WO2014029951A1 - Système de cryptographie - Google Patents

Système de cryptographie Download PDF

Info

Publication number
WO2014029951A1
WO2014029951A1 PCT/GB2012/000675 GB2012000675W WO2014029951A1 WO 2014029951 A1 WO2014029951 A1 WO 2014029951A1 GB 2012000675 W GB2012000675 W GB 2012000675W WO 2014029951 A1 WO2014029951 A1 WO 2014029951A1
Authority
WO
WIPO (PCT)
Prior art keywords
server
key
encryption
bit sequence
sequence
Prior art date
Application number
PCT/GB2012/000675
Other languages
English (en)
Inventor
Carlos Eduardo Bevilacqua LEAL
Original Assignee
Senta Technologies Limited
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Senta Technologies Limited filed Critical Senta Technologies Limited
Priority to PCT/GB2012/000675 priority Critical patent/WO2014029951A1/fr
Publication of WO2014029951A1 publication Critical patent/WO2014029951A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/34—Network arrangements or protocols for supporting network services or applications involving the movement of software or configuration parameters 

Definitions

  • the present invention is in the field of cryptography.
  • the present invention relates to the authentication of devices and the encryption of data for transmission between devices.
  • Communication between devices is a necessary aspect of the modern world.
  • Information is communicated between devices through a communications infrastructure, such as, the Internet, a mobile telecommunications network, or an amalgam of such networks.
  • the networks or devices may not be secure in that a third party to the communication may be able to intercept the communication. Interception of communications is not desirable for certain information, such as personal information, financial information, or military information.
  • the information may be transmitted over a secure communications channel between the transmitting and recipient device. Secure communications channels can be initiated using numerous protocols, such as HTTPS, and may use numerous encryption methodologies, such as Public Key Infrastructure (PKI) or using a shared encryption key.
  • PKI Public Key Infrastructure
  • existing protocols suffer from a common defect: the secure communications channel is vulnerable when the transmitting or recipient device is compromised.
  • a method of creating a secure communication channel between a device and a server including the steps of: i) a first server transmitting an encryption module selected from a plurality of different encryption modules to a device;
  • the device communicating with a second server and including an identifier for the encryption module
  • a method of generating a common encryption key including the steps of: i) a device obtaining a key sequence and generating a first bit sequence;
  • the device combining the key sequence and first bit sequence using a first bitwise processing method to produce a first combined sequence
  • the device transmitting the first combined sequence to a server
  • step (iv) if the mask size of the third bit sequence is less than a predefined threshold, repeating the steps from step (iv) until the mask size of the third bit sequence is at least meets the predefined threshold;
  • the server generating the common encryption key by applying the third bit sequence as a mask to the first combined sequence and second bit sequence.
  • a method of transmitting encrypted data between a first and second device including the
  • the first device encrypting data using the common key and transmitting the encrypted data to the second device;
  • authenticating a device including: i) the device transmitting information to a server;
  • Si the server categorising the information based on predictability
  • the server storing the categorised information into a knowledge base
  • the server comparing further information received from the device with the stored categorised information; and v) the server authenticating the device if the further information matches the stored categorised information to a defined threshold.
  • Figure 1 shows a block diagram illustrating an overview of the authentication system.
  • Figure 2 shows a flow diagram illustrating a replaceable encryption modules method in accordance with an embodiment of the invention.
  • Figure 3 shows a flow diagram illustrating a common key generation method in accordance with an embodiment of the invention.
  • Figure 4 shows a flow diagram illustrating an encrypted transmission method in accordance with an embodiment of the invention.
  • Figure 5 shows a flow diagram illustrating a machine authentication method in accordance with an embodiment of the invention.
  • Figure 6 shows a block diagram illustrating an overview of the Senta authentication system.
  • Figure 7 shows a block diagram illustrating a module replacement system in accordance with an embodiment of the invention.
  • Figures 8 and 9 show block diagrams illustrating the creation of a encrypted
  • Figure 10 shows a block diagram illustrating a common key generation process in accordance with an embodiment of the invention.
  • Figure 11 shows a block diagram illustrating the creation of an encryption key from a common key in accordance with an embodiment of the invention.
  • Figure 12 shows a block diagram illustrating the creation and management
  • Figure 13 shows a block diagram illustrating a device authentication system in accordance with an embodiment of the invention.
