Distributed encryption

Patent metadata

Field	Value
Publication number	US-12355739-B2
Application number	US-202318216367-A
Country	US
Kind code	B2
Filing date	Jun 29, 2023
Priority date	Nov 29, 2017
Publication date	Jul 8, 2025
Grant date	Jul 8, 2025

Abstract

Examples described herein include systems and methods for performing distributed encryption across multiple devices. An example method can include a first device discovering a second device that shares a network. The device can identify data to be sent to a server and calculate a checksum for that data. The device can then split the data into multiple portions and send a portion to the second device, along with a certificate associated with the server for encrypting the data. The first device can encrypt the portion of data it retained. The first device can receive an encrypted version of the second portion of the data sent to the second device. The first device can merge these two portions and send the merged encrypted data to the server, along with the checksum value. The server can decrypt the data and confirm that it reflects the original set of data.

First claim

What is claimed is:

1. A method for performing distributed encryption upon validating a digitally signed command from a server, the method comprising:
receiving, from the server at a first device, the digitally signed command;
sending a first instruction from the first device to a second device, wherein the first instruction includes: the digitally signed command, a public key, a request for the second device to calculate a digital signature using the digitally signed command and the public key, and a request for the second device to send the calculated digital signature to the first device;
receiving the calculated digital signature at the first device from the second device;
validating the digitally signed command from the server by comparing it to the calculated digital signature, wherein the validating confirms that the digitally signed command and calculated digital signature are identical to one another; and
upon validating the digitally signed command, executing, at the first device, the digitally signed command, wherein executing the digitally signed command includes:
identifying data to be communicated by the first device;
dividing the identified data into a plurality of portions including a first portion and a second portion;
sending a second instruction to another device, wherein the second instruction includes: the first portion of the identified data and a request for the other device to encrypt the first portion of the identified data;
receiving an encrypted copy of the first portion of the identified data from the other device; and
merging the encrypted copy of the first portion of the identified data with an encrypted copy of the second portion of the identified data that was encrypted by a different device than the other device that encrypted the first copy of the identified data.

2. The method of claim 1 , wherein the digitally signed command is generated based on a private key stored at the server.

3. The method of claim 1 , wherein executing the digitally signed command further includes:
sending the merged copies of the first and second portions of the identified data to the server.

4. The method of claim 1 , wherein the different device is the first device.

5. The method of claim 1 , wherein the different device is a third device separate from the first and second devices, and executing the digitally signed command further includes:
sending a third instruction to the third device, wherein the third instruction includes: the second portion of the identified data and a request for the third device to encrypt the second portion of the identified data; and
receiving the encrypted copy of the second portion of the identified data from the third device.

6. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor of a first device, cause the processor to perform a method for performing distributed encryption upon validating a digitally signed command from a server, wherein the method comprises:
receiving, from the server at the first device, the digitally signed command;
sending a first instruction from the first device to a second device, wherein the first instruction includes: the digitally signed command, a public key, a request for the second device to calculate a digital signature using the digitally signed command and the public key, and a request for the second device to send the calculated digital signature to the first device;
receiving the calculated digital signature at the first device from the second device;
validating the digitally signed command from the server by comparing it to the calculated digital signature, wherein the validating confirms that the digitally signed command and calculated digital signature are identical to one another; and
upon validating the digitally signed command, executing, at the first device, the digitally signed command, wherein executing the digitally signed command includes:
identifying data to be communicated by the first device;
dividing the identified data into a plurality of portions including a first portion and a second portion;
sending a second instruction to another device, wherein the second instruction includes: the first portion of the identified data and a request for the other device to encrypt the first portion of the identified data;
receiving an encrypted copy of the first portion of the identified data from the other device; and
merging the encrypted copy of the first portion of the identified data with an encrypted copy of the second portion of the identified data that was encrypted by a different device than the other device that encrypted the first copy of the identified data.

7. The non-transitory, computer-readable medium of claim 6 , wherein the digitally signed command is generated based on a private key stored at the server.

8. The non-transitory, computer-readable medium of claim 6 , wherein executing the digitally signed command further includes:
sending the merged copies of the first and second portions of the identified data to the server.

9. The non-transitory, computer-readable medium of claim 6 , wherein the different device is the first device.

10. The non-transitory, computer-readable medium of claim 6 , wherein the different device is a third device separate from the first and second devices, and executing the digitally signed command further includes:
sending a third instruction to the third device, wherein the third instruction includes: the second portion of the identified data and a request for the third device to encrypt the second portion of the identified data; and
receiving the encrypted copy of the second portion of the identified data from the third device.

11. A system for performing distributed encryption upon validating a digitally signed command from a server, the system comprising:
a first device having a processor and memory storage; and
a non-transitory, computer-readable medium comprising instructions that, when executed by the processor, cause the processor to carry out stages comprising:
receiving, from the server at the first device, the digitally signed command;
sending a first instruction from the first device to a second device, wherein the first instruction includes: the digitally signed command, a public key, a request for the second device to calculate a digital signature using the digitally signed command and the public key, and a request for the second device to send the calculated digital signature to the first device;
receiving the calculated digital signature at the first device from the second device;
validating the digitally signed command from the server by comparing it to the calculated digital signature, wherein the validating confirms that the digitally signed command and calculated digital signature are identical to one another; and
upon validating the digitally signed command, executing, at the first device, the digitally signed command, wherein executing the digitally signed command includes:
identifying data to be communicated by the first device;
dividing the identified data into a plurality of portions including a first portion and a second portion;
sending a second instruction to another device, wherein the second instruction includes: the first portion of the identified data and a request for the other device to encrypt the first portion of the identified data;
receiving an encrypted copy of the first portion of the identified data from the other device; and
merging the encrypted copy of the first portion of the identified data with an encrypted copy of the second portion of the identified data that was encrypted by a different device than the other device that encrypt

Assignees

• Omnissa Llc

Inventors

• Aluvala Suman
• Panchapakesan Ramani
• Kesavan Rajneesh
• Kochhar Arjun

Classifications

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L2209/80

  Wireless · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title