Encrypted record transmission
View Patent ↗The invention provides a method and apparatus for transmitting data securely using an unreliable communication protocol, such as User Datagram Protocol. In one variation, the invention retains compatibility with conventional Secure Sockets Layer (SSL) and SOCKS protocols, such that secure UDP datagrams can be transmitted between a proxy server and a client computer in a manner analogous to conventional SOCKS processing. In contrast to conventional SSL processing, which relies on a guaranteed delivery service such as TCP and encrypts successive data records with reference to a previously-transmitted data record, encryption is performed using a nonce that is embedded in each transmitted data record. This nonce acts both as an initialization vector for encryption/decryption of the record, and as a unique identifier to authenticate the record. Because decryption of any particular record does not rely on receipt of a previously received data record, the scheme will operate over an unreliable communication protocol. The system and method allows secure packet transmission to be provided with a minimum amount of overhead.
1. A method for generating and transmitting an encrypted record over a network to a computing device for decryption at the computing device, the method comprising:
receiving a plurality of blocks of plaintext at a network interface of a server; and
executing instructions stored in memory of the server, wherein execution of the instructions by a processor of the server:
generates a block of ciphertext based on a block of plaintext from the plurality of blocks of plaintext, wherein generating the block of ciphertext includes encrypting the block of plaintext with an initialization vector and a session key, and wherein the initialization vector is different for each of the plurality of blocks of plaintext,
generates a nonce, wherein the nonce is different for each of the plurality of blocks of plaintext,
generates a message authentication check (MAC) by applying a hashing function to the nonce, the session key, and the block of plaintext,
embeds the block of ciphertext into an encrypted record,
appends a header, the MAC, the nonce, and the unique initialization vector to the encrypted record,
embeds a bit into the header of the encrypted record, wherein the embedded bit indicates to the computing device that the encrypted record is a secure record, and
transmits the encrypted record to the computing device over the network using an unreliable protocol.
2. A non-transitory computer-readable storage medium having embodied thereon a program, the program executable by a computer to perform a method for generating and transmitting an encrypted record for decryption at the computing device, the method comprising:
receiving a plurality of blocks of plaintext at a network interface of a server;
generating a block of ciphertext based on a block of plaintext from the plurality of blocks of plaintext, wherein generating the block of ciphertext includes encrypting the block of plaintext with an initialization vector and a session key, and wherein the initialization vector is different for each of the plurality of blocks of plaintext;
generating a nonce, wherein the nonce is different for each of the plurality of blocks of plaintext;
generating a message authentication check (MAC) by applying a hashing function to the nonce, the session key, and the block of plaintext;
embedding the block of ciphertext into an encrypted record;
appending a header, the MAC, the nonce, and the unique initialization vector to the encrypted record;
embedding a bit into the header of the encrypted record, wherein the embedded bit indicates to the computing device that the encrypted record is a secure record; and
transmitting the encrypted record to the computing device over the network using an unreliable protocol.
3. The method of claim 1 , wherein the nonce appended to the encrypted record indicates to the computing device that the encrypted record was already received in the past.
4. The method of claim 1 , wherein the unreliable protocol is User Datagram Protocol (UDP).
5. The method of claim 1 , wherein detection of the embedded bit by the computing device signals to the client that the encrypted record is to be processed by a modified Socket Secure (SOCKS) processing function rather than a conventional SOCKS processing function.
6. The non-transitory computer-readable storage medium of claim 2 , wherein the nonce appended to the encrypted record indicates to the computing device that the encrypted record was already received in the past.
7. The non-transitory computer-readable storage medium of claim 2 , wherein the unreliable protocol is User Datagram Protocol (UDP).
8. The non-transitory computer-readable storage medium of claim 2 , wherein detection of the embedded bit by the computing device signals to the computing device that the encrypted record is to be processed by a modified Socket Secure (SOCKS) processing function rather than a conventional SOCKS processing function.
9. An encrypted record transmission system, comprising:
a server having a processor, memory storing executable instructions, and a network interface communicatively coupled to a network, wherein the server:
receives a plurality of blocks of plaintext at the network interface, and
executes the instructions stored in the memory of the server, wherein execution of the instructions by the processor:
generates a block of ciphertext based on a block of plaintext from the plurality of blocks of plaintext, wherein generating the block of ciphertext includes encrypting the block of plaintext with an initialization vector and a session key, and wherein the initialization vector is different for each of the plurality of blocks of plaintext,
generates a nonce, wherein the nonce is different for each of the plurality of blocks of plaintext,
generates a message authentication check (MAC) by applying a hashing function to the nonce, the session key, and the block of plaintext,
embeds the block of ciphertext into an encrypted record,
appends a header, the MAC, the nonce, and the unique initialization vector to the encrypted record,
embeds a bit into the header of the encrypted record, wherein the embedded bit indicates to the computing device that the encrypted record is a secure record, and
transmits the encrypted record over the network using an unreliable protocol, and
a computing device having a network interface communicatively coupled to the network, wherein the computing device:
receives the encrypted record over the network, and
decrypts the encrypted record without reliance on a previously received record.
10. The system of claim 9 , wherein the nonce appended to the encrypted record indicates to the computing device that the encrypted record was already received in the past.
11. The system of claim 9 , wherein the unreliable protocol is User
Datagram Protocol (UDP).
12. The system of claim 9 , wherein detection of the embedded bit by the computing device signals to the computing device that the encrypted record is to be processed by a modified Socket Secure (SOCKS) processing function rather than a conventional SOCKS processing function.
13. The method of claim 1 , wherein the header identifies the encrypted record as including encrypted UDP data.
14. The method of claim 1 , wherein further execution of the instructions by the processor transmits the session key over the network to the computing device.
15. The method of claim 1 , wherein further execution of the instructions by the processor transmits the initialization vector associated with the encrypted record over the network to the computing device.
16. The method of claim 1 , wherein further execution of the instructions by the processor transmits the MAC associated with the encrypted record over the network to the computing device.
17. The non-transitory computer-readable storage medium of claim 2 , wherein the header identifies the encrypted record as including encrypted UDP data.
18. The non-transitory computer-readable storage medium of claim 2 , wherein the method further includes transmitting the session key over the network to the computing device.
19. The non-transitory computer-readable storage medium of claim 2 , wherein the method further includes transmitting the initialization vector associated with the encrypted record over the network to the computing device.
20. The non-transitory computer-readable storage medium of claim 2 , wherein the method further includes transmitting the MAC associated with the encrypted record over the network to the computing device.
21. The system of claim 9 , wherein the header identifies the encrypted record as including encrypted UDP data.
22. The system of claim 9 , wherein further execution of the instructions by the processor transmits the session key over the network to the computing device.
23. The system of claim 9 , wherein further execution of the instructions by the processor transmits the initialization vector associated with the encrypted record over the network to the computing device.
24. The encrypted record transmission system of claim 9 , wherein further execution of the instructions by the processor transmits the MAC associated with the encrypted record over the network to the computing device.