  • Figure 14 shows a block diagram illustrating an implementation of an embodiment of the invention.
  • the present invention provides a cryptography system for authenticating devices and for encrypting communications for transmission between devices.
  • Embodiments of the present invention deploy different components including different coding/decoding algorithms to devices periodically to help mitigate the damage caused by compromised devices.
  • Embodiments of the present invention use obfuscation of the executable code of the components to make it difficult for viruses or malware to read variables and important data within the component.
  • Embodiments of the present invention use an authentication system to fingerprint a device, to track the evolving state of the device, and to authenticate the device based on its evolving fingerprint.
  • the system 100 includes a first main server 101 connected to a second server 102.
  • the two servers 101 and 02 may exist within the same physical architecture, or as virtual machines on the same hardware; or as different processes or functions on the same server; or as many servers in a distributed or clustered environment.
  • the servers 101 and 102 are connected via a communications infrastructure 103, such as the Internet or a mobile telecommunications infrastructure, to a plurality of devices 104, each device having a file system.
  • the devices 104 may be any of mobile devices, mobile telephony devices, computing devices, or other device.
  • Each device 104 includes a network interface 105, a processor 106, and a memory 107.
  • the first server 01 generates an encryption component including an encryption algorithm selected from a predefined list of algorithms.
  • the encryption component is also generated with a randomised/pseudo- randomised key.
  • the encryption component includes a component identifier.
  • the component may also include a generated asymmetric key pair.
  • the generated encryption component may be obfuscated to inhibit hacking of the component.
  • the first server 101 randomly generates an encryption component and the device in 104 will also randomly generate an encryption component.
  • the REMA algorithm uses a seed on both the server and client devices to synchronise encryption components.
  • the first server 101 transmits the generated encryption component to one of the devices 104.
  • the first server 101 may generate a replacement encryption component and transmit it to the device 104 in step 201.
  • the device 104 may then replace its current encryption module with the new encryption module in step 202.
  • the transmission may be over a secure communications channel.
  • the device 104 may use the encryption component to communicate with the second server 102 in step 203.
  • the identifier of the encryption component may be communicated by the device 104 to the second server 102.
  • the second server 102 may use the identifier to extract the encryption component from the first server 101 in step 204.
  • the second server 102 may use the extracted encryption component to create a secure communication channel to communicate with the device 104 in step 205. Communications over the secure communication channel can be encrypted using the encryption algorithm of the encryption component.
  • the device 104 and second server 102 may communicate to generate a common encryption key to use with the encryption component.
  • the second device may obtain the common encryption key from the second server.
  • the second device may also be provided with an encryption component by the first server 101 , and the second device may communicate with the second server 102 using the encryption component to obtain the common encryption key.
  • the first and second device may then communicate using the common encryption key to encrypt/decrypt transmissions.
  • This method relates to the generation of a common key between a device 04 and server 02.
  • the device 104 To generate a common key at the device 104 and the server 102, the device 104 generates a first bit sequence in step 300. Also in step 300, the device 104 combines the bit sequence with a key that is generated at the device 104 (randomly or via user input), received through another secure channel, or stored within the device 104. The combined sequence is transmitted to the server 102 in step 301.
  • step 302 the server 102 generates a second bit sequence, and transmits this to the device 104.
  • step 303 the device 104 combines the second bit sequence with the first sequence and then inverts the result to produce a third bit sequence.
  • step 304 if the mask size of the third bit sequence is fails to meet a minimum size threshold then a new second bit sequence is requested from the server 102.
  • the purpose of testing for a minimum threshold is to ensure that the fesulting common key generated is sufficiently long to meet encryption requirements. Accordingly, the minimum size threshold will be set to the minimum key length that will meet those requirements such as 32-bit, 64-bit, 28-bit, or 256-bit encryption strength.
  • step 305 the third bit sequence which meets the mask threshold size is transmitted to the server 102.
  • step 306 the server 102, applies the third bit sequence as a mask to the first combined sequence and second bit sequence.
  • the result of the mask application is a common key.
