IP Library Granted Patent US 10,382,405
Granted Patent B2
US 10,382,405 · App. 15/923,330 · Granted Aug 13, 2019

Managing payload decryption via fingerprints

Inventors: Timothy William Barnett (Roswell, GA); Alexander I. Kasatkin (Alpharetta, GA); Christopher Hozumi Miyata (Tulsa, OK)
Assignee: BLUEFIN PAYMENT SYSTEMS LLC
H04L63/0428G06F11/0766G06F16/23G06F16/2379G06F16/955G06F21/44G06F21/602G06F21/6227G06F21/6245G06F21/73G06F21/77G06Q10/00G06Q20/20G06Q20/223G06Q20/382G06Q20/3823G06Q20/401G06Q20/409G06Q20/4014H04L9/0861H04L9/0877H04L9/14H04L9/3226H04L9/3234H04L63/0435H04L63/061H04L63/08H04L63/0876H04L63/12H04L63/123G06Q10/10G06Q2220/00G06Q2220/10G16H10/60H04L63/20H04L2209/24H04L2209/56H04L2209/60H04L2209/80
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,382,405
App. No.
15/923,330
Granted
Aug 13, 2019
Kind
B2
Abstract

Systems and methods for creating fingerprints for encryption devices are described herein. In various embodiments, the system includes an encryption device operatively connected to a device management system. According to particular embodiments, the device management system: 1) receives a first payload from the encryption device, the first payload including data in a particular format; 2) creates a fingerprint for the encryption device, the fingerprint including a section format for each of one or more distinct sections of the particular format; 3) storing a record of the fingerprint for the encryption device and the unique identifier at the at least one database; and 4) comparing a format of each subsequent payload received from the encryption device to the fingerprint for the device to determine whether the device has been compromised.

Claims (54)

1. A point to point encryption management computing system comprising at least one hardware processor operatively coupled to memory, the at least one hardware processor configured to:

receive a first payload from a device, the first payload comprising data in a particular format and a device indicator comprising a unique identifier used for identifying the device;

parse the first payload to extract the unique identifier;

retrieve a unique identifier table from memory;

compare the unique identifier to the unique identifier table to determine whether the unique identifier is included in the unique identifier table;

upon determining that the unique identifier is included in the unique identifier table, create a fingerprint associated with the unique identifier, wherein the fingerprint is created by:

parsing the particular format of the first payload into one or more distinct sections of the particular format;

determining the section format of each of the one or more distinct sections; and

creating a record of the section format of each of the one or more distinct sections; and

compare a format of each subsequent payload received from the device to the fingerprint for the device to determine whether the device has been compromised.

2. The point to point encryption management computing system of claim 1 , wherein the at least one hardware processor is further configured to, upon determining that the device has been compromised, change a state of the device to indicate the device is compromised.

3. The point to point encryption management computing system of claim 2 , wherein the at least one processor is further configured to only decrypt payloads of devices with states indicating they have not been compromised.

4. The point to point encryption management computing system of claim 1 , wherein comparing the format of each subsequent payload received from the device to the fingerprint for the device to determine whether the device has been compromised comprises:

receiving a second payload from the device, the second payload comprising second data in a second particular format and a second device indicator, the second device indicator comprising a second unique identifier used for identifying the device;

retrieving the fingerprint from at least one database based on the second device indicator; and

comparing the second particular format to the fingerprint to determine whether the device has been compromised.

5. The point to point encryption management computing system of claim 4 , wherein comparing the second particular format to the fingerprint to determine whether the device has been compromised comprises comparing the second format of each of one or more distinct sections of the second particular format to the section format for each of one or more distinct sections of the fingerprint.

6. The point to point encryption management computing system of claim 5 , wherein the at least one processor is further configured to, upon determining that the device has been compromised, transmit a message to a user indicating that the device has been compromised.

7. The point to point encryption management computing system of claim 6 , wherein the at least one processor is further configured to, upon determining that the device has been compromised, disregard the second payload without decrypting any data.

8. The point to point encryption management computing system of claim 1 , wherein the at least one hardware processor receives the first payload via a cloud-based communication system.

9. The point to point encryption management computing system of claim 8 , wherein the at least one hardware processor receives each subsequent payload received from the device from the cloud-based communication system.

