Cryptographic policy filters and policy control method and apparatus
View Patent ↗An apparatus for an integrated dynamic encryption and/or decryption for use in an application includes a policy filter, a policy filter module coupled to said policy filter, a service module coupled to said policy filter, and a cryptographic module, where the apparatus retrieves the cryptographic module and configures the policy filter in accordance with the cryptographic module and the policy filter module performs a plurality of verification upon the cryptographic module, and further where the service module is configured to generate a plurality of cipher suites and the policy filter is configured to filter the plurality of cipher suites in accordance with a predetermined policy filter parameters to generate a plurality of filtered cipher suites. Moreover, an apparatus for an integrated dynamic encryption and/or decryption for use in an application includes storage means for storing a plurality of predetermined attributes and corresponding values, and a digital signature, a controller for controlling selective retrieval of said plurality of attributes and values, and said digital signature from said storage means, processing means for selectively processing said plurality of predetermined attributes and values, and said digital signature and in accordance thereto, providing a supportable encryption and/or decryption level to said application, compression means for compressing said plurality of attributes and values and in accordance thereto generating a compressed plurality of attributes and values for storing in said storage means, and decompressing means for decompressing said compressed plurality of attributes and values in accordance to said controller retrieving said compressed plurality of attributes and values.
1. A method of policy filtering to configure an application program for one or more cryptographic capabilities, the method comprising:
receiving, from an application program, a request to identify cipher suites that are supported by an application interface;
accessing a policy filter associated with the application interface;
in response to the received request, identifying one or more cipher suites that are supported by the application interface;
generating a customized list of one or more cipher suites that are supported by the application interface based on the one or more cipher suites that are identified and also based on configuration parameters of the policy filter associated with the application interface; and
making accessible the customized list of authorized cipher suites to the application program.
2. The method of claim 1 wherein identifying one or more cipher suites comprises identifying one or more cipher suites that are supported by the application interface by accessing a preexisting list of one or more cipher suites that are supported by the application interface.
3. The method of claim 1 wherein generating a customized list comprises removing unauthorized cipher suites from a preexisting list of one or more cipher suites in accordance with configuration parameters of the policy filter associated with the application interface.
4. The method of claim 1 wherein the cipher suites include at least one of an encryption algorithm, a key size, a type of a cryptographic operation, and a strength of the cryptographic operation.
5. The method of claim 1 wherein the request to identify cipher suites comprises a request to identify cryptographic capabilities supported by the application interface.
6. The method of claim 1 wherein:
the policy filter removes unauthorized cipher suites from the list of cipher suites and provides the list of authorized cipher suites to the application interface, and the application interface returns the list of authorized cipher suites to the application program.
7. The method of claim 1 wherein the policy filtering is performed in an untrusted environment.
8. A policy filter system for configuring an application program to support a plurality of cryptographic capabilities, the policy filter system comprising:
an application interface configured to receive a request to identify cipher suites that are supported by the application interface and identify one or more cipher suites that are supported by the application interface; and
a policy filter associated with the application interface and configured to generate a customized list of one or more cipher suites that are supported by the application interface based on the one or more cipher suites that are identified and also based on predetermined configuration parameters and making accessible the customized list of authorized cipher suites to the application interface.
9. The system of claim 8 wherein the application interface is further configured to identify one or more cipher suites that are supported by the application interface by accessing a preexisting list of one or more cipher suites that are supported by the application interface.
10. The system of claim 8 wherein the policy filter is further configured to generate a customized list by removing unauthorized cipher suites from a preexisting list of one or more cipher suites in accordance with configuration parameters of the policy filter associated with the application interface.
11. The system of claim 8 wherein the cipher suites includes at least one of an encryption algorithm, a key size, a type of a cryptographic operation, and a strength of the cryptographic operation.
12. The system of claim 8 wherein the request to identify cipher suites comprises a request to identify cryptographic capabilities supported by the application interface.
13. The system of claim 8 wherein the application interface is further configured to provide the filtered list of cipher suites to the application program.
14. The system of claim 8 wherein the policy filter system operates in an untrusted environment.
15. A system for policy filtering to configure an application program for one or more cryptographic capabilities, the system comprising:
means for receiving, from an application program, a request to identify cipher suites that are supported by an application interface;
means for accessing a policy filter associated with the application interface;
means for identifying one or more cipher suites that are supported by the application interface in response to the received request;
means for generating a customized list of one or more cipher suites that are supported by the application interface based on the one or more cipher suites that are identified and are also based on configuration parameters of the policy filter associated with the application interface; and
means for making accessible the customized list of authorized cipher suites to the application program.
16. A method of policy filtering to configure an application program for one or more cryptographic capabilities, the method comprising:
receiving, from an application program, a request to identify cipher suites that are supported by an application interface;
accessing a policy filter associated with the application interface;
in response to the received request, identifying one or more cipher suites that are supported by the application interface and are also based on configuration parameters of the policy filter associated with the application interface; and
making accessible the identified one or more cipher suites to the application program.
17. The method of claim 16 wherein the cipher suites include at least one of an encryption algorithm, a key size, a type of a cryptographic operation, and a strength of the cryptographic operation.
18. The method of claim 16 wherein the request to identify cipher suites comprises a request to identify cryptographic capabilities supported by the application interface.
19. The method of claim 16 wherein:
the policy filter removes unauthorized cipher suites from the list of cipher suites and provides the list of authorized cipher suites to the application interface, and
the application interface returns the list of authorized cipher suites to the application program.
20. The method of claim 16 wherein the policy filtering is performed in an untrusted environment.