Multiple vector one-time key pad

Abstract

A system and method of securely generating encryption keys that includes a computing device obtaining a seed and applying a first function to the seed to derive a first sequence of digits. A second function is then used to obtain a second sequence of digits from the first sequence of digits at a predetermined start position. The encryption key is derived from the resulting second sequence of digits.

Description

FIELD OF THE INVENTION

The field of the invention is encryption and data security.

BACKGROUND

The background description includes information that may be useful in understanding the present invention. It is not an admission that any of the information provided herein is prior art or relevant to the presently claimed invention, or that any publication specifically or implicitly referenced is prior art.

One-Time Pad (“OTP”) cryptography is an encryption method that experts consider to be the gold standard of encryption. In order to execute One Time Pad correctly, the following conditions must be met:

• • 1. The key is as long as the plaintext.
  • 2. The key is random.
  • 3. The key is never reused.
  • 4. The key is secret.

One of the most difficult challenges that arises with One Time Pad encryption is providing a key that is truly random. Others have tried, but many use so-called “random” numbers that can theoretically be reproduced based on the natural rules of mathematics. As computing power grows and evolves, these theoretical limits become more likely of becoming practically achievable every passing day.

Thus, there is still a need for a better, more secure OTP solution.

SUMMARY OF THE INVENTION

The inventive subject matter provides apparatus, systems and methods in which a computing device generates an encryption key by deriving a first sequence of digits by applying a first function to a seed. The computing device generates a second sequence of digits by applying a second function to at least a portion of the first sequence of digits, beginning at a predetermined start position, and then deriving the encryption key from the second sequence of digits.

In embodiments of the inventive subject matter, the first function can be a root calculation of a number.

In embodiments, the seed can be a non-perfect square integer and the first sequence of digits is a mantissa derived from a square root of the seed.

In embodiments, the seed can be a number ending in 2, 3, 7 or 8.

In embodiments, the second function can be a mathematical function such as a multiplication, a division, an addition and a subtraction.

In embodiments, a computing device can securely encrypt multiple files by using different functions, indices, starting positions to generate separate encryption keys. The computing device can ensure the keys are sufficiently distinct by ensuring that the indices and/or starting positions are sufficiently numerically separate.

Various objects, features, aspects and advantages of the inventive subject matter will become more apparent from the following detailed description of preferred embodiments, along with the accompanying drawing figures in which like numerals represent like components.

All publications identified herein are incorporated by reference to the same extent as if each individual publication or patent application were specifically and individually indicated to be incorporated by reference. Where a definition or use of a term in an incorporated reference is inconsistent or contrary to the definition of that term provided herein, the definition of that term provided herein applies and the definition of that term in the reference does not apply.

The following description includes information that may be useful in understanding the present invention. It is not an admission that any of the information provided herein is prior art or relevant to the presently claimed invention, or that any publication specifically or implicitly referenced is prior art.

In some embodiments, the numbers expressing quantities of ingredients, properties such as concentration, reaction conditions, and so forth, used to describe and claim certain embodiments of the invention are to be understood as being modified in some instances by the term “about.” Accordingly, in some embodiments, the numerical parameters set forth in the written description and attached claims are approximations that can vary depending upon the desired properties sought to be obtained by a particular embodiment. In some embodiments, the numerical parameters should be construed in light of the number of reported significant digits and by applying ordinary rounding techniques. Notwithstanding that the numerical ranges and parameters setting forth the broad scope of some embodiments of the invention are approximations, the numerical values set forth in the specific examples are reported as precisely as practicable. The numerical values presented in some embodiments of the invention may contain certain errors necessarily resulting from the standard deviation found in their respective testing measurements.

Unless the context dictates the contrary, all ranges set forth herein should be interpreted as being inclusive of their endpoints and open-ended ranges should be interpreted to include only commercially practical values. Similarly, all lists of values should be considered as inclusive of intermediate values unless the context indicates the contrary.

As used in the description herein and throughout the claims that follow, the meaning of “a,” “an,” and “the” includes plural reference unless the context clearly dictates otherwise. Also, as used in the description herein, the meaning of “in” includes “in” and “on” unless the context clearly dictates otherwise.

