Systems and methods for securing data in motion

• US 9,516,002 B2
• Filed: 04/15/2014
• Issued: 12/06/2016
• Est. Priority Date: 11/25/2009
• Status: Expired due to Fees

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L., Bono, Stephen C., Landau, Gabriel D., Nielson, Seth James
• Primary Examiner(s): Tolentino, Roderick
• Assistant Examiner(s): Malinowski, Walter
• Application Number:
  US14/253,588
• Publication Number:
  US 20140304503A1
• Time in Patent Office: 966 Days
• Field of Search: 726/15, 713/193, 713/165, 713/153, 380/277, 380/37
• US Class Current: 1/1
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Two approaches are provided for distributing trust among certificate authorities. Each approach may be used to secure data in motion. One approach provides methods and systems in which a secure data parser is used to distribute trust in a set of certificate authorities during initial negotiation (e.g., the key establishment phase) of a connection between two devices. Another approach of the present invention provides methods and systems in which the secure data parser is used to disperse packets of data into shares. A set of tunnels is established within a communication channel using a set of certificate authorities, keys developed during the establishment of the tunnels are used to encrypt shares of data for each of the tunnels, and the shares of data are transmitted through each of the tunnels. Accordingly, trust is distributed among a set of certificate authorities in the structure of the communication channel itself.

Claims

1. A method comprising:

establishing, using a hardware processor, a secure communication channel;

establishing a plurality of secure communication tunnels within the secure communication channel, wherein the plurality of secure communication tunnels is established using certificates issued by a plurality of unique certificate authorities;

dispersing data packets into a plurality of shares, wherein a share is encrypted using a key associated with the establishment of a first secure communication tunnel of the plurality of secure communication tunnels, and wherein the key associated with the establishment of the first secure communication tunnel is different from a key associated with the establishment of a second secure communication tunnel of the plurality of secure communication tunnels; and

transmitting the share over the second secure communication tunnel, wherein the first secure communication tunnel is different than the second communication tunnel.

2. The method of claim 1, further comprising:

receiving the encrypted share; and

decrypting the encrypted share based on the key associated with the establishment of the first secure communication tunnel.

3. The method of claim 1, further comprising generating a certificate authority hierarchy, wherein the certificate authority hierarchy comprises a set of root certificate authorities, and

wherein the plurality of unique certificate authorities comprises the set of root certificate authorities.

4. The method of claim 1, further comprising generating a certificate authority hierarchy, wherein the certificate authority hierarchy comprises a set of minor certificate authorities, and

wherein the plurality of unique certificate authorities comprises the set of minor certificate authorities.

5. The method of claim 1, wherein the first secure communication tunnel and the second secure communication tunnel are established over different physical transport mediums.

6. The method of claim 5, wherein at least one of physical transport mediums experiences a network failure, the method further comprising:

establishing an additional secure communication tunnel within at least one operational physical transport medium; and

transmitting the share over the additional secure communication tunnel.

7. The method of claim 1, wherein associations between the plurality of secure communication tunnels and the unique certificate authorities are dynamic.

8. The method of claim 1, wherein the plurality of secure communication tunnels are established based on the Transport Layer Security protocol.

9. The method of claim 1, further comprising:

generating a certificate authority hierarchy, wherein the certificate authority hierarchy comprises a set of minor certificate authorities; and

encrypting each one of the plurality of shares based on a certificate issued by a unique minor certificate authority of the certificate authority hierarchy.

10. The method of claim 1, wherein a second share is encrypted using the key associated with the establishment of the second secure communication tunnel, and further comprising transmitting the second share over the first secure communication tunnel.

11. A system comprising a hardware processor configured to:

establish a secure communication channel;

establish a plurality of secure communication tunnels within the secure communication channel, wherein the plurality of secure communication tunnels is established using certificates issued by a plurality of unique certificate authorities;

disperse data packets into a plurality of shares, wherein a share is encrypted using a key associated with the establishment of a first secure communication tunnel of the plurality of secure communication tunnels, and wherein the key associated with the establishment of the first secure communication tunnel is different from a key associated with the establishment of a second secure communication tunnel of the plurality of secure communication tunnels; and

transmit the share over the second secure communication tunnel, wherein the first secure communication tunnel is different than the second communication tunnel.

12. The system of claim 11, wherein the hardware processor is further configured to:

receive the encrypted share; and

decrypt the encrypted share based on the key associated with the establishment of the first secure communication tunnel.

13. The system of claim 11, wherein the hardware processor is further configured to generate a certificate authority hierarchy, wherein the certificate authority hierarchy comprises a set of root certificate authorities, and wherein the plurality of unique certificate authorities comprises the set of root certificate authorities.

14. The system of claim 11, wherein the hardware processor is further configured to generate a certificate authority hierarchy, wherein the certificate authority hierarchy comprises a set of minor certificate authorities, and wherein the plurality of unique certificate authorities comprises the set of minor certificate authorities.

15. The system of claim 11, wherein the first secure communication tunnel and the second secure communication tunnel are established over different physical transport mediums.

16. The system of claim 15, wherein at least one of physical transport mediums experiences a network failure, the hardware processor further configured to:

establish an additional secure communication tunnel within at least one operational physical transport medium; and

transmit the share over the additional secure communication tunnel.

17. The system of claim 11, wherein associations between the plurality of secure communication tunnels and the unique certificate authorities are dynamic.

18. The system of claim 11, wherein the plurality of secure communication tunnels are established based on the Transport Layer Security protocol.

19. The system of claim 11, wherein the hardware processor is further configured to:

generate a certificate authority hierarchy, wherein the certificate authority hierarchy comprises a set of minor certificate authorities; and

encrypt each one of the plurality of shares based on a certificate issued by a unique minor certificate authority of the certificate authority hierarchy.

20. The system of claim 11, wherein a second share is encrypted using the key associated with the establishment of the second secure communication tunnel, and wherein the hardware processor is further configured to transmit the second share over the first secure communication tunnel.

21. A non-transitory computer-readable medium comprising instructions that, when executed by processing circuitry, cause a computer system to carry out a method for secure workgroup communication, the method comprising:

establishing, using a hardware processor, a secure communication channel;

establishing a plurality of secure communication tunnels within the secure communication channel, wherein the plurality of secure communication tunnels is established using certificates issued by a plurality of unique certificate authorities;

dispersing data packets into a plurality of shares, wherein a share is encrypted using a key associated with the establishment of a first secure communication tunnel of the plurality of secure communication tunnels, and wherein the key associated with the establishment of the first secure communication tunnel is different from a key associated with the establishment of a second secure communication tunnel of the plurality of secure communication tunnels; and

transmitting the share over the second secure communication tunnel, wherein the first secure communication tunnel is different than the second communication tunnel.