Maintaining data confidentiality is an important concern for all computing device users regardless of task(s) performed. Encryption schemes represent one form of technology directed towards securing data when stored in memory and/or transmitted over networks. Many systems use a single encryption protocol for all communications over a network, regardless of the differences between various users. Should the encryption scheme be compromised, this could affect all communications over the network. One illustrative example of an encryption system is disclosed in U.S. Pat. No. 9,306,738, which issued Apr. 5, 2016 to Microsoft Technology Licensing, LLC, the disclosure of which is incorporated by reference herein in its entirety.
An encryption system or method that allowed for secure encryption between various endpoints on a network using a single protocol that could be followed by all endpoints and renders the deciphering by an unauthorized third party computationally impractical, would be an improvement in the art.
This summary is provided to introduce a selection of representative concepts in a simplified form that are further described below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used in any way that would limit the scope of the claimed subject matter.
The present disclosure is directed to secure computations and transmission of encrypted data over a network. Two unequal unsigned integer numbers are used as keys, which are kept secret by users. In some illustrative embodiments, each key is supplied as the seed to a uniform pseudorandom number generator, and follows an algorithm to encrypt and decrypt a communications channel between two endpoints on the network. In other illustrative embodiments, each key is supplied as the seed to a uniform pseudorandom eight-bit unsigned integer generator. The communications channel is a stream of bits representing any data that may be represented or stored by a computer capable of processing binary data. In one illustrative embodiment, a network has multiple endpoints, such as different terminals disposed at different locations (for example, terminals at various branches of a financial institution that are connected to a common network). Using keys that are specific to transactions between specified terminals allows for greater security of the encrypted transmissions.
It will be appreciated by those of ordinary skill in the art that the various drawings are for illustrative purposes only. The nature of the present disclosure, as well as other embodiments in accordance with this disclosure, may be more clearly understood by reference to the following detailed description, to the appended claims, and to the several drawings.
The present disclosure relates to apparatus, systems and methods for secure computations and transmission of encrypted data over a network. It will be appreciated by those skilled in the art that the embodiments herein described, while illustrative, are not intended to so limit this disclosure or the scope of the appended claims. Those skilled in the art will also understand that various combinations or modifications of the embodiments presented herein can be made without departing from the scope of this disclosure. All such alternate embodiments are within the scope of the present disclosure.
Turning to
In one illustrative embodiment, the system or method in accordance with this disclosure utilizes an algorithm that encrypts and decrypts a communications channel between two endpoints, such as those indicated at 102 and 104. The communications channel is a stream of bits representing any data that may be represented or stored by a computer capable of processing binary data. In the depicted example, the data comprises a length of ASCII text, which is converted to a hexadecimal string for encryption. It will be appreciated that this is merely illustrative and that any types of data files may be encrypted using the principles of the present disclosure.
In the depicted embodiment, the algorithm requires two keys, that is, unsigned integer numbers, designated as KeyA and KeyB. Both endpoints know both KeyA and KeyB. KeyA and KeyB must not be equal. Both KeyA and KeyB are kept secret.
In some embodiments, the various endpoints on a network may each have a particular set of keys for communicating with other specified endpoints on the network. For example, each endpoint could have a particular set of keys that are used only to communicate with a single other endpoint (or a subset of other endpoints). Then, even if the communication channel between two particular endpoints were compromised, others would not be.
Each key is a number supplied as the seed to a uniform pseudorandom real number generator. Thus, there are a number of uniform pseudorandom real number generators corresponding to the number of keys used. In this example, there are two keys and thus two pseudorandom real number generators used, although it will be appreciated that in other embodiments other numbers of keys and corresponding pseudorandom real number generators may be used. In the depicted embodiment of
For purposes of this description, one uniform pseudorandom real number generator will be referred to as the A-PRNG, and the other as B-PRNG. The uniform pseudorandom real number generators generate a number in the range [0.0,MAX]. The value of MAX can be any positive real number. MAX=10.0 is suggested as sufficient.
