U.S. patent application number 14/322481 was filed with the patent office on 2015-05-14 for method of and system for encryption and authentication.
The applicant listed for this patent is Traverse A. Davies, SR., Jordan Bruce MacLeod. Invention is credited to Traverse A. Davies, SR., Jordan Bruce MacLeod.
Application Number | 20150135301 14/322481 |
Document ID | / |
Family ID | 37498089 |
Filed Date | 2015-05-14 |
United States Patent
Application |
20150135301 |
Kind Code |
A1 |
Davies, SR.; Traverse A. ;
et al. |
May 14, 2015 |
METHOD OF AND SYSTEM FOR ENCRYPTION AND AUTHENTICATION
Abstract
The invention provides a method of and system for networked
security, involving multiple clients and servers. Rather than
relying on single server based authentication and/or single stream
based data transmission, the invention breaks apart information
before if leaves the User's computer so that intercepting any
single electronic message does not provide the hacker with
sufficient information to gain access. The invention splits the
values (i.e. password, User name, card number for authorization;
encrypted text for encryption, etc.) at the point of
sender/external authorization client. These split values are
encrypted with different keys and transmitted to multiple external
authorization servers. The invention can be applied to any secure
transmission, storage or authentication of data over a data
network.
Inventors: |
Davies, SR.; Traverse A.;
(Halifax, CA) ; MacLeod; Jordan Bruce; (Halifax,
CA) |
|
Applicant: |
Name |
City |
State |
Country |
Type |
Davies, SR.; Traverse A.
MacLeod; Jordan Bruce |
Halifax
Halifax |
|
CA
CA |
|
|
Family ID: |
37498089 |
Appl. No.: |
14/322481 |
Filed: |
July 2, 2014 |
Related U.S. Patent Documents
|
|
|
|
|
|
Application
Number |
Filing Date |
Patent Number |
|
|
11917136 |
Mar 21, 2008 |
8775792 |
|
|
PCT/CA2006/000958 |
Jun 9, 2006 |
|
|
|
14322481 |
|
|
|
|
60689102 |
Jun 10, 2005 |
|
|
|
Current U.S.
Class: |
726/12 |
Current CPC
Class: |
H04L 63/083 20130101;
H04L 9/3226 20130101; H04L 63/18 20130101; H04L 2209/80 20130101;
H04L 63/02 20130101; H04L 9/3215 20130101; H04L 63/08 20130101;
H04L 2209/56 20130101 |
Class at
Publication: |
726/12 |
International
Class: |
H04L 29/06 20060101
H04L029/06 |
Claims
1.-24. (canceled)
25. A method of secured communication over a networked system
comprising: a first party: splitting a secure message into two or
more separate messages, each separate message including at least
some unique portion of said secure data message, said two or more
separate messages collectively preserving information contained in
said secure message; and transmitting each of said two or more
separate messages to a separate gatekeeper; each of said separate
gatekeepers: receiving a respective one of said separate messages;
receiving a partial data set from a second party; securely
processing said separate message by comparing the one of said
separate messages to the partial data set; generating a pass code
responsive to the comparison; and transmitting said processed
separate message and the pass code to the second party; said second
party: receiving said processed separate messages and the pass code
from each of said separate gatekeepers; and re-assembling said
processed, separate messages.
26. The method of claim 25 wherein said secure message is split
using a partitioning algorithm.
27. The method of claim 26 wherein said partitioning algorithm
comprises at least one of: a sliding algorithm or a non-sliding
algorithm.
28. The method of claim 26 wherein the contents of said two or more
separate messages overlap.
29. The method of claim 26 wherein the contents of said two or more
separate messages do not overlap.
30. The method of claim 25 wherein said secure message comprises a
request for access to data held by said second party.
31. The method of claim 30 wherein said request for access includes
data selected from the group consisting of a Username, a User ID, a
password, a passphrase and a User identifier.
