Patent Application
20230299940
None.
The technology herein relates to computer security, and more particularly to systems and methods for transporting entropy from one side of a messaging system to another side of the messaging system. The technology herein also relates to systems and methods for deterministically changing entropy expansion arrays.
Entropy measures the amount of disorder or randomness. Randomness in a computer system is often a bad thing, since we usually expect computer results to be deterministic i.e., given the same inputs, the computer should generate the same outputs. However, entropy and randomness play important roles in secure computer messaging where unpredictability can be an advantage.
When you access your bank account online, you probably do not want anyone else to listen in to the digital conversion between your computer or smart device and the bank's computer system. To protect the exchange of banking information, your computer/smart device and the bank's computer each transform the exchanged information into a different (unreadable) form before sending it over a public network or communications channel such as the Internet or a cellular telephone network, point-to-point wireless communication, etc. The different form conceals the “clear text” content of the information from digital eavesdroppers. On the other side, your computer/smart device or the bank's computer transforms the unreadable form back into its original clear text form so it can be used. To secure the information exchange, the transformation is designed so it is computationally infeasible for an eavesdropper to learn or derive the clear text from the unreadable form.
To accomplish this goal, the transformation used to convert the clear text into the unreadable form (sometimes called “cipher text”) should be unpredictable. If the transformation is predictable, then an eavesdropper will be able to guess it and derive the clear text.
As a simple example, suppose Bob wants to send a secret message “meet at ten P” to Alice. Bob decides to use a transform that equates each letter with a number corresponding to the position of the letter in the alphabet, adds the two numbers together, and looks up the alphabet letter corresponding to sum. If the sum exceeds 26, Bob subtracts 26 and uses the result to look up the corresponding letter. Bob decides to use Alice's name as the “key” to transform the clear text into cipher text. This is what the transformation looks like using the key “ALICEALICE”:
The resulting cipher text “NQNWFUFNQU” appears to be unintelligible and therefore secure. However, if Deborah knows that Bob is sending the message to Alice, it would not be surprising for Deborah to guess that Bob has used Alice's name as the “key” for the transformation. Once Deborah guesses the correct key, it is a simple matter for her to try different transformations until she gets intelligible results. Deborah's computer could crack the above code in just a few seconds, revealing the clear text message.
To avoid the attack, Bob could instead choose a key that is truly random and thus unpredictable. If each element of the random key is used only once (i.e., to transform a single letter of the clear text message before being discarded), the system will be perfectly secure.
While the above approach seems to be straightforward, it should be apparent that both Bob and Alice need the same “key” in order to make the system work. A challenge is to distribute the random key (which may be a stream of numbers or other values) so it is available to both Bob and Alice but not to Deborah. Bob could share the secret key with Alice when they meet in person, but this is inconvenient in the modern electronic, network-connected world. Further improvements are therefore possible and desirable.
Please refer to the following detailed description of example non-limiting embodiments in conjunction with the drawings, of which:
Example non-limiting embodiments herein get the entropy from one side to the other along with methods to deterministically change an expansion array used to produce an entropy expansion. This can be encrypted with anything as the payload is a one time pad (OTP).
In some example embodiments, the messages for expansion are encrypted with an OTP so they cannot be discovered. A non-limiting purpose of this incarnation is to distribute entropy to two or more sides from a third server that delivers TRNG (True Random Number Generation). This new incarnation is OTP encrypted. Its primary payload is data with a to-be-expanded OTP included in the stream. This allows for both data and TRNG to be delivered in a single stream. This would still be a special case as some specific embodiments would not necessarily be good for audio/video (A/V) use because of the interruption caused by processing the entropy payload but might have a purpose where resources are tight and a TRNG can be available in the hardware (think Smart Home device).
There can be any number of encryption stations 1B and any number of decryption stations 1C. In one example embodiment, one encryption station communicates with one decryption station. In another example embodiment, one encryption station communicates with plural (N, where N is any number) decryption stations. In a further example embodiment, plural (M, where M is any number) encryption stations communicate with one decryption station. In another example embodiment, N encryption stations communicate with M decryption stations.
In some embodiments, the expansion arrays can be of fixed sizes or varying sizes. This will create even more entropy and further obfuscate the final random results. This may be very useful if your data is critical and of high value.
Once the procedures above are provided to generate entropy expansion 304, an originating station may use the expanded entropy as a one time pad (OTP) to encrypt a message such as a data stream which the station can then send over the network 104. In some embodiments, the originating station 102 may, within this same transmission, send parts of the entropy expansion it will use in the future to encrypt later parts of the data stream. The receiving station can receive, cache and expand this entropy expansion for later use in decrypting (or encrypting) a further portion(s) of the encrypted stream. It can also expand the entropy in near real time holding a cache of potential entropy size without actually requiring the storage for that full potential size. This is a useful feature for smaller devices like sensors that may have small storage capacity.
In example non-limiting preferred embodiments, a mixed stream of encrypted data and entropy can be sent over the same channel using port facading and/or port rotation, to allow both encrypted data and future entropy to be conveyed over a single channel. See
For example,
In some example embodiments, the system can be “primed” with a certain amount of shared entropy. This can be shared over a legacy encrypted stream, emailed, provided via a QR Code, or in other ways. This “primed” shared entropy can then be used as the basis for encrypting further entropy exchanged over a communications channel, and expanded as needed to encrypt further data.
While the invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not to be limited to the disclosed embodiment, but on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.
This application is a continuation of U.S. patent application Ser. No. 16/809,237, filed Mar. 4, 2020, which claims priority from U.S. Provisional Application No. 62/813,741 filed Mar. 4, 2019. These applications are incorporated herein by reference in their entirety and for all purposes.
| Number | Date | Country | |
|---|---|---|---|
| 62813741 | Mar 2019 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 16809237 | Mar 2020 | US |
| Child | 17977792 | US |
