Systems, methods, and computer program products for accelerated dynamic protection of data

• US 7,280,658 B2
• Filed: 06/01/2001
• Issued: 10/09/2007
• Est. Priority Date: 06/01/2001
• Status: Expired due to Term

• Current Assignee: Snap, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Amini, Lisa, Belknap, William R.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Nalven; Andrew L
• Application Number:
  US09/872,077
• Publication Number:
  US 20020184488A1
• Time in Patent Office: 2,321 Days
• Field of Search: 380/45, 380/43, 380/42, 705/51, 705/57
• US Class Current: 380/45
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A system, method, and computer product that accelerates encryption and decryption of data while using both a static key and a dynamic key. The present invention eliminates intermediate decryption of data that is transmitted between computer systems. More particularly, encryption efficiency is improved by eliminating decryption of the statically encrypted data while incorporating the advantages of a dynamic key such as enabling rapid change of the dynamic key. The efficiency improvements reduce the computer resources required to protect the data and therefore stronger data encryption may be enabled with the saved computer resources. End-to-end security of the data is maintained without the need for trusted data servers.

Claims

1. A computer implemented method for encrypting and decrypting using a first key and a second key, comprising:

encrypting said data element with said first key and a current encryption state to produce a first encrypted data and an updated , encryption state;

encrypting said first encrypted data with said second key to produce a second encrypted data;

transmitting said second encrypted data with said current encryption state to a receiving computer system;

encrypting a subsequent data element with said first key and said updated encryption state to produce a subsequent first encrypted data and a subsequent updated encryption state;

encrypting said subsequent first encrypted data with said second key to produce a subsequent second encrypted data;

transmitting said subsequent second encrypted data with said updated encryption state to a receiving computer system;

decrypting, on said receiving computer system, said subsequent second encrypted data with said second key to produce a decrypted subsequent second encrypted data; and

decrypting said decrypted subsequent second encrypted data with said first key and said updated encryption state transmitted with said subsequent second encrypted data to produce a decrypted subsequent data element.

2. The method of claim 1, wherein said encrypting said data element with said first key strongly encrypts said data element with said first key;

and wherein said encrypting said subsequent data element with said first key strongly encrypts said subsequent data element with said first key.

3. The method of claim 1, wherein said encrypting said first encrypted data with said second key weakly encrypts said first encrypted data with said second key;

wherein said encrypting said subsequent first encrypted data with said second key weakly encrypts said subsequent first encrypted data with said second key.

4. The method of claim 1,

wherein said encrypting said data element with said first key is on a first computer system;

wherein said encrypting said subsequent data element with said first key is on said first computer system;

further comprising;

transmitting said first encrypted data and said current encryption state from said first computer system to a second computer system; and

transmitting said subsequent first encrypted data and said updated encryption state from said first computer system to said second computer system;

wherein said encrypting said first encrypted data with said second key is on said second computer system,

wherein said encrypting said subsequent first encrypted data with said second key is on said second computer system, said second computer system being untrusted; and

thereby distributing encryption and decryption between said first computer system, said second

computer system, and said receiving computer system.

5. The method of claim 1,

wherein said encrypting said data element with said first key is on a first computer system;

wherein said encrypting said subsequent data element with said first key is on said first computer system;

wherein said encrypting said first encrypted data with said second key is on said first computer system;

wherein said encrypting said subsequent first encrypted data with said second key is on said first computer system; and

thereby distributing encryption and decryption between said first computer system and said receiving computer system.

6. The method of claim 1 wherein said data element comprises digital data representing audio and video information.

7. The method of claim 1, wherein said transmitting said second encrypted data transmits a packet comprising said second encrypted data with said current encryption state to said receiving computer system;

wherein said transmitting said subsequent second encrypted data transmits a subsequent packet comprising said subsequent second encrypted data with said updated encrypted state to said receiving computer system; and

further comprising;

determining, on said receiving computer system, whether a transmission failure occurred based on identifying a loss of said packet comprising said second encrypted data;

in response to said determining, performing said decrypting, on said receiving computer system, said subsequent second encrypted data; and

said decrypting, on said receiving computer system, said decrypted subsequent second encrypted data.

8. The method of claim 1 further comprising:

determining, on said receiving computer system, whether transmission of said second encrypted data failed;

performing, on said receiving computer system, in response to said determining, said decrypting said subsequent second encrypted data with said second key, and said decrypting said decrypted subsequent second encrypted data with said first key and said updated encryption state transmitted with said subsequent second encrypted data.