32. The method of claim 25 wherein said first party is selected
from the group consisting of: a personal computer; a cellular
telephone; a personal digital assistant (PDA); a portable music
player; a wireless email device; a portable video player; and other
similar electronic communication device.
33. The method of claim 25 wherein said secure message comprises an
encrypted text message, each separate message being encrypted with
a different key.
34. The method of claim 25 wherein said secure message comprises an
email message.
35. The method of claim 25 wherein said transmitted separate
messages further comprise decoy messages.
36. The method of claim 25 wherein said second party comprises a
secure server.
37. The method of claim 25 wherein said second party comprises a
firewalled server which will only communicate with said separate
gatekeepers.
38. The method of claim 25 wherein said secure message is of a type
selected from the group consisting of: high security documents;
digital media files, including movies and music files; financial
transaction data; authentication codes; any document needing
absolute verifiable sources; live video transmissions, including
corporate digital conferences, CCTV, or subscription and fee based
broadcasts; electronic voting; RFID tags; and transmission of
biometric authentication date.
39. The method of claim 25 wherein said secured communication is
applied to a system selected from the group consisting of:
unencrypted file transmission with enhanced error correction;
automatic protection against server level viruses via checksum
matching; use of multiple routing in protected server to counter
DOS attacks; network authentication for Financial transactions or
Network logons; wireless Data Transmission for Modified WEP
encryption or Multiple broadcast point transmission; secure
networked storage and retrieval of data; use of splitting via
multiple processors in addition to multiple servers; and splitting
via multiple processors applied to a single computer rather than a
network of computers or servers.
40. The method of claim 25 wherein said secure message comprises a
data message to be securely stored, and securely processing
comprises separately protecting and storing each of said two or
more separate messages.
41. The method of claim 30 wherein said second party is an
authentication server and said authentication server responds to a
received request for access being accepted by: generating an
authentication code; splitting up said authentication code into two
or more parts; separately encrypting said two or more parts; and
transmitting said two or more parts to separate gateways who may
forward the encrypted parts to the User so that it may be
re-assembled and decrypted.
42. The method of claim 25 wherein said secure message comprises a
data message being securely store at said first party, said first
party being a storage server, and said second party being a User
retrieving said stored message.
43. A method of authentication comprising: generating
identification data for a User; dividing said identification data
into two or more separate sets; protecting each of said two or more
separate sets; and transmitting each of said two or more separate
protected sets of data to two or more intermediate servers; said
two or more intermediate servers: receiving a partial set of data
from an authentication server; comparing the two or more separate
protects sets of data to the partial set of data; generating a pass
code responsive to the comparison; and forwarding said two or more
separate protected sets of data and the pass code to the
authentication server; said authentication server re-assembling two
or more separate protected sets of data and determining whether
access should be granted to said User.
44. A system for secured communication comprising: a first device
operable to: split a secure message into two or more separate
messages, each separate message including at least some unique
portion of said secure data message, and said two or more separate
messages collectively preserving information contained in said
secure message; and transmit each of said two or more separate
messages to a separate gatekeeper; each of said separate
gatekeepers being operable to: receive a respective one of said
separate messages; receive a partial data set from a second device;
securely process the one of said separate messages by comparing the
one of said separate messages to the partial data set; generate a
pass code responsive to the comparison; and transmit said processed
separate message and the pass code to the second device; said
second device being operable to: receive said processed separate
messages and the pass code from each of said separate gatekeepers;
and re-assemble said processed, separate messages; said first
device, second device and separate gatekeepers being interconnected
via a communication network.
Description
FIELD OF INVENTION
[0001] The present invention relates generally to
telecommunications, and more specifically, to a method of and
system for electronic encryption, authentication and security over
networked systems.
BACKGROUND OF THE INVENTION
[0002] Computer and telecommunications systems are almost pervasive
in the industrialized world today. Many of these systems provide
access to personal and/or commercial data, services and resources
that must be kept secure, limiting access to those individuals and
devices with proper authorization. This is a major challenge.
