Matching cryptographic computing resources to predicted requirements for decrypting encrypted communications

Abstract

A computer-implemented method of using a processor to access a cryptographic function constraint associated with an encrypted message is disclosed. Based on a determination that the cryptographic function constraint does not include a mandatory cryptographic computation resource requirement, a first resource scaling operation is performed that includes analyzing a cryptographic metric associated with the processor. The cryptographic metric includes information associated with the encrypted message and a performance measurement of a cryptographic function executed by the processor. A result of the analysis of the cryptographic function constraint and the cryptographic metric is used to determine a cryptographic processing requirement of the encrypted message; and match the cryptographic processing requirement with a selected cryptographic computation resource of a set of cryptographic computation resources to identify a set of customized cryptographic computation resources that match the cryptographic processing requirement of the encrypted message. The set of customized cryptographic computation resources is used to perform a customized cryptographic function on the encrypted message.

Description

Background Technology

[0001] This invention generally relates to programmable computer systems. More specifically, this invention relates to computer systems, computer-implemented methods, and computer program products that automatically match or scale cryptographic computing resources to predicted and / or enforced requirements for decrypting encrypted communications, including, for example, encrypted connection requests such as Hypertext Transfer Protocol Security (HTTPS) messages.

[0002] HTTPS is a secure version of HTTP and is the primary protocol used to send data between web browsers and web servers. HTTPS is encrypted to increase the security of data transmission. This is especially important when users transmit sensitive data, such as through websites logging into financial accounts, email services, or health insurance providers. HTTPS uses an encryption protocol to encrypt communication. This protocol is called Transport Layer Security (TLS) and was formerly known as Secure Sockets Layer (SSL). The TLS (or SSL) protocol protects communication by using what is called asymmetric public-key infrastructure. This type of security system uses two different keys to encrypt communication between the two parties: a private key and a public key. The private key is controlled by the website owner and kept private. The private key resides on the web server and is used to decrypt information encrypted with the public key. The public key is available to anyone who wants to interact with the server securely. Information encrypted with the public key can only be decrypted with the private key.

[0003] Sensitive application data can be sealed using a secure enclave on worker nodes. A secure enclave is an isolated and trusted memory region that protects critical aspects of application functionality, helping to keep sensitive application data confidential and unmodified. In other words, a secure enclave is an encrypted portion of main memory. The secure enclave is hardened by processor-based security mechanisms. Secure cryptographic keys, which are associated with the hardware of a given machine (e.g., the processor chip of a worker node), are highly secure.

[0004] The operational performance of a computer system's processing unit (CPU) can be slowed down by the amount and nature of the processing tasks the CPU must perform. Encryption accelerators and coprocessors attempt to improve hardware performance by assisting the CPU in its required tasks. Encryption accelerators are software-based tools that attempt to accelerate overall system performance by providing additional hardware such as coprocessors, where cryptographic algorithms can be performed separately from the CPU processing cores, thereby freeing up the CPU processing cores to focus on other functions and operations. Coprocessors are complementary processors because they can be configured to take over the execution of selected processor-intensive tasks from the associated CPU, allowing the CPU to concentrate its computational resources on tasks essential to the overall system.

[0005] Known cryptographic speedups and coprocessors do not solve the efficiency problem of cryptographic operations. For example, due to performance and key protection considerations, web servers typically use open-source software (e.g., This is used to perform HTTPS decryption. Suitable open-source software (OSS) may include an engine that delivers or routes encrypted connection requests received at the web server to a defined cryptographic computation resource. However, the defined cryptographic computation resource is not specifically aligned (or matched) with the cryptographic operations required for the encrypted connection request. For example, under some conditions, the appropriate cryptographic processing for the encrypted connection request must be performed in a high-security computing resource (e.g., a cloud HSM (Hardware Security Module)), and under other conditions, the appropriate cryptographic processing for the encrypted connection request does not need to be performed in a high-security computing resource.

