Methods, systems, and machine-readable media for cryptographic techniques using variable-sized symbol sets.

Abstract

Systems, methods, and non-transitory computer-readable media for symmetric cryptography using variable-size symbol sets are disclosed. To combat brute-force attacks or other similar types of attacks, multiple variable-size symbol sets can be used to encrypt / decrypt data. For example, different sets of symbols, including varying numbers of unique symbols, can be used to encrypt / decrypt different parts of data (e.g., data blocks representing multiple symbols, bit sets representing a single symbol). Using variable-size symbol sets increases the complexity of the encryption process, thereby significantly increasing the difficulty of decrypting encrypted data using brute-force attacks.

Description

Technical Field

[0001] The embodiments of this subject generally relate to cryptography, and more specifically to cryptography using sets of symbols of varying sizes. Background Technology

[0002] Symmetric cryptography is commonly used to securely transmit data between devices. For example, a text input, known as plaintext, is transformed into an encrypted form, called ciphertext, using a symmetric key along with a cryptographic algorithm. This ciphertext can then be transmitted to a receiving device, which uses the same symmetric key and the inverse operation of the cryptographic algorithm to decrypt the ciphertext back to plaintext. Accordingly, it is possible to both encrypt and decrypt data using the symmetric key. An attacker attempting to decrypt the ciphertext might use a brute-force attack, which involves systematically checking all possible keys until the correct key is found. Consequently, ensuring data security is receiving increasing attention. Attached Figure Description

[0003] In accompanying drawings that are not necessarily drawn to scale, similar reference numerals can describe similar components in different views. Similar numbers with different letter subscripts can represent different instances of similar components. Some embodiments are illustrated in the accompanying drawings by way of example rather than limitation, wherein:

[0004] Figure 1 This is a block diagram of a system for cryptographic techniques using a set of symbols of varying sizes, according to some exemplary embodiments.

[0005] Figure 2 This is a block diagram of a cryptographic technology management system according to some exemplary embodiments.

[0006] Figure 3 The operation of using a variable-sized set of symbols in conjunction with stream ciphers is illustrated according to some exemplary embodiments.

[0007] Figure 4 The operation of using a variable-sized set of symbols in conjunction with block ciphers is illustrated according to some exemplary embodiments.

[0008] Figure 5 This is a flowchart illustrating an exemplary method for a cryptographic technique using a set of symbols of varying sizes, according to a particular exemplary embodiment.

[0009] Figure 6 This is a block diagram illustrating a representative software architecture that can be used in conjunction with various hardware architectures described herein.

[0010] Figure 7This is a block diagram illustrating components of a machine capable of reading instructions from a machine-readable medium (e.g., a machine-readable storage medium) and performing any one or more of the methods discussed herein, according to some exemplary embodiments. Detailed Implementation

[0011] In the following description, various details are set forth for illustrative purposes in order to provide a thorough understanding of some exemplary embodiments. However, it will be apparent to those skilled in the art that the subject matter can be practiced without these specific details or with minor modifications.

[0012] In this specification, reference to "an embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with that embodiment is included in at least one embodiment of the subject matter. Therefore, the phrases "in one example" or "in an embodiment" appearing throughout this specification do not necessarily all refer to the same embodiment.

[0013] For illustrative purposes, specific configurations and details have been set forth to provide a thorough understanding of the subject matter. However, it will be apparent to those skilled in the art that embodiments of the described subject matter can be practiced without the specific details set forth herein or in various combinations thereof. Furthermore, well-known features may be omitted or simplified so as not to obscure the described embodiments. Various examples are given throughout the description herein. These are merely descriptions of specific embodiments. The scope or meaning of the claims is not limited to the examples given.

[0014] Systems, methods, and non-transitory computer-readable media for symmetric data cryptography using sets of symbols of varying sizes are disclosed. The cryptographic techniques are used to securely transmit data between devices. In symmetric cryptography, a single symmetric key is used to both encrypt and decrypt data encrypted using said symmetric key. To provide secure data transmission, a symmetric key can be distributed to multiple devices, and the symmetric key can be used to encrypt and decrypt data transmitted between these devices. For example, a transmitting device uses the symmetric key along with a cryptographic algorithm to transform plaintext input into encrypted ciphertext output. The transmitting device transmits the ciphertext to a receiving device, which decrypts the ciphertext back to its original plaintext form using the same symmetric key and the inverse operation of the cryptographic algorithm.

[0015] Symmetric cryptography is typically performed using block ciphers or stream ciphers. When using block ciphers, input data is encrypted / decrypted in fixed-size blocks representing multiple individual symbols (e.g., multiple characters) from the plaintext or ciphertext input. For example, the entire symmetric key is used simultaneously to encrypt an input block representing multiple symbols from the plaintext. This yields a ciphertext output block that has the same size as the plaintext input block and represents the same number of symbols.

[0016] However, when using stream ciphers, the input data is encrypted / decrypted according to the set of data bits representing individual symbols (e.g., a single character) from the plaintext or ciphertext input. For example, encrypting the set of input data bits representing a single symbol in the plaintext using a symmetric key yields output data representing a single symbol in the ciphertext. Similar to block ciphers, when using stream ciphers, the ciphertext output data has the same size as the plaintext input data and represents the same number of symbols (e.g., one).

[0017] In either case, the cryptographic algorithm used to encrypt / decrypt data operates based on a fixed-size set of symbols. The symbol set defines a unique set of symbols that the cryptographic algorithm uses to group / represent individual data bits in plaintext, symmetric key, and / or ciphertext. The symbol set can include any number of unique symbols; however, in some embodiments, the symbol set can be based on groups of different sizes of individual bits. For example, the symbol set can include 2 unique symbols (e.g., binary), which can be represented by a single bit (0, 1). As another example, the symbol set can include 16 unique symbols (e.g., hexadecimal), which can be represented by groups of four bits (0000-1111).

[0018] The cryptographic algorithm processes individual bits of the plaintext, symmetric key, and / or ciphertext based on the fixed-size symbol set used. For example, when using a symbol set of size 2, the input data stream "1011" is processed into four individual bits. As another example, when using a symbol set of size 4, the input data stream "1011" is processed into two separate groups of two bits (e.g., 10, 01).

[0019] Current cryptographic techniques use a single, fixed-size set of symbols when encrypting / decrypting data. For example, the cryptographic algorithm uses the same fixed-size set of symbols to modify all data, meaning that the bits of the plaintext, symmetric key, and / or ciphertext are all grouped in the same way based on the size of the symbol set being used.

[0020] While current cryptographic techniques offer high security for data transmission, they remain vulnerable to brute-force attacks and other similar types of attacks. For example, an attacker who knows the fixed-size set of symbols used to generate ciphertext might systematically attempt to decrypt the ciphertext using different key values ​​until an intelligible plaintext output is generated. To further combat brute-force attacks or other similar types of attacks, it is possible to use multiple sets of symbols of varying sizes when encrypting / decrypting data. For example, different sets of symbols, including varying numbers of unique symbols, can be used to encrypt / decrypt different parts of the data (e.g., blocks of data representing multiple symbols, sets of bits representing a single symbol). Using variable-size sets of symbols adds extra complexity to the encryption process, thereby significantly increasing the difficulty of decrypting encrypted data using brute-force attacks.

[0021] When using block ciphers, additional complexity is added by subdividing each data block into sub-blocks of varying sizes and encrypting / decrypting these sub-blocks using a set of symbols of varying sizes. For example, a data block can be divided into multiple sub-blocks comprising subsets of varying lengths of data bits contained within the block. Each sub-block can then be encrypted / decrypted using a set of symbols of different sizes. Therefore, an attacker attempting to determine the key used to encrypt the data using a brute-force attack would have to determine not only the key used for encryption but also the varying set of symbols used, the size and sequence of the sub-blocks, and the pattern of applying the varying set of symbols to the sub-blocks. This additional complexity results in encrypted data that is virtually impossible to decrypt using a brute-force attack or other similar types of attacks.