Unauthorized access is known to occur on a regular basis to some of
the most heavily guarded computer systems and local networks on the
planet, including for example, servers in the Pentagon.
[0003] Almost all existing authorization processes employ a model
wherein Users communicate their access information in the form of
single electronic messages to single servers. An exemplary block
diagram of such a system is shown in FIG. 1.
[0004] In the course of the login process, a prospective User 12
will send a single electronic message containing, for example, a
User ID (identification) and password. This single electronic
message is received by the single server 14 over the network 16
(which may be a local Ethernet, wide area network,
telecommunications network, Internet; wireless, hard wired or fiber
optic network; or any combination of these or similar networks) and
it determines whether the submitted data correlates with a stored,
authorized User ID and hashed password 18. If the User ID and
password are valid then access to the secure resources 20 is
allowed, while if the information is invalid, access is denied.
[0005] This existing authorization process is highly and
increasingly vulnerable to hacking (i.e. unauthorized entry) into
servers that often carry private, valuable and confidential
information. The above process is highly vulnerable because a
hacker 22 (i.e. an individual or computer attempting to obtain
unauthorized entry) is often able to intercept the single
electronic message containing the User's ID and password, and
thereby obtain all necessary information to gain access. Hackers
are also able to trick single servers into believing they are an
authorized User by exploiting known weaknesses or gaining back door
entry.
[0006] Either way, the use of a single electronic message to a
single server has been found to be an insecure method of
authentication and security.
[0007] A similar paradigm is used for encryption, where a single
key or phrase is used to protect a document or dataset. Again, this
is an ineffective method of protection. Keys and phrases that are
too short are easily discovered simply by guesswork. Keys that are
long are generally stored electronically, and thus are vulnerable
to being found or intercepted. Accordingly, the use of a single key
or phrase stored in a single location has also been found to be an
ineffective model for encryption.
[0008] There is therefore a need for a method of and system for
electronic encryption, authentication and security over networked
systems, which addresses the problems outlined above.
SUMMARY OF THE INVENTION
[0009] It is therefore an object of the invention to provide a
method of and system for electronic encryption, authentication and
security over networked systems, which obviates or mitigates at
least one of the disadvantages described above.
[0010] An authorization and encryption process has been developed
that may be described as Multi-Homed Protection (MHP). MHP splits
data values being protected (for example a password, User name,
card number for authorization, encrypted text for encryption, or
other data) at the point of the sender or external authorization
client 30, as shown in the process flow diagram of FIG. 2.
[0011] For authorization processes, these split values are
encrypted with different keys and transmitted to multiple external
authorization servers 32, 34 (two are shown, but many more could be
used). These external authorization servers 32, 34 verify the
username, password, etc. at different servers by comparing
submitted data with stored tables. Each external authorization
server 32, 34 then provides an authorization ID to the protected
authorization server 36. The total of all multiple authorization
IDs are required to match. Provided all IDs match, a validation key
is then returned to each of the issuing external authorization
servers, thus signifying valid authorization.
[0012] This technology introduces and provides an exponential
increase in complexity and security for systemic authorization
processes. Because of the difficulty in intercepting every partial
set of values simultaneously, it carries the potential to minimize
occurrences of hacking to the point where almost all hacking that
occurs is due to human error (for example, the Client leaving his
password written down at his desk, or falling victim to a
"shoulder-surfing" attack by a co-worker).
[0013] Similar to the authorization process, the multi-homed
encryption (MHE) process splits encrypted values at the point of
sending, transmitting each encrypted part to different external
servers. These parts are then relayed to the recipient, where the
whole set of encrypted values is consequently reassembled.
[0014] This technology makes it virtually impossible to intercept
the entire set of transmitted encrypted values/text. Because of the
difficulty in intercepting every partial set of values
simultaneously, this technology results in an exponential
improvement in the degree of protection for the encryption
process.