  • the device 104 also applies the third bit sequence as a mask to the first combined sequence and first bit sequence.
  • bit sequences are combined using a bitwise processing method such as XOR.
  • a bitwise processing method such as XOR.
  • D combines key and bit sequence A using XOR to produce combined sequence X 00101110 d) D transmits combined sequence X to S
  • D combines bit sequences A and B using XOR and then inverts the bits to produce mask 01 111001
  • the mask size of 01111001 is five because there are five Ts - the predefined minimum threshold is four
  • the mask operator may optionally include additional transformations of the generated common encryption key.
  • Communications between the device 104 and the server 102 may be conducted over a PKI secured channel.
  • communications between the device 104 and the server 102 are conducted using an secure communications channel created using the method shown in Figure 2.
  • a potential advantage of this method is that because both the device 104 and the server 102 are contributing random aspects to the common key generation process it is more difficult for a third party to simulate the random number generator and predict what the key might be.
  • FIG 4 a method according to an embodiment of the cryptography system of Figure 1 will be described. This method relates to the use of a server 102 to manage the secure communication channel created between two devices 104.
  • a first device 104 generates a common key with a server 102.
  • the key may be generated using the method shown in Figure 3.
  • a second device may obtain the common key from the server 102.
  • the second device may communicate with the server 102 using the method shown in Figure 2.
  • the first and second device may communicate using the common key to initiate encrypt/decrypt component for transmission of data between the first and second device.
  • a new key may be generated by the encryption module REMA on both the first and second device automatically, and in sycnhronisation with each other so the keys are the same.
  • the first device 104 may switch between generated keys when communicating with the second device. Transmissions may include an identifier to enable the second device to select the correct key.
  • the first device 104 may use their received encryption component as shown in Figure 2 to encrypt data transmissions.
  • the second device may request the encryption component of the first device 104 from the server 102 to enable the second device to decrypt the data transmissions.
  • a potential advantage of using a central server 102 to coordinate encrypted data transmissions between devices 104 according to this method is encryption keys can be renewed easily to inhibit the usefulness of a hacker stealing data or cloning a device. Referring to Figure 5, a method according to an embodiment of the cryptography system of Figure 1 will be described.
  • This method relates to the authentication of devices 104 using a "fingerprint" of the device and optional user credentials for example biometrics or proximity authentication methods 104.
  • An authenticator module on a device 104 retrieves information about the device 104.
  • Information may include evolving information such as the file system stored on the memory 107 of the device 104, GPS position, data on the SIM card, or other form of storage media; and/or IP address, and static information such as IMEI, MAC address or hardware serial numbers.
  • the information preferably includes "file/folder names" in conjunction with "file/folder creation/modification dates".
  • other information such as the size of the file, the value of a specific byte or selection of bytes, or a hash function may be used.
  • step 500 the information is transmitted to an authentication server which inserts the information into a learning engine for each device 104.
  • the learning engine may be a knowledge base or neural net.
  • the authentication server may reside on the server 02.
  • the information is weighted based on its predictability.
  • predictability is estimated based upon characteristics of the information. For example, typically static operating system files and hardware IDs may be marked as low risk, operational operating system files that infrequently change (such as Program files folder) may be marked as medium risk, user documents would fall into high risk, and operational files that are continuing evolving (i.e. swap files) are marked as evolving.
  • the information forms an effective fingerprint for the device 104.
  • the predictability of each information item in the learning engine is updated based on how frequently the information item has changed on the device. Frequency of change can be determined by comparing changes from previous authentication sessions. Therefore, the evolving fingerprint of the device is monitored by the authentication server.
  • the device 104 provides a machine identifier constructed from low risk information, a password formed from randomly selected information items covering low, medium and high risk predictability, an evolutionary key selected from the information items marked as evolving, and a selection of new information items in step 502.
  • authentication may optionally involve characteristics from a users biometric signature or a proximity authentication mechanism to pair devices and users together.