For purposes of this description, the algorithm will be described in the context of two endpoints communicating with each other, PNTA and PNTB. The algorithm description will refer to PRNG1 and PRNG2. PRNG1 and PRNG2 refer to either A-PRNG or B-PRNG as shown in Table 1 below.
The length of KeyA and KeyB in bits is equal to 2K where K may be chosen as any integer greater than or equal to 4. The greater the value of K the greater the secureness of the encryption.
Two constant parameters are specified by the algorithm.
M=2(B-11),
N=2(B-7),
where B is the length of the cyclic redundancy check, CRC, in bits.
Three variable parameters are initialized as follows:
Associated with the CRCByteCount is a constant, CRCByteCntMax, whose suggested value is 64.
In the embodiment of
The encrypted data stream may then be transmitted to the receiving endpoint, such as depicted endpoint 104. In the depicted embodiment of
Optionally, RB number of random bytes may be inserted into the bit stream preceding the beginning of the true unencrypted data. RB may be generated from a uniform pseudorandom integer number generator using the absolute value of (KeyA−KeyB) as the seed and generating a random number in the range [0,255]. The intent of prepending RB random bytes is to mask the values of KeyA and KeyB to someone attacking the beginning of the transmission wherein the transmission of the true encrypted data would otherwise always start with KeyA and KeyB. In the depicted embodiment of
Turning to
Each key is a bit string supplied as the seed to an eight-bit unsigned integer uniform pseudorandom number generator. Thus, there are a number of eight-bit unsigned integer uniform pseudorandom number generators corresponding to the number of keys used. In this example, there are two keys and thus two eight-bit unsigned integer pseudorandom number generators used, although it will be appreciated that in other embodiments other numbers of keys and corresponding eight-bit unsigned integer pseudorandom number generators may be used. In the depicted embodiment of
For purposes of this description, one eight-bit unsigned integer uniform pseudorandom number generator will be referred to as A-PRNG, and the other eight bit unsigned integer uniform pseudorandom real number generator, as B-PRNG. A-PRNG and B-PRNG must be identical eight-bit unsigned integer uniform pseudorandom number generators. For purposes of this description, the algorithm will be described in the context of two endpoints communicating with each other, PNTA and PNTB. The algorithm description will refer to PRNG1 and PRNG2. PRNG1 and PRNG2 refer to either A-PRNG or B-PRNG as shown in Table 1 above.
The algorithm uses two other keys, KeyAA and KeyBB. KeyAA and KeyBB are bit strings (or equivalently, a number of bit length 2K) each supplied as the seed to a uniform pseudorandom real number generator. For purposes of this embodiment, one uniform pseudorandom real number generator will be referred to as the AA-PRNG uniform pseudorandom real number generator, and the other as the BB-PRNG uniform pseudorandom real number generator. AA-PRNG is created using KeyAA as the seed. BB-PRNG is created using KeyBB as the seed. BB-PRNG and AA-PRNG use the identical random number generator. BB-PRNG and AA-PRNG generate a number in the range [0.0,MAX]. The value of MAX can be any positive real number. MAX=20.0 is suggested as sufficient. The lengths of KeyAA and KeyBB in bits are equal to 2K where K may be chosen as any integer greater than or equal to 4. The greater the value of K the greater the secureness of the encryption. KeyAA and KeyBB are initialized from successive values returned from PRNG1 and PRNG2, respectively.
A constant parameter is specified by the algorithm.
M=2(S-11),
where S is the length of the cyclic redundancy check, CRC, in bits.
The algorithm employs a hashing function, HASH. The hashing algorithm is not dictated, but for example, SHA3-256 as defined in NIST publication SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions, FIPS 202, could be used. The input to HASH is a digest of variable length H bits. Suggested value of H is 256. HASH returns a hash value whose length in bits is equal to H.
