WIDELY DISTRIBUTED PARAMETERIZATION

• US 20160241524A1
• Filed: 02/16/2016
• Published: 08/18/2016
• Est. Priority Date: 02/13/2015
• Status: Active Grant

• Current Assignee: Global Integrity, Inc.
• Original Assignee: Protected Mobility LLC
• Inventors: FASCENDA, Anthony C., STURNIOLO, Emil
• Granted Patent: US 10,050,943 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

This technology mitigates the vulnerabilities of parameter storage by calculating parameters dynamically rather than storing and using static parameters. This example non-limiting technology derives parameters “on-demand” from a subset of widely distributed parameters determined by a random string generated for each encrypted session. The subset of widely distributed parameters will be different each time a new subset is generated as the individual parameters are randomly selected. Thus the individual encrypted message (or document) will be encrypted differently using a different set of parameters each time. Some of these parameters bind the encrypted message to a specific user account and user device making the resulting encrypted message highly secure.

Claims

1. A method of encrypting comprising:

querying a computing environment to discover a set of widely dispersed parameters;

transforming the widely dispersed parameter set into a cryptographic key;

using the cryptographic key to encrypt a message; and

communicating the encrypted message and sufficient information to enable a further end point to derive the same or an associated cryptographic key to decrypt the message without communicating or revealing the cryptographic key.

2. The method of claim 1 wherein the cryptographic key is generated using a set of widely dispersed parameters some of which are tied to a user'"'"'s account and some of which are tied to a user'"'"'s device.

3. The method of claim 1 wherein the cryptographic key is derived from a set of parameters from multiple tables based on a randomly generated string such that it cannot be known beforehand which set of widely dispersed parameters might be chosen per use in deriving the cryptographic key.

4. The method of claim 1 wherein the cryptographic key comprises a symmetric key.

5. The method of claim 1 wherein the cryptographic key comprises an asymmetric key.

6. The method of claim 1 further including using a set of passphrases to derive the cryptographic key.

7. The method of claim 1 further including detecting changes in registered parameters and automatically reregistering a current set of parameters with a registration server thus allowing messages previously encrypted to previous parameters to be addressed by the server along with new messages based on new parameters.

8. The method of claim 1 further including:

randomly selecting a passphrase;

constructing a parameter table containing a list of cryptographic keys, a list of encryption initialization vectors, salts, a list of hashtypes, a list of iteration counts and a list of key sizes; and

filling entries in the table by generating a constant obtained by hashing passphrase, and subsequently hashing a previous entry with the constant.

9. The method of claim 1 further including generating a random string used as a pointer into a parameter table or other data structure.

10. The method of claim 1 further including using one time parameters used only for generating a cryptographic key for one or a small number of messages.

11. A method of decrypting comprising:

receiving a secure, encrypted message;

detecting a random string, at least one identifier, a passphrase hash and ciphertext;

using the passphrase hash to generate a parameter set comprising widely dispersed parameters;

using the parameter set to derive a cryptographic key; and

applying the cryptographic key to decrypt the ciphertext.

12. A system for exchanging secure messages comprising:

an encryptor;

a decryptor;

a widely dispersed parameter data structure containing parameters that are derived from a user-specific computing environment;

a key deriver that derives at least one cryptographic key from the parameter set; and

a controller that controls the encryptor and/or decryptor transform between plaintext and ciphertext using the derived cryptographic key.