Cryptographic agility through link layer abstraction

Patent metadata

Field	Value
Publication number	US-12524283-B2
Application number	US-202217987883-A
Country	US
Kind code	B2
Filing date	Nov 16, 2022
Priority date	Aug 16, 2022
Publication date	Jan 13, 2026
Grant date	Jan 13, 2026

Abstract

This disclosure relates generally to configuring a legacy application or service with a reconfigurable cryptographic provider capable of leveraging many different cryptographic algorithms, protocols or functions. The application or service can be configured with the reconfigurable cryptographic provider by redirecting cryptographic API calls intended for a linked static shared cryptographic library or provider to a cryptographic adapter configured to emulate responses provided by the linked static shared cryptographic library. A cryptographic adapter is also described and is configured to generate abstracted versions of the cryptographic API calls and pass them on to the reconfigurable cryptographic provider, which selects and implements an appropriate cipher solution based on the abstracted cryptographic API calls.

First claim

What is claimed is:

1 . A non-transitory computer-readable storage medium storing instructions configured to be executed by one or more processors to carry out steps that include:
receiving one or more cryptographic API calls from a software application at a cryptographic adapter; processing the one or more cryptographic API calls to generate an abstracted cryptographic API call; transmitting the abstracted cryptographic API call to a current cryptographic provider; and transmitting a response to the software application in a format matching expected legacy cryptographic provider responses.

2 . The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include:
receiving a response from the current cryptographic provider at the cryptographic adapter; amending the response received from the current cryptographic provider to correspond to the format matching expected legacy cryptographic provider responses; and transmitting the amended response to the software application.

3 . The non-transitory computer-readable storage medium of claim 2 , wherein the response from the current cryptographic provider is an abstracted response presented in a format used natively by the cryptographic adapter.

4 . The non-transitory computer-readable storage medium of claim 2 , wherein amending the response comprises spoofing one or more return values not present in the response received from the current cryptographic provider so that the amended response corresponds to the format matching expected legacy cryptographic provider responses.

5 . The non-transitory computer-readable storage medium of claim 1 , wherein the one or more cryptographic API calls include a request to initiate secure communications.

6 . The non-transitory computer-readable storage medium of claim 1 , wherein the one or more cryptographic API calls include a request to perform one or more hashing functions.

7 . The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include:
tracking changes in a state of the software application based on the one or more cryptographic API calls, wherein the response to the software application is based at least in part on the state of the software application.

8 . The non-transitory computer-readable storage medium of claim 1 , wherein the one or more cryptographic API calls comprises a plurality of cryptographic API calls and the cryptographic adapter incorporates information contained in the plurality of cryptographic API calls into parameters of the abstracted cryptographic API call.

9 . The non-transitory computer-readable storage medium of claim 1 , wherein the abstracted cryptographic API call omits or makes changes to one or more parameters provided in the one or more cryptographic API calls.

10 . The non-transitory computer-readable storage medium of claim 1 , wherein processing the cryptographic API call comprises:
determining an intent of the one or more cryptographic API calls and incorporating the intent into one or more parameters included in the abstracted cryptographic API call.

11 . The non-transitory computer-readable storage medium of claim 1 , wherein the intent is determined by identifying how the level of security requested compares with other levels of security utilized by the software application.

12 . The non-transitory computer-readable storage medium of claim 1 , wherein the response transmitted to the software application comprises an emulated certificate in the format matching expected legacy cryptographic provider responses.

13 . A cryptographic adapter, comprising:
one or more processors; and
memory storing one or more programs configured to be executed by the one or more processors, the one or more programs including instructions for:
receiving one or more cryptographic API calls from a software application;
processing the one or more cryptographic API calls to generate an abstracted cryptographic API call;
transmitting the abstracted cryptographic API call to a current cryptographic provider; and
transmitting a response to the software application in a format matching expected legacy cryptographic provider responses.

14 . The cryptographic adapter of claim 13 , wherein the one or more programs include further instructions for:
tracking changes in a state of the software application based on the one or more cryptographic API calls, wherein the response to the software application is based at least in part on the state of the software application.

15 . A method of operating a cryptographic adapter, the method comprising:
receiving one or more cryptographic API calls from a software application; tracking changes in a state of the software application based on the one or more cryptographic API calls; processing the one or more cryptographic API calls to generate an abstracted cryptographic API call; transmitting the abstracted cryptographic API call to a current cryptographic provider; and transmitting a response to the software application based on a current state of the software application and in a format matching expected legacy cryptographic provider responses.

Assignees

• VMware LLC

Inventors

• Huntley Sean James
• Dhanasekar Vasantha Kumar
• Ott David E
• Beveridge Daniel James

Classifications

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• G06F9/546 Primary

  Message passing systems or structures, e.g. queues · CPC title