, from at least one of the multiple recipients, first key identification data associated with the at least one of the multiple recipients;

means, operatively coupled to the receiving means, for parsing the header data to determine whether at least one of the plurality of cryptographic key packages corresponds to key identification data for the at least one of the multiple recipients; and

means, operatively coupled to the parsing means, for removing at least some cryptographic key packages not corresponding to the first key identification data received from the at least one of the multiple recipients.

14. The apparatus of claim 13 wherein at least one cryptographic key package includes at least one symmetric encryption key wrapped using an asymmetric encryption key.

15. The apparatus of claim 13 wherein the data also contains message data and wherein the apparatus includes means for re-storing the parsed header data with encrypted message data for future use.

16. The apparatus of claim 13 wherein the means for removing at least some cryptographic key packages removes all cryptographic key packages except the cryptographic key package corresponding to the predetermined recipient.