Distributed encryption

Patent metadata

Field	Value
Publication number	US-10904230-B2
Application number	US-201815898670-A
Country	US
Kind code	B2
Filing date	Feb 19, 2018
Priority date	Nov 29, 2017
Publication date	Jan 26, 2021
Grant date	Jan 26, 2021

Abstract

Examples described herein include systems and methods for performing distributed encryption across multiple devices. An example method can include a first device discovering a second device that shares a network. The device can identify data to be sent to a server and calculate a checksum for that data. The device can then split the data into multiple portions and send a portion to the second device, along with a certificate associated with the server for encrypting the data. The first device can encrypt the portion of data it retained. The first device can receive an encrypted version of the second portion of the data sent to the second device. The first device can merge these two portions and send the merged encrypted data to the server, along with the checksum value. The server can decrypt the data and confirm that it reflects the original set of data.

First claim

What is claimed is:

1. A method for using distributed encryption to send data from a first device to a server, comprising:
discovering a second device sharing a network with the first device;
calculating a checksum for the data;
dividing, at the first device, the data into a first portion and a second portion;
sending, from the first device to the second device, the second portion of the data and a certificate associated with the server;
encrypting the first portion of the data at the first device to form a first encrypted portion;
receiving, at the first device from the second device, a second encrypted portion that is an encrypted version of the second portion of the data, wherein the second device encrypts the second portion of the data using the certificate;
merging, at the first device, the first encrypted portion and the second encrypted portion to form merged encrypted data; and
sending, from the first device to the server, the merged encrypted data and checksum.

2. The method of claim 1 , wherein sending to the server further comprises sending information regarding a number of encrypted portions used to form the merged encrypted data.

3. The method of claim 1 , wherein sending to the server further comprises sending a sample size of the data.

4. The method of claim 1 , further comprising:
sending, from the first device to a third device, a third portion of the data and the certificate associated with the server;
receiving, at the first device from the third device, a third encrypted portion that is an encrypted version of the third portion of the data; and
merging the first, second, and third encrypted portions to form the merged encrypted data.

5. The method of claim 1 , wherein the second device is selected based, at least in part, on whether the second device is on battery power.

6. The method of claim 1 , wherein receiving further comprises receiving, at the first device from the second device, an indication of a current power level of the second device.

7. The method of claim 1 , wherein sending the merged encrypted data is performed in response to a digitally signed command from the server.

8. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor of a user device, perform stages for using distributed encryption to send data from a first device to a server, the stages comprising:
discovering a second device sharing a network with the first device;
calculating a checksum for the data;
dividing, at the first device, the data into a first portion and a second portion;
sending, from the first device to the second device, the second portion of the data and a certificate associated with the server;
encrypting the first portion of the data at the first device to form a first encrypted portion;
receiving, at the first device from the second device, a second encrypted portion that is an encrypted version of the second portion of the data, wherein the second device encrypts the second portion of the data using the certificate;
merging, at the first device, the first encrypted portion and the second encrypted portion to form merged encrypted data; and
sending, from the first device to the server, the merged encrypted data and checksum.

9. The non-transitory, computer-readable medium of claim 8 , wherein sending to the server further comprises sending information regarding a number of encrypted portions used to form the merged encrypted data.

10. The non-transitory, computer-readable medium of claim 8 , wherein sending to the server further comprises sending a sample size of the data.

11. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
sending, from the first device to a third device, a third portion of the data and the certificate associated with the server;
receiving, at the first device from the third device, a third encrypted portion that is an encrypted version of the third portion of the data; and
merging the first, second, and third encrypted portions to form the merged encrypted data.

12. The non-transitory, computer-readable medium of claim 8 , wherein the second device is selected based, at least in part, on whether the second device is on battery power.

13. The non-transitory, computer-readable medium of claim 8 , wherein receiving further comprises receiving, at the first device from the second device, an indication of a current power level of the second device.

14. The non-transitory, computer-readable medium of claim 8 , wherein sending the merged encrypted data is performed in response to a digitally signed command from the server.

15. A system for using distributed encryption to send data to a server, comprising:
a first device having a processor and memory storage;
wherein the memory storage contains a non-transitory, computer-readable medium comprising instructions that, when executed by the processor, carry out stages comprising:
discovering a second device sharing a network with the first device;
calculating a checksum for the data;
dividing, at the first device, the data into a first portion and a second portion;
sending, from the first device to the second device, the second portion of the data and a certificate associated with the server, wherein the second device encrypts the second portion of the data using the certificate;
encrypting a first portion of the data at the first device to form a first encrypted portion;
receiving, at the first device from the second device, a second encrypted portion that is an encrypted version of the second portion of the data;
merging, at the first device, the first encrypted portion and the second encrypted portion to form merged encrypted data; and
sending, from the first device to the server, the merged encrypted data and checksum.

16. The system of claim 15 , wherein sending to the server further comprises sending information regarding a number of encrypted portions used to form the merged encrypted data.

17. The system of claim 15 , wherein sending to the server further comprises sending a sample size of the data.

18. The system of claim 15 , the stages further comprising:
sending, from the first device to a third device, a third portion of the data and the certificate associated with the server;
receiving, at the first device from the third device, a third encrypted portion that is an encrypted version of the third portion of the data; and
merging the first, second, and third encrypted portions to form the merged encrypted data.

19. The system of claim 15 , wherein the second device is selected based, at least in part, on whether the second device is on battery power.

20. The system of claim 15 , wherein receiving further comprises receiving, at the first device from the second device, an indication of a current power level of the second device.

Assignees

• Vmware Inc

Inventors

• Aluvala Suman
• Panchapakesan Ramani
• Kesavan Rajneesh
• Kochhar Arjun

Classifications

• H04L2209/80

  Wireless · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L63/0485 Primary

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title

• H04L9/3247

  involving digital signatures · CPC title