9. The method of claim 8 wherein said second encrypted data of said failed transmission is not retransmitted.

10. The method of claim 8 wherein said second encrypted data of said failed transmission is not recovered.

11. The method of claim 8 wherein said second encrypted data of said failed transmission is corrupt.

12. An article of manufacture comprising a program storage medium readable by a computer and embodying one or more instructions executable by the computer for causing a computer system to encrypt and decrypt using a first key and a second key, comprising:

encrypting a data element with said first key and a current encryption state to produce a first encrypted data and an updated encryption state;

encrypting said first encrypted data with said second key to produce a second encrypted data;

transmitting said second encrypted data with said current encryption state to a receiving computer system;

encrypting a subsequent data element with said first key and said updated encryption state to produce a subsequent first encrypted data and a subsequent updated encryption state;

encrypting said subsequent first encrypted data with said second key to produce a subsequent second encrypted data;

transmitting said subsequent second encrypted data with said updated encryption state to said receiving computer system;

decrypting, on said receiving computer system, said subsequent second encrypted data with said second key to produce a decrypted subsequent second encrypted data; and

decrypting said decrypted subsequent second encrypted data with said first key and said updated encryption state transmitted with said subsequent second encrypted data to produce a decrypted subsequent data element.

13. The article of manufacture of claim 12 wherein said encrypting said data element with said first key strongly encrypts said data element with said first key,

wherein said encrypting said subsequent data element with said first key strongly encrypts said subsequent data element with said first key.

14. The article of manufacture of claim 12 wherein said encrypting said first encrypted data with said second key weakly encrypts said first encrypted data with said second key;

and wherein said encrypting said subsequent first encrypted data with said second key weakly encrypts said subsequent first encrypted data with said second key.

15. The article of manufacture of claim 12,

wherein said encrypting said data element with said first key is on a first computer system;

wherein said encrypting said subsequent data element with said first key is on said first computer system;

further comprising;

transmitting said first encrypted data and said current encryption state from said first computer system to a second computer system; and

transmitting said subsequent first encrypted data and said updated encryption state from said first computer system to said second computer system;

wherein said encrypting said first encrypted data with said second key is on said second computer system, said second computer system being untrusted;

wherein said encrypting said subsequent first encrypted data with said second key is on said second computer system; and

thereby distributing encryption and decryption between said first computer system, said second computer system, and said receiving computer system.

16. The article of manufacture of claim 12,

wherein said encrypting said data element with said first key is on a first computer system;

wherein said encrypting said first encrypted data with said second key is on said first computer system;

wherein said encrypting said subsequent data element with said first key is on said first computer system;

wherein said encrypting said subsequent first encrypted data with said second key is on said first computer system; and

thereby distributing encryption and decryption between said first computer system and said receiving computer system.

17. The article of manufacture of claim 12 wherein said data element comprises digital data representing audio and video information.

18. The article of manufacture of claim 12, wherein said transmitting said second encrypted data transmits a packet comprising said second encrypted data with said current encryption state to said receiving computer system;

wherein said transmitting said subsequent second encrypted data transmits a subsequent packet comprising said subsequent second encrypted data with said updated encryption state to said receiving computer system; and

further comprising;

determining, on said receiving computer system, whether a transmission failure occurred based on identifying a loss of said packet comprising said second encrypted data;

in response to said determining, performing said decrypting, on said receiving computer system, said subsequent second encrypted data; and

said decrypting, on said receiving computer system, said decrypted subsequent second encrypted data.

19. A computer implemented method for encrypting and decrypting using a first key and a second key, wherein a data element is partitioned into chunks, comprising:

encrypting said a data element chunk with said first key and a current encryption state to provide a first encrypted chunk data and an updated encryption state;

encrypting a subsequent data element chunk with said first key and said updated encryption state to provide a subsequent first encrypted chunk data and a subsequent updated encryption state;

encrypting said first encrypted chunk data with said second key to provide second encrypted chunk data;

transmitting said second encrypted chunk data and said current encryption state to a receiving computer system;

encrypting said subsequent first encrypted chunk data with said second key to provide subsequent second encrypted chunk data;

transmitting said subsequent second encrypted chunk data and said updated encryption state to said receiving computer system;

decrypting said subsequent second encrypted chunk data with said second key; and

decrypting said decrypted subsequent second encrypted chunk data with said first key and said updated encryption state that is transmitted with said subsequent second encrypted chunk data to provide a decrypted subsequent data element chunk.

20. The method of claim 19 wherein said encrypting said data element chunk with said first key strongly encrypts said data element chunk with said first key, and wherein said encrypting said subsequent data element chunk with said first key strongly encrypts said subsequent data element chunk with said first key.

21. The method of claim 19 wherein said encrypting said first encrypted chunk data with said second key weakly encrypts said first encrypted chunk data with said second key, and wherein said encrypting said subsequent first encrypted chunk data with said second key weakly encrypts said subsequent encrypted chunk data with said second key.

