# US 10,484,365 B2 · Space-time separated and jointly evolving relationship-based network access and data protection system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,365 B2
- Document ID: US10484365B2
- Status: Granted
- Kind: B2
- Application number: 16/133,173
- Filed: 2018-09-17
- Published: 2019-04-04
- Granted: 2019-11-19
- Earliest claimed: 2013-09-17
- Assignees: Auburn University
- Applicants: Auburn University
- Inventors: Chwan-Hwa Wu; J. David Irwin; David Charles Last; Myers Hawkins; Hao Sun
- Web page: https://patentgrep.com/patent/US10484365B2

## CPC

- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- H04L 9/0656: {Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 63/0838: {using one-time-passwords}
- H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords}
- H04L 63/10: {for controlling access to devices or network resources}
- G06F 2221/2107: File encryption
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 2209/606: Traitor tracing
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A network security system that employs space-time separated and jointly-evolving relationships to provide fast network access control, efficient real-time forensics capabilities, and enhanced protection for at-rest data in the event of a network breach. The network security system allows, in part, functionality by which the system accepts a request by a user to access the data stored in the database, identifies a sequence of security agents to participate in authenticating and protecting the access of the data by the user, generates a sequence of pseudorandom IDs and space-time varying credentials, checks at each one of the security agents a corresponding one of the credentials, determines that the user is permitted to access the data using access control logs if all the security agents accept the corresponding credentials, and varies the credentials based on a space-time relationship.

## Claims

### Claim 1

A system for protecting a data file stored in a cloud based storage system, comprising:
computer-executable software code stored on one or more non-transitory data storage devices for:
authenticating a synchronous password received by a plurality of computing devices, a first portion of the synchronous password being received by one of the plurality of computing devices, and a second portion of the synchronous password being received by another of the plurality of computing devices;
encrypting a selected data file using a key determined through the use of a space-time jointly evolving function generated by one of the plurality of computing devices;
splitting the selected data file into a plurality of file fragments;
storing each of the plurality of file fragments in a random location on the plurality of computing devices; and
generating an index file that includes a file storage path for each file fragment and a security key for each file fragment, the index file configured to be used to merge the plurality of file fragments into the selected data file.

### Claim 2 (depends on 1)

The system of claim 1, further comprising:
computer-executable software code stored on one or more non-transitory data storage devices for:
encrypting the index file using a second key determined through the use of a second space-time jointly evolving function generated by one of the plurality of computing devices based on the state of each of the plurality of computing devices;
splitting the index file into a plurality of index file fragments, wherein a size of each index file fragment is randomly determined; and
storing each of the plurality of index file fragments in a separate location on the plurality of computing devices of the system.

### Claim 3 (depends on 2)

The system of claim 2, wherein the plurality of file fragments and the plurality of index file fragments are stored at random locations in a cloud based storage system to avoid side channel attacks to the selected data file and the index file.

### Claim 4 (depends on 1)

The system of claim 1, wherein one of the plurality of computing devices of the system is a smartphone, a smartcard, a token, a Trusted Platform Module (TPM), or a USB-based flash drive device.

### Claim 5 (depends on 1)

The system of claim 1, wherein:
the synchronous password comprises an ordered combination of a plurality of symbols, and
the first portion of the synchronous password includes a first subset of symbols of the plurality of symbols and the second portion of the synchronous password includes a second subset of symbols of the plurality of symbols, the second subset of symbols being different than the first subset of symbols.

### Claim 6 (depends on 5)

The system of claim 5, wherein the first subset of symbols includes every other symbol of the plurality of symbols and the second subset of symbols includes the remaining symbols of the plurality of symbols.

### Claim 7 (depends on 6)

The system of claim 6, further comprising: computer-executable software code stored on one or more non-transitory data storage devices for receiving the plurality of symbols of the synchronous password by the plurality of computing devices in the ordered combination of the synchronous password.

### Claim 8 (depends on 1)

The system of claim 1, wherein the space-time jointly evolving function is generated based on the state of the plurality of computing devices of the system.

### Claim 9 (depends on 1)

The system of claim 1, further comprising computer-executable software code stored on one or more non-transitory data storage devices for generating a transformed synchronous password by mapping the synchronous password to a random number based on the state of the plurality of computing devices.

### Claim 10 (depends on 1)

The system of claim 1, further comprising computer-executable software code stored on one or more non-transitory data storage devices for binding each of the plurality of file fragments using a public key generated by a Trusted Platform Module using internal states of the plurality of computing devices.

### Claim 11 (depends on 1)

The system of claim 1, further comprising computer-executable software code stored on one or more non-transitory data storage devices for generating a random function seeded using the state of each of the plurality of computing devices, and wherein the steps of splitting the selected data file, storing each of the plurality of file fragments, and generating the index file are performed using the random function.

### Claim 12 (depends on 1)

The system of claim 1, wherein the plurality of computing devices are spatially separated computing devices.

### Claim 13 (depends on 1)

The system of claim 1, wherein:
the system is configured to prevent any one of the plurality of computing devices from having possession of the synchronous password or from deriving the synchronous password based on an authentication function used to authenticate the synchronous password; and
the system is configured to prevent interception or derivation of the synchronous password by attackers.