System and method for securely encrypting data
OwnerArnold G. Reinholdinventor
Life of this patent
Estimating the term…
Abstract
A system for encryption includes a message management module (MMM); a restricted secret server (RSS) including a restricted secret server network interface (RSS-NI) connected to the MMM and including at least one very large key (VLK) module. The system uses Terakey™ an encryption system whose intrinsic security can be demonstrated from first principles, without making assumptions about the computational difficulty of mathematical problems, such as factoring large integers or computing logarithms in finite groups. It employs a key that is much larger than the anticipated volume of message traffic. The large size of the key also reduces the risk of side channel attacks and facilitates realistic security measures to maintain a secure chain of custody for the key.
Claims19
A system for encryption comprising:
- a message management module (MMM);
- a restricted secret server (RSS) including a restricted secret server network interface (RSS-NI) connected to the MMM and including at least one very large key (VLK) module;
- a Data Guard disposed between the RSS-NI and the at least one VLK module;
- and
- wherein the Data Guard is configured to restrict and sanitize request data by enforcing message formats and restricting a transfer rate of very large key (VLK) data.
A method for encrypting data comprising:
- receiving a first message on at least one message management module (MMM);
- securely sending the first message to a restricted secret server (RSS) having a very large key (VLK) module;
- using a deterministic random number generator (DRNG) on the RSS;
- seeding the DRNG with a seed;
- using the seeded DRNG to select multiple subsets of data from a block of unpredictable data;
- combining the multiple subsets of data from the block of unpredictable data to form a key stream;
- and
- using a reversible operation to combine the key stream with a portion of the first message to create a second message;
- securely sending the second message to the at least one MMM, wherein securely sending a return message comprises:
- sending the return message from the restricted secret server via a second dedicated link to the at least one Data Guard;
- authenticating the second message on the at least one Data Guard;
- and
- forwarding the second message via a secure, authenticated link to the at least one MMM;
- and
- wherein only the at least one MMM can query the RSS using a secure link within one of:
- a data center's intranet to access the RSS;
- and
- a direct communication link between the at least one MMM and the RSS.
Dependencies are inferred from the claim text.