  • the machine identifier may be constructed by forming a hash value from the low risk information in step 503.
  • the device 104 is authenticated when the password matches the fingerprint of the device 104 within the learning engine to a specific threshold. In alternative embodiments, these may include optional random parameters, and may for example include biometrics or proximity parameters. If the match is below the specific threshold then the device 104 is required to provide another password formed from another set of randomly selected information items. This process may be repeated for a set number of times. If the match is not only below the specific threshold but is below a further lower threshold or no password matches after the set number of times then the device may be marked as "Not Recognised".
  • step 505 if the device 104 is authenticated, then information items whose details did not match exactly are updated within the learning engine. Also in step 505, information items that did not exist at all in learning engine are added to the learning engine. If the device 104 is authenticated, then its evolution is tracked using information items marked as evolving. Dates extracted from the evolving information items provided by the device 104 are compared to the dates of the evolving information items stored in the learning engine. If the evolving information item is older than the stored evolving information item, the device 104 is marked as a device clone.
  • the device 04 is marked as a clone, marker files are identified on the device to distinguish it amongst its clones.
  • the markers are used to match the clone device to their own learning engine instead of their clone's.
  • Potential advantages of the authentication method above are that devices 104 can be authenticated through anonymiser services, cloned devices can be detected, and no secondary means, such as a user PIN, security dongle, or card and chip, are required to authenticate a device.
  • the identifier is a simple random universally unique identifier (UUID) that is associated on Senta Server side with some set of data collected from the device. In this embodiment, all of the device data is weighted equally. This data may comprise the following info:
  • MB serial system UUID
  • MAC-address some hardware data
  • These files are also evolving, they change their location and content and so the server monitors their current state. If machine is cloned or it is not recognized it obtains a new identifier and its data stores to learning engine. The learning engine then analyzes the file name, location and content.
  • the Senta system 600 operates on the data part of a transportation protocol to provide a secure communications channel 601.
  • the transportation protocol is responsible for packet synchronization and other aspects.
  • the Senta system 600 comprises the following components:
  • the encryption key generation module (EKGM) is a virtual entity. There is no specific executable code for the EKGM, but each implementation of the EKGM includes a set of features as listed below and is herein referred to as an Avatar of the EKGM. Each Avatar has different executable code and encryption parameters but has some common features.
  • Each Avatar of the EKGM has a counterpart stored on the "Primary Encryption Module (PEM)" 602.
  • PEM Primary Encryption Module
  • the EKGM Server is extracted by the Senta Prime Server 603, and is used by the Senta Prime Server 603 to communicate with the equivalent EKGM Client on the client side.
  • the EKGM Client is located at a device 604 or 605.
  • the encryption modules may be stored on a separate repository server, not on the Senta Prime Server.
  • Each EKGM Avatar may include the following features:
  • Session JD A variable to store a session ID, called Session JD
  • AA1 Rivest-Shamir-Adleman (RSA) public key algorithm, or an Elliptic Curve Cryptography (ECC) algorithm. It is referenced as AA1
  • a hard coded pair of asymmetric keys referred to as K1 and P2 on the EKGM Client, and for use by AA1.
  • the keys are previously calculated and hard coded in the EKGM.
  • the corresponding key pair on the EKGM Server are referred to as P1 and K2
  • ⁇ An implementation of a symmetric algorithm, such as a Diffie-Hellman (DH) key agreement algorithm. It is referenced as AS1.
  • the key generated by AS1 is KS1.
  • the parameter used to generate KS1 at the server side is KSS1 and the parameter used to generate KS1 at the client side is B
  • the code comprising the Avatars of the EKGM are preferably at least partially obfuscated.
  • ProGuardTM or KlassMasterTM may be used to obfuscate the code.
  • ⁇ KEY_DEFAULT is different amongst Avatars
  • the main aim of the Primary Encryption module is to establish protected channel for common encryption key instantiation with KGP protocol.
  • Some of the logic is separated from the EKGM to the PEM, and the EKGM uses the PEM for initial protected communication between client and server until the main encryption component (generated by REMA that use common encryption key) is not instantiated.
  • the PEM will encapsulate the following components of the EKGM:
  • An implementation of an asymmetric algorithm such as a Rivest-Shamir-Adleman
  • a hard coded pair of asymmetric keys referred to as K1 and P2 on the EKGM Client, and for use by AA1.
  • the keys are previously calculated and hard coded in the EKGM.