22. The method of claim 19,

wherein said encrypting said data element chunk with said first key is on a first computer system;

wherein said encrypting said subsequent data element chunk with said first key is on said first computer system;

further comprising;

transmitting said first encrypted chunk data and said current encryption state to a second computer system; and

transmitting said subsequent first encrypted chunk data and said updated encryption state to said second computer system;

wherein said encrypting said first encrypted chunk data with said second key is on said second computer system,

wherein said encrypting said subsequent first encrypted chunk data with said second key is on said second computer system, second computer system being untrusted; and

thereby distributing encryption between said first computer system and said second computer system.

23. The method of claim 19,

wherein said encrypting said data element chunk with said first key is on a first computer system;

wherein said encrypting said subsequent data element chunk with said first key is on said first computer system;

wherein said encrypting said second encrypted chunk data with said second key is on said first computer system;

wherein said encrypting said subsequent second encrypted chunk data with said second key is on said first computer system.

24. The method of claim 19, further comprising:

determining, on said receiving computer system, whether a transmission failure of said second encrypted chunk data occurred;

wherein in response to said transmission failure said second encrypted chunk data associated with said failed transmission is not retransmitted.

25. An article of manufacture comprising a program storage medium readable by a computer and embodying one or more instructions executable by the computer for causing a computer system to encrypt and decrypt using a first key and a second key, wherein a data element is partitioned into chunks, comprising:

encrypting a data element chunk with said first key and a current encryption state to produce a first encrypted chunk data and an updated encryption state;

encrypting a subsequent data element chunk with said first key and said updated encryption state to produce a subsequent first encrypted chunk data and a subsequent updated encryption state;

encrypting said second encrypted chunk data with said second key to produce a second encrypted chunk data;

encrypting said subsequent second encrypted chunk data with said second key to produce a subsequent second encrypted chunk data;

transmitting said second encrypted chunk data with said current encryption state to a receiving computer system;

transmitting said subsequent encrypted chunk data with said updated encryption state to said receiving computer system;

decrypting said subsequent second encrypted chunk data with said second key; and

decrypting said decrypted subsequent second encrypted chunk data with said first key and said updated encryption state that is transmitted with said subsequent second encrypted chunk data.

26. The article of manufacture of claim 25 wherein said encrypting said data element chunk said first key weakly encrypts said data element chunk with said first key, wherein said encrypting said subsequent data element chunk with said first key weakly encrypts said subsequent data element chunk with said first key.

27. The article of manufacture of claim 25 wherein said encrypting said data element chunk with said second key weakly encrypts said data element chunk with said second key, wherein said encrypting said subsequent data element chunk with said second key weakly encrypts said subsequent data element chunk with said second key.

28. The article of manufacture of claim 25,

wherein said encrypting said data element chunk with said first key is on a first computer system;

wherein said encrypting said subsequent data element chunk with said first key is on said first computer system;

further comprising;

transmitting said first encrypted chunk data to a second computer system;

transmitting said subsequent first encrypted chunk data to said second computer system;

wherein said encrypting said first encrypted chunk data with said second key is on said second computer system, said second computer system being untrusted;

wherein said encrypting said subsequent first encrypted chunk data with said second key is on said second computer system; and

thereby distributing encryption between said first computer system and said second computer system.

29. The article of manufacture of claim 28, further comprising:

determining when transmission of said second encrypted chunk data from said

first computer system to said second computer system failed; and

in response to said determining, performing, on said first computer system, said decrypting said subsequent second encrypted chunk data and said decrypting said decrypted subsequent second encrypted chunk data thereby recovering said decrypting without retransmission of said second encrypted chunk data.

30. The article of manufacture of claim 25,

wherein said encrypting said data element with said first key is on a first computer system;

wherein said encrypting said subsequent data element chunk with said first key is on said first computer system;

wherein said encrypting said first encrypted chunk data with said second key is on said first computer system; and

wherein said encrypting said subsequent first encrypted chunk data with said second key is on said first computer system.

31. A computer implemented method for encrypting and decrypting using a first key and a second key, comprising:

encrypting a data element with said first key to produce a first encrypted data;

encrypting said first encrypted data with said second key and a current encryption state to produce a second encrypted data and an updated encryption state;

transmitting said second encrypted data with said current encryption state to a receiving computer system;

encrypting a subsequent data element with said first key to produce a subsequent first encrypted data;

encrypting said subsequent first encrypted data with said second key and said updated encryption state to produce a subsequent second encrypted data and another updated encryption state;

transmitting said subsequent second encrypted data with said updated encryption state to a receiving computer system;

decrypting, on said receiving computer system, said subsequent second encrypted data with said second key and said updated encryption state that is transmitted with said second encrypted data; and

decrytping, on said receiving computer system, said decrypted subsequent second encrypted dats with said first key.