[0022] To utilize variable-sized symbol sets, metadata defining various symbol sets is generated for each symmetric key and distributed to devices along with the symmetric key. For example, a cryptographic management system generates a symmetric key and determines a configuration describing the encryption / decryption of data using that key, such as defining the various symbol sets to be used, the order in which the symbol sets are used, the size and order of the sub-blocks into which the data block is divided. The cryptographic management system stores the determined configuration in a cryptographic configuration data item associated with the symmetric key. The cryptographic management system distributes the symmetric key and its corresponding cryptographic configuration data item to devices, which can then use the cryptographic configuration data item associated with the assigned symmetric key to encrypt / decrypt data using various symbol sets.

[0023] Figure 1This is a block diagram illustrating an exemplary system 100 for symmetric data cryptography using a set of symbols of varying sizes, according to some exemplary embodiments. As shown, system 100 includes a transmitting device 102, a receiving device 104, and a cryptographic management system 106 connected to a communication network 108 and configured to communicate with each other using the communication network 108. The communication network 108 is any type of network, including a local area network (LAN) (such as an intranet), a wide area network (WAN) (such as the Internet), or any combination thereof. Furthermore, the communication network 108 can be a public network, a private network, or a combination thereof. The communication network 108 is implemented using any number of communication links associated with one or more service providers, including one or more wired communication links, one or more wireless communication links, or any combination thereof. Additionally, the communication network 108 is configured to support the transmission of data formatted using any number of protocols.

[0024] Multiple computing devices can be connected to the communication network 108. A computing device is any type of general computing device capable of network communication with other computing devices. For example, a computing device can be a personal computing device such as a desktop or workstation, a business server, a portable computing device such as a laptop, smartphone, or tablet PC, or an Internet of Things (IoT) device such as a sensor, wearable device, or smart meter. Computing devices can include... Figure 7 Some or all of the features, components and peripherals of the machine 700 shown.

[0025] To facilitate communication with other computing devices, a computing device may include a communication interface configured to receive communications such as requests and data from another computing device communicating with the computing device network, and to further relay the communications to appropriate modules / components running on the computing device. The communication interface also sends communications to another computing device communicating with the computing device network.

[0026] The cryptographic management system 106 generates symmetric keys for encrypting / decrypting data. For example, the cryptographic management system 106 can generate symmetric keys and assign them to designated devices for transmitting encrypted data between these devices. The cryptographic management system 106 can use any of a wide variety of known symmetric key generation techniques (such as pseudo-random number generators) to generate the symmetric keys.

[0027] In addition to generating the symmetric keys, the cryptographic management system 106 also generates cryptographic configuration data items for each symmetric key. These cryptographic configuration data items include data identifying multiple sets of symbols of varying sizes to be used when encrypting and / or decrypting data using the symmetric keys.

[0028] The cryptographic configuration data item may include data identifying the set of symbols to be used when encrypting / decrypting data using a symmetric key, and the order in which the set of symbols is used when encrypting / decrypting data. The order may be a fixed, repeating order that follows and repeats the sequential order of the identified set of symbols. For example, a first set of symbols in the sequential order is used to encrypt a first portion of the data, followed by a second set of symbols to encrypt a second portion of the data, and so on, until each set of symbols in the sequential order has been used, at which point the order is repeated (e.g., the first set of symbols in the sequential order is used again).

[0029] Alternatively, the order can be varied such that the order in which the symbol sets are used changes from one iteration to the next, rather than repeating. For example, the sequential order of the symbol sets can be modified in each iteration. As another example, the sequential order of the symbol sets can remain the same from one iteration to the next; however, the way the sequential order of the symbol sets is applied can be changed, such as applying them in reverse order or starting with a different initial symbol set than in the previous iteration.

[0030] Additional complexity can be applied when using block ciphers instead of stream ciphers. For example, each data block can be divided into sub-blocks, and each sub-block can be encrypted / decrypted using different sets of symbols. The sub-blocks can also have varying sizes. Accordingly, the cryptographic configuration data item can also include data defining the size of the sub-blocks into which the data block is divided. For example, the cryptographic configuration data item can define a fixed sub-block size, such that the data block will be subdivided into multiple sub-blocks of the same size. As another example, the cryptographic configuration data item can define various sub-block sizes, such that the data block is subdivided into multiple sub-blocks of varying sizes.

[0031] The cryptographic configuration data item can also identify the order in which various sub-block sizes are used when dividing a data block into sub-blocks. Similar to the order defined for a set of symbols, the order for sub-block sizes can be a fixed, repeating order that follows and repeats the sequential ordering of sub-block sizes, thereby splitting each individual data block into sub-blocks in the same way. Alternatively, the order can be changed so that the order of sub-block sizes used to divide the data block changes from one data block to the next.

[0032] The cryptographic configuration data item for the symmetric key can include any number of symbol sets and sub-block sizes. Furthermore, the number of symbol sets and the number of sub-block sizes can be the same or different. For example, the cryptographic configuration data item can recognize two different symbol sets and three different sub-block sizes. As another example, the cryptographic configuration data item can recognize three different symbol sets and two different sub-block sizes. However, these are merely two possible examples and are not intended to constitute a limitation. Any number and combination of symbol sets and sub-block sizes can be used.

[0033] A cryptographic management system 106 assigns symmetric keys and corresponding cryptographic configuration data items to devices such as transmitting device 102 and receiving device 104 for secure data transmission between the devices. For example, the cryptographic management system 106 may assign symmetric keys and the cryptographic configuration data items to both transmitting device 102 and receiving device 104. Transmitting device 102 can use the symmetric key and the corresponding cryptographic configuration data items to encrypt data, which is then transmitted to receiving device 104 via communication network 108. Receiving device 104 can similarly decrypt the encrypted data received from transmitting device 102 using the same symmetric key and the corresponding cryptographic configuration data items.

[0034] Although the illustrated system 100 includes only one transmitting device 102 and only one receiving device 104, this is for ease of explanation only and is not intended to be limiting. Those skilled in the art will recognize that system 100 can include any number of transmitting devices 102 and / or receiving devices 104. Although the transmitting device 102 and receiving device 104 are described separately, this is also for ease of explanation and is not intended to be limiting. For example, the transmitting device 102 can also be the receiving device 104, and vice versa. That is, the transmitting device 102 can perform the functions described in connection with the receiving device 104, such as receiving encrypted data from another device and decrypting the encrypted data using a symmetric key and corresponding cryptographic techniques to configure data items. Similarly, the receiving device 104 can perform the functions described in connection with the transmitting device 102, such as encrypting data using a symmetric key and corresponding cryptographic techniques to configure data items and transmitting the encrypted data to another device.

[0035] The cryptographic management system 106 can simultaneously accept and interact with connections from any number of transmitting devices 102 and / or receiving devices 104. The cryptographic management system 106 can support connections from a wide variety of different types of transmitting devices 102 and / or receiving devices 104, such as desktop computers; mobile computers; mobile communication devices, e.g., mobile phones, smartphones, tablets; smart TVs; set-top boxes; keypads; and / or any other network-enabled computing device. Therefore, the transmitting devices 102 and receiving devices 104 can have varying types, capabilities, operating systems, etc.

[0036] Figure 2 This is a block diagram of a cryptographic technology management system 106 according to some exemplary embodiments. To avoid unnecessary detail obscuring the subject matter of the invention, [details omitted]. Figure 2 Various functional components (e.g., modules) that are not particularly relevant to conveying an understanding of the subject matter have been omitted. However, those skilled in the art will readily recognize that the cryptographic management system 106 can support various additional functional components to facilitate additional functionality not specifically described herein. Furthermore, in Figure 2 The various functional modules described can reside on a single computing device or can be distributed across several computing devices in various arrangements (such as those used in cloud-based architectures).