  • the corresponding key pair on the EKGM Server are referred to as P1 and K2
  • a symmetric algorithm such as a Diffie-Hellman (DH) key agreement algorithm. It is referenced as AS1.
  • the key generated by AS 1 is KS1.
  • the parameter used to generate KS1 at the server side is KSS1 and the parameter used to generate KS1 at the client side is B
  • the PEM entity is a modification of the EKGM entity without the KGP algorithm.
  • the PEM entity will obtain the common key directly from the Senta Prime Server 603.
  • the PEM entity can be used on one side of the encrypted communications channels between devices 604 and 605.
  • the authenticator is the component that handles the machine authentication. Briefly, the authenticator extracts previously defined information from the file system of the device 604 or 605. Some of the defined information is fixed, for example, the Windows directory date, some information is dynamic following a defined rule, some information is dynamic within following a rule and other information is generic.
  • the authenticator is also preferably obfuscated following the same rules as for EKGM Avatar obfuscation.
  • a new EKG Avatar and Player component shall be generated.
  • the Avatar and Player may be integrated or coupled.
  • the Avatar may then establish a secure communications channel and feed decrypted data to the Player.
  • a separate server 602 which provides a repository 700 of EKGM Clients and EKGM Servers.
  • EKGM Clients are served by requests by Clients 701 under a typical Client-Server connection 702.
  • the Optional Encryption Module Repository (or OEMR) 602 also includes a database mapping EKGM Clients to corresponding EKGM Servers.
  • the database may provide a mapping between EKGMJDs.
  • EKGM Clients are replaced on devices with different EKGM Clients periodically or driven by an internal/external event. The time period or events can be defined based on the level of security required. There may be more devices then there are EKGM Avatars, in which some devices will have the same Avatars.
  • the OEMR may not be a repository as such, but may in fact be a generator of the encryption components.
  • the Senta Prime Server 603 is a server (preferably a web server such an HTTP server) that includes the following features: • Interacts with OEMR Server 602 to obtain EKGM Servers corresponding to the EKGM Clients of devices 604, 605 with which it is communicating
  • each EKGM Server includes a mapping function, mapping EKGM Client obfuscated calls to actual functions on the Senta Prime Server 603.
  • a EKGM Client is generated or selected at the OEMR Server 602 and downloaded by an application at a client device 604 or 605.
  • the EKGM may be generated on the client without the need to be downloaded from the Senta server.
  • the EKGM Client may be replaced periodically with a different EKGM Client.
  • the OEMR Server 602 can replace the EKGM Client via pushing the module to the device, or the device may pull the module.
  • another service such as a web service, or video service
  • R1 , W1 and KSS1 variables are generated by the EKG Client at the Client Device 604 or 605.
  • the modified/secondary encryption logic is used in the above steps, and the modified/secondary encryption module is created first to establish communication channel, and the encryption module is initialised afterwards.
  • a communication channel is established between the Client Device 800 and the Senta Prime Server 801 to enable the Senta Prime Server 801 to communicate with the Client Device 800 securely to generate a common encryption key.
  • a message is created formed of a time stamp + KSS1 + W1 + a control string (a control string is a value known to both device and server to verify the integrity of the message).
  • the message is encrypted using K1 and then with P2 using AA1.
  • the Client Device 800 transmits the message to the Senta Prime Server 801.
  • the Senta Prime Server 801 generates the encryption module, or alternatively retrieves the corresponding encryption module from the repository OE R Server if used.
  • the Senta Prime Server 801 uses the corresponding AA1 in the EKGM Server 803 to decrypt the data using K2 and P1. g) The Senta Prime Server 801 checks the time stamp and the control string to validate the message. For example, if the time stamp is outside a predefined period then the message may be treated as invalid.
  • the Senta Prime Server 801 calculates KS1 and the parameter B using AS1.
  • the Senta Prime Server 801 stores W1.
  • the Senta Prime Server 801 generates a unique connection session ID, SessionJD.
  • the Senta Prime Server 801 creates a message formed from time stamp + B + SessionJD + control string.
  • the message is encrypted with K2, then with P1.
  • the encrypted message 900 is transmitted back to the client device 800.
  • the EKGM Client decrypts the message and verifies it, then calculates KS1 using B sent from the Senta Prime Server 801.
  • the Client Device 800 stores SessionJD.
  • a common key is generated between the Senta Prime Server and the Client Device to facilitate future secure transmissions between the Client Device and a second device.
  • the common key generation process is
  • KGP protocol uses principles inspired by Quantum Cryptography to create a common key whilst reducing the risk of a security attack on the Senta Prime Server.
