US 9,317,703 B2 · Enhanced security setup for media encryption

Abstract

Systems and methods for enhanced security of media are provided. Media security may be enhanced by improving the setup of encryption and/or decryption, by improving the performance of encryption and/or decryption, or by improving both. The calls related to enhanced security of media from an application in an emulated environment to a security module in the operating system hosting the emulated environment may be combined to reduce the overhead of accessing a security module. An application handling secure shell (SSH) communications may execute multiple calls to a cryptographic module in the host operating system. Because many calls to the cryptographic module during SSH communications follow patterns, two or more related calls may be combined into a single combined call to the cryptographic module. For example, a call to generate a server-to-client key and a call to generate a client-to-server key may be combined into a single call.

Claims20

Dependent claims

A method for setting up secure media encryption in one call, comprising:

providing an interface for an application executing in an emulated environment of a host operating system, in which the application accesses a security module in the host operating system through calls to the interface;
identifying two or more related calls, from the application to the module, for setting up secure media encryption, the two or more related calls comprising at least one of:
a call to create a cryptography context;
a call to randomly generate an encryption key;
a call to compute a hash subkey;
a call to store the computed hash subkey in the cryptography context;
a call to compute an initialization vector;
and
a call to create a cipher instance, in which a cipher instance initialization vector is initialized to the computed initialization vector;
combining the two or more related calls into a single call;
and
executing the single combined call to the module of the host operating system to perform the two or more related calls.

9 more elements

A computer program product for setting up secure media encryption in one call, comprising:

a non-transitory computer-readable medium comprising:
code to provide an interface for an application executing in an emulated environment of a host operating system, in which the application accesses a security module in the host operating system through calls to the interface;
code to identify two or more related calls, from the application to the module, for setting up secure media encryption, the two or more related calls comprising at least two of:
a call to create a cryptography context;
a call to randomly generate an encryption key;
a call to compute a hash subkey;
a call to store the computed hash subkey in the cryptography context;
a call to compute an initialization vector;
and
a call to create a cipher instance, in which a cipher instance initialization vector is initialized to the computed initialization vector;
code to combine the two or more related calls into a single call;
and
code to execute the single combined call to the module of the host operating system to perform the two or more related calls.

10 more elements

An apparatus for setting up secure media encryption in one call, comprising:

a processor;
and
a memory coupled to the processor, in which the processor is configured:
to provide an interface for an application executing in an emulated environment of a host operating system, in which the application accesses a security module in the host operating system through calls to the interface;
to identify two or more related calls, from the application to the module, for setting up secure media encryption, the two or more related calls comprising at least one of:
a call to create a cryptography context;
a call to randomly generate an encryption key;
a call to compute a hash subkey;
a call to store the computed hash subkey in the cryptography context;
a call to compute an initialization vector;
a call to create a cipher instance, in which a cipher instance initialization vector is initialized to the computed initialization vector;
and
a call to choose a machine key from a plurality of machine keys;
to combine the two or more related calls into a single call;
and
to execute the single combined call to the module of the host operating system to perform the two or more related calls.

13 more elements

Dependencies are inferred from the claim text.

Enhanced security setup for media encryption

Life of this patent

Enhanced security setup for media encryption

Life of this patent

Abstract

Claims20