# US 10,320,561 B2 · Method for providing encrypted information and encrypting entity

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,561 B2
- Document ID: US10320561B2
- Status: Granted
- Kind: B2
- Application number: 15/501,178
- Filed: 2014-11-04
- Published: 2017-10-26
- Granted: 2019-06-11
- Earliest claimed: 2014-11-04
- Assignees: NEC Corporation
- Applicants: NEC Europe Ltd.
- Inventors: Ghassan Karame; Felix Klaedtke
- Web page: https://patentgrep.com/patent/US10320561B2

## CPC

- H04L 9/0847: {involving identity based encryption [IBE] schemes}
- G06F 21/60: Protecting data
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- H04L 2209/08: Randomization, e.g. dummy operations or using noise
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method for providing encrypted information by an information entity to one or more operating entities, the information entity having a database for storing encrypted information and the one or more operating entities being configured to operate on the encrypted information, wherein the encrypted information is stored encrypted with an encryption key known to the one or more operating entities includes performing, by an operating entity, a request on the encrypted information, wherein plaintext information to be stored encrypted is provided in tuples, each having ID information, one or more fields with field information specifying the fields, and values, wherein at least the values are encrypted with non-deterministic order preserving encryption with at least one encryption key such that each plaintext value is encrypted into a set of encrypted values, and wherein the set of encrypted values is partitioned into a left set and a right set.

## Claims

### Claim 1

A method for a first operating entity of one or more operating entities of a software-defined network (SDN) to configure or reconfigure a first network device of one or more network devices of the SDN, the method comprising:
providing, by the one or more network devices, tuples of plaintext information, wherein each tuple comprises identification (ID) information, one or more fields, field information specifying the one or more fields, and values;
encrypting, by the one or more network devices, at least the values of the tuples of plaintext information via non-deterministic order preserving encryption using at least one encryption key such that each plaintext value is encrypted into a respective set of encrypted values, wherein each respective set of encrypted values is portioned into a left set and a right set with each element in the left set being smaller than each element in the right set;
storing, by the one or more network devices, the encrypted values by storing at least one of the left set or the right set for each respective set of encrypted values; and
receiving, by the one or more network devices, from the first operating entity, a request relating to the encrypted information, wherein the request includes configuration or reconfiguration of the first network device by modifying a flow table of the first network device.

### Claim 2 (depends on 1)

The method according to claim 1, wherein encrypting at least the values of the tuples of the plaintext information further comprises:
encrypting the field information.

### Claim 3 (depends on 1)

The method according to claim 1, wherein storing the encrypted values by storing at least one of the left set or the right set for each respective set of encrypted values further comprises:
storing both the left set and the right set for each respective set of encrypted values.

### Claim 4 (depends on 1)

The method according to claim 1, wherein for a first set of encrypted values, a left boundary and a right boundary of the left set are stored in different fields of the tuple corresponding to the first set of encrypted values, and/or a left boundary and a right boundary of the right set are stored in different fields of the tuple corresponding to the first set of encrypted values.

### Claim 5 (depends on 1)

The method according to claim 1, further comprising:
checking plausibility of the request, wherein one or more policies are also stored encrypted and used for defining plausibility.

### Claim 6 (depends on 1)

The method according to claim 1, wherein encrypting at least the values of the tuples of plaintext information further comprises:
encrypting different fields of the one or more fields of a first tuple using different encryption keys.

### Claim 7 (depends on 1)

The method according to claim 1, wherein encrypting at least the values of the tuples of plaintext information further comprises:
introducing dummy fields and/or dummy values.

### Claim 8 (depends on 7)

The method according to claim 7, wherein the dummy fields and/or the dummy values are randomly chosen and comprise a dummy indication mark.

### Claim 9 (depends on 1)

The method according to claim 1, wherein encrypting at least the values of the tuples of plaintext information further comprises:
encrypting each value multiple times using a different encryption key each time.

### Claim 10 (depends on 9)

The method according to claim 9, wherein the encryption keys are generated using a one way cryptographic function on a pre-shared common encryption key and epoch information in the form of a counter specifying the epoch when an operating entity switches to another encryption key or encryption key set.

### Claim 11 (depends on 1)

The method according to claim 1, further comprising:
processing the request so as to generate a result; and
generating a configuration allowance token for the first operating entity based on the result to allow configuration or reconfiguration of the first network device.

### Claim 12 (depends on 11)

The method according to claim 11, wherein the configuration or reconfiguration of the first network device is based on rules for configuring or reconfiguring the one or more network devices.

### Claim 13 (depends on 11)

The method according to claim 11, wherein the configuration allowance token is a cryptographic timestamped token configured to mutually authenticate the first operating entity and the first network device.

### Claim 14 (depends on 1)

The method according to claim 1, further comprising:
performing a smaller-than operation or a smaller-than-or-equal-to operation on the encrypted information by comparing a first left set element with a first right set element.

### Claim 15 (depends on 1)

The method according to claim 1, wherein the left set is provided in the form of a left interval and right interval, and/or the right set is provided in the form of a left interval and right interval.

### Claim 16 (depends on 1)

The encrypting entity according to claim 1, wherein the left set is provided in the form of a left interval and right interval, and/or the right set is provided in the form of a left interval and right interval.

### Claim 17 (depends on 1)

The method according to claim 1, wherein encrypting at least the values of the tuples of plaintext information further comprises:
encrypting boundaries of the left set of a first set of encrypted values using different encryption keys, and/or encrypting boundaries of the right set of the first set of encrypted values using different encryption keys.

### Claim 18

A system comprising one or more network devices of a software-defined network (SDN), wherein the one or more network devices comprise one or more processors and one or more non-transitory computer-readable mediums having processor-executable instructions stored thereon, wherein the processor-executable instructions, when executed, facilitate:
providing tuples of plaintext information, wherein each tuple comprises identification (ID) information, one or more fields, field information specifying the one or more fields, and values;
encrypting at least the values of the tuples of plaintext information via non-deterministic order preserving encryption using at least one encryption key such that each plaintext value is encrypted into a respective set of encrypted values, wherein each respective set of encrypted values is portioned into a left set and a right set with each element in the left set being smaller than each element in the right set;
storing the encrypted values by storing at least one of the left set or the right set for each respective set of encrypted values; and
receiving, from a first operating entity of the SDN, a request relating to the encrypted information, wherein the request includes configuration or reconfiguration of a first network device by modifying a flow table of the first network device.