[0015] One aspect of the invention is defined as a method of
secured communication over a networked system comprising the steps
of: a first party: splitting a secure message into two or more
separate messages, each separate message including at least some
unique portion of the secure data message, and all of the two or
more separate messages collectively preserving all of the
information contained in the secure message; and transmitting each
of the two or more separate messages to a separate gatekeeper. Each
of the separate gatekeepers then receive a respective one of the
separate messages; securely process the separate message, and
transmit the processed separate message to a second party. The
second party receives the processed separate messages from each of
the separate gatekeepers; and re-assembles the processed, separate
messages.
[0016] Another aspect of the invention is defined as a system for
secured communication comprising: a first device operable to: split
a secure message into two or more separate messages, each separate
message including at least some unique portion of the secure data
message, and all of the two or more separate messages collectively
preserving all of the information contained in the secure message;
and transmit each of the two or more separate messages to a
separate gatekeeper; each of the separate gatekeepers being
operable to: receive a respective one of the separate messages;
securely process the separate message, and transmit the processed
separate message to a second device; the second device being
operable to: receive the processed separate messages from each of
the separate gatekeepers; and re-assemble the processed, separate
messages; the first device, second device and separate gatekeepers
being interconnected via a communication network.
[0017] This summary of the invention does not necessarily describe
all features of the invention.
BRIEF DESCRIPTION OF THE DRAWINGS
[0018] These and other features of the invention will become more
apparent from the following description in which reference is made
to the appended drawings wherein:
[0019] FIG. 1 presents a system block diagram of a basic
authentication model as known in the art;
[0020] FIG. 2 presents a process flow diagram of an authentication
model in an embodiment of the invention;
[0021] FIGS. 3A-3C present a set of system block diagrams for
authentication, document transmission and document storage
paradigms respectively, in embodiments of the invention; and
[0022] FIGS. 4A-4D present a set of process flow diagrams of an
authentication model in an embodiment of the invention.
DETAILED DESCRIPTION
[0023] A method of and system for electronic encryption,
authentication and security over networked systems is described,
that is far more secure from known hacking techniques than existing
security processes. While existing security processes typically
rely on one single electronic message and one server, the process
of the invention breaks information apart before it leaves the
User's computer or other digital device, so that intercepting any
single electronic message does not provide the hacker with
sufficient information to gain access. It will send, for example,
the User identification (ID) and password to two or more external
servers that act as gatekeepers. The system and method of the
invention can break apart this information several times, each time
providing an exponential increase in security.
[0024] The system and method of the invention can be implemented
over any form of network, including, for example, a local Ethernet,
wide area network, telecommunication network, Internet; wireless,
hard wired or fiber optic network; or any combination of these or
similar networks. As well, the User or client may be any electronic
device capable of supporting simple computation, including for
example a personal computer (PC), laptop computer, personal digital
assistant (PDA), wireless email device, cellular telephone, or MP3
player. Other similar devices could also be used. Of course, the
system can accommodate access to any data or content including, for
example: music, video, web pages and email.
[0025] Each server, or gatekeeper, then communicates independently
with the protected server that holds the information or resources
that are being secured. For each gatekeeper, there is a key where
preexisting data (User ID, password, etc) must correspond to the
submitted data. Ultimately, each key must grant authorization
before the User gains access to the protected server. This process
makes it exponentially more difficult for hackers to penetrate into
protected servers than any existing form of authorization
security.
[0026] This method and system is straightforward to implement given
the teachings herein and is able to piggyback off existing software
programs. The ability to decentralize information introduces an
entirely new paradigm into the IT security world (from centralized,
Newtonian communication, to decentralized, fractal communication)
and gives it tremendous value, particularly in the global business,
scientific and defense communities where the level of authorization
security is currently inadequate.
