Secured embedded data encryption systems

• US 9,438,569 B2
• Filed: 10/03/2014
• Issued: 09/06/2016
• Est. Priority Date: 03/13/2013
• Status: Active Grant

• Current Assignee: Willow Company Limited
• Original Assignee: Willow Company Limited
• Inventors: Livolsi, Jonathan P., Livolsi, Robert R.
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US14/506,320
• Publication Number:
  US 20150026470A1
• Time in Patent Office: 704 Days
• Field of Search: 713/168
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

Devices generate security vectors based on their own attributes. A device'"'"'s security vectors compose its transformation matrix. The devices securely share copies of their transformation matrices with other devices. A transmitting device adds its unique MAC to packets, encrypts those packets using its own transformation matrix, and transmits those packets. A receiving device uses its copy of the transmitting device'"'"'s transformation matrix to decrypt the data in a packet, determining whether a MAC extracted from that packet matches the transmitting device'"'"'s MAC. The receiving device can permit or prevent further processing of the packet'"'"'s data depending on whether the MACs match. Each device can store a copy of a same program that can be used to derive derivative security vectors from existing security vectors. Each device in the network can derive the same set of derivative vectors for any selected other device in the network, thereby “evolving” the transformation matrices.

Claims

1. A method of securing communications between a first device and a second device, wherein the method comprises:

sending, from the first device to the second device, a first set of security vectors and a first message authentication code (MAC) to the second device to provide, on the second device, a stored first set of security vectors and a stored first MAC, wherein the first set of ecurity vectors and the first MAC are unique to the first device;

generating, by the first device, a first transformation matrix from the first set of security vectors;

generating, by the first device, a first derivative transformation matrix from the first transformation matrix using an initialization program;

encrypting, by the first device, data and the first MAC using the first derivative transformation matrix to provide encrypted data and an encrypted first MAC;

sending, from the first device to the second device, the encrypted data and the encrypted first MAC;

generating, by the second device, a second transformation matrix from the stored first set of security vectors;

generating, by the second device, a second derivative transformation matrix from the second transformation using the initialization program;

decrypting, by the second device, the encrypted data and the encrypted first MAC using the second derivative transformation matrix to provide decrypted data and a decrypted first MAC;

comparing the decrypted first MAC to the stored first MAC; and

releasing the decrypted data if the decrypted first MAC is equivalent to the stored first MAC.

2. The method of claim 1, comprising, before the step of sending the first set of security vectors,

generating a first set of security vectors by the first device, wherein the first set of security vectors is unique to the first device;

and

generating a second set of security vectors by the second device, wherein the second set of security vectors is unique to the second device.

3. The method of claim 1, comprising, sending the second set of security vectors and the first MAC to the first device.

4. The method of claim 1, wherein sending the first set of security vectors and the first MAC to the second device comprises:

encrypting the first set of security vectors and the first MAC using an encryption algorithm proprietary to the first device and to the second device.

5. The method of claim 1, comprising, after releasing the decrypted data, processing, by the second device, the decrypted data, transferring the decrypted data to a further destination, or a combination thereof.

6. The method of claim 1, comprising storing an initialization program in the first device and in the second device.

7. The method of claim 1, comprising storing a copy of the decrypted data in a buffer of the second device.

8. The method of claim 1, wherein,

at least one of the security vectors of the first set of security vectors is periodically updated;

and

at least one of the security vectors of the second set of security vectors is periodically updated.

9. The method of claim 1, wherein,

at least one of the security vectors of the first set of security vectors is unique to the first device;

and

at least one of the security vectors of the second set of security vectors is unique to the second device.

10. The method of claim 1, wherein at least one of the security vectors of the first set of security vectors and at least one of the security vectors of the second set of security vectors is selected from a geophysical location of the respective communications device, biometric information of a user of at respective communications device, a time/date stamp associated with a respective device, and a combination of any of the foregoing.

11. The method of claim 1, wherein,

the data and the first MAC are encrypted on a packet-by-packet basis;

and

the encrypted data and the encrypted first MAC are decrypted on a packet-by-packet basis.

12. The method of claim 1, wherein encrypting data comprises encrypting data at a transport layer and higher layers of a communications model.

13. The method of claim 1, wherein encrypting data and the first MAC comprises embedding the first MAC in the data.

14. The method of claim 1, comprising deleting the stored copy of the decrypted data if the first MAC is not equivalent to the decrypted first MAC.

15. The method of claim 1, wherein the first set of security vectors comprises an IP address unique to the first device.

16. An encryption/decryption processor, comprising:

a storage unit for storing a set of security vectors and a message authentication code (MAC);

a transmitter for transmitting encrypted data and an encrypted MAC;

an encryption unit for encrypting data and for encrypting the MAC;

a generator for generating a derivative set of security vectors and for generating a derivative transformation matrix;

a receiver for receiving encrypted data and an encrypted MAC;

a decryption unit for decrypting encrypted data and for decrypting the encrypted MAC; and

a comparison unit for comparing a stored MAC and a decrypted MAC.

17. A system for secured network communications within a group comprising a plurality of devices and a network device, wherein the network device comprises the encryption/decryption processor of claim 16.

18. A computer program product stored on a non-transitory computer-readable storage medium comprising computer-executable instructions for causing a processor to:

send, from a first device to a second device, a first set of security vectors and a first message authentication code (MAC) to the second device to provide, on the second device, a stored first set of security vectors and a stored first MAC, wherein the first set of security vectors and the first MAC are unique to the first device;

generate, by the first device, a first transformation matrix from the first set of security vectors;

generate, by the first device, a first derivative transformation matrix from the first transformation matrix using an initialization program;

encrypt, by the first device, data and the first MAC using the first derivative transformation matrix to provide encrypted data and an encrypted first MAC;

send, from the first device to the second device, the encrypted data and the encrypted first MAC;

generate, by the second device, a second transformation matrix from the stored first set of security vectors;

generate by the second device, a second derivative transformation matrix from the second transformation using the initialization program;

decrypt, by the second device, the encrypted data and the encrypted first MAC using the second derivative transformation matrix to provide decrypted data and a decrypted first MAC;

compare the decrypted first MAC to the stored first MAC; and

release the decrypted data if the decrypted first MAC is equivalent to the stored first MAC.