The recitation of ranges of values herein is merely intended to serve as a shorthand method of referring individually to each separate value falling within the range. Unless otherwise indicated herein, each individual value is incorporated into the specification as if it were individually recited herein. All methods described herein can be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. The use of any and all examples, or exemplary language (e.g. “such as”) provided with respect to certain embodiments herein is intended merely to better illuminate the invention and does not pose a limitation on the scope of the invention otherwise claimed. No language in the specification should be construed as indicating any non-claimed element essential to the practice of the invention.

Groupings of alternative elements or embodiments of the invention disclosed herein are not to be construed as limitations. Each group member can be referred to and claimed individually or in any combination with other members of the group or other elements found herein. One or more members of a group can be included in, or deleted from, a group for reasons of convenience and/or patentability. When any such inclusion or deletion occurs, the specification is herein deemed to contain the group as modified thus fulfilling the written description of all Markush groups used in the appended claims.

BRIEF DESCRIPTION OF THE DRAWING

FIG. 1 is a flowchart of the process of generating secure encryption keys according to embodiments of the inventive subject matter.

FIG. 2 shows a flowchart illustrating how multiple files can be securely encrypted using the systems and methods of the inventive subject matter.

DETAILED DESCRIPTION

Throughout the following discussion, numerous references will be made regarding servers, services, interfaces, engines, modules, clients, peers, portals, platforms, or other systems formed from computing devices. It should be appreciated that the use of such terms, is deemed to represent one or more computing devices having at least one processor (e.g., ASIC, FPGA, DSP, ×86, ARM, ColdFire, GPU, multi-core processors, etc.) programmed to execute software instructions stored on a computer readable tangible, non-transitory medium (e.g., hard drive, solid state drive, RAM, flash, ROM, etc.). For example, a server can include one or more computers operating as a web server, database server, or other type of computer server in a manner to fulfill described roles, responsibilities, or functions. One should further appreciate the disclosed computer-based algorithms, processes, methods, or other types of instruction sets can be embodied as a computer program product comprising a non-transitory, tangible computer readable media storing the instructions that cause a processor to execute the disclosed steps. The various servers, systems, databases, or interfaces can exchange data using standardized protocols or algorithms, possibly based on HTTP, HTTPS, AES, public-private key exchanges, web service APIs, known financial transaction protocols, or other electronic information exchanging methods. Data exchanges can be conducted over a packet-switched network, the Internet, LAN, WAN, VPN, or other type of packet switched network.

The following discussion provides many example embodiments of the inventive subject matter. Although each embodiment represents a single combination of inventive elements, the inventive subject matter is considered to include all possible combinations of the disclosed elements. Thus if one embodiment comprises elements A, B, and C, and a second embodiment comprises elements B and D, then the inventive subject matter is also considered to include other remaining combinations of A, B, C, or D, even if not explicitly disclosed.

As used herein, and unless the context dictates otherwise, the term “coupled to” is intended to include both direct coupling (in which two elements that are coupled to each other contact each other) and indirect coupling (in which at least one additional element is located between the two elements). Therefore, the terms “coupled to” and “coupled with” are used synonymously.

FIG. 1 provides a flowchart of the process of generating secure encryption keys according to embodiments of the inventive subject matter.

At step 110, a computing device obtains a first function, a seed, and at least one index (which, as will be discussed below, corresponds to at least one start position).

When discussed herein, a computing device refers to any device having at least one processor, at least one non-transitory memory (RAM, ROM, etc.) and, optionally, at least one data-communication interface that enables the device to exchange data with other devices. Examples of suitable computing devices includes desktop computers, laptop computers, server computers, tablets, smartphones, gaming consoles, etc.

The functions, seeds, indices and/or other information discussed herein can be stored locally at the computer device in a database within the computing device's memory for retrieval or can be retrieved as needed by the computing device from a remote database stored at a remote computing device.

In embodiments, the first function can comprise a root function. In some embodiments, the first function will be a square root function.

In embodiments of the inventive subject matter, the seed comprises a non-perfect square integer and the first sequence of digits comprises a mantissa derived from the square root of the seed. In embodiments, the first sequence of digits comprises a portion of the mantissa.