[0027] The encryption process of the invention functions under the
same principles as the authorization process. Basically, existing
encryption technology, such as PGP--the world's leader in
encryption software--wraps a single message into a complex
encrypted message. A potential interceptor or hacker may be easily
able to intercept the message. Though it is extremely difficult to
decrypt the message without knowing the key, it is not
impossible--given enough time and processing power, it can be
decrypted. The invention is able to piggyback on PGP or almost any
other encryption software, and the combination of the two would
offer an exponentially greater level of encryption security.
[0028] The encryption process works by fragmenting a message into
two or more--and potentially thousands or millions--of parts and
sending the parts to the recipient via several different
communication channels. Thus, if a hacker is able to intercept one
message he or she will only have obtained a small part of the whole
message. The more parts that the message is broken into, the more
difficult it becomes for the hacker to intercept each crucial,
partial message. Even if a hacker were able to intercept every one
of several thousand messages--some of which could be decoys--the
hacker would then have the enormous difficulty of putting these
pieces back together. Furthermore, each of these messages will be
encrypted using a high level of existing encryption software, such
as PGP which is currently one of the strongest.
[0029] The invention is not unbreakable no encryption technology
is--however, it does provide an exponential increase in protection
from existing technology.
[0030] The present invention will be further illustrated by means
of the following examples.
FIGS. 3A-3C
[0031] FIGS. 3A-3C present system block diagrams of authentication,
document transmission and document storage paradigms
respectively.
[0032] In one embodiment of the invention a message (either
encrypted or plaintext) is broken into multiple parts on the User's
computer 50 using a partitioning algorithm, which may be a sliding
or a non-sliding algorithm. Note that the partitions of data can
overlap one another, provided that collectively, they preserve all
of the information from the original message. Each of these
multiple parts gets transmitted independently to a separate
external server 52, and each of those external servers 52
authenticates its part of the message based on stored algorithms
(thus, the external servers 52 are operating as partial
authentication servers). This can be done by storing each piece on
each external server 52 (for identity authentication) or by running
the same algorithms on a stored firewalled version of the whole
(i.e. Username and Passphrase). Though three external servers 52
are shown in FIG. 3A, there is no upper limit on the number of
external servers 52 that could be employed.
[0033] After the pieces have been authenticated, they are sent to a
firewalled server 54, 56 that only communicates with the individual
authentication servers 52. This firewalled server 54, 56 compares
the authentication certificates from each authentication server 52,
or in the case of an encrypted message, recombines the pieces. In
the case of authentication, all of the certificates are compared
and it is determined whether or not all are valid. If they are
valid, each authentication server 52 is given a validity
certificate from the firewalled server 54, 56, and then sends a
final validity to the client (whether that is an e-commerce enabled
website, a network login or any other electronic password
protection utility).
[0034] The order of the pieces to be recombined can be determined
in a number of ways. For example: [0035] 1. they could be ordered
by their original transmission time stamps (i.e. the time at which
they left the original User); [0036] 2. each separate piece could
be given a unique number or other identifier when the splitting is
done on the User, the piece numbering being encrypted with the
balance of the data in the piece. Numeric identifiers, of course,
do not have to be in numerical order; [0037] 3. a "rules-based"
approach could be used; [0038] 4. a schema approach could be used;
or [0039] 5. any combination of the above. For example, timing data
could be mixed with an identifier, which indicates which rule to
apply. Other methods of determining the order of the pieces would
be clear to one skilled in the art.
[0040] The same could also be done with a non-firewalled server 54
as shown in FIG. 3B.
[0041] In the case of document storage per FIG. 3C, the document
remains stored on the firewalled server 54, 56 until a request
arrives, at which point the document is re-broken by the
appropriate algorithms and sent out to the receiving computer 50
using the same multiple server schema (that is, sending separate
pieces through multiple external servers 52). In the case of
document transmission (i.e. e-mail transmission and the like) per
FIGS. 3B, the multiple parts are sent to the recipient who checks
the validity of each piece and then re-combines and decrypts.
