Method and apparatus for the virtualization of cryptographic resources

• US 9,959,414 B1
• Filed: 03/14/2017
• Issued: 05/01/2018
• Est. Priority Date: 11/05/2014
• Status: Active Grant

• Current Assignee: David H. Leventhal, Robert F. Barnitt
• Original Assignee: Dark Signal Research, LLC
• Inventors: Leventhal, David H, Barnitt, Robert F
• Primary Examiner(s): BEHESHTI SHIRAZI, SAYED ARESH
• Application Number:
  US15/458,870
• Time in Patent Office: 413 Days
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/402 Encrypted data
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

A method and apparatus is provided for the virtualization of cryptographic resources which enables memory speed encryption and decryption that is not bound by the speed at which processor resources can compute the result of a symmetric-key algorithm. This is achieved through a time-memory tradeoff via empty space at provisioning time. When implementing the apparatus, un-initialized memory is filled with the output of a symmetric-key algorithm uniquely keyed for the specific set of data that is going to be written to the provisioned area. Since the provisioning operation stores cryptographically structured data, rather than redundant data, plaintext that is xor'"'"'ed into memory is automatically encrypted and ciphertext that xor'"'"'ed into memory is automatically decrypted without the need for additional cryptographic computation. This reduced computation requirement enables cryptographic function to be implemented at the ends of communication, rather than the middle, and treated as a virtualized resource.

Claims

1. A method of provisioning a cryptographic memory operation comprising:

a keying operation, an initialization operation, a store plaintext operation and a store ciphertext operation;

the keying operation, the store plaintext operation and the store ciphertext operation are performed by at least a physical processor coupled to a memory;

the keying operation for generating a random number and keying a symmetric-key algorithm; and

the initialization operation for initializing each byte of a cryptographic memory allocation with consecutive values from a keystream computed using the symmetric key algorithm in a counter based cipher mode; and

the store plaintext operation wherein a logical set of plaintext bytes are encoded using the consecutive values from the keystream computed using the symmetric key algorithm before being written to the cryptographic memory allocation; and

an encoded logical set of plaintext bytes written to initialized bytes of the cryptographic memory allocation replacing the consecutive values from the keystream which was used to encode the logical set of plaintext bytes by writing the encoded logical set of plaintext bytes to the initialized bytes of the cryptographic memory allocation storing the consecutive values; and

the store ciphertext operation wherein the encoded logical set of plaintext bytes are decoded using the consecutive values from the keystream computed using the symmetric key algorithm before being written to the cryptographic memory allocation; and

decoded logical set of plaintext bytes written to the cryptographic memory allocation replacing the consecutive values from the keystream which was used to decode the encoded logical set of plaintext bytes by writing the decoded logical set of plaintext bytes to the same location on the cryptographic memory allocation.

2. The method of provisioning a cryptographic memory operation according to claim 1, wherein the random number is generated using a hardware based random number generator.

3. The method of provisioning a cryptographic memory operation according to claim 1, wherein the random number is generated using a software based pseudorandom number generator.

4. The method of provisioning a cryptographic memory operation according to claim 1, wherein the symmetric-key algorithm is an Advanced Encryption Standard (AES) algorithm.

5. The method of provisioning a cryptographic memory operation according to claim 1, wherein the initialization operation is performed using multiple processors.

6. The method of provisioning a cryptographic memory operation according to claim 1, wherein the initialization operation is performed using multiple cores on a single processor.

7. The method of provisioning a cryptographic memory operation according to claim 1, wherein the initialization operation is performed using multiple cores on multiple processors in parallel.