10. A point to point encryption management computing system comprising at least one hardware processor operatively coupled to memory, the at least one hardware processor configured to:

receive an initial payload from one or more devices, each initial payload comprising encrypted and unencrypted data in a format;

parse each initial payload to extract a unique identifier;

retrieve a unique identifier table from memory;

compare each of the unique identifiers to the unique identifier table to determine whether each of the unique identifiers are included in the unique identifier table;

upon determining that each of the unique identifiers are included in the unique identifier table, create a fingerprint associated with each unique identifier, wherein each fingerprint is created by:

parsing the format of each initial payload into one or more distinct sections;

determining a section format of each of the one or more distinct sections; and

creating a record of the section format of each of the one or more distinct sections; and

compare the format of each subsequent payload from the one or more devices to the fingerprint associated with the unique identifier for the one or more devices; and

upon determining that the format of a particular payload of the subsequent payloads received from a particular device does not match the fingerprint associated with the unique identifier for the particular device, decline to decrypt any encrypted data of the particular payload and transmit a notification of declining to decrypt the encrypted data to a user computing system.

11. The point to point encryption management computing system of claim 10 , wherein the at least one hardware processor is further configured to, upon determining that the format of the particular payload does not match the fingerprint associated with the unique identifier for the particular device, changing a status associated with the particular device from active to tampered.

12. The point to point encryption management computing system of claim 10 , wherein each payload from the particular device includes one or more segments of data in a particular order.

13. The point to point encryption management computing system of claim 12 , wherein each of the one or more segments of data included in each payload from the particular device is in a particular format.

14. The point to point encryption management computing system of claim 13 , wherein the particular format for a particular segment of the one or more segments is a character format.

15. The point to point encryption management computing system of claim 14 , wherein the particular format for a second particular segment of the one or more segments is a hexadecimal format.

16. The point to point encryption management computing system of claim 10 , wherein the at least one hardware processor receives the initial payload via a cloud-based communication system.

17. The point to point encryption management computing system of claim 16 , wherein the at least one hardware processor receives each subsequent payload from the one or more devices via the cloud-based communication system.

18. A computer-implemented method for managing payload decryption via a computing system operatively coupled to an encryption device, the method comprising:

receiving, by at least one processor, a first payload from the encryption device, the first payload comprising data in a particular format, a unique identifier used for identifying the encryption device, and encrypted data;

extracting the unique identifier from the first payload;

comparing the unique identifier to a unique identifier table retrieved from memory to determine whether the unique identifier is included in the unique identifier table;

upon determining that the unique identifier is included in the unique identifier table, creating, by a fingerprint creation means, a fingerprint for the encryption device, by:

parsing the particular format into one or more distinct sections of the particular format;

determining the section format of each of the one or more distinct sections; and

creating a record of the section format of each of the one or more distinct sections;

storing a record of the fingerprint and the unique identifier in memory and changing a state of the encryption device to active by the at least one processor;

comparing, by the at least one processor, a second particular format of a subsequent payload received from the encryption device to the fingerprint for the encryption device to determine whether the encryption device has been compromised; and

upon determining that the encryption device has not been compromised, decrypting encrypted data of the subsequent payload.

19. The computer-implemented method of claim 18 , the method further comprising the steps of:

receiving, by the at least one processor, the subsequent payload from the encryption device, the subsequent payload comprising data in the second particular format and the unique identifier; and

retrieving, by the at least one processor, the fingerprint from memory for comparing the second particular format to the fingerprint.

20. The computer-implemented method of claim 19 , the method further comprising the steps of, upon determining that the encryption device has been compromised, declining, by the at least one processor, to decrypt the encrypted data of the subsequent payload.

Assignments (5)
RELEASE OF SECURITY INTEREST Recorded Jun 7, 2022
From: GOLDMAN SACHS SPECIALTY LENDING GROUP, L.P.
To: BLUEFIN PAYMENT SYSTEMS LLC
Reel/Frame 060119/0857 →
SECURITY INTEREST Recorded Jun 6, 2022
From: BLUEFIN PAYMENT SYSTEMS LLC
To: TRUIST BANK
Reel/Frame 060105/0919 →
SECURITY INTEREST Recorded Sep 27, 2019
From: BLUEFIN PAYMENT SYSTEMS LLC
To: GOLDMAN SACHS SPECIALTY LENDING GROUP, L.P.
Reel/Frame 050509/0785 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 9, 2018
From: BARNETT, TIMOTHY WILLIAM; KASATKIN, ALEXANDER I.; MIYATA, CHRISTOPHER HOZUMI
To: CAPITAL PAYMENTS, LLC
Reel/Frame 046293/0067 →
MERGER AND CHANGE OF NAME Recorded Jul 9, 2018
From: CAPITAL PAYMENTS, LLC; BLUEFIN PAYMENT SYSTEMS LLC
To: BLUEFIN PAYMENT SYSTEMS LLC
Reel/Frame 046293/0203 →
Continuity (4)
Continuation 15139034 · Apr 26, 2016
Continuation 14591223 · Jan 7, 2015
Provisional Application 61955739 · Mar 19, 2014
Related Publication 20180211251A1 · Jul 26, 2018