Multiple parts could also be stored on multiple servers and never
made whole.
[0042] The major ways in which this can address issues with
existing technologies are as follows:
[0043] in order to duplicate the hash of a password (as noted above
in the Background to the Invention) a hacker would need to
determine which pieces of the message contain the values they need
to alter and then duplicate the hash of each of those parts. This
may involve many parts; and
[0044] in the case of packet sniffing, multiple routing means that
there are multiple packet ID's comprising the same pieces of data,
making reassembly of the original transmission very difficult, as
well as making the packet sniffer need to work on multiple machines
simultaneously and determine which packets have the same
originating sender. Even when this is completed, the hacker still
needs to break the strong encryption used.
[0045] An alternative method is to separate the message into
individual bits, with a provided key that would add an additional 8
bits to each bit (in order to determine message position) and send
each bit as a separate transmission. This is too time consuming to
be practical in today's computing environment but may be possible
in the near future. The preferred embodiment at the present time is
to use byte-based transmissions with strong encryption.
[0046] If a file has been stored with multiple parts, encrypted and
stored in multiple locations, the User can allow another user to
access the file in a number of ways. For example, in response to
hitting a "send" option on the User's GUI, a dialog could open
asking who (on the trusted user list) the User wants to send it the
file to. Each trusted user is configured with an identity in the
file transmission structure. The User selects the trusted user he
wishes to send the file to and if the file was stored locally, the
system would perform the encryption and splitting routines, and
send the pieces to the other user. But if the file is already
stored in multiple different places as in the case of this example,
the system would: [0047] 1. send a notification to the other user
that the first user is sending a file; [0048] 2. wait for an
acceptance response from the second user; [0049] 3. instruct the
locations storing those pieces, to send them to the other user;
[0050] 4. the pieces are then sent to the other user who receives
and decrypts them. This assumes that either the original encryption
had been done using a key the second user has access to, or if the
second user does not have access to the key, the first user would
encrypt, split and then transmit the key.
[0051] Of course, access to such stored documents could be
delegated or emailed to any other party, who does not necessarily
have to be on a "trusted user list".
FIGS. 4A-4D
[0052] FIGS. 4A-4D present a process flow diagram of an
authentication model in an embodiment of the invention.
[0053] FIG. 4A presents a process flow diagram of the
authentication process from the point of view of the Client.
[0054] Typically, values for the User Name 70 and Passphrase 72 are
entered interactively by the User. It is not generally desirable
for the User's computer to store the last User Name 70 and/or
Passphrase 72 as some systems do, as it compromises security.
[0055] The User Name 70 and Passphrase 72 are then encrypted 76 on
the client using a seed number. This seed number 74 will be
generated in some manner of generating random or pseudo-random
numbers as known in the art, such as:
[0056] using a random number generating algorithm;
[0057] accessing various time signals;
[0058] accessing random data locations in memory; or
[0059] tracking the User's random cursor movements.
[0060] The encrypted username 78 and encrypted passphrase 80 are
then combined into one large number 82 which is then separated into
multiple parts using some manner of partitioning algorithm 84. The
separated values are stored in an array structure 86. The contents
of the separate elements of the array 86 are then sent to separate
external servers 88 for comparison with a data set stored on the
Protected Server.
[0061] FIG. 4B presents a process flow diagram of the
authentication process from the point of view of Firewalled Backend
Server.
[0062] An encrypted User name 90 and encrypted passphrase 92 are
stored in the database records of the Firewalled Backend server 54,
56. In the event of a client submitting an authentication request,
the external servers 100 request the stored encrypted User name 90
and encrypted passphrase 92 from the Firewalled Backend server 54,
56. These encrypted User name 90 and passphrase values 92 are then
combined into one large number 94 which is then separated into
multiple parts via the splitting subroutine 96. Separated values
are stored in an array structure 98. The contents of each element
of the array structure 98 are sent to separate external servers 100
for comparison with client data broadcast.
