Data protection using programmatically generated key pairs from a master key and a descriptor
View Patent ↗Systems and methods are disclosed for allowing an authority to monitor a computer user's information in a most palatable manner for the computer user. The authority is provided access to information with encrypted user identification information and the user is notified if decryption is facilitated. The systems and methods also include a novel key production system whereby large numbers of deterministic key pairs may be created for use in the monitoring system.
1. A method comprising the acts of:
storing a master key value associated with a user;
generating a public and private key pair including a public key and a private key for content of the user, including:
obtaining a descriptor value from the content, and modifying a portion of the master key value using the descriptor value by:
deriving a series of bits from the descriptor value, determining a size of the series of bits derived from the descriptor value, and replacing a portion of the master key value equivalent to the size of the series of bits derived from the descriptor value, with the series of bits derived from the descriptor;
seeding a pseudo random number generator (PRNG) with the modified master key value;
applying the PRNG to a result of seeding the PRNG for a plurality of cycles;
after the plurality of cycles, using an output of one or more subsequent cycles from the PRNG to derive the public and private key pair.
2. The method of claim 1 wherein the descriptor value is a date value related to a date of a log entry, and the public key is used to encrypt at least a portion of the log entry.
3. The method of claim 1 wherein combining the master key value with the descriptor value further comprises hashing the descriptor value prior to using bits derived from the descriptor value to replace bits of the master key value.
4. The method of claim 1 wherein the descriptor value relates to dates or times of a first set of log entries and the public key is used to encrypt at least a portion of each of a plurality of log entries belonging to the first set of log entries.
5. The method of claim 4 comprising the further acts of:
providing a second descriptor value, the second descriptor value related to the dates or times of a second set of log entries, wherein the second set of log entries is from a same log as the first set of log entries and is not identical to the first set of log entries;
combining the master key value with the second descriptor value to form a second modified master key value by replacing a portion of the master key value with bits derived from the second descriptor value;
applying, to the second modified master key value, the PRNG that was applied to the first modified master key value for the same number of cycles that were applied to the first modified master key value; and
using one or more subsequent cycles from the PRNG to derive a second public and second private key pair.
6. The method of claim 5 further comprising continuing to produce new sets of private and public key pairs by creating new modified master key values using the master key value and differing descriptor values, wherein each of the differing descriptor values relates to date values of log entries, wherein the log entries logically belong to the same log.
7. The method of claim 1 wherein the descriptor value relates to meta data of a file and the public key is used to encrypt at least a portion of the file.
8. The method of claim 7 further comprising producing new sets of private and public key pairs by creating a plurality of new modified master key values using the master key value and differing descriptor values, wherein each descriptor value relates to metadata of each of a plurality of files, and a created public key is used to encrypt at least a portion of each of the plurality of files.
9. A method for producing encryption keys comprising:
storing a descriptor value for content of a user in a first memory;
storing a master key value associated with a user in a second memory;
generating a public and private key pair for content of the user, including:
modifying a portion of the master key value using the descriptor value by using a microprocessor to form a combination value by:
deriving a series of bits from the descriptor value,
determining a size of the series of bits derived from the descriptor value,
replacing a portion of the master key value equivalent to the size of the series of bits derived from the descriptor value with the series of bits derived from the descriptor;
seeding a pseudo random number generator (PRNG) with the modified master key value;
storing an output of a first PRNG cycle in a third memory;
employing a plurality of successive PRNG cycles by seeding an Nth cycle of the PRNG with the output from an (N−1)th cycle of the PRNG; and
developing the private key and the public key pair based upon outputs from the PRNG cycles.
10. The method of claim 9 wherein the first memory, second memory and third memory are all part of a same addressable memory space in a single computer system.
11. The method of claim 9 wherein:
the descriptor is a deterministic value derived from information regarding data selected to be encrypted with the public key; and
the PRNG is a MersenneTwister.
12. The method of claim 11 wherein the PRNG is cycled a total of at least 700,000 times.
13. The method of claim 9 comprising the additional acts of:
using the public key to encrypt a portion of one or more records regarding a user's access to a network;
after performing the encryption, allowing access to the one or more records to an authority;
receiving a request from the authority for a decrypted version of the one or more records;
employing the private key to respond to the request from the authority; and
providing notice to the user regarding the access to the one or more records to the authority.
14. The method of claim 13 wherein the network comprises one or more of the Internet, a corporate network, a government network, or a secure network.
15. A non-transitory computer readable medium on which are stored instructions, comprising instructions which, when executed by a processor, causes the processor to:
store a descriptor value for content of a user;
store a master key value associated with a user;
generate a public and private key pair for content of the user, including instructions which cause the processor to:
modify a portion of the master key value using the descriptor value comprising instructions that when executed cause the processor to:
derive a series of bits from the descriptor value,
determine a size of the series of bits derived from the descriptor value,
replace a portion of the master key value equivalent to the size of the series of bits derived from the descriptor value with the series of bits derived from the descriptor value;
seed a pseudo random number generator (PRNG) with the modified master key value;
store an output of a first PRNG cycle seeded with the modified master key value;
cause a plurality of successive PRNG cycles by seeding an Nth cycle of the PRNG with the output from an (N−1)th cycle of the PRNG; and
develop the private key and the public key pair based upon outputs from the PRNG cycles.
16. A non-transitory computer readable medium on which are stored instructions, comprising instructions which, when executed by a processor, cause the processor to:
store a descriptor value for content of a user;
store a master key value associated with a user;
generate a public and private key pair for content of the user, including instructions which cause the processor to:
modify a portion of the master key value using the descriptor value comprising instructions that when executed cause the processor to:
derive a series of bits from the descriptor value,
determine a size of the series of bits derived from the descriptor value,
replace a portion of the master key value equivalent to the size of the series of bits derived from the descriptor value with the series of bits derived from the descriptor value;
seed a pseudo random number generator (PRNG) with the modified master key value;
apply a PRNG for a plurality of cycles, and
after the plurality of cycles, using an output of one or more subsequent cycles from the PRNG to derive the public and private key pair.
17. The computer readable medium of claim 16 wherein the descriptor value is a date value related to the date of a log entry, and the public key is used to encrypt at least a portion of the log entry.
18. The computer readable medium of claim 16 wherein instructions that when executed cause the processor to modify a portion of the master key value further comprise instructions that when executed cause the processor to hash the descriptor value prior to using its bits to replace bits of the master key.