  • polarizer sequences are combined with an input sequence using a bitwise process that XORs each corresponding bits of the sequences. Therefore, the polarizer sequence will be understood to mean that a bit of 0 in the polarizer sequence will keep the bit of the input sequence and a bit of 1 in the polarizer sequence will inverse the bit of the input sequence.
  • EKGM Client At the Client Device, EKGM Client generates a random (or, alternatively, a pseudo-random) sequence of bits 0s and 1s called KEY 1000.
  • KEY 1000 may be hard coded within the EKGM Avatar.
  • KEY 1000 is XOR'ed with POL1 1001 and stored in RES1 1002.
  • EKGM Client encrypts the following message time stamp + RES1 +control string with KS1. Session a l D is added to the encrypted message.
  • the Senta Prime Server retrieves the EKGM Server corresponding to the EKGM Client using the SessionJD.
  • the Senta Prime Server using the logic within the related EKGM Server decrypts the encrypted message with the key KS1. The timestamp and control string are checked for validity. h) The Senta Prime Server generates a randomly sequence of polarizers, POL2 1004.
  • the Senta Prime Server forms a message from time stamp + POL2.
  • the message is encrypted with W1 , then KS1, and is then transmitted 1006 to the EKGM Client at the Client Device.
  • the EKGM Client decrypts the package with the corresponding keys. To decrypt W1 , it uses R1. The timestamp is checked for validity.
  • POL3 1007 is compared with RES1 1002 and POL2 1004. For each bit 'V in POL3 1007, AND operation is applied to the corresponding bit in RES1 and POL2, and the result is stored in RES4 1008.
  • step (m) case the count on step (m) is less then 32 a message is sent to the server, encrypted with KS1. Then the server must repeat the steps (h) to (m) until either 32 is reached or if steps are repeated more than three times.
  • the KEY_KGP will be set to KEY_DEFAULT common to both EKGM Client and EKGM Server.
  • both Senta Prime Server and the Client Device have a common encrypted key (KEY_KGP).
  • the common key is preferably used as the base for another encryption key or can be used to encrypt transmissions between the Client Device and the Senta Prime Server.
  • a second device is provided with the common key by the Senta Prime Server over a secure channel between the Senta Prime Server and the second device, and the Client Device can encrypt transmissions for reception by the second device. 5.
  • the common key can be used to generate a longer key.
  • the requirement for a longer key might be dictated by the encryption algorithm requiring the key.
  • the generation process might utilise a numeric transformation to expand the key or, alternatively, the process of generating the common key may be repeated several times to construct a final encryption key comprised of several KEY_KGPs.
  • the encryption algorithm is preferably a bitwise algorithm. The requirements of the system will dictate the speed and encryption strength of the encrypt/decrypt functions of the algorithm - for example, lightweight functions for video streaming, lightweight functions for mobile encryption, and high security functions for military-grade security.
  • the encryption algorithm is the bitwise symmetric encryption algorithm defined within the EKGM Avatar.
  • the method provides for the ability to ensure that the two devices can coordinate the encryption key and can replace the encryption key at any time.
  • protected communication is possible only between devices over HTTP protocol with Senta Server as a trusted party.
  • the server has to be connected to Senta Server first and authenticated on it:
  • Server generates REMA encryption component using generated on step 2 common encryption key for further protected communication with Senta Server.
  • Server authenticates on Senta Server using Peerld (unique value for Peer identification) and password. This done to restrict access to Senta Server. Only peers with Peerld that stored on Senta Server can connect to Senta Server.
  • Peerld unique value for Peer identification
  • Server is available to accept connections.
  • Client send request to open session to defined Peerld to Senta Server using encryption component.
  • Senta Server generates session and stores it.
  • Senta Server generates common encryption key (CEK) using random algorithm.
  • Senta Server sends sessionjd and CEK to Client
  • Client receives CEK, generates encryption component with REMA using CEK and associates this component with sessionjd. This Component will be used to communicate with Server.
  • Server requests Senta Server for generated with Client CEK with sessionjd using its encryption component.
  • Evolving Digital Signature (EDS) Authentication Authenticator
  • the Authenticator is an optional component of the Senta system 600.
  • An Authenticator Client 1300 gathers data from the machine (the machine may exist on a user device such as a mobile smartphone or a computer) and will is separate to the EKGM Client.
  • An Authenticator Server 1301 sits on the Senta Prime Server 603 and analyses the data provided by the Authenticator Client 1300.
  • the Authenticator Server 1301 may use a Neural Network or similar system to analyse the provided data.
  • a Neural Network or similar system for example, one possible Neural Network-type system made by Numenta IncTM utilises a Neural Network-type system modelled on the human cortex.
  • An example authentication process operates in accordance with the following steps:
  • the Authenticator Client 1300 detects the operating system that the machine is executing.
  • the machine may be a virtual or real machine.
  • the Authenticator Client 1300 has access to the file system 1302 of the operating system.
  • the file system includes information about the files and folders stored on in machine. Such information includes the name of the file/folder, the date of modification and creation date of the file/folder. For simplicity, in the remainder of this description, this information (the tuple ⁇ filename, date of modification/creation) will be referred to as a file.
  • Predictability of the file The last creation (or modification) date of the file is compared with the creation (or modification) date stored in the system for the file being analyzed. For each match, the file is given a value 1 , no match, zero. A mean of all values is calculated by using the data gathered on the last n periods of time. The number of n is predefined. The calculation process is given in step 11 below.
  • the length of the file and/or the value of a specific byte is the length of the file and/or the value of a specific byte
  • MAC Hard Drive ID
  • CPU ID CPU ID
  • any other hardware coding markers can also be considered part of Low Risk Group and can be used in risk analysis.
  • Client fetches all available folders to store data there (3 level depth) and sends them to Senta Server.
  • Senta Server stores available folders.
  • Client collect information about available markers (32 files) and sends random 8 markers to Senta Server.
  • Senta Server sends file system questions to client (8 existing evolutionary files, 8 not existing evolutionary files and 5 not existing folders).
  • Client collect information from files system according to asked questions and send results.
  • Senta Server if more than 3 existing evolutionary files not the sane as in knowledge base than treat as enroll. If at least 1 not existing evolutionary file or not existing folder exists on device - treat as enroll.
  • Senta Server sends stamping instructions: delete 8 markers used for authentication; create new 8 markers with another location; delete 5-8 evolutionary files; create new 5-8 evolutionary files.
  • Senta Server sends learning instructions: 4 existing folders to learn structure (3-level depth)
  • the system can flag the collision.
  • Marker files are created on the machine, and known only to the Authenticator Server 1301. The position and names of the files are stored in the Knowledge Base 1304. From time to time, new markers are created and the old markers are deprecated by the Knowledge Base 304. The "collision" machine and the other machine with the newer file will hereafter be considered a "clone".
  • a search for the markers will be performed before the authentication process to establish which machine is being communicated with. Both the cloned machine and newer machine may be marked by the markers. Each one will have a different set of markers.
  • C(g) is the parameter related to each Risk Group from item 4 above, calculated as follows:
  • the Senta system 600 can delist the machine, in this case, the machinewill be considered a 'collision'. Their files will be considered as such, and the markers will still stand.
  • the Senta system 600 may be used to secure movie, music, or other media downloads.
  • the Senta system 600 may be used to secure financial transactions.
  • the Senta system 600 may be used to set up a gatekeeper system to manage access to a network or computer in a secure fashion. Referring to Figure 14, a possible implementation of the Senta system 600 will be described.
  • a mobile telecommunications core infrastructure 1400 includes Followers 1 01 such as the PEM entity or EKG Avatars.
  • the followers 1401 may be used to generate a secure communications channel 1402 with mobile devices 1403 on the telecommunications network.
  • the mobile devices 1403 will include Masters 1404 such as a EKGM Avatar.
  • the Senta and OEMR Servers may be deployed by the mobile telecommunications carrier or may be available to the mobile devices 1403 and infrastructure 1400 through a connected network such as through the Internet.
  • a potential advantage of deploying Followers within the core infrastructure is that, if desired, a backdoor to the secure communications channel can be installed by the mobile telecommunications carrier for internal monitoring purposes or at the instigation of a government.
  • the present invention may be implemented as software executing on computer hardware or within hardware itself.
  • the applicant hereby discloses in isolation each individual feature or step described herein and any combination of two or more such features, to the extent that such features or steps or combinations of features and/or steps are capable of being carried out based on the present specification as a whole in the light of the common general knowledge of a person skilled in the art, irrespective of whether such features or steps or combinations of features and/or steps solve any problems disclosed herein, and without limitation to the scope of the claims.
  • the applicant indicates that aspects of the present invention may consist of any such individual feature or step or combination of features and/or steps.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Computer And Data Communications (AREA)

