METHOD AND APPARATUS FOR CAMOUFLAGING OF DATA, INFORMATION AND FUNCTIONAL TRANSFORMATIONS

• US 20090138944A1
• Filed: 11/03/2008
• Published: 05/28/2009
• Est. Priority Date: 12/23/1997
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Arcot Systems, Inc. (Broadcom, Inc.)
• Inventors: Hird, Geoffrey R., Kausik, Balas Natarajan, Rajasekaran, Sanguthevar
• Granted Patent: US 8,429,720 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 2209/046 of operations, operands or results of the operations
• CPC Class Codes: H04L 2209/20 Manipulating the length of blocks of bits, e.g. padding or block truncation
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A computer-representable object (including, without limitation, a cryptographic key, or a graph or a Boolean description of a system) is secured using a generalized camouflaging technique. The secured object need not be stored in the system, not even in encrypted form. Instead, the technique employs a composition function that regenerates the secured object when one inputs a valid password (which may be any computer-representable information held by a user). By regenerating the secured object each time a valid password is entered, there is no need to store the secured object. If one inputs an invalid password, the technique may generate an incorrect object, such that the user is unable to distinguish this incorrect object from the secured object. If the user tries to use the incorrect object, the user can be exposed as unauthorized, without the user'"'"'s knowledge that he has been exposed.

Claims

1. A method for operating an access control system to camouflage a secret so as to be accessible by an authorized user yet protected against unauthorized access, said method comprising the steps of:

(a) representing in digital form a secret to be protected against unauthorized access;

(b) storing a plurality of computer-represented objects related to said secret;

(i) at least one of said objects being accessible by an authorized user as a password;

(ii) at least another of said objects being stored in a computer-readable wallet accessible to said access control system; and

(c) representing said secret as a function of said plurality of objects, using a composition function; and

(d) storing, in a computer-readable memory, said composition function;

(i) in a manner accessible to said access control system;

(ii) so as to be executable to generate a candidate secret using a user-inputted candidate password in conjunction with at least said another object stored in said wallet;

(iii) said generated candidate secret not regenerating said secret if said candidate password is not said password; and

(iv) said generated candidate secret regenerating said secret if said candidate password is said password;

thereby protecting said secret against unauthorized access by persons not having said password.

2-66. -66. (canceled)