32. The method of claim 31,

wherein said encrypting said data element with said first key to produce said first encrypted data is also based on a first-encryption encryption state to produce said first encrypted data and an updated first-encryption encryption state;

wherein said transmitting said second encrypted data with said current encryption state also transmits said first-encryption encryption state;

wherein said encrypting said subsequent data element with said first key to produce said subsequent first encrypted data is also based on said updated first-encryption encryption state to produce said subsequent first encrypted data and an updated subsequent first-encryption encryption state;

wherein said transmitting said subsequent second encrypted data with said updated encryption state also transmits said updated first-encryption encryption state; and

wherein, on said receiving computer system said decrypting said decrypted subsequent second encrypted data with said first key is also based on said updated first-encryption encryption state that is transmitted with said subsequent second encrypted data to produce said decrypted subsequent data element.

33. The method of claim 31,

wherein said encrypting said data element with said first key is on a first computer system;

wherein said encrypting said subsequent data element with said first key is on said first computer system;

further comprising;

transmitting said first encrypted data with said current encryption state and said subsequent first encrypted data with said updated encryption state from said first computer system to a second computer system;

wherein said encrypting said first encrypted data with said second key is on said second computer system, wherein said encrypting said subsequent first encrypted data is on said second computer system, said second computer system being untrusted; and

thereby distributing encryption and decryption between said first computer system, said second computer system, and said receiving computer system.

34. The method of claim 31 further comprising:

determining, on said receiving computer system, whether transmission of said second encrypted data failed; and

performing on said receiving computer system, in response to said determining, said decrypting said subsequent second encrypted data with said second key and said updated encryption state transmitted with said subsequent second encrypted data; and

said decrypting said decrypted subsequent second encrypted data with said first key.

35. The method of claim 34 wherein said second encrypted data of said failed transmission is not retransmitted.

36. The method of claim 34 wherein said second encrypted data of said failed transmission is not recovered.

37. An article of manufacture comprising a program storage medium readable by a computer and embodying one or more instructions executable by the computer for causing a computer system to encrypt and decrypt using a first key and a second key, comprising:

encrypting a data element with said first key to produce a first encrypted data;

encrypting said first encrypted data with said second key and a current encryption state to produce a second encrypted data and an updated encryption state;

transmitting said second encrypted data with said current encryption state to a receiving computer system;

encrypting a subsequent data element with said first key to produce a subsequent first encrypted data;

encrypting said subsequent first encrypted data with said second key and said updated encryption state to produce a subsequent second encrypted data and another updated encryption state;

transmitting said subsequent second encrypted data with said updated encryption state to a receiving computer system;

decrypting, on said receiving computer system, said subsequent second encrypted data with said second key and said updated encryption state that is transmitted with said second encrypted data; and

decrypting, on said receiving computer system, said decrypted subsequent second encrypted data with said first key.

38. The article of manufacture of claim 37

wherein said encrypting said data element with said first key to produce said first encrypted data is also based on a current first-encryption encryption state to produce said first encrypted data and an updated first-encryption encryption state;

wherein said transmitting said second encrypted data with said current encryption state also transmits said current first-encryption encryption state;

wherein said encrypting said subsequent data element with said first key to produce said subsequent first encrypted data is also based on said updated first-encryption encryption state to produce said subsequent first encrypted data and a subsequent updated first-encryption encryption state;

wherein said transmitting said subsequent second encrypted data with said updated encryption state also transmits said updated first-encryption encryption state; and

wherein, on said receiving computer system said decrypting said decrypted subsequent second encrypted data with said first key is also based on said updated first-encryption encryption state that is transmitted with said subsequent second encrypted data to produce said decrypted subsequent data element.

39. The article of manufacture of claim 37,

wherein said encrypting said data element with said first key is on a first computer system;

wherein said encrypting said subsequent data element with said first key and said current encryption state is on said first computer system;

further comprising;

transmitting said first encrypted data from a first computer system to a second computer system; and

transmitting said subsequent first encrypted data from said first computer system to said second computer system;

wherein said encrypting said first encrypted data with said second key is on said second computer system, said second computer system being untrusted; and

wherein said encrypting said subsequent first encrypted data with said second key is on said second computer system; and

thereby distributing encryption and decryption between said first computer system, said second computer system, and said receiving computer system.

40. The article of manufacture of claim 37 further comprising:

determining, on said receiving computer system, whether transmission of said second encrypted data failed; and

in response to said determining, performing on said receiving computer system, said decrypting said subsequent second encrypted data with said second key and said updated encryption state transmitted with said subsequent second encrypted data, and said decrypting said decrypted subsequent second encrypted data with said first key.

41. The article of manufacture of claim 40 wherein said second encrypted data of said failed transmission is not retransmitted.

42. The article of manufacture of claim 40 wherein said second encrypted data of said failed transmission is not recovered.