[0063] FIG. 4C presents a process flow diagram of the process of
Final Authentication on the gateway servers.
[0064] Each gateway server 52 receives matched data sets from both
the client 108 and the protected server 118 (recall that the
protected server 118 is the server that contains the secure data
and/or resources). Each data set is a piece of the aggregate value
of both the encrypted ID and the encrypted Passphrase. The partial
data set 110 from the protected server 118 and the partial client
data set 112 are compared 124 at the gateway server 52. If the two
data sets match 114, a positive validation code 116 is generated
with a transaction identification number and is then returned to
protected server 118.
[0065] The protected server 118 then returns an authentication code
to each of the gateway servers 52, which they receive at block 120.
This authentication code is split into encrypted parts 110 by the
protected server 118 before returning to external servers 52. The
external servers 52 encrypt and broadcast their respective portions
of the authorization code, returning them to the client 108 at
block 122. When the partial authorization codes are received by the
client 108, they are then recombined into a single authentication
number. This authentication number would be appended specifically
for any transactions within this session. Any use of this
authentication number beyond this session would be considered
invalid.
[0066] If data sets within each or any external server do not
match, a negative code is returned to protected server at block 126
and the authentication code is deemed invalid. If each data set
matches within each external server, positive codes are returned to
the protected server, and the combined and authentication code is
deemed valid.
[0067] FIG. 4D illustrates a simplified overview of the entire
Authentication Process.
[0068] First, the Client combines and broadcasts an encrypted data
set (User ID and passphrase). The encrypted data set is combined
into an aggregate value and then split, after which it is broadcast
to external servers 52 (one data set per server).
[0069] When this data is received by the external servers 52, the
external servers 52 request relevant data from the protected server
54. Each external data set 138 (typ.) is compared 130 with the
generated data set from the protected server 54. The validation
state is sent to the protected server 54, and the Protected server
54 compares all validation states in the transaction.
[0070] In the event of positive verification of every partial data
set at step 132, the protected server 54 returns an (encrypted,
partial) authentication code. Authentication codes are sent to the
client and recombined. If this authentication code is recombined
into a valid number, transaction proceeds (step 134). If the
authorization code is recombined into an invalid number,
transaction halts (step 136).
EXAMPLE
Application to an Authorization Process in an Online Music Store
Card
[0071] A User accesses an online music store to make a purchase.
After selecting "checkout" in his online shopping cart, the User is
prompted for a User name, password and card number (the User's
music card was obtained via mail or at physical location. The User
could also use credit or debit card for the transaction). The User
then enters his User name, password and card number. The User name
and password are encrypted using his card number as a seed value
(further modified by the use of a time stamp), using, for example,
public key based encryption such as PGP. The encrypted User name
and password are joined into a single value, then split into
byte-sized chunks. The algorithm used to do this is based on
byte-generation via alternating bits, starting at each end of full
value, the first bit being taken from the beginning of the string,
the second bit is the last bit in the string, the third bit is the
second in the string, the fourth bit is the second from last in the
string and so on for each byte.
[0072] This example provides a highly secure transaction. In
practice, however, less secure methodologies may be employed, such
as simple byte for byte chunking. In such a case each chunk is
submitted to a separate, music store, external server. Each chunk
is algorithmically compared to stored values from the music store's
protected server. If they match internal values, a pass code is
sent to the protected server. Hall values pass, the transaction is
completed and an authorization stamp is encrypted, broken apart
into byte-sized chunks and sent to the online music store's
separate, external servers. Each piece of the transaction code is
then sent to the User and reassembled within the User's software.
If all of the chunks match, the User is given a transaction
succeeded message and, if applicable, download of music begins.
