Secure data transfer using random ordering and random block sizing
View Patent ↗Encrypted information is conventionally broken into blocks which are transmitted sequentially. Because the order and the size of such blocks can be easily determined, an eavesdropper can gain valuable information regarding the content of the communication. More specifically, if known types of information exist within a block, the encryption key may be determined allowing the content of other encrypted blocks to be obtained. Embodiments of a system, method and computer program product described herein can overcome this deficiency by securely transferring information through random ordering and random block sizing. An original data set to be transferred is divided into a plurality of blocks, where at least two blocks have different sizes. The blocks are encrypted and inserted into a sequence of data transfer slots. The blocks are then selected for transfer in random order by selecting a slot to transfer based on a generated random number.
1. A device for secure data transfer of a plurality of portions of data from a data set comprising:
a first module configured to, for each portion of data in the plurality of portions of data from the data set:
select the portion of data from the data set, and
divide the portion of data into a plurality of blocks, wherein at least two blocks in the plurality of blocks have different sizes;
a hardware-based cryptographic processor configured to encrypt the plurality of blocks for each portion of data; and
a second module configured to, for each transfer of a portion of data in the plurality of portions of data from the data set:
determine a number of data transfer slots based on a first generated random number,
map the plurality of blocks into the determined number of data transfer slots, and
transfer the plurality of blocks in random order to a destination via the determined number of data transfer slots,
wherein the determined number of data transfer slots is variable for each transfer of a portion of data.
2. The device of claim 1 , wherein the first module is further configured to apply a circular shift to the portion of data prior to dividing the portion of data into the plurality of blocks.
3. The device of claim 1 , wherein the first module is further configured to split a set of identified data in the portion of data between two blocks.
4. The device of claim 1 , wherein the second module is further configured to include a dummy block in the plurality of blocks during transfer.
5. The device of claim 1 , wherein the second module is further configured to select a data transfer slot in the determined number of data transfer slots based on a second generated random number.
6. The device of claim 5 , wherein the second module is further configured to transfer a block associated with the selected data transfer slot.
7. The device of claim 1 , wherein the second module is further configured to select a data transfer slot in the determined number of data transfer slots based on a transmission priority of a block in the plurality of blocks.
8. A non-transitory computer useable medium having program logic stored thereon that, when executed by a processor, causes the processor to perform a method for securely transferring a plurality of portions of data from a data set, the method comprising:
for each portion of data in the plurality of portions of data from the data set, selecting the portion of data from the data set;
dividing the selected portion of data into a plurality of blocks, wherein at least two blocks in the plurality of blocks have different sizes;
encrypting, in a hardware-based cryptographic processor, the plurality of blocks for each portion of data;
for each transfer of a portion of data in the plurality of portions of data front the data set, determining a number of data transfer slots based on a first generated random number;
mapping the plurality of blocks into the determined number of data transfer slots; and
transferring the plurality of blocks in random order to a destination via the determined number of data transfer slots, wherein the determined number of data transfer slots is variable for each transfer of a portion of data.
9. The computer useable medium recited in claim 8 , wherein a circular shift is applied to the portion of data prior to dividing the portion of data into the plurality of blocks.
10. The computer useable medium recited in claim 8 , wherein a set of identified data in the portion of data is split between two blocks.
11. The computer useable medium recited in claim 8 , wherein a data transfer slot in the determined number of data transfer slots is selected based on a second generated random number.
12. The computer useable medium recited in claim 11 , wherein a block associated with the selected data transfer slot is transferred.
13. The computer useable medium recited in claim 8 , wherein a data transfer slot in the determined number of data transfer slots is selected based on a transmission priority of a block in the plurality of blocks.
14. A method for secure data transfer of a plurality of portions of data from a data set comprising:
for each portion of data in the plurality of portions of data from the data set, selecting the portion of data from the data set;
dividing the selected portion of data into a plurality of blocks, wherein at least two blocks in the plurality of blocks have different sizes;
encrypting, in a hardware-based cryptographic is processor, the plurality of blocks for each portion of data;
for each transfer of a portion of data in the plurality of portions of data from the data set, determining a number of data transfer slots based on a first generated random number;
mapping the plurality of blocks into the determined number of data transfer slots; and
transferring the plurality of blocks in random order to a destination via the determined number of data transfer slots, wherein the determined number of data transfer slots is variable for each transfer of a portion of data.
15. The method recited in claim 14 , wherein a circular shift is applied to the portion of data prior to dividing the portion of data into the plurality of blocks.
16. The method recited in claim 14 , wherein a set of identified data in the portion of data is split between two blocks.
17. The method recited in claim 14 , wherein a data transfer slot in the determined number of data transfer slots is selected based on a second generated random number.
18. The method recited in claim 17 , wherein a block associated with the selected data transfer slot is transferred.
19. The method recited in claim 14 , wherein a data transfer slot in the determined number of data transfer slots is selected based on a transmission priority of a block in the plurality of blocks.