[0037] As shown, the cryptographic management system 106 includes a key generation component 202, a cryptographic configuration component 204, and a key distribution component 206. The key generation component 202 generates symmetric keys for data encryption and decryption. Each symmetric key can be used to both encrypt and decrypt data encrypted using that symmetric key. For example, a plaintext input can be transformed into an encrypted ciphertext output using the symmetric key along with a cryptographic algorithm. Similarly, the ciphertext can be decrypted back to its original plaintext form using the same symmetric key and the inverse operation of the cryptographic algorithm.

[0038] The symmetric key comprises a fixed-length, sequentially ordered set of bits. The length of the symmetric key (e.g., the number of bits contained in the symmetric key) can be any of various lengths, such as 128 bits, 192 bits, 256 bits, etc. The key generation component 202 can generate the symmetric key using any algorithm from a wide variety of known key generation algorithms (such as a pseudo-random number generator).

[0039] Cryptographic configuration component 204 generates cryptographic configuration data items for symmetric keys. These cryptographic configuration data items define a set of configurations for encrypting / decrypting data using the symmetric key corresponding to the cryptographic configuration data item. For example, the cryptographic configuration data item may include data defining the following: the various sets of symbols to be used when encrypting / decrypting data, the order in which the sets of symbols are used, the size and order of the sub-blocks into which the data block is divided (e.g., when using block cipher), etc.

[0040] As shown, the cryptographic technology configuration component 204 includes a symbol set determination component 208, a sub-block size determination component 210, an order determination component 212, and a configuration item generation component 214.

[0041] The symbol set determination component 208 determines the set of symbols to be used with the symmetric key. To accomplish this, the symbol set determination component 208 may randomly select the symbol set from a set of predetermined symbol sets. Each symbol set is defined by a certain number of unique symbols within the symbol set.

[0042] Although the symbol set can include any number of unique symbols, in some embodiments, the number of unique symbols included in the symbol set can be based on groups of different sizes of individual bits. For example, the symbol set can be based on groups of single bits (e.g., binary) and thus include 2 unique symbols (e.g., 0, 1). As another example, the symbol set can be based on groups of three bits (e.g., octal) and thus include 8 unique symbols (e.g., 000-111). As yet another example, the symbol set can be based on groups of four bits (e.g., hexadecimal) and thus include 16 unique symbols (e.g., 0000-1111).

[0043] In some embodiments, the symbol set may include unique symbols that are geometric shapes, rather than conventional numbers or characters. For example, the symbol set may include geometric symbols such as pentagons, rectangles, rhombuses, circles, etc. In this type of embodiment, each symbol in the symbol set may be represented by a set of binary geometric shapes (rather than bit binary values) such as triangles, lines, etc. Examples of symbol sets including geometric shapes are described in U.S. Patent US16 / 884,749, the contents of which are incorporated herein by reference in their entirety.

[0044] As another example, the symbol set may include unique symbols as codes, such as Quick Response (QR) codes or barcodes. In this type of embodiment, each symbol in the symbol set may be represented by a set of smaller codes (rather than bit binary values) of smaller portions of a QR code or barcode.

[0045] The symbol set determination component 208 may use an algorithm that randomly selects two or more symbol sets to be used with the symmetric key. In some embodiments, the symbol set determination component 208 may select a fixed number of symbol sets for each symmetric key. For example, the symbol set determination component 208 may select two symbol sets from the symbol sets for each symmetric key. As another example, the symbol set determination component 208 may select three symbol sets from the symbol sets for each symmetric key. Although the number of symbol sets selected for each symmetric key may be fixed, the symbol sets selected for each symmetric key may be varied.

[0046] Alternatively, in some embodiments, the number of symbols selected for each symmetric key can be varied. For example, the symbol set determining component 208 can select two, three, four, or other numbers of symbol sets for use with each of the symmetric keys. Accordingly, the number of symbol sets used for encrypting / decrypting data can be varied among the various symmetric keys.

[0047] Sub-block size determination component 210 determines the sub-block size into which a data block is to be divided for encryption / decryption. The sub-block size determined by sub-block size determination component 210 is used when encrypting / decrypting data using block cipher instead of stream cipher. In block cipher, input data is encrypted / decrypted in data blocks of equal size. To add complexity during the encryption / decryption process, each data block can be divided into multiple sub-blocks, which can have varying sub-block sizes. The sub-block size determined by sub-block size determination component 210 defines the size (e.g., number of bits) of the sub-blocks into which the data block is to be divided. For example, the sub-block size can be defined as a number of bits smaller than the total number of bits in each data block.

[0048] The sub-block size determination component 210 can determine any number of sub-block sizes for a symmetric key. Furthermore, the number of sub-block sizes determined for each symmetric key can be fixed or variable. For example, the sub-block size determination component 210 can determine a fixed number of sub-block sizes for each symmetric key, such as 2 sub-block sizes, 3 sub-block sizes, etc. As another example, the sub-block size determination component 210 can determine different numbers of sub-block sizes for different symmetric keys.

[0049] The sub-block size determination component 210 uses any of a variety of techniques or algorithms to determine the sub-block size for each symmetric key. In some embodiments, the sub-block size determination component 210 may determine the sub-block size based on a predetermined group of sub-block sizes. Each predetermined group of sizes may include a set of two or more sizes. A size in each predetermined group may be defined such that the sum of the sub-block sizes in the predetermined group of sub-block sizes equals the size of the data block used for encryption / decryption using block cipher.

[0050] In some embodiments, the sub-block size determination component 210 uses an algorithm that randomly selects sub-block sizes based on one or more constraints to determine the sub-block size. For example, the constraints may define a minimum or maximum number of sub-blocks or sub-block sizes, a minimum or maximum sub-block size, a requirement that the sum of the sub-block sizes equals a specified size (e.g., the size of a data block), and so on.

[0051] These are merely two examples of how the sub-block size determination component 210 can determine the sub-block size for a symmetric key, and are not intended to constitute a limitation. The sub-block size determination component 210 may use any of a wide variety of algorithms and techniques to determine the sub-block size.

[0052] Sequence determination component 212 determines the order in which symbol sets are applied when encrypting / decrypting data using a symmetric key, and, depending on the embodiment, the order in which sub-block sizes are applied. Sequence determination component 212 may randomly select the order. For example, sequence determination component 212 receives data from symbol set determination component 208 and / or sub-block size determination component 210 indicating which number of symbol sets and / or sub-block sizes are selected for use with the symmetric key. The data may include an identifier assigned to each symbol set and / or sub-block size.

[0053] Then, the sequence determination component 212 determines the order for the symbol set and / or sub-block size. For example, the sequence determination component 212 determines the sequential order of the symbol set and / or sub-block size to be used when encrypting / decrypting data. This operation can be accomplished using an algorithm that randomly assigns an order to the symbol set and / or sub-block size. As another example, the sequence determination component 212 can randomly select the sequence from a set of predetermined sequences.

[0054] In some embodiments, the order for each of the symbol size and / or sub-block size can be simply repeated from one iteration to the next. Alternatively, the order can be changed from one iteration to the next, such as by performing the process in reverse order, starting each iteration from a different point in the sequential order, and so on. Accordingly, the order determination component 212 can also determine how the order should be applied in each iteration. For example, three symbol sets (S1, S2, and S3) can be arranged in the sequential order of S1, S2, and S3. In the first iteration, the symbol sets can be applied according to the sequential order, such that S1 is used for the first part of the data, S2 for the second part of the data, and S3 for the third part of the data. However, in the next iteration, the order can be changed, such as applying the reverse order of the sequential order (e.g., S3, S2, S1) or starting from a different initial symbol set (e.g., S2, S3, S1).