Three variable parameters are initialized as follows:
On the transmission side the bit stream is processed as follows:
4) A running sum of the absolute value of the Deviation is maintained, DeviationSum.
5) A running sum of the number of bytes processed is maintained, ByteCnt.
6) If Deviation is greater than or equal to zero, then the next bit in the bit stream is inverted, otherwise it is not inverted. The resulting bit stream is the encrypted bit stream.
7) If DeviationSum is greater than DevSumThreshold, then a new epoch is begun and the following processing is performed, otherwise step 8 is performed next.
The encrypted data stream may then be transmitted to the receiving endpoint, such as depicted endpoint 104. In the depicted embodiment, this is shown at 1000B. On the receiving side the bit stream is processed bit by bit and decrypted as follows:
0) The number of prepended random bytes, RB, is set equal to a random value returned from PRNG1 after which PRNG1 is called RB number of times. If RB was zero, then RB was set equal to the default value.
1) A random number is generated by AA-PRNG, AA.
2) A random number is generated by BB-PRNG, BB.
4) A running sum of the absolute value of the Deviation is maintained, DeviationSum.
5) A running sum of the number of bytes processed is maintained, ByteCnt.
6) If Deviation is greater than or equal to zero, then the next bit in the bit stream is inverted, otherwise it is not inverted.
7) If DeviationSum is greater than DevSumThreshold, then a new epoch is begun and the following processing is performed, otherwise step 8 is performed next.
Function SHIFTBITS treats the bit stream as a set of shift registers, S[i]. The size of the ith shift register, SS[i], and the bit shift of the ith shift register, SB[i], are random values. Starting with index i=0, the process of forming the shift registers and performing the bit shifting is as follows:
Function UNSHIFTBITS is the antithesis of SHIFTBITS. Starting with the index i=0, the process of undoing the bit shifting performed by SHIFTBITS is as follows:
Each computing object 510, 512, etc. and computing objects or devices 520, 522, 524, 526, 528, etc. can communicate with one or more other computing objects 510, 512, etc. and computing objects or devices 520, 522, 524, 526, 528, etc. by way of the communications network 540, either directly or indirectly. Even though illustrated as a single element in
There are a variety of systems, components, and network configurations that support distributed computing environments. For example, computing systems can be connected together by wired or wireless systems, by local networks or widely distributed networks. Currently, many networks are coupled to the Internet, which provides an infrastructure for widely distributed computing and encompasses many different networks, though any network infrastructure can be used. For example, communications made incident to the systems as described in various embodiments.
Thus, a host of network topologies and network infrastructures, such as client/server, peer-to-peer, or hybrid architectures, can be utilized.
In a client/server architecture, particularly a networked system, a client is usually a computer that accesses shared network resources provided by another computer, e.g., a server. In the illustration of
A server is typically a remote computer system accessible over a remote or local network, such as the Internet or wireless network infrastructures. The client process may be active in a first computer system, and the server process may be active in a second computer system, communicating with one another over a communications medium, thus providing distributed functionality and allowing multiple clients to take advantage of the information-gathering capabilities of the server.
In a network environment in which the communications network 540 or bus is the Internet, for example, the computing objects 510, 512, etc. can be Web servers with which other computing objects or devices 520, 522, 524, 526, 528, etc. communicate via any of a number of known protocols, such as the hypertext transfer protocol (HTTP). Computing objects 510, 512, etc. acting as servers may also serve as clients, e.g., computing objects or devices 520, 522, 524, 526, 528, etc., as may be characteristic of a distributed computing environment.
