Widely distributed parameterization

• US 10,050,943 B2
• Filed: 02/16/2016
• Issued: 08/14/2018
• Est. Priority Date: 02/13/2015
• Status: Active Grant

• Current Assignee: Global Integrity, Inc.
• Original Assignee: Global Integrity, Inc.
• Inventors: Fascenda, Anthony C., Sturniolo, Emil
• Primary Examiner(s): Dada, Beemnet
• Application Number:
  US15/044,796
• Publication Number:
  US 20160241524A1
• Time in Patent Office: 910 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

This technology mitigates the vulnerabilities of parameter storage by calculating parameters dynamically rather than storing and using static parameters. This example non-limiting technology derives parameters “on-demand” from a subset of widely distributed parameters determined by a random string generated for each encrypted session. The subset of widely distributed parameters will be different each time a new subset is generated as the individual parameters are randomly selected. Thus the individual encrypted message (or document) will be encrypted differently using a different set of parameters each time. Some of these parameters bind the encrypted message to a specific user account and user device making the resulting encrypted message highly secure.

Claims

1. In a distributed computing environment, a method for determining a widely dispersed set of digital information, comprising:

querying a first computational environment to discover a first set of widely dispersed digital information;

obtaining at least a second set of widely dispersed digital information discovered by at least a second computational environment;

combining the at least two subsets of the widely dispersed digital information by at least one of the computational environments;

deriving cryptographic material from a combination of the first widely dispersed digital information set and the second widely dispersed digital information set;

using the derived cryptographic material as parameters to encrypt a message; and

communicating the encrypted message and additional differential information to enable a further end point to enables an at least one other computational environment to derive the same cryptographic material enabling decryption of the encrypted message without communicating or revealing the derived cryptographic material.

2. The method of claim 1 wherein the cryptographic material is generated using a set of widely dispersed parameters some of which are tied to a user'"'"'s account and some of which are tied to a user'"'"'s device.

3. The method of claim 1 wherein the cryptographic material is derived from a set of parameters from multiple tables based on a randomly generated string such that it cannot be known beforehand which set of widely dispersed parameters might be chosen per use in deriving the cryptographic material.

4. The method of claim 1 further comprising using the cryptographic material to generate a symmetric key.

5. The method of claim 1 further comprising using the cryptographic material to generate an asymmetric key.

6. The method of claim 1 further including using a set of passphrases to derive the cryptographic material.

7. The method of claim 1 further including detecting changes in registered parameters and automatically reregistering a current set of parameters with a registration server thus allowing messages previously encrypted to previous parameters to be addressed by the server along with new messages based on new parameters.

8. The method of claim 1 further including:

randomly selecting a passphrase;

constructing a parameter table containing a list of cryptographic keys, a list of encryption initialization vectors, salts, a list of hash types, a list of iteration counts and a list of key sizes; and

filling entries in the table by generating a constant obtained by hashing passphrase, and subsequently hashing a previous entry with the constant.

9. The method of claim 1 further including generating a random string used as a pointer into a parameter table or other data structure.

10. The method of claim 1 further including using one time parameters used only for generating a cryptographic key for one or a small number of messages.

11. The method of claim 1 wherein the steps are performed by:

an encryptor;

a decryptor;

a widely dispersed parameter data structure containing parameters that are derived from a user-specific computing environment;

a key generator that generates at least one cryptographic key from the parameter set; and

a controller that controls the encryptor and/or decryptor transform between plaintext and ciphertext using the generated cryptographic key.

14. The method of claim 1 wherein the digital information comprises binary data.

12. In a distributed computing environment, a method for determining a widely dispersed set of digital information,

wherein the widely dispersed set of digital information is determined by at least two computational environments,

the widely dispersed set of digital information is combined by at least one of the computational environments,

the combined widely dispersed set of digital information is used by the at least one computational environment as input parameters to a derivation process which generates cryptographic material used for an encrypting process of additional input data;

the method comprising;

querying a first of the at least two computational environment to discover a subset of the widely dispersed digital information;

generating at least one other subset of widely dispersed digital information by the at least one other computational environment;

communicating between the at least one other and the first computational environments the at least one other subset of widely dispersed digital information;

combining the at least two subsets of the widely dispersed digital information by at least one of the computational environments;

using the combined set of widely dispersed digital information as input to the cryptographic material derivation process;

using the derived cryptographic material as parameters to the encryption process;

the encryption process produces encrypted digital data from the additional input data,

wherein the method allows for the communication of the encrypted digital data and additional differential information that enables an at least one other computational environment to derive the same cryptographic material enabling the decryption of the encrypted digital information without ever exchanging or revealing the derived cryptographic material.

15. The method of claim 12 wherein the digital information comprises binary data.

13. A distributed computing system for determining a widely dispersed set of digital information, the system comprising:

a first computational environment;

a second computation environment different from the first computational environment;

the first and second computational environments being configured to determine the widely dispersed set of digital information,

at least one of the first and second computational environments combining the widely dispersed set of digital information,

the at least one of the first and second computational environments using the combined widely dispersed set of digital information as input parameters to a derivation process which generates cryptographic material used for an encrypting process of additional input data;

at least one processor that queries the first computational environment to discover a first subset of the widely dispersed digital information;

at least one further processor that queries the second computational environment to discover at least a further subset of widely dispersed digital information;

at least one communication device that communicates the at least one further subset of widely dispersed digital information between the first and second computational environments;

at least one of said processors being further configured to combine the first subset and the at least one further subset of the widely dispersed digital information; and

at least one of the first sand second computational environments using the combined set of widely dispersed digital information as input to a cryptographic material derivation process, using the derived cryptographic material as parameters to an encryption process that produces encrypted digital data from additional input data,

the at least one communication device enabling communication of the encrypted digital data and additional differential information that enables an at least one other computational environment to derive the same cryptographic material enabling the decryption of the encrypted digital information without ever exchanging or revealing the derived cryptographic material.

16. The system of claim 13 wherein the digital information comprises binary data.