[0055] The symbol set determination component 208, sub-block size determination component 210, and order determination component 212 provide data identifying the selected symbol set, sub-block size, and order to the configuration item generation component 214. The configuration item generation component 214 then generates a cryptographic configuration data item based on the received data. The cryptographic configuration data item may be a metadata file identifying the selected symbol set, sub-block size, and order for the symmetric key. The resulting cryptographic configuration data item may be associated with the symmetric key used when encrypting / decrypting data.

[0056] Key distribution component 206 distributes the symmetric key and its corresponding cryptographic configuration data item to various devices for encrypting / decrypting data transmitted between the devices. For example, key distribution component 206 may distribute the same symmetric key and its corresponding cryptographic configuration data item to transmitting device 102 and receiving device 104. Transmitting device 102 uses the symmetric key and a cryptographic algorithm based on the cryptographic configuration data item to change plaintext input into encrypted ciphertext output. Similarly, receiving device 104 uses the same symmetric key and the inverse operation of the cryptographic algorithm based on the cryptographic configuration data item to decrypt the ciphertext back to its original plaintext form. (Further details will follow.) Figure 3 and Figure 4 This describes an example of encrypting / decrypting data using a symmetric key and the corresponding cryptographic data item.

[0057] Figure 3Operation 300 for using a variable-size set of symbols with a stream cipher, according to some exemplary embodiments, is illustrated. When using a stream cipher, input data is encrypted / decrypted according to a set of data bits representing a single symbol (e.g., a single character) from the plaintext or ciphertext input. For example, an input set of data bits representing a single symbol in the plaintext is encrypted using a corresponding set of data bits from the symmetric key to obtain output data representing a single symbol in the ciphertext. The size of the input (e.g., the number of bits in the plaintext) is generally the same as or proportional to the size of the symmetric key (the number of bits in the symmetric key). For example, four bits of the data input can be encrypted using four bits of the symmetric key.

[0058] Furthermore, each subsequent set of bits in the input is encrypted / decrypted using a subsequent set of bits from the symmetric key. For example, the first four bits of the symmetric key can be used to encrypt / decrypt the first four bits of the input, the second four bits of the symmetric key can be used to encrypt / decrypt the second four bits of the input, and so on.

[0059] The dimensions of the input (plaintext bits, ciphertext bits) and symmetric key (e.g., symmetric key bits) are based on the set of symbols being used. Although current stream cipher systems use a fixed size of input and symmetric key based on a single set of symbols to encrypt / decrypt all data, it is possible to improve the security of encrypted data by using various sizes of input and symmetric key based on different sets of symbols.

[0060] As in Figure 3As shown, the plaintext 302 input is grouped 304 based on a set of symbols. Similarly, the symmetric key 306 is also grouped 308 based on the same set of symbols. The set of symbols used to group the plaintext 302 input and the symmetric key 306 is determined and modified based on a cryptographic configuration data item corresponding to the symmetric key 306. For example, the cryptographic configuration data item may identify multiple sets of symbols of varying sizes and the order in which the sets of symbols are to be used. Accordingly, both the plaintext 302 and the symmetric key 306 are grouped based on the set of symbols and the order identified in the cryptographic configuration data item. For example, the first set of bits for the plaintext 302 and the first set of bits for the symmetric key 306 may be grouped based on a set of hexadecimal symbols comprising 16 unique symbols. Thus, the first set of bits for both the plaintext 302 and the symmetric key 306 may each comprise 4 bits to represent a single hexadecimal symbol. Then, the resulting group of bits representing the hexadecimal symbols of the plaintext and the hexadecimal symbols of the symmetric key 306 is provided as input to the cryptographic algorithm 310, which outputs the first set of bits of the ciphertext 312. The first set of bits of the ciphertext 312 may also include 4 bits, which represent the hexadecimal symbols of the plaintext 302.

[0061] Then, the subsequent set of bits of plaintext 302 is encrypted based on different symbol sets. For example, the subsequent set of bits of plaintext 302 can be encrypted based on an octal symbol set including 8 unique symbols. Therefore, the subsequent set of bits of plaintext 302 and symmetric key 306 can each include 3 bits to represent a single octal symbol. Then, the resulting group of bits representing the octal symbols of the plaintext and symmetric key 306 is provided as input to cryptographic algorithm 310, which outputs the subsequent set of bits of ciphertext 312. The subsequent set of bits of ciphertext 312 can also include 3 bits to represent the octal symbol of plaintext 312. This process can be repeated according to the symbol set and order specified in the cryptographic configuration data item until the entire plaintext 302 has been encrypted into ciphertext 312.

[0062] The same process can be used to decrypt ciphertext 312 back to plaintext 302. For example, ciphertext 312 can be used instead of plaintext 302 as input. That is, the bit sets of plaintext 312 and symmetric key 306 are grouped according to the cryptographic configuration data items, and the resulting bit groups are used as input to cryptographic algorithm 310. The inverse operation of cryptographic algorithm 310 is performed to transform the bit groups of ciphertext 312 back into the bit groups of plaintext 302.

[0063] Figure 4Operation 400 of using a variable-size symbol set with a block cipher is illustrated according to some exemplary embodiments. When using a block cipher, input data is encrypted / decrypted in fixed-size blocks representing multiple individual symbols (e.g., multiple characters) from plaintext 402 or ciphertext 418. For example, the input data block representing multiple symbols in plaintext 402 is encrypted simultaneously using all of symmetric key 412. This results in an output data block of ciphertext 418, which has the same size as the input data block of plaintext 402 and represents the same number of symbols.

[0064] Each data block is encrypted / decrypted based on a defined set of symbols. For example, the input data block and individual data bits in the symmetric key 412 are grouped according to the set of symbols to represent a sequence of symbols from the set of symbols. Then, the data block is encrypted / decrypted based on the sequence of symbols, rather than on individual symbols as in stream ciphers.

[0065] The current block cipher uses the same set of symbols to encrypt / decrypt each data block. To provide additional security to the encrypted data, multiple sets of symbols can be used. For example, the set of symbols used for each data block can be changed. Thus, a data block can be encrypted / decrypted based on a binary set of symbols including 2 unique symbols, another data block can be encrypted / decrypted based on an octal set of symbols including 8 unique symbols, and yet another data block can be encrypted / decrypted based on a hexadecimal set of symbols including 16 unique symbols. To provide additional complexity, in some embodiments, one or more data blocks within a block can be divided into sub-blocks of varying or equal length, and each sub-block can be encrypted / decrypted based on a different set of symbols.

[0066] As in Figure 4 As shown, the plaintext 402 input is divided into fixed-size data blocks 404. These fixed-size data blocks can then be divided into sub-blocks 406 with equal and / or varying sub-block sizes (e.g., number of bits). The sub-block size and order can be defined by configuring data items using cryptographic techniques corresponding to the symmetric key 412. Each sub-block of the plaintext 402 input is then grouped based on a symbol set 408. This yields a sequence of symbols from the symbol set 408 representing the sub-blocks of plaintext 402.

[0067] Similarly, the symmetric key 412 is divided into sub-blocks 414 based on the sub-block size and order defined by the cryptographic configuration data items corresponding to the symmetric key 412. Then, each sub-block of the symmetric key 412 is grouped based on the same set of symbols 416 used to group the sub-blocks of plaintext 402. This yields a sequence of symbols from the symbol set 408 representing the sub-blocks of the symmetric key 412.