As mentioned, advantageously, the techniques described herein can be applied to any device. It can be understood, therefore, that handheld, portable and other computing devices and computing objects of all kinds are contemplated for use in connection with the various embodiments. Accordingly, the below general purpose remote computer described below in
Embodiments can partly be implemented via an operating system, for use by a developer of services for a device or object, and/or included within application software that operates to perform one or more functional aspects of the various embodiments described herein. Software may be described in the general context of computer executable instructions, such as program modules, being executed by one or more computers, such as client workstations, servers or other devices. Those skilled in the art will appreciate that computer systems have a variety of configurations and protocols that can be used to communicate data, and thus, no particular configuration or protocol is considered limiting.
With reference to
Computer 610 typically includes a variety of computer readable media and can be any available media that can be accessed by computer 610. The system memory 630 may include computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) and/or random access memory (RAM). By way of example, and not limitation, system memory 630 may also include an operating system, application programs, other program modules, and program data.
A user can enter commands and information into the computer 610 through input devices 640. A monitor or other type of display device is also connected to the system bus 622 via an interface, such as output interface 650. In addition to a monitor, computers can also include other peripheral output devices such as speakers and a printer, which may be connected through output interface 650.
The computer 610 may operate in a networked or distributed environment using logical connections to one or more other remote computers, such as remote computer 670. The remote computer 670 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, or any other remote media consumption or transmission device, and may include any or all of the elements described above relative to the computer 610. The logical connections depicted in
As mentioned above, while example embodiments have been described in connection with various computing devices and network architectures, the underlying concepts may be applied to any network system and any computing device or system in which it is desirable to improve efficiency of resource usage.
Also, there are multiple ways to implement the same or similar functionality, e.g., an appropriate API, tool kit, driver code, operating system, control, standalone or downloadable software object, etc. which enables applications and services to take advantage of the techniques provided herein. Thus, embodiments herein are contemplated from the standpoint of an API (or other software object), as well as from a software or hardware object that implements one or more embodiments as described herein. Thus, various embodiments described herein can have aspects that are wholly in hardware, partly in hardware and partly in software, as well as in software.
The word “exemplary” is used herein to mean serving as an example, instance, or illustration. For the avoidance of doubt, the subject matter disclosed herein is not limited by such examples. In addition, any aspect or design described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects or designs, nor is it meant to preclude equivalent exemplary structures and techniques known to those of ordinary skill in the art. Furthermore, to the extent that the terms “includes,” “has,” “contains,” and other similar words are used, for the avoidance of doubt, such terms are intended to be inclusive in a manner similar to the term “comprising” as an open transition word without precluding any additional or other elements when employed in a claim.
As mentioned, the various techniques described herein may be implemented in connection with hardware or software or, where appropriate, with a combination of both. As used herein, the terms “component,” “module,” “system” and the like are likewise intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on computer and the computer can be a component. One or more components may reside within a process and/or thread of execution and a component may be localized on one computer and/or distributed between two or more computers.
The aforementioned systems have been described with respect to interaction between several components. It can be appreciated that such systems and components can include those components or specified sub-components, some of the specified components or sub-components, and/or additional components, and according to various permutations and combinations of the foregoing. Sub-components can also be implemented as components communicatively coupled to other components rather than included within parent components (hierarchical). Additionally, it can be noted that one or more components may be combined into a single component providing aggregate functionality or divided into several separate sub-components, and that any one or more middle layers, such as a management layer, may be provided to communicatively couple to such sub-components in order to provide integrated functionality. Any components described herein may also interact with one or more other components not specifically described herein but generally known by those of skill in the art.
While this disclosure has been described using certain embodiments, it can be further modified while keeping within its spirit and scope. This application is therefore intended to cover any variations, uses, or adaptations of the disclosure using its general principles. Further, this application is intended to cover such departures from the present disclosure as come within known or customary practices in the art to which it pertains and which fall within the limits of the appended claims.
This application claims the benefit of U.S. Provisional Application No. 62/324,504, filed Apr. 19, 2016, the disclosure of which is incorporated herein by reference in its entirety.
Number | Date | Country | |
---|---|---|---|
62324504 | Apr 2016 | US |