For example, suppose that the computing device selects an integer I=9045373634724111364582183943721787334

In embodiments, the integer I can be generated from a random number generator. In other embodiments, the integer I can be generated a priori and then selected from a list or collection of generated integers. In these embodiments, the integer I to be used can change according to a schedule and/or discarded after use such that the computing device moves on to the next integer in the list.

In embodiment, the seed is a number that ends in 2, 3, 7 or 8. In embodiments of the inventive subject matter, the seed can be generated by appending a 2, 3, 7, or 8 at the end of a number such that the seed is a non-perfect square integer.

Then, the computing device converts this number to a non-perfect square number (NPSN) by appending a 2, 3, 7, or 8 at the end, resulting in a seed:

• • NPSN=90453736347241113645821839437217873342

At step 120, the computing device applies a first function to the seed to generate a first sequence of digits.

In the illustrative example shown here, the first function is considered to be calculating the square root of the NPSN and can include extracting the mantissa of the answer. Thus, the square root of the NPSN is computed to generate an irrational number (IN).

Thus, the IN=9510716920781582890.66240905539651295150751163699893602931 . . . .

The mantissa (“M”) of the IN is extracted, which in this example:

• • M=0.66240905539651295150751163699893602931079330053949056821 . . . .

The first sequence of digits is then generated by applying the first index or start position. For the purposes of this example, suppose the first index is 7. Thus, the first 7 digits of the mantissa M are removed (the digits 6624090 following the decimal point) and the first sequence then results:

• • I₁=7
  • M=0.5539651295150751163699893602931079330053949056821 . . . .
  • S₁=0.55396512951507511636998936029310793300539490568215589216 . . . .

In embodiments of the inventive subject matter, the steps of step 120 can be performed a priori and stored in a file for later use. For example, the first sequence of digits S₁ that comprises the portion of the mantissa M can be stored in the file and retrieved by the computing device at a future time.

At step 130, the computing device applies a second function to at least a portion of the first sequence of digits at the start position, to generate a second sequence of digits. The second function can be obtained at step 130 or at the initial step 110.

In embodiments, the second function comprises a mathematical function that includes one or more of a multiplication, a division, an addition, and a subtraction.

In embodiments, the second function can be a mathematical function based upon a digital representation of at least a portion of an image. For example, second function can be a function to modify each bit in a sequence of the bit-converted digits of the mantissa by a sequence of rasterized bit in the image.

In embodiments, the second function can be a mathematical function based upon a digital representation of at least a portion of a piece of music. For example, the second function can be a function to modify each bit in a sequence of the bit-converted digits of the mantissa by a characteristic in a sequence of notes in the music. The modification can be based upon the tone (frequency) of the note, its length (¼, ⅛th, half, whole, etc.), or some characteristic of preceding to following notes (e.g., tempo).

Using a second index and a second function removes the result from the possible “natural” numbers set. In this example, the first sequence S₁ is multiplied by a second index I₂, which in this case is 9. Thus:

• • I₂*S₁=9*0.55396512951507511636998936029310793300539490568215589216 . . . .

In embodiments such as the example illustrated herein, the second index I₂ can also be used as a starting point for the second sequence of digits. This is shown below:

• • Z (the result of I₂*S₁)=4.985686165635676047329904242637971397048554151139403029506 . . . .

Applying the second index I₂ to eliminate the first 9 digits:

• • Z=635676047329904242637971397048554151139403029506 . . . .

Thus, the computing device derives the second sequence S₂ to be:

• • S₂=0.6356760473299042426379713970485541511394030295061272508176 . . . .

As discussed herein, the first and second functions are considered to be “non-null” functions in that they effect a transformation of some type. The first and second functions are not intended to include null functions that effectively “does nothing” to the data value to which it is applied.

At step 140, the computing device generates an encryption key from the second sequence of digits.

The encryption key can be the second sequence S₂ that is truncated to an appropriate length. As noted above, the encryption key must be as long as the plaintext, so the computing device truncates the second sequence S₂ to the length of the plaintext to be encrypted.

In embodiments, step 140 includes converting at least a portion of the second sequence of digits to a binary sequence.