[0068] Then, the sequences of symbols representing sub-blocks of plaintext 402 and sub-blocks of symbols representing symmetric key 412 are used as inputs to cryptographic algorithm 410. Cryptographic algorithm 410 generates ciphertext 418 based on the provided inputs. Ciphertext 418 may have the same size as the sub-blocks of plaintext 402 provided as input.

[0069] Each subsequent sub-block of plaintext 402 can be processed in a similar manner based on the corresponding subsequent sub-blocks of symmetric key 412. The symbol set, sub-block size, and order of each are defined by the cryptographic configuration data item. This process can be repeated until the entire plaintext 402 has been encrypted into ciphertext 418.

[0070] The same process can be used to decrypt ciphertext 418 back to plaintext 402. For example, ciphertext 418 can be used instead of plaintext 402 as input. That is, ciphertext 418 can be divided into fixed-size data blocks, each of which can be further divided into sub-blocks with varying sub-block sizes defined by the cryptographic configuration data item. Then, each sub-block of ciphertext 418 is grouped based on a set of symbols defined by the cryptographic configuration data item, resulting in a sequence of symbols from the set of symbols representing the sub-block of ciphertext 418. Similarly, the symmetric key 412 can be divided into sub-blocks and grouped based on the set of symbols, sub-block sizes, and order defined by the cryptographic configuration data item. The sequence of symbols from the set of symbols representing ciphertext 418 and symmetric key 412 can be provided as input to the cryptographic algorithm 410. The inverse operation of the cryptographic algorithm 410 is performed to transform each sub-block of ciphertext 418 back to plaintext 402.

[0071] Figure 5This is a flowchart illustrating an exemplary method 500 for a cryptographic technique using a set of symbols of varying sizes, according to a particular exemplary embodiment. Method 500 may be embodied in computer-readable instructions executable by one or more processors, such that the operation of method 500 is performed partially or entirely by transmission device 102; accordingly, method 500 will be described hereinafter by way of example with reference thereto. However, it should be appreciated that at least some operations of method 500 may be deployed on various other hardware configurations, and method 500 is not intended to be limited to transmission device 102.

[0072] At operation 502, transmission device 102 accesses a symmetric key and a corresponding cryptographic configuration data item. The cryptographic configuration data item identifies multiple sets of symbols to be used when encrypting and / or decrypting data using the symmetric key. Each identified set of symbols can have a varying size, meaning that each set can include a different number of unique symbols, such as 2, 4, 8, 16, etc. The cryptographic configuration data item can also include the order in which the sets of symbols are used, such as by defining the sequential order of the sets of symbols to be used when encrypting different parts of the data item (e.g., plaintext).

[0073] At operation 504, transmission device 102 encrypts the data item using a symmetric key corresponding to the cryptographic configuration data item. For example, transmission device 102 may encrypt portions of the data item based on different sets of symbols in the order identified in the cryptographic configuration data item.

[0074] The size of each portion of the data item can be based on the technique used to encrypt the data item. For example, when using a stream cipher, the portions of the data item can be sets of bits representing individual characters of a set of symbols being used. In this type of embodiment, the transmission device 102 groups individual bits of the data input based on the set of symbols, such that the resulting groups of input bits (e.g., portions of the data input) represent individual symbols in the set of symbols. For example, when using a set of hexadecimal symbols with 16 unique symbols, the transmission device 102 can group the input data item into 4-bit groups, each 4-bit group representing a hexadecimal symbol. As another example, when using a set of binary symbols with 2 unique symbols, the transmission device 102 can group the input data item into single-bit groups, each single-bit group representing a binary symbol.

[0075] However, when using block ciphers, the portions of the data items encrypted using various symbol sets can be fixed-size data blocks or sub-blocks of fixed-size data blocks. In this type of embodiment, the transmission device 102 initially divides the individual bits of the data input into fixed-size data blocks. Depending on the implementation, the fixed-size data block is encrypted as a whole using one of the symbol sets, or the fixed-size data block can be further subdivided into sub-blocks, and the sub-blocks are encrypted individually using different symbol sets. The size and order of the sub-blocks are defined by the cryptographic techniques used to configure the data items.

[0076] At operation 506, transmitting device 102 transmits the encrypted data item to receiving device 104. Receiving device 104 can configure the data item to decrypt the encrypted data item using the same symmetric key and cryptographic techniques. For example, receiving device 104 can decrypt a portion of the encrypted data item using the same set of symbols used by transmitting device 102 to encrypt the corresponding portion of the data input.

[0077] Software Architecture

[0078] Figure 6 This is a block diagram illustrating an exemplary software architecture 606, which can be used in conjunction with various hardware architectures described herein. Figure 6 This is a non-limiting example of Software Architecture 606, and it should be recognized that many other architectures can be implemented to facilitate the functionality described herein. Software Architecture 606 can be implemented in, for example... Figure 7 The machine 700 operates on hardware, which specifically includes a processor 704, a memory 714, and input / output (I / O) components 718. A representative hardware layer 652 is illustrated, which can be represented (for example) Figure 7 The machine 700. A representative hardware layer 652 includes a processing unit 654 having associated executable instructions 604. The executable instructions 604 represent executable instructions of the software architecture 606, including implementations of the methods, components, etc., described herein. Hardware layer 652 also includes a memory and / or storage module 656, which also has executable instructions 604. Hardware layer 652 may also include other hardware 658.

[0079] exist Figure 6In the exemplary architecture, software architecture 606 can be conceptualized as a stack of layers, where each layer provides specific functionality. For example, software architecture 606 may include layers such as operating system 602, library 620, framework / middleware 618, application 616, and presentation layer 614. Operationally, application 616 and / or other components within these layers can initiate application programming interface (API) calls 608 through the software stack and receive responses, such as message 612, in response to API calls 608. The illustrated layers are merely representative, and not all software architectures have all layers. For example, some mobile or dedicated operating systems may not provide framework / middleware 618, while others may provide such a layer. Other software architectures may include additional or different layers.

[0080] Operating system 602 manages hardware resources and provides public services. Operating system 602 may include, for example, kernel 622, services 624, and drivers 626. Kernel 622 may act as an abstraction layer between the hardware layer and other software layers. For example, kernel 622 may be responsible for memory management, processor management (e.g., scheduling), component management, networking, security settings, etc. Services 624 can provide other public services for other software layers. Drivers 626 are responsible for controlling or interfacing with the underlying hardware. For example, drivers 626 include display drivers, camera drivers, etc. Drivers, flash memory drivers, serial communication drivers (e.g., Universal Serial Bus (USB) drivers), Drivers, audio drivers, power management drivers, etc., depending on the hardware configuration.

[0081] Library 620 provides a shared infrastructure used by application 616 and / or other components and / or layers. The functionality provided by library 620 allows other software components to perform tasks in a way that is easier than directly interfacing with the functionality of the underlying operating system 602 (e.g., kernel 622, services 624, and / or drivers 626). Library 620 may include system libraries 644 (e.g., the C standard library), which provide functions such as memory allocation, string manipulation, and mathematical functions. Furthermore, library 620 may include API libraries 646, such as media libraries (libraries supporting the rendering and manipulation of various media formats such as MPEG4, H.264, MP3, AAC, AMR, JPG, and PNG), graphics libraries (e.g., OpenGL frameworks for rendering 2D and 3D graphical content on a display), database libraries (e.g., SQLite providing various relational database functions), web libraries (e.g., WebKit providing web browsing functionality), etc. Library 620 may also include a wide range of other libraries 648 to provide many other APIs for application 616 and other software components / modules.

[0082] The framework / middleware 618 (sometimes referred to as middleware) provides a higher-level common infrastructure that can be used by the application 616 and / or other software components / modules. For example, the framework / middleware 618 can provide various graphical user interface (GUI) functions, advanced resource management, advanced location services, and so on. The framework / middleware 618 can provide a wide range of other APIs that can be used by the application 616 and / or other software components / modules, some of which may be specific to a particular operating system 602 or platform.

