Dynamic selection and calibration of ciphers based on network and resource constraints

Patent metadata

Field	Value
Publication number	US-12088713-B2
Application number	US-202117385287-A
Country	US
Kind code	B2
Filing date	Jul 26, 2021
Priority date	Jul 26, 2021
Publication date	Sep 10, 2024
Grant date	Sep 10, 2024

Abstract

The disclosure provides an approach for cryptographic agility. Embodiments include receiving a request from an application for a cryptographic operation, wherein the request is associated with a computing device. Embodiments include determining one or more resource constraints related to the computing device. Embodiments include selecting, based on the one or more resource constraints, a cryptographic technique from a plurality of cryptographic techniques associated with indications of resource requirements. Embodiments include performing the cryptographic operation using the cryptographic technique. Embodiments include providing a response to the application based on performing the cryptographic operation.

First claim

We claim:

1. A method, comprising:
receiving, at a cryptographic agility system and from an application, via an application programming interface (API), a request related to a cryptographic operation, wherein the request is associated with a computing device, the request comprising one or more of:
a set of data to be encrypted; or
contextual information related to the request;

determining, with the cryptographic agility system, one or more resource constraints related to the computing device;
selecting, with the cryptographic agility system and based at least in part on the one or more resource constraints, a cryptographic technique from a plurality of cryptographic techniques associated with indications of resource requirements for each of the plurality of cryptographic techniques; and
providing, from the cryptographic agility system and to the application, via the API, a response to the request, the response comprising at least one of:
data encrypted by the selected cryptographic technique; or
information related to performing the selected cryptographic technique to encrypt the data on the computing device.

2. The method of claim 1 , wherein the cryptographic agility system and the application run on the computing device.

3. The method of claim 1 , wherein determining the one or more resource constraints related to the computing device comprises determining one or more of:
processor availability on the computing device;
memory availability on the computing device;
a network performance metric related to the computing device;
hardware-based cryptographic acceleration device availability on the computing device;
physical storage availability on the computing device; or
power availability on the computing device.

4. The method of claim 1 , wherein:
the method further comprises:
allowing the application to interact with the cryptographic agility system without knowledge of the cryptographic agility system;

the API is an abstracted crypto API;
the cryptographic agility system comprises an agility shim that provides the abstracted crypto API; and
receiving the request from the application comprises receiving a call from the application to a generic cryptographic function of the abstracted crypto API to allow the application to interact with the cryptographic agility system without knowledge of the cryptographic agility system.

5. The method of claim 1 , wherein selecting the cryptographic technique comprises selecting the cryptographic technique based at least in part on contextual information related to the request, the contextual information comprising one or more of the following:
organizational context, comprising one or more of the following:
a geographic region related to the request;
one or more industry mandates related to the request; or
one or more government mandates related to the request; or

user context, comprising one or more of the following:
an identity of a user related to the request;
one or more characteristics of data related to the request; or
one or more characteristics of the application.

6. The method of claim 1 , wherein selecting the cryptographic technique comprises selecting the cryptographic technique based at least in part on compliance of the selected cryptographic technique with one or more policies related to the request.

7. The method of claim 6 , wherein the one or more policies indicate a required level of security based on one or more attributes related to the request.

8. The method of claim 1 , wherein selecting the cryptographic technique comprises selecting a cryptographic algorithm and one or more configuration parameters related to the cryptographic algorithm.

9. The method of claim 1 , further comprising switching to an alternative cryptographic technique based on one or more updated resource constraints or capabilities related to the computing device.

10. A system, comprising:
one or more processors; and
a non-transitory computer-readable medium storing instructions that, when executed by the one or more processors, cause the system to perform operations comprising:
receiving, at a cryptographic agility system and from an application, via an application programming interface (API), a request related to a cryptographic operation, wherein the request is associated with a computing device, the request comprising one or more of:
a set of data to be encrypted; or
contextual information related to the request;

determining, with the cryptographic agility system, one or more resource constraints related to the computing device;
selecting, with the cryptographic agility system and based at least in part on the one or more resource constraints, a cryptographic technique from a plurality of cryptographic techniques associated with indications of resource requirements for each of the plurality of cryptographic techniques; and
providing, from the cryptographic agility system and to the application, via the API, a response to the request, the response comprising at least one of:
data encrypted by the selected cryptographic technique; or
information related to performing the selected cryptographic technique to encrypt the data on the computing device.

11. The system of claim 10 , wherein determining the one or more resource constraints related to the computing device comprises determining one or more of:
processor availability on the computing device;
memory availability on the computing device;
a network performance metric related to the computing device;
hardware-based cryptographic acceleration device availability on the computing device;
physical storage availability on the computing device; or
power availability on the computing device.

12. The system of claim 10 , wherein:
the method further comprises:
allowing the application to interact with the cryptographic agility system without knowledge of the cryptographic agility system;

the API is an abstracted crypto API;
the cryptographic agility system comprises an agility shim that provides the abstracted crypto API; and
receiving the request from the application comprises receiving a call from the application to a generic cryptographic function of the abstracted crypto API to allow the application to interact with the cryptographic agility system without knowledge of the cryptographic agility system.

13. The system of claim 10 , wherein selecting the cryptographic technique comprises selecting the cryptographic technique based at least in part on contextual information related to the request, the contextual information comprising one or more of the following:
organizational context, comprising one or more of the following:
a geographic region related to the request;
one or more industry mandates related to the request; or
one or more government mandates related to the request; or

user context, comprising one or more of the following:
an identity of a user related to the request;
one or more characteristics of data related to the request; or
one or more characteristics of the application.

14. The system of claim 10 , wherein selecting the cryptographic technique comprises selecting the cryptographic technique based at least in part on compliance of the selected cryptographic technique with one or more policies related to the request.

15. The system of claim 14 , wherein the one or more policies indicate a required level of security based on one or more attributes related to the request.

16. The system of claim 10 , wherein selecting the cryptographic technique comprises selecting a cryptographic algorithm and one or mor

Assignees

• VMware LLC

Inventors

• Beveridge Daniel James
• Benson Mark
• Brotherson Marc Wayne
• Huntley Sean
• Jenkins Akeem
• Ott David

Classifications

• H04L9/14 Primary

  using a plurality of keys or algorithms · CPC title