Selective encryption delineation

Patent metadata

Field	Value
Publication number	US-10601781-B2
Application number	US-201615190512-A
Country	US
Kind code	B2
Filing date	Jun 23, 2016
Priority date	Oct 12, 2015
Publication date	Mar 24, 2020
Grant date	Mar 24, 2020

Abstract

Decoding a partially encrypted data stream may include receiving and scanning the partially encrypted data stream. Scanning the partially encrypted data stream may include identifying an encrypted portion sentinel in the partially encrypted data stream subsequent to a first portion, identifying an encrypted portion in the partially encrypted data stream subsequent to the encrypted portion sentinel, and generating a decrypted data portion by decrypting the encrypted portion. Decrypting the encrypted portion may include identifying an encrypted data portion in the encrypted portion, the encrypted data portion omitting an end encrypted portion sentinel, decrypting the encrypted data portion, and identifying an end encrypted portion sentinel in the encrypted portion subsequent to the encrypted data portion. Decoding the partially encrypted data stream may include including the decrypted data portion in the decrypted output data stream, and outputting the decrypted output data stream to a client device in the second network domain.

First claim

What is claimed is:

1. A method of decrypting a partially encrypted data stream to facilitate exchanging a mixture of sensitive and insensitive data, the method comprising:
receiving, from a remote server in a first network domain, at an edge encryption proxy in a second network domain, the partially encrypted data stream;
scanning the partially encrypted data stream, wherein scanning the partially encrypted data stream includes:
identifying a first portion of the partially encrypted data stream, wherein the first portion omits an encrypted portion sentinel;
wherein the end encrypted portion sentinel comprises at least one value selected based at least in part on a determination that the at least one value is statistically unlikely to be included to be included in the partially encrypted data stream;
including the first portion in a decrypted output data stream;
identifying encryptionmetadata in the partially encrypted data stream;
identifying the encrypted portion sentinel in the partially encrypted data stream subsequent to the first portion, wherein the encrypted portion sentinel is configured to indicate that subsequent data is encrypted until a subsequent end encrypted portion sentinel is present in the partially encrypted data stream, wherein an end encrypted portion sentinel comprises at least one value selected based at least in part on a determination that the at least one value is statistically unlikely to be included in the partially encrypted data stream; and
identifying an encrypted portion in the partially encrypted data stream subsequent to the encrypted portion sentinel;

generating a decrypted data portion by decrypting the encrypted portion in response to identifying the encrypted portion sentinel, wherein decrypting the encrypted portion includes:
identifying an encrypted data portion in the encrypted portion, the encrypted data portion omitting the end encrypted portion sentinel;
decrypting the encrypted data portion using at least in part the encryption metadata before having identified the end encrypted portion sentinel; and
defining an end to the encrypted data portion in response to identifying the end encrypted portion sentinel in the encrypted portion subsequent to the encrypted data portion, wherein the end encrypted portion sentinel is configured to indicate that subsequent data is decrypted until a subsequent encrypted portion sentinel is present in the partially encrypted data stream;

including the decrypted data portion in the decrypted output data stream; and
outputting the decrypted output data stream to a client device in the second network domain.

2. The method of claim 1 , wherein scanning the partially encrypted data stream includes performing byte-wise scanning operations.

3. The method of claim 1 , wherein the first portion includes unencrypted data.

4. The method of claim 1 , wherein the partially encrypted data stream includes data encoded in accordance with a defined encoding scheme.

5. The method of claim 4 , wherein the defined encoding scheme is a Unicode encoding scheme.

6. The method of claim 4 , wherein: the encrypted portion sentinel is a first valid code in the defined encoding scheme; the end encrypted portion sentinel is a second valid code in the defined encoding scheme that differs from the encrypted portion sentinel; the first portion includes codes that are valid in the defined encoding scheme and omits codes other than codes that are valid in the defined encoding scheme; and the encrypted portion includes codes that are valid in the defined encoding scheme, omits codes other than codes that are valid in the defined encoding scheme, and omits the encrypted portion sentinel.

7. The method of claim 1 , wherein decrypting the encrypted portion includes: identifying encryption metadata in the encrypted portion by: identifying an encryption metadata start sentinel in the encrypted portion; identifying the encryption metadata in the encrypted portion subsequent to the encryption metadata start sentinel, wherein the encryption metadata omits the encryption metadata start sentinel, and omits an encryption metadata end sentinel; and identifying the encryption metadata end sentinel in the encrypted portion subsequent to the encryption metadata; and omitting the encryption metadata start sentinel, the encryption metadata, and the encryption metadata end sentinel from the encrypted data portion.

8. The method of claim 1 , wherein decrypting the encrypted data portion includes decrypting the encrypted data portion using decryption information that is unavailable to the remote server.

9. The method of claim 1 , wherein scanning the partially encrypted data stream comprises: performing byte-wise scanning operations; and entering an unencrypted state in response to identifying the end encrypted portion sentinel.

10. A non-transitory computer-readable storage medium, comprising executable instructions that, when executed by a processor, cause the processor to perform operations to exchange a mixture of sensitive and insensitive data, the operations comprising:
receiving, at an edge encryption proxy in a first network domain, from a client device in the first network domain, a first request for information, the first request indicating a remote server in a second network domain;
transmitting a second request for the information to the remote server on behalf of the client device;
in response to transmitting the second request to the remote server, receiving, from the remote server, at the edge encryption proxy, a partially encrypted data stream;
including a first portion of the partially encrypted data stream in a decrypted output data stream, wherein the first portion omits an encrypted portion sentinel, wherein the encrypted portion sentinel is configured to indicate that subsequent data is encrypted until a subsequent end encrypted portion sentinel, wherein an end encrypted portion sentinel comprises at least one value selected based at least in part on a determination that the at least one value is statistically unlikely to be included in the partially encrypted data stream;
identifying encryption metadata in the partially encrypted data stream;
identifying an encrypted portion in the partially encrypted data stream subsequent to the encrypted portion sentinel in the partially encrypted data stream, the encrypted portion sentinel subsequent to the first portion in the partially encrypted data stream is present in the partially encrypted data stream;
generating a decrypted data portion by decrypting the encrypted portion in response to identifying the encrypted portion sentinel, wherein decrypting the encrypted portion includes:
generating the decrypted data portion by decrypting an encrypted data portion from the encrypted portion before having identified the end encrypted portion sentinel, such that the decrypted data portion includes at least a portion of the information, the encrypted data portion omitting the end encrypted portion sentinel, wherein the end encrypted portion sentinel is configured to indicate that subsequent data is decrypted until a subsequent encrypted portion sentinel, and wherein the decrypting of the encrypted data portion uses at least in part the encryption metadata; and
defining an end of the encrypted data portion in response to identifying the end encrypted portion sentinel in the encrypted portion subsequent to the encrypted data portion when the end encrypted portion sentinel is present in the partially encrypted data stream;

including the decrypted data portion in the decrypted output data stream; and
outputting the decrypted output data stream to the client device in response to the first request.

11. T

Assignees

• Servicenow Inc

Inventors

• Merritt Norris

Classifications

• H04L63/0457

  wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption (cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065) · CPC title

• H04L9/36

  with means for detecting characters not meant for transmission · CPC title

• H04L2209/34

  Encoding or coding, e.g. Huffman coding or error correction · CPC title

• H04L63/0281 Primary

  Proxies · CPC title

• H04L9/06 Primary

  the encryption apparatus using shift registers or memories for block-wise {or stream} coding, e.g. DES systems {or RC4; Hash functions; Pseudorandom sequence generators} · CPC title