Granted Patent B2

US 12,732,377 · App. 18/638,593 · Granted Sep 8, 2026

Inventor: Bertrand F Cambou (Flagstaff, AZ)

Assignee: ARIZONA BOARD OF REGENTS ON BEHALF OF NORTHERN ARIZONA UNIVERSITY

H04L9/3236H04L9/0825H04L9/0869H04L9/3271

Abstract

Claims (66)

1 . A method of storing a remotely decryptable encrypted file M on a remote device, comprising:

receiving a digital file C;

generating a nonce ω;

generating a random stream S;

hashing C with ω and applying the resulting hash to an extended output function resulting in C*;

organize C* into d addressable segments having addresses 1 to d;

derive a set of N challenges from S, where each challenge encodes an address within the range of 1 to d;

extract from C* a sequential, addressable set of N responses corresponding to the addresses in C* encoded in the set of N challenges;

randomly pick a binary number of K having N bits, and encrypt M with K, resulting in M*;

store M*;

identify those responses in the sequential, addressable set of N responses located at addresses having the same sequential positions of a first binary symbol in K, resulting in an identified subset of f responses;

store the identified subset of f responses in non-volatile memory at the remote device.

2 . The method of claim 1 , further including steps of deleting C*, the derived set of N challenges, the sequential, addressable set of N responses other than the identified subset of f responses, and K.

3 . A method of decrypting a file an encrypted file M*, encrypted according to the method of claim 1 , comprising:

hashing C with ω and applying the resulting hash to an extended output function resulting in C*;

organizing C* into d addressable segments having addresses 1 to d;

deriving a set of N challenges from S, where each challenge encodes an address within the range of 1 to d;

extracting from C* a sequential, addressable set of N responses corresponding to the addresses in C* encoded in the set of N challenges;

identifying positions in the addressable set of N responses occupied by responses that match responses in the identified subset of f responses;

constructing a key of length N having the first binary symbol at the identified positions, and a second binary symbol at the remaining positions;

using the constructed key to decrypt M.

4 . The method of claim 3 , wherein identifying positions in the addressable set of N responses occupied by responses that match responses in the identified subset of f responses comprises computing a Hamming distance between each response in the set of N responses and each response in the subset of f responses and identifying a match where the Hamming distance is below some threshold.

5 . The method of claim 1 , wherein deriving a set of N challenges from S, where each challenge encodes an address within the range of 1 to d comprises hashing S and applying an extended output function to the resulting hash.

6 . A method of managing a digital file at terminal

device, comprising:

providing a first list of challenges to a challenge-response-pair (CRP) mechanism, and receiving a first ordered sequence of responses;

generating a random binary key;

encrypting the digital file with the random binary key;

selecting a subset of responses in the first ordered sequence of responses, the selected subset of responses comprising responses that have positions in the ordered sequence that correspond to positions in the random binary key occupied a first binary symbol;

storing the selected subset of responses and information from which the first list of challenges is capable of being generated; and

not storing the random binary key.

7 . The method of claim 6 , further comprising not storing or deleting the random binary key, and the first list of challenges.

8 . The method of claim 6 , wherein the CRP mechanism is generated by producing an ordered sequence of responses from a file C with a cryptographic hashing algorithm.

9 . The method of claim 6 further comprising:

using the information from which the first list of challenges is capable of being generated to generate the first list of challenges;

receiving the selected subset of responses;

using the first list of challenges to generate a second ordered sequence of responses from the CRP mechanism;

comparing each response in the selected subset of responses to each of the responses in the second ordered sequence of responses and identifying matches;

constructing a binary key by placing the first binary symbol at positions in the key equal to positions in the second ordered sequence of responses for which the response matches a response in the selected subset of responses, and placing a second binary symbol at the remaining positions, and

decrypting the digital file using the binary key.

10 . A method of managing a digital file F on a terminal device with a server device, comprising:

performing an enrollment procedure, comprising:

using a random seed to generate a public/private key pair Pk/Sk;

using the private key Sk to encrypt F, resulting in C;

using C to generate a first ordered sequence of addressable responses;

generating a random binary key K;

selecting, within the ordered sequence of addressable responses, a subset of responses (Kr) having a position within the ordered sequence that are the same as positions of a first binary symbol within K;

encrypt Pk with K resulting in M*;

store, at the terminal device, a subkey Kc including M* and C, and

store, at the server device, F and Kr;

delete K.

11 . The method of claim 10 , further comprising a decryption cycle for digital file F, comprising:

receiving, at the terminal device, Kr;

using C to generate a second ordered sequence of addressable responses;

compare every response in Kr to every response in the second ordered sequence of addressable responses to identify places in the second ordered sequence where matches occur;

construct a copy of K by assigning the first binary symbol to every position in K for which a matching position in the second ordered sequence of addressable responses was identified, and by assigning a second binary symbol to every other position in K;

use the copy of K to decrypt M* resulting in Pk;

use Pk to decrypt C resulting in F.

12 . The method of claim 10 , wherein comparing every response in Kr to every response in the second ordered sequence of addressable responses to identify places in the second ordered sequence where matches occur comprises determining matches on the basis of a bit-error-rate (BER) below some threshold.

13 . The method of claim 12 , wherein the threshold is 25%.

14 . The method of claim 10 , wherein comparing every response in Kr to every response in the second ordered sequence of addressable responses to identify places in the second ordered sequence where matches occur comprises computing a Hamming distance between each response in the second ordered sequence and each response in Kr, and identifying a match when the Hamming distance falls below a predetermined threshold.

15 . The method of claim 10 , wherein comparing every response in Kr to every response in the second ordered sequence of addressable responses to identify places in the second ordered sequence where matches occur comprises computing a Hamming distance between each response in the second ordered sequence and each response in Kr, and identifying a match when the Hamming distance for a pair is the minimum Hamming distance for all computed pairs involving a given response from Kr.

16 . The method of claim 10 , wherein Sk/Pk are an asymmetrical encryption key pair.

17 . The method of claim 10 , wherein Sk/Pk are a symmetrical encryption key pair.

18 . The method of claim 10 , wherein using C to generate a first ordered sequence of addressable responses comprises hashing C, concatenating the resulting hash with a nonce, and extending the result with an extended output function.

19 . The method of claim 18 , wherein the extended output function is Secure Hash Algorithm KECCAK (SHAKE).

Assignments (1)

Continuity (3)

References Cited (42)