Systems and methods for smart cipher selection
View Patent ↗A computer-implemented method for smart cipher selection may include (1) receiving, at a server and from a client, a request to communicate according to a cipher for encryption, the request containing a client list of ciphers available at the client, (2) identifying a server list of ciphers available at the server, (3) measuring, in response to receiving the request, a resource load at the server and a risk factor indicating a degree of risk posed by the client, and (4) selecting a common cipher, from the client list and the server list, for encrypted communication based on the measured resource load at the server and the measured risk factor indicating the degree of risk posed by the client. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for smart cipher selection, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, at a server and from a client, a request to communicate according to a cipher for encryption, the request containing a client list of ciphers available at the client;
identifying a server list of ciphers available at the server;
measuring, in response to receiving the request, a risk factor indicating a degree of risk posed by the client, wherein:
the risk measurement indicates that the risk factor does not exceed a predetermined risk threshold;
the risk factor comprising at least one of:
a geolocation of the client;
an Internet protocol address of the client;
a time of day of the request from the client;
measuring, in response to receiving the request, a resource load at the server that comprises a measurement of computational processing power at the server;
determining whether the resource-load measurement exceeds a predetermined resource-load threshold;
in response to determining that the resource-load measurement exceeds the predetermined resource-load threshold, selecting from both the client list and the server list a common cipher that has a lower level of complexity than at least one other common cipher for encrypted communication based on both the resource-load measurement exceeding the predetermined resource-load threshold and the risk factor not exceeding the predetermined risk threshold;
in response to determining that the resource-load measurement does not exceed the predetermined resource-load threshold, selecting from both the client list and the server list, based on both the resource-load measurement not exceeding the predetermined resource-load threshold and the risk factor not exceeding the predetermined risk threshold, a common cipher that has a higher level of complexity than the common cipher that would have been selected had the resource-load measurement exceeded the predetermined resource-load threshold;
encrypting communication between the server and the client using the selected common cipher;
transmitting the communication between the server and the client that was encrypted using the selected common cipher.
2. The computer-implemented method of claim 1 , wherein:
the predetermined risk threshold is one of a set of predetermined thresholds correlated with a set of risks posed by clients; and
selecting the common cipher for encrypted communication comprises selecting the common cipher based at least in part on which of the set of predetermined thresholds the risk factor at the client falls below.
3. The computer-implemented method of claim 1 , wherein:
the predetermined resource-load threshold is one of a set of predetermined thresholds correlated with a set of server resource loads; and
selecting the common cipher for encrypted communication comprises selecting the common cipher based at least in part on which of the set of predetermined thresholds the resource load at the server exceeds.
4. The computer-implemented method of claim 1 , wherein selecting the common cipher for encrypted communication comprises:
identifying a required resource load for the common cipher; and
determining whether the resource-load measurement satisfies the required resource load.
5. The computer-implemented method of claim 1 , further comprising categorizing each cipher in the server list of ciphers according to a required resource load for the cipher.
6. The computer-implemented method of claim 1 , wherein the risk factor indicating the degree of risk posed by the client comprises a reputation of the client.
7. The computer-implemented method of claim 1 , wherein selecting the common cipher comprises allowing use of a cipher categorized below a safety threshold based on the risk measurement indicating that the risk factor does not exceed the predetermined risk threshold.
8. The computer-implemented method of claim 1 , wherein the geolocation of the client comprises a geolocation that is absent from a predetermined list of non-secure geolocations.
9. The computer-implemented method of claim 1 , wherein the Internet protocol address of the client comprises an Internet protocol address that is absent from a predetermined list of suspicious Internet protocol addresses.
10. The computer-implemented method of claim 1 , wherein the time of day of the request from the client falls within a predetermined range of times of day designated as low-risk times of day.
11. The computer-implemented method of claim 1 , wherein the measured resource load at the server comprises a central processing unit load.
12. The computer-implemented method of claim 1 , wherein the resource-load measurement measures at least one of:
hard drive access;
available random access memory;
processor heating;
use of virtual machines; and
open process threads.