At step 150, the computing device applies the generated encryption key to the data to encrypt it.

At a future time, the computing device generates the decryption key by repeating the steps 110-140 (using the same integer, function, and index values) and decrypts the data.

If the encrypted data is transmitted to a second computing device, the second computing device must be able to reproduce the steps 110-140 in order to generate the decryption key, so as to access the data. Thus, along with the transmission of the encrypted data, the computing device transmits to the second computing device additional information that the second computing device can use to generate the decryption key.

In these embodiments, it is understood that the second (receiving) computing device could have a priori knowledge of some of the secret information that the computing device already knows. For example, the second computing device could have a copy of the integer I and/or the list of integers along with the logic for selecting the integers (e.g., the schedule for selecting integers for use and/or the current integer).

In these embodiments, the additional information accompanying the encrypted data can include information necessary for the second computing device to select or derive the correct starting integer. For example, the additional information could include a timestamp that designates the time of encryption of the data. This timestamp would then be used by the second computing device to consult the schedule and determine the integer from the list that corresponded with the time on the timestamp. In another example, the additional information could include a pointer or indicator of the integer from the plurality of integers on the list (for situations where the integer is selected by the encrypting/sending computing device or other selection criteria is used).

In both of these examples, the astute reader will recognize that the exchange of this information is insufficient for an intercepting party to derive the integer because the integer is not derived from the timestamp or the pointer/indicator.

In some, less preferred embodiments, a single integer is used. In these cases, the second computing device could a priori have the integer stored or retrieve it from a third-party service.

In some embodiments, the first function will always be a square root function (along with extracting the mantissa of the resulting number). In these cases, no communication of any indicator of a function between the sending computing device and receiving computing device would be necessary.

In other embodiments, the first function can be a selection of a function among a plurality of available functions. As with the integer, the selection can be according to a schedule known to both the sending and receiving computing devices, or other selection process. In embodiments where the selection is according to a schedule, a timestamp of the time of encryption (which can be the same timestamp used for the integer) can be used by the receiving device to select the function. In other embodiments, a pointer or indicator that the receiving computing device uses to find the correct function among a plurality of functions can be included in the additional information.

If the receiving computing device does not have the correct function, it can obtain it securely from a third-party service.

It is contemplated that the second function can be selected and indicated to the receiving computing device in a similar manner.

In embodiments of the inventive subject matter, the additional information that accompanies the transmission of encrypted data can include an indicator of one or both of the indices. The indicator can be the value of the indicator (e.g., “7” and “9” from the above illustrative example) or a pointer to an index value in a database.

As discussed above, the key must be as long as the plaintext. Thus, the receiving computing device can determine the length of the key based on the received encrypted data. However, in embodiments, the additional information that accompanies the encrypted data can include an indicator of a key length. This indicator can enable the receiving computing device to check that the encrypted data hasn't been manipulated with or corrupted (either by deliberate action or error in transmission) during the transmission.

One of the principal tenets of a one-time pad is that each key is used only once, and then is discarded. This provides additional security to the users because if a third party were to somehow obtain or derive a decryption key for a particular encrypted data set, the key would only be useful against that specific encrypted data set. Other transmissions of encrypted data sets would not be affected. Thus, it is contemplated that each combination of information used to generate an encryption/decryption key (e.g., the combination of the initial integer, first and second function, and the indices), is only used once: for one encryption and then for decryption. After that, the encrypting computing device generates new keys for subsequent encryptions by changing one or more of the integer, the function(s) and/or the indices.

FIG. 2 shows a flowchart illustrating how multiple files can be securely encrypted using the systems and methods of the inventive subject matter in such a way that computing resources used are reduced.

At step 210, a computing device obtains an irrational number to use as a base sequence. In embodiments, the irrational number can be generated by the computing device according to the processes of steps 110-120 of FIG. 1. In other embodiments, the irrational numbers can be a priori generated and stored for the computing device to later retrieve. In embodiments, the mantissa of the irrational number is extracted and used as the base sequence. Obtaining the mantissa of the irrational number is discussed above.