[0083] Application 616 includes built-in application 638 and / or third-party application 640. Examples of representative built-in applications 638 may include, but are not limited to, contact applications, browser applications, book reader applications, location applications, media applications, messaging applications, and / or game applications. Third-party applications 640 may include applications using Android by entities other than the vendor of a specific platform. TM or iOS TM Applications developed using a Software Development Kit (SDK) can be used on mobile operating systems such as iOS. TM ANDROID TM , Mobile software running on a phone or other mobile operating system. A third-party application 640 may initiate API calls 608 provided by the mobile operating system (e.g., operating system 602) to facilitate the functions described herein.

[0084] Application 616 may use built-in operating system functions (e.g., kernel 622, service 624, and / or driver 626), libraries 620, and frameworks / middleware 618 to build a user interface for interacting with the system. Alternatively or additionally, in some systems, interaction with the user may occur through a presentation layer (e.g., presentation layer 614). In these systems, the application / component "logic" may be separated from the user-interacting aspects of that application / component.

[0085] Figure 7 This is a block diagram illustrating components of a machine 700, according to some exemplary embodiments, capable of reading instructions 604 from a machine-readable medium (e.g., a machine-readable storage medium) and executing any or more of the methods discussed herein. Specifically, Figure 7 A schematic representation of a machine 700 in an exemplary form of a computer system is shown, within which instructions 710 (e.g., software, programs, applications, applets, apps, or other executable code) can be executed, causing the machine 700 to perform any or more of the methods discussed herein. Accordingly, the instructions 710 can be used to implement the modules or components described herein. The instructions 710 transform a general, unprogrammed machine 700 into a specific machine 700 programmed to perform the described and exemplified functions in the described manner. In alternative embodiments, the machine 700 operates as a standalone device or can be coupled (e.g., networked) to other machines. In a networked deployment, the machine 700 can operate as a server machine or a client machine in a server-client network environment, or as a peer-to-peer (or distributed) network environment. Machine 700 may include, but is not limited to, server computers, client computers, PCs, tablets, laptops, netbooks, set-top boxes (STBs), personal digital assistants (PDAs), entertainment media systems, cellular phones, smartphones, mobile devices, wearable devices (e.g., smartwatches), smart home devices (e.g., smart appliances), other smart devices, web appliances, network routers, network switches, bridges, or any machine 700 capable of sequentially or otherwise executing instructions 710 specifying actions to be taken by machine 700. Furthermore, although only a single machine 700 is shown, the term "machine" should also be understood to include a collection of machines that individually or jointly execute instructions 710 to perform any or more methods discussed herein.

[0086] Machine 700 may include processor 704, memory / storage device 706, and I / O components 718, which may be configured to communicate with each other via bus 702. Memory / storage device 706 may include memory 714 (e.g., main memory or other memory device) and storage cell 716, both of which may be accessed by processor 704, for example, via bus 702. Storage cell 716 and memory 714 store instructions 710 embodying any one or more of the methods or functions described herein. Instructions 710 may also reside wholly or partially within memory 714, storage cell 716, at least one of processor 704 (e.g., within the processor's cache memory), or any combination of these during execution by machine 700. Thus, memory 714, storage cell 716, and the memory of processor 704 are examples of machine-readable media.

[0087] I / O component 718 may include a wide range of components for receiving input, providing output, generating output, transmitting information, exchanging information, capturing measurement results, etc. The specific I / O component 718 included in a particular machine 700 will depend on the machine type. For example, a portable machine such as a mobile phone may include a touch input device or other such input mechanism, while a headless server machine may not include such a touch input device. It should be recognized that I / O component 718 may include many other components not listed here. Figure 7 The components shown are illustrated below. The I / O components 718 are grouped according to function, but this is merely for simplicity in the following discussion and is in no way limiting. In various exemplary embodiments, the I / O components 718 may include output components 726 and input components 728. Output components 726 may include visual components (e.g., displays, such as plasma display panels (PDPs), light-emitting diode (LED) displays, liquid crystal displays (LCDs), projectors, or cathode ray tubes (CRTs)), acoustic components (e.g., speakers), haptic components (e.g., vibration motors, resistance mechanisms), other signal generators, etc. Input components 728 may include alphanumeric input components (e.g., keyboards, touchscreens configured to receive alphanumeric input, optical keyboards, or other alphanumeric input components), point-based input components (e.g., mice, touchpads, trackballs, joysticks, motion sensors, or other point-based devices), haptic input components (e.g., physical buttons, touchscreens providing position and / or force for touch or touch gestures), audio input components (e.g., microphones), etc.

[0088] In another exemplary embodiment, I / O component 718 may include biometric component 730, motion component 734, environmental component 736, or position component 738, as well as a wide range of other components. For example, biometric component 730 may include components for performing operations such as: detecting expressions (e.g., hand gestures, facial expressions, voice expressions, body posture, or eye tracking), measuring biosignals (e.g., blood pressure, heart rate, body temperature, sweating, or brain waves), identifying a person (e.g., voice recognition, retinal recognition, facial recognition, fingerprint recognition, or EEG-based recognition), and so on. Motion component 734 may include accelerometer components (e.g., accelerometers), gravity sensor components, rotation sensor components (e.g., gyroscopes), and so on. Environmental component 736 may include, for example, a lighting sensor component (e.g., a photometer), a temperature sensor component (e.g., one or more thermometers that detect ambient temperature), a humidity sensor component, a pressure sensor component (e.g., a barometer), a sound sensor component (e.g., one or more microphones that detect background noise), a proximity sensor component (e.g., an infrared sensor that detects nearby objects), a gas sensor (e.g., a gas detection sensor that detects the concentration of harmful gases to ensure safety or to measure pollutants in the atmosphere), or other components that can provide indications, measurements, or signals corresponding to the surrounding physical environment. Position component 738 may include a position sensor component (e.g., a GPS receiver component), an altitude sensor component (e.g., an altimeter or a barometer that can derive altitude by detecting air pressure), an orientation sensor component (e.g., a magnetometer), etc.

[0089] A wide range of technologies can be used to implement communication. I / O component 718 may include communication component 740, which can be used to couple machine 700 to network 732 or device 720 via coupling 724 and coupling 722, respectively. For example, communication component 740 may include a network interface component or other suitable device for interfacing with network 732. In other examples, communication component 740 may include wired communication components, wireless communication components, cellular communication components, near field communication (NFC) components, etc. Components (e.g., (low power consumption) Components and other communication components used to provide communication via other modes. Device 720 can be any of another machine or a wide range of peripheral devices (e.g., peripheral devices coupled via USB).

[0090] Furthermore, the communication component 740 can detect identifiers or include components that can be used to detect identifiers. For example, the communication component 740 may include a radio frequency identification (RFID) tag reader component, an NFC smart tag detection component, an optical reader component (e.g., an optical sensor to detect one-dimensional barcodes, such as Universal Product Code (UPC) barcodes, or to detect multi-dimensional barcodes, such as Quick Response (QR) codes, Aztec codes, Data Matrix, Dataglyph, MaxiCode, PDF417, UltraCode, UCC RSS-2D barcodes, and other optical codes) or a sound detection component (e.g., a microphone to identify tagged audio signals). Additionally, various information can be derived from the communication component 740, such as deriving location via Internet Protocol (IP) geolocation, and via... Location can be derived using signal triangulation, or by detecting NFC beacon signals that indicate a specific location, and so on.

[0091] In this context, "carrier signal" refers to any intangible medium capable of storing, encoding, or carrying instructions 710 executed by machine 700, and includes digital or analog communication signals or other intangible media that facilitate the communication of such instructions 710. Instructions 710 can be transmitted or received via network 732, using a transmission medium, through a network interface device, and using any of many known transmission protocols.

