Distributed encryption

Patent metadata

Field	Value
Publication number	US-11706202-B2
Application number	US-202117157367-A
Country	US
Kind code	B2
Filing date	Jan 25, 2021
Priority date	Nov 29, 2017
Publication date	Jul 18, 2023
Grant date	Jul 18, 2023

Abstract

Examples described herein include systems and methods for performing distributed encryption across multiple devices. An example method can include a first device discovering a second device that shares a network. The device can identify data to be sent to a server and calculate a checksum for that data. The device can then split the data into multiple portions and send a portion to the second device, along with a certificate associated with the server for encrypting the data. The first device can encrypt the portion of data it retained. The first device can receive an encrypted version of the second portion of the data sent to the second device. The first device can merge these two portions and send the merged encrypted data to the server, along with the checksum value. The server can decrypt the data and confirm that it reflects the original set of data.

First claim

What is claimed is:

1. A method for using distributed encryption to send data from a first device to a recipient device, comprising:
identifying a second device and a third device that share a network with the first device;
calculating a checksum for the data;
dividing, at the first device, the data into a first portion and a second portion;
sending, from the first device to the second device, the first portion of the data and a certificate associated with the recipient device;
sending, from the first device to the third device, the second portion of the data and the certificate;
receiving, at the first device from the second device, a first encrypted portion that is an encrypted version of the first portion of the data;
receiving, at the first device from the third device, a second encrypted portion that is an encrypted version of the second portion of the data;
merging the first encrypted portion and the second encrypted portion to form merged encrypted data; and
sending the merged encrypted data and checksum to the recipient device.

2. The method of claim 1 , wherein sending the merged encrypted data further comprises sending an indication of a number of encrypted portions used to form the merged encrypted data.

3. The method of claim 1 , wherein sending the merged encrypted data further comprises sending a sample size of the data.

4. The method of claim 1 , further comprising:
sending, from the first device to a fourth device, a third portion of the data and the certificate;
receiving, at the first device from the fourth device, a third encrypted portion that is an encrypted version of the third portion of the data; and
merging the first, second, and third encrypted portions to form the merged encrypted data.

5. The method of claim 1 , wherein the second device is identified based, at least in part, on whether the second device is on battery power.

6. The method of claim 1 , wherein the second device is identified based, at least in part, on a battery level of the second device.

7. The method of claim 1 , wherein sending the merged encrypted data is performed in response to a digitally signed command from the recipient device.

8. A non-transitory, computer-readable medium comprising instructions that, when executed by a hardware-based processor, perform stages for using distributed encryption to send data from a first device to a recipient device, the stages comprising:
identifying a second device and a third device that share a network with the first device;
calculating a checksum for the data;
dividing, at the first device, the data into a first portion and a second portion;
sending, from the first device to the second device, the first portion of the data and a certificate associated with the recipient device;
sending, from the first device to the third device, the second portion of the data and the certificate;
receiving, at the first device from the second device, a first encrypted portion that is an encrypted version of the first portion of the data;
receiving, at the first device from the third device, a second encrypted portion that is an encrypted version of the second portion of the data;
merging the first encrypted portion and the second encrypted portion to form merged encrypted data; and
sending the merged encrypted data and checksum to the recipient device.

9. The non-transitory, computer-readable medium of claim 8 , wherein sending the merged encrypted data further comprises sending an indication of a number of encrypted portions used to form the merged encrypted data.

10. The non-transitory, computer-readable medium of claim 8 , wherein sending the merged encrypted data further comprises sending a sample size of the data.

11. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
sending, from the first device to a fourth device, a third portion of the data and the certificate;
receiving, at the first device from the fourth device, a third encrypted portion that is an encrypted version of the third portion of the data; and
merging the first, second, and third encrypted portions to form the merged encrypted data.

12. The non-transitory, computer-readable medium of claim 8 , wherein the second device is identified based, at least in part, on whether the second device is on battery power.

13. The non-transitory, computer-readable medium of claim 8 , wherein the second device is identified based, at least in part, on a battery level of the second device.

14. The non-transitory, computer-readable medium of claim 8 , wherein sending the merged encrypted data is performed in response to a digitally signed command from the recipient device.

15. A system for using distributed encryption to send data from a first device to a recipient device, the system comprising:
a hardware-based processor; and
a non-transitory, computer-readable medium comprising instructions that, when executed by the processor, perform stages comprising:
identifying a second device and a third device that share a network with the first device;
calculating a checksum for the data;
dividing, at the first device, the data into a first portion and a second portion;
sending, from the first device to the second device, the first portion of the data and a certificate associated with the recipient device;
sending, from the first device to the third device, the second portion of the data and the certificate;
receiving, at the first device from the second device, a first encrypted portion that is an encrypted version of the first portion of the data;
receiving, at the first device from the third device, a second encrypted portion that is an encrypted version of the second portion of the data;
merging the first encrypted portion and the second encrypted portion to form merged encrypted data; and
sending the merged encrypted data and checksum to the recipient device.

16. The system of claim 15 , wherein sending the merged encrypted data further comprises sending an indication of a number of encrypted portions used to form the merged encrypted data.

17. The system of claim 15 , wherein sending the merged encrypted data further comprises sending a sample size of the data.

18. The system of claim 15 , the stages further comprising:
sending, from the first device to a fourth device, a third portion of the data and the certificate;
receiving, at the first device from the fourth device, a third encrypted portion that is an encrypted version of the third portion of the data; and
merging the first, second, and third encrypted portions to form the merged encrypted data.

19. The system of claim 15 , wherein the second device is identified based, at least in part, on whether the second device is on battery power.

20. The system of claim 15 , wherein sending the merged encrypted data is performed in response to a digitally signed command from the recipient device.

Assignees

• Vmware Inc

Inventors

• Aluvala Suman
• Panchapakesan Ramani
• Kesavan Rajneesh
• Kochhar Arjun

Classifications

• H04L63/0485 Primary

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title