13. A system for smart cipher selection, the system comprising:
a receiving module, stored in memory, that receives, at a server and from a client, a request to communicate according to a cipher for encryption, the request containing a client list of ciphers available at the client;
an identification module, stored in memory, that identifies a server list of ciphers available at the server;
a measuring module, stored in memory, that performs the following in response to receiving the request:
measures a risk factor indicating a degree of risk posed by the client, wherein:
the risk measurement indicates that the risk factor does not exceed a predetermined risk threshold;
the risk factor comprising at least one of:
a geolocation of the client;
an Internet protocol address of the client;
a time of day of the request from the client;
measures, in response to receiving the request, a resource load at the server that comprises a measurement of computational processing power at the server;
determines whether the resource-load measurement exceeds a predetermined resource-load threshold;
a selection module, stored in memory, that:
in response to determining that the resource-load measurement exceeds the predetermined resource-load threshold, selects from both the client list and the server list a common cipher that has a lower level of complexity than at least one other common cipher for encrypted communication based on both the resource-load measurement exceeding the predetermined resource-load threshold and the risk factor not exceeding the predetermined risk threshold;
in response to determining that the resource-load measurement does not exceed the predetermined resource-load threshold, selects from both the client list and the server list, based on both the resource-load measurement not exceeding the predetermined resource-load threshold and the risk factor not exceeding the predetermined risk threshold, a common cipher that has a higher level of complexity than the common cipher that would have been selected had the resource-load measurement exceeded the predetermined resource-load threshold;
encrypts communication between the server and the client using the selected common cipher;
transmits the communication between the server and the client that was encrypted using the selected common cipher;
at least one physical processor configured to execute the receiving module, the identification module, the measuring module, and the selection module.
14. The system of claim 13 , wherein:
the predetermined risk threshold is one of a set of predetermined thresholds correlated with a set of risks posed by clients; and
the selection module selects the common cipher for encrypted communication by selecting the common cipher based at least in part on which of the set of predetermined thresholds the risk factor at the client falls below.
15. The system of claim 13 , wherein:
the predetermined resource-load threshold is one of a set of predetermined thresholds correlated with a set of server resource loads; and
the selection module selects the common cipher for encrypted communication by selecting the common cipher based at least in part on which of the set of predetermined thresholds the resource load at the server exceeds.
16. The system of claim 13 , wherein the selection module selects the common cipher for encrypted communication by:
identifying a required resource load for the common cipher; and
determining whether the resource-load measurement satisfies the required resource load.
17. The system of claim 13 , wherein the selection module categorizes each cipher in the server list of ciphers according to a required resource load for the cipher.
18. The system of claim 13 , wherein the risk factor indicating the degree of risk posed by the client comprises a reputation of the client.
19. The system of claim 13 , wherein the selection module selects the common cipher by allowing use of a cipher categorized below a safety threshold based on the risk measurement indicating that the risk factor does not exceed the predetermined risk threshold.
20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
receive, at a server and from a client, a request to communicate according to a cipher for encryption, the request containing a client list of ciphers available at the client;
identify a server list of ciphers available at the server;
measure, in response to receiving the request, a risk factor indicating a degree of risk posed by the client, wherein:
the risk measurement indicates that the risk factor does not exceed a predetermined risk threshold;
the risk factor comprising at least one of:
a geolocation of the client;
an Internet protocol address of the client;
a time of day of the request from the client;
measure, in response to receiving the request, a resource load at the server that comprises a measurement of computational processing power at the server;
determine whether the resource-load measurement exceeds a predetermined resource-load threshold;
in response to determining that the resource-load measurement exceeds the predetermined resource-load threshold, select from both the client list and the server list a common cipher that has a lower level of complexity than at least one other common cipher for encrypted communication based on both the resource-load measurement exceeding the predetermined resource-load threshold and the risk factor not exceeding the predetermined risk threshold;
in response to determining that the resource-load measurement does not exceed the predetermined resource-load threshold, select from both the client list and the server list, based on both the resource-load measurement not exceeding the predetermined resource-load threshold and the risk factor not exceeding the predetermined risk threshold, a common cipher that has a higher level of complexity than the common cipher that would have been selected had the resource-load measurement exceeded the predetermined resource-load threshold;
encrypt communication between the server and the client using the selected common cipher;
transmit the communication between the server and the client that was encrypted using the selected common cipher.