[0073] Thus, multiple data streams are generated for a single
transaction with the added advantage of allowing some overlap in
streams for enhanced error correction for cases of unencrypted data
transmission. This provides a greater degree of security for any
network transmission.
[0074] Thus, in short:
[0075] A process has been developed that enhances the level of
electronic encryption and authorization;
[0076] This process divides electronic messages into multiple parts
and then authenticates each individual part before recombining into
a coherent whole;
[0077] With encryption, exponentially higher levels of security for
both data transmission and authentication, are provided;
[0078] Messages are algorithmically separated into parts. Each part
may be transmitted to different servers;
[0079] Where each part is then authenticated;
[0080] Parts are transmitted to a firewalled server;
[0081] Parts are re-combined (or in case of authentication,
individual authentication certificates are compared);
[0082] In case of authentication, certificates are returned to each
authenticating server. For encryption, parts are broken apart again
and returned; and
[0083] Validity certificates are returned to originating
computer.
Options and Alternatives
[0084] While particular embodiments of the present invention have
been shown and described, it is clear that changes and
modifications may be made to such embodiments without departing
from the true scope and spirit of the invention. For example:
[0085] 1. the invention could be used for encrypted file
transmission such as: high security documents, digital media files
(such as movies or music), financial transaction data,
authentication codes, any document needing absolute verifiable
sources, live video transmission (e.g. corporate digital
conferences, CCTV, or subscription or fee based broadcast),
electronic voting, RFID tags or transmission of biometric
authentication date; [0086] 2. unencrypted file transmission with
enhanced error correction; [0087] 3. automatic protection against
server level viruses. This works via checksum matching; [0088] 4.
use of multiple routing in protected server to counter DOS attacks;
[0089] 5. network authentication for financial transactions,
network logons or similar processes; [0090] 6. wireless Data
Transmission including: Modified WEP encryption, and Multiple
broadcast point transmission; [0091] 7. secure networked storage
and retrieval of data; [0092] 8. use of splitting via multiple
processors in addition to multiple servers. The difference is that
splitting via multiple processors applies to a single computer
rather than network (at present such applications are technically
impractical); [0093] 9. Multiple Server File Storage; it would also
be possible to take a single file and spread it byte or bit wise
over multiple hard drives residing in multiple computer systems;
[0094] 10. Multiple encryption; an alternative would be to split
the message before encryption and then encrypt using multiple
schemas for a single message or string; [0095] 11. This technology
could also be used to split a single value into multiple locations
on a single machine (e.g. multiple tables within a single
database); or [0096] 12. This technology could be used to protect
communications between multiple computers, servers and/or networks
in a symmetric multi-processing, grid-computing or
cluster-computing model along the lines of Chaos Linux or the SETI
project.
CONCLUSIONS
[0097] The present invention has been described with regard to one
or more embodiments. However, it will be apparent to persons
skilled in the art that variations and modifications can be made
without departing from the true scope and spirit of the
invention.
[0098] The method steps of the invention may be embodiment in sets
of executable machine code stored in a variety of formats such as
object code or source code. Such code is described generically
herein as programming code, or a computer program for
simplification. Clearly, the executable machine code may be
integrated with the code of other programs, implemented as
subroutines, by external program calls or by other techniques as
known in the art.
[0099] The embodiments of the invention may be executed by a
computer processor or similar device programmed in the manner of
method steps, or may be executed by an electronic system which is
provided with means for executing these steps. Similarly, an
electronic memory medium such computer diskettes, CD-Roms, Random
Access Memory (RAM), Read Only Memory (ROM) or similar computer
software storage media known in the art, may be programmed to
execute such method steps. As well, electronic signals representing
these method steps may also be transmitted via a communication
network.
[0100] The system and method described could, for example, be
applied to computers, smart terminals, personal digital assistants
and Internet-ready telephones. Again, such implementations would be
clear to one skilled in the art, and do not take away from the
invention.
[0101] All citations are hereby incorporated by reference.
* * * * *