[0092] In this context, "client device" refers to any machine 700 that interfaces with communication network 732 to obtain resources from one or more server systems or other client devices. Client devices may be, but are not limited to, mobile phones, desktop computers, laptops, PDAs, smartphones, tablets, ultrabooks, netbooks, multiprocessor systems, microprocessor-based or programmable consumer electronics devices, game consoles, STBs, or any other communication device that a user can use to access network 732.

[0093] In this context, "communication network" refers to one or more parts of network 732, which can be an ad hoc network, intranet, extranet, virtual private network (VPN), LAN, wireless LAN (WLAN), WAN, wireless WAN (WWAN), metropolitan area network (MAN), the Internet, a part of the Internet, a part of the Public Switched Telephone Network (PSTN), a Simple Old-Style Telephone Service (POTS) network, a cellular telephone network, a wireless network, etc. The network can be a network of one type or a combination of two or more such networks. For example, network 732 or a portion thereof may include a wireless or cellular network, and the coupling may be a Code Division Multiple Access (CDMA) connection, a Global System for Mobile Communications (GSM) connection, or other types of cellular or wireless coupling. In this example, the coupling may implement any of a variety of data transmission technologies, such as Single Carrier Radio Transmission (1xRTT), Evolved Data Optimization (EVDO), General Packet Radio Service (GPRS), Enhanced Data Rate Evolution of GSM (EDGE), the 3rd Generation Partnership Project (3GPP) including 3G, fourth-generation wireless (4G) networks, Universal Mobile Telecommunications System (UMTS), High-Speed ​​Packet Access (HSPA), Global Microwave Access Interoperability (WiMAX), Long Term Evolution (LTE) standards, other technologies defined by various standards-setting organizations, other long-range protocols, or other data transmission technologies.

[0094] In this context, "machine-readable medium" means a component, device, or other tangible medium capable of temporarily or permanently storing instructions 710 and data, and may include, but is not limited to, random access memory (RAM), read-only memory (ROM), buffer memory, flash memory, optical media, magnetic media, cache memory, other types of storage devices (e.g., erasable programmable read-only memory (EEPROM)) and / or any suitable combination thereof. The term "machine-readable medium" should be understood to include a single medium or multiple media capable of storing instructions 710 (e.g., a centralized or distributed database or associated cache and server). The term "machine-readable medium" should also be understood to include any medium or combination of media capable of storing instructions 710 (e.g., code) executable by machine 700, such that when executed by one or more processors 704 of machine 700, the instructions 710 cause machine 700 to perform any or more of the methods described herein. Therefore, "machine-readable medium" refers to a single storage device or apparatus, and a "cloud-based" storage system or storage network comprising multiple storage devices or apparatuses. The term "machine-readable medium" refers to a "non-transitory" machine-readable medium and excludes signals or other "transitory" computer-readable media. A "non-transitory" machine-readable medium is a physical device capable of storing data for a period of time during which the stored data is transferable or reproducible. Examples of non-transitory machine-readable media are physical memory devices, random access memory (RAM), etc. Conversely, a transient machine-readable medium is not physical and stores data only temporarily, such as signals.

[0095] In this context, a "component" refers to a device, physical entity, or logic having partitions or modularization techniques defined by function or subroutine calls, such as boundaries, branch points, APIs, or other means of implementing specific processing or control functions. Components can be combined through their interfaces with other components to perform machine processes. A component can be an encapsulated functional hardware unit designed for use in conjunction with other components, and a program portion that often performs a specific function within a related function. Components can constitute software components (e.g., code embodied on a machine-readable medium) or hardware components. A "hardware component" is a tangible unit capable of performing certain operations and which can be physically configured or arranged. In various exemplary embodiments, one or more computer systems (e.g., a standalone computer system, a client computer system, or a server computer system) or one or more hardware components of a computer system (e.g., a processor or processor group 704) can be configured by software (e.g., an application program 616 or an application portion) to operate to perform certain operations described herein. Hardware components can also be implemented mechanically, electronically, or by any suitable combination thereof. For example, a hardware component can include a dedicated circuit system or logic permanently configured to perform certain operations. Hardware components can be dedicated processors, such as field-programmable gate arrays (FPGAs) or application-specific integrated circuits (ASICs). Hardware components can also include programmable logic or circuitry systems that are temporarily configured by software to perform certain operations. For example, a hardware component may include software executed by a general-purpose processor 704 or another programmable processor 704. Once configured by such software, the hardware component becomes a specific machine 700 (or a specific component of machine 700) uniquely tailored to perform the configured functions, and no longer the general-purpose processor 704. It should be understood that the decision to implement a hardware component mechanically, through a dedicated, permanently configured circuitry system, or through a temporarily configured (e.g., software-configured) circuitry system can be driven by cost and time considerations. Therefore, the phrase “hardware component” (or “hardware implementation component”) should be understood to encompass tangible entities, such as those physically constructed, permanently configured (e.g., hardwired), or temporarily configured (e.g., programmed) to operate in a manner to perform certain operations described herein. When considering embodiments that temporarily configure (e.g., program) hardware components, it is not necessary to configure or instantiate each hardware component at any given time. For example, in cases where the hardware components include a general-purpose processor 704 configured by software to become a dedicated processor, the general-purpose processor 704 can be configured as different dedicated processors (e.g., including different hardware components) at different times. The software accordingly configures one or more specific processors 704, for example, to constitute a specific hardware component at one time and different hardware components at different times.Hardware components are capable of providing information to and receiving information from other hardware components. Accordingly, the described hardware components can be considered as communicationally coupled. In the presence of multiple hardware components, communication can be achieved through signal transmission between two or more of the hardware components (e.g., via appropriate circuitry and bus 702). In embodiments where multiple hardware components are configured or instantiated at different times, such communication between hardware components can be achieved, for example, by storing and retrieving information in a memory structure accessible to these multiple hardware components. For example, a hardware component may perform an operation and store the output of that operation in a memory device to which it is communicationally coupled. Another hardware component may then access the memory device at a later time to retrieve and process the stored output. Hardware components may also initiate communication with input or output devices and be able to operate on resources (e.g., collections of information). The various operations of the exemplary methods described herein can be performed at least in part by one or more processors 704 that are temporarily (e.g., via software) or permanently configured to perform the relevant operations. Whether configured temporarily or permanently, such a processor 704 can constitute a processor-implemented component that will perform one or more of the operations or functions described herein. As used herein, a “processor-implemented component” refers to a hardware component implemented using one or more processors 704. Similarly, the methods described herein can be at least partially processor-implemented, with one or more specific processors 704 serving as examples of hardware. For example, at least some of the method operations can be performed by one or more processors 704 or processor-implemented components. Furthermore, the one or more processors 704 can also support the execution of related operations in a “cloud computing” environment or as “Software as a Service” (SaaS). For example, at least some of the operations can be performed by a group of computers (for example, a machine 700 including processor 704), where these operations are accessible via a network 732 (e.g., the Internet) and via one or more appropriate interfaces (e.g., APIs). The execution of some of these operations can be distributed across the processors 704, and thus deployed across several machines 700 rather than residing within a single machine 700. In some example embodiments, these processors 704 or processor-implemented components may be located in a single geographic location (e.g., in a home environment, an office environment, or a server farm). In other exemplary embodiments, these processors 704 or processor-implemented components may be distributed across several geographic locations.