Abstract

La présente invention se rapporte à un système de cryptographie. Ce système comprend un procédé impliquant des modules de chiffrement remplaçables, un procédé permettant de générer une clé commune à un dispositif et un serveur, et un procédé d'utilisation d'un serveur destiné à faciliter la création d'un canal de communications chiffré entre deux dispositifs. Un système servant à authentifier des dispositifs à l'aide de la mise en correspondance d'informations évolutives d'un dispositif est également décrit.
PCT/GB2012/000675 2012-08-21 2012-08-21 Système de cryptographie WO2014029951A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/GB2012/000675 WO2014029951A1 (fr) 2012-08-21 2012-08-21 Système de cryptographie

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/GB2012/000675 WO2014029951A1 (fr) 2012-08-21 2012-08-21 Système de cryptographie

Publications (1)

Publication Number Publication Date
WO2014029951A1 true WO2014029951A1 (fr) 2014-02-27

Family

ID=46970353

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/GB2012/000675 WO2014029951A1 (fr) 2012-08-21 2012-08-21 Système de cryptographie

Country Status (1)

Country Link
WO (1) WO2014029951A1 (fr)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017053577A1 (fr) * 2015-09-25 2017-03-30 Mcafee Inc. Authentification à distance et réinitialisation de mot de passe sans mot de passe
CN112016058A (zh) * 2020-08-28 2020-12-01 上海宝通汎球电子有限公司 一种基于协同验证的软件保护机制及数据交换方法
TWI787974B (zh) * 2020-11-27 2022-12-21 中國銀聯股份有限公司 動態金鑰生成方法和系統

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020064283A1 (en) * 2000-11-27 2002-05-30 Parenty Consulting, Llc Method and system for object encryption using transparent key management
US20090077388A1 (en) * 2007-09-19 2009-03-19 Fuji Xerox Co., Ltd. Information processing apparatus and computer readable medium
US20100281270A1 (en) * 2007-09-28 2010-11-04 Shingo Miyazaki Cryptographic module selecting device and program

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020064283A1 (en) * 2000-11-27 2002-05-30 Parenty Consulting, Llc Method and system for object encryption using transparent key management
US20090077388A1 (en) * 2007-09-19 2009-03-19 Fuji Xerox Co., Ltd. Information processing apparatus and computer readable medium
US20100281270A1 (en) * 2007-09-28 2010-11-04 Shingo Miyazaki Cryptographic module selecting device and program

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017053577A1 (fr) * 2015-09-25 2017-03-30 Mcafee Inc. Authentification à distance et réinitialisation de mot de passe sans mot de passe
US10454900B2 (en) 2015-09-25 2019-10-22 Mcafee, Llc Remote authentication and passwordless password reset
US11962574B2 (en) 2015-09-25 2024-04-16 Mcafee, Llc Remote authentication and passwordless password reset
CN112016058A (zh) * 2020-08-28 2020-12-01 上海宝通汎球电子有限公司 一种基于协同验证的软件保护机制及数据交换方法
CN112016058B (zh) * 2020-08-28 2023-12-22 上海宝通汎球电子有限公司 一种基于协同验证的软件保护机制及数据交换方法
TWI787974B (zh) * 2020-11-27 2022-12-21 中國銀聯股份有限公司 動態金鑰生成方法和系統

Similar Documents

Publication Publication Date Title
CN109150519B (zh) 基于公共密钥池的抗量子计算云存储安全控制方法和系统
Kaaniche et al. A secure client side deduplication scheme in cloud storage environments
CN109600226B (zh) 基于随机数隐式协商的tls协议会话密钥还原方法
US20170244687A1 (en) Techniques for confidential delivery of random data over a network
US8396218B2 (en) Cryptographic module distribution system, apparatus, and program
US20130227286A1 (en) Dynamic Identity Verification and Authentication, Dynamic Distributed Key Infrastructures, Dynamic Distributed Key Systems and Method for Identity Management, Authentication Servers, Data Security and Preventing Man-in-the-Middle Attacks, Side Channel Attacks, Botnet Attacks, and Credit Card and Financial Transaction Fraud, Mitigating Biometric False Positives and False Negatives, and Controlling Life of Accessible Data in the Cloud
Akhil et al. Enhanced cloud data security using AES algorithm
JP2009529832A (ja) 発見不可能、即ち、ブラック・データを使用するセキュアなデータ通信
CN106789997B (zh) 一种防重放攻击的加密方法
US11588627B2 (en) Systems and methods for utilizing quantum entropy in single packet authorization for secure network connections
CN110971411B (zh) 一种基于sotp技术对私钥乘加密的sm2同态签名方法
CN108809633B (zh) 一种身份认证的方法、装置及系统
Maitra et al. An enhanced multi‐server authentication protocol using password and smart‐card: cryptanalysis and design
US20220069995A1 (en) System and method for securing data
KR102656403B1 (ko) 보안 통신에 사용하기 위한 키 생성
CN106941404A (zh) 密钥保护方法及装置
Ristić Bulletproof SSL and TLS
GB2488753A (en) Encrypted communication
Sarvabhatla et al. A secure and light weight authentication service in hadoop using one time pad
Huang et al. A secure communication over wireless environments by using a data connection core
Shin et al. A Survey of Public Provable Data Possession Schemes with Batch Verification in Cloud Storage.
CN111740995B (zh) 一种授权认证方法及相关装置
WO2014029951A1 (fr) Système de cryptographie
CN114765543A (zh) 一种量子密码网络扩展设备的加密通信方法及系统
Alsalami et al. Utilizing public blockchains for censorship-circumvention and IoT communication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12768874

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 29.05.15)

122 Ep: pct application non-entry in european phase

Ref document number: 12768874

Country of ref document: EP

Kind code of ref document: A1