At step 220, the computing device generates an encryption key for a first one of multiple files by applying a first function that applies a first index against a first portion of the base sequence beginning at a first start position. Thus, the computing device selects a first start position that can be the same or different than the first index. The first start position corresponds to the digit of the mantissa from the decimal point denoted by the value of the first start position. Thus, a first start position of “8” corresponds to the 8^th digit in the mantissa from the decimal point as the start of the first portion.

In embodiments, the first function comprises multiplying the first portion of the base sequence by the first index.

At step 230, the computing device encrypts the first file from the multiple files using the generated encryption key.

At step 240, the computing device generates an encryption key for a second one of multiple files by applying a second function that applies a second index against a second portion of the base sequence beginning at a second start position. As with the first start position, the second start position corresponds to the digit of the mantissa from the decimal point denoted by the value of the second start position. Thus, two separate portions of the same base sequence can be used to generate two distinct keys. This saves computing resources by requiring only a single base sequence and mantissa to be obtained and/or derived.

In embodiments, the second function comprises multiplying the second portion of the base sequence by the second index.

At step 250, the computing device encrypts the second file from the multiple files using the generated second encryption key.

The computing device ensures significant differences between the first and second encryption keys (the encryption keys for the first and second files) by ensuring there is at least one difference between the first and second start indices and the first and second positions. A difference between the first and second start indices could include a difference in value between the indices of at least 1, at least 5, at least 10, at least 100, etc. A difference between the first and second positions can include differences of at least one position, at least 5 positions, at least 10 positions, at least 100 positions, etc.

As with the embodiments of FIG. 1 above, in these embodiments the computing device saves the selections of the start positions, indices, and functions for later decryption. If one of the encrypted files is transmitted to a receiving computing device, the sending device can send indicators or pointers related to the start positions, indices, functions and the irrational number for that particular encrypted file such that the receiving device can look these up in a priori databases containing lists of potential start positions, indices, functions and irrational numbers. Thus, the sending device can granularly control who can access which files at which points.

It should be apparent to those skilled in the art that many more modifications besides those already described are possible without departing from the inventive concepts herein. The inventive subject matter, therefore, is not to be restricted except in the spirit of the appended claims. Moreover, in interpreting both the specification and the claims, all terms should be interpreted in the broadest possible manner consistent with the context. In particular, the terms “comprises” and “comprising” should be interpreted as referring to elements, components, or steps in a non-exclusive manner, indicating that the referenced elements, components, or steps may be present, or utilized, or combined with other elements, components, or steps that are not expressly referenced. Where the specification claims refers to at least one of something selected from the group consisting of A, B, C . . . and N, the text should be interpreted as requiring only one element from the group, not A plus N, or B plus N, etc.

Claims

1. A method of generating an encryption key, comprising: obtaining, by a computing device, a first sequence of digits derived from application of a first function to a seed, wherein the seed is a non-perfect square integer, and the first sequence of digits comprises a mantissa derived from a square root of the seed;obtaining, by the computing device, a second sequence of digits from application of a second function to at least a portion of the first sequence of digits, beginning at a predetermined start position;deriving, by the computing device, the encryption key from the second sequence of digits; andencrypting, by the computing device, data with the derived encryption key.

2. The method of claim 1, wherein the first function comprises a root.

3. The method of claim 1, further comprising selecting, by the computing device, the seed as a number ending in 2, 3, 7, or 8.

4. The method of claim 1, wherein the first sequence of digits comprises a portion of the mantissa.

5. The method of claim 4, wherein the step of obtaining the first sequence of digits comprises accessing, by the computing device, a previously stored file containing the portion of the mantissa.

6. The method of claim 4, wherein the second function comprises a mathematical function selected from the group consisting of a multiplication, a division, an addition, and a subtraction.

7. The method of claim 4, wherein the second function comprises a mathematical function based upon a digital representation of at least a portion of an image.

8. The method of claim 4, wherein the second function comprises a mathematical function based upon a digital representation of at least a portion of a piece of music.

9. The method of claim 4, wherein the step of deriving the encryption key comprises converting, by the computing device, at least a portion of the second sequence of digits to a binary sequence.

10. The method of claim 1, wherein the second function comprises multiplying, by the computing device, the portion of the first sequence of digits by an integer.