[0096] In this context, "processor" refers to any circuit or virtual circuit (physical circuitry emulated by logic executed on the actual processor 704) that manipulates data values ​​according to control signals (e.g., "commands", "opcodes", "machine codes", etc.) and generates corresponding output signals (applied to operate machine 700). Processor 704 can be, for example, a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an ASIC, a radio frequency integrated circuit (RFIC), or any combination thereof. Processor 704 may also include a multi-core processor having two or more independent processors 704 (sometimes referred to as "cores") capable of executing instructions 710 simultaneously.

Claims

1. A method for using a symmetric cryptography technique with a variable-size symbol set, the method comprising: The transmission device accesses a first symmetric key and a first cryptographic configuration data item corresponding to the first symmetric key. The first cryptographic configuration data item identifies at least a first symbol set including a first number of unique symbols and a second symbol set including a second number of unique symbols, wherein the first number is different from the second number. According to the first cryptographic technique, the data item is configured to be encrypted using the first symmetric key to obtain an encrypted data item, wherein encrypting the data item includes: Based on the different first number of unique symbols and the second number of unique symbols, the first part of the data item and the second part of the data item are determined; Encrypt the first portion of the data item based on the first set of symbols; and The second portion of the data item is encrypted based on the second set of symbols; and The encrypted data item is transmitted to a first receiving device that has been allocated the first symmetric key and the first cryptographic configuration data item. The first receiving device decrypts the encrypted data item using the first cryptographic configuration data item.

2. The method according to claim 1, wherein, The first cryptographic configuration data item further identifies a first data size corresponding to the first symbol set and a second data size corresponding to the second symbol set, wherein the first data size is different from the second data size, and the size of the first part of the data item is based on the first data size, and the size of the second part of the data item is based on the second data size.

3. The method according to claim 1, wherein, Encrypting the first portion of the data item based on the first symbol set includes: Based on the first number of unique symbols contained in the first symbol set, a group of input bits contained in the first part of the data item is divided into a first group of input bit groups, and each input bit group in the first group of input bit groups represents a symbol from the first symbol set. Based on the first number of unique symbols contained in the first symbol set, a set of key bits contained in the first part of the first symmetric key is divided into a first set of key bit groups, each key bit group in the first set of key bit groups representing a symbol from the first symbol set; and The first set of input bit groups and the first set of key bit groups are provided as inputs to the cryptographic algorithm to obtain the first set of encryption bit groups, where each encryption bit group in the first set of encryption bit groups represents a symbol from the first set of symbols.

4. The method according to claim 3, wherein, The first group of input bits includes an input bit group, the first group of key bits includes a key bit group, and the first group of encryption bits includes an encryption bit group.

5. The method according to claim 3, wherein, Encrypting the second part of the data item based on the second symbol set includes: Based on the second number of unique symbols contained in the second symbol set, the second group of input bits contained in the second part of the data item is divided into a second group of input bit groups, each of the second group of input bit groups representing a symbol from the second symbol set; Based on the second number of unique symbols contained in the second symbol set, the second group of key bits contained in the second part of the first symmetric key is divided into a second group of key bit groups, each key bit group in the second group of key bit groups representing a symbol from the second symbol set; and The second set of input bit groups and the second set of key bit groups are provided as inputs to the cryptographic algorithm to obtain a second set of encryption bit groups, each of which represents a symbol from the second set of symbols.

6. The method according to claim 1, further comprising: Access the second symmetric key and the second cryptographic configuration data item corresponding to the second symmetric key, wherein the second cryptographic configuration data item is different from the first cryptographic configuration data item; According to the second cryptographic technique, the second data item is encrypted using the second symmetric key to obtain the second encrypted data item; as well as The second encrypted data item is transmitted to a second receiving device that has been allocated the second symmetric key and the second cryptographic configuration data item. The second receiving device decrypts the second encrypted data item using the second symmetric key based on the second cryptographic configuration data item.

7. The method according to claim 1, wherein, Encrypting the data items also includes: The third part of the data item is encrypted based on a third set of symbols identified by configuring the data item using the first cryptographic technique. The third set of symbols includes a third number of unique symbols, which are different from the first and second numbers.

8. The method according to claim 7, wherein, The size of the third part of the data item is based on the third data size corresponding to the third symbol set.

9. A system for using a symmetric cryptography technique employing a set of symbols of varying sizes, the system comprising: Transmission equipment, configured to perform operations including the following: Access a first symmetric key and a first cryptographic configuration data item corresponding to the first symmetric key, wherein the first cryptographic configuration data item identifies at least a first symbol set including a first number of unique symbols and a second symbol set including a second number of unique symbols, wherein the first number is different from the second number; According to the first cryptographic technique, the data item is configured to be encrypted using the first symmetric key to obtain an encrypted data item, wherein encrypting the data item includes: Based on the different first number of unique symbols and the second number of unique symbols, the first part of the data item and the second part of the data item are determined; Encrypt the first portion of the data item based on the first set of symbols; and The second portion of the data item is encrypted based on the second set of symbols; and The encrypted data item is transmitted to a receiving device that has been allocated the first symmetric key and the first cryptographic configuration data item. The receiving device decrypts the encrypted data item using the first cryptographic configuration data item.

10. The system of claim 9, further comprising the receiving device, the receiving device being configured to perform operations including: Receive the encrypted data item from the transmission device; and The encrypted data item is decrypted using the first symmetric key assigned to the receiving device and the first cryptographic configuration data item corresponding to the first symmetric key.

11. The system according to claim 10, wherein, Decrypting the encrypted data item using the first symmetric key assigned to the receiving device and the first cryptographic configuration data item corresponding to the first symmetric key includes: Decrypt the first part of the encrypted data item based on the first symbol set; and The second part of the encrypted data item is decrypted based on the second set of symbols.

12. The system according to claim 9, wherein, The first cryptographic configuration data item further identifies a first data size corresponding to the first symbol set and a second data size corresponding to the second symbol set, wherein the first data size is different from the second data size, and the size of the first part of the data item is based on the first data size, and the size of the second part of the data item is based on the second data size.

13. The system according to claim 9, wherein, Encrypting the first portion of the data item based on the first symbol set includes: Based on the first number of unique symbols contained in the first symbol set, a group of input bits contained in the first part of the data item is divided into a first group of input bit groups, each of the first group of input bit groups representing a symbol from the first symbol set. Based on the first number of unique symbols contained in the first symbol set, a group of key bits contained in the first part of the first symmetric key is divided into a first group of key bit groups, and each key bit group in the first group of key bit groups represents a symbol from the first symbol set. The first set of input bit groups and the first set of key bit groups are provided as inputs to the cryptographic algorithm to obtain the first set of encryption bit groups, where each encryption bit group in the first set of encryption bit groups represents a symbol from the first set of symbols.

14. The system according to claim 13, wherein, The first group of input bits includes an input bit group, the first group of key bits includes a key bit group, and the first group of encryption bits includes an encryption bit group.

15. A machine-readable medium storing instructions, which, when executed by one or more computer processors of a transmission device, cause the transmission device to perform operations using a symmetric cryptographic technique employing a variable-size set of symbols, wherein... The instructions include: Access a first symmetric key and a first cryptographic configuration data item corresponding to the first symmetric key, wherein the first cryptographic configuration data item identifies at least a first symbol set including a first number of unique symbols and a second symbol set including a second number of unique symbols, wherein the first number is different from the second number; According to the first cryptographic technique, the data item is configured to be encrypted using the first symmetric key to obtain an encrypted data item, wherein encrypting the data item includes: Based on the different first number of unique symbols and the second number of unique symbols, the first part of the data item and the second part of the data item are determined; Encrypt the first portion of the data item based on the first set of symbols; and The second portion of the data item is encrypted based on the second set of symbols; and The encrypted data item is transmitted to a first receiving device that has been allocated the first symmetric key and the first cryptographic configuration data item. The first receiving device decrypts the encrypted data item using the first cryptographic configuration data item.

Images