[0006] Therefore, known techniques for performing cryptographic operations do not improve the efficiency of such operations, leading to wasteful and inefficient overuse of cryptographic computational resources, including those with particularly high security. Summary of the Invention

[0007] Embodiments of the present invention include a computer-implemented method of using a processor system to access resource extension (RS) data associated with an encrypted message, wherein the OP defines cryptographic operation constraints. A first resource scaling operation is performed, at least in part based on the determination that the cryptographic operation constraints do not include mandatory cryptographic computation resource requirements. This first resource scaling operation includes performing an analysis of cryptographic metrics associated with the processor system. The cryptographic metrics include information associated with the encrypted message and performance measurements resulting from cryptographic operations performed by the processor system. The results of the analysis of the cryptographic operation constraints and the cryptographic metrics are used to determine the cryptographic processing requirements of the encrypted message and further to match the determined cryptographic processing requirements with selected resources from a set of available cryptographic computation resources, thereby identifying or selecting a set of customized cryptographic computation resources that match the cryptographic processing requirements of the encrypted message. This set of customized cryptographic computation resources is used to perform customized cryptographic operations on the encrypted message.

[0008] The technical benefits provided by the above embodiments of the present invention include segmenting any mandatory cryptographic resource requirements to ensure that such requirements are applied appropriately, as mandatory cryptographic resource requirements are typically applied to higher-security encrypted messages that demand more secure cryptographic resources. By segmenting messages with mandatory cryptographic resource requirements, the remaining message types can be matched more effectively with the cryptographic computation resources they require. By using both cryptographic constraints and cryptographic metrics to match the remaining message types with their required cryptographic computation resources, this matching operation can be improved by leveraging the actual historical performance of the cryptographic hardware.

[0009] The above embodiments of the present invention may further include configuring open-source cryptographic software to receive requests to perform cryptographic operations on encrypted messages; and routing the requests to the processor system instead of executing the requests.

[0010] The technical benefits provided by the above embodiments of the present invention include allowing existing open-source software to be effectively modified to incorporate the features and functions of different embodiments of the present invention.

[0011] The above embodiments of the present invention may further include making the first resource scaling operation include: capturing a first set of updated cryptographic metrics generated by performing the custom cryptographic operation on the encrypted message using the set of custom cryptographic computing resources; and updating the cryptographic metrics with the first set of updated cryptographic metrics.

[0012] The technical benefits provided by the above embodiments of the present invention include allowing the computer-implemented method to accumulate data from each iteration of the computer-implemented method and to use the accumulated data to improve subsequent iterations of the computer-implemented method.

[0013] Embodiments of the present invention also provide computer systems and computer program products having substantially the same features as the computer-implemented methods described above.

[0014] Additional features and advantages are achieved through the technology of this invention. Other embodiments and aspects of the invention are described in detail herein and are considered part of the claimed invention. For a better understanding of the advantages and features of the invention, refer to the specification and drawings. Attached Figure Description

[0015] The subject matter considered to be the invention is specifically pointed out and clearly claimed in the claims at the end of the specification. The foregoing and other features and advantages of the invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings, in which:

[0016] Figure 1 A diagram depicts a communication system embodying aspects of the present invention;

[0017] Figure 2 A flowchart illustrating a computer-implemented method embodying aspects of the present invention is depicted;

[0018] Figure 3 A schematic diagram illustrating a communication system architecture that embodies aspects of the present invention is provided;

[0019] Figure 4 A system embodying aspects of the present invention is described;

[0020] Figure 5 A diagram illustrating data fields of Resource Scaling Envelope (RS-EVP) data extension according to various aspects of the present invention is provided.

[0021] Figure 6 Diagrams illustrating both the system and method according to various aspects of the present invention are depicted;

[0022] Figure 7 Diagrams illustrating both the system and method according to various aspects of the present invention are depicted;

[0023] Figure 8 A machine learning system that can be used to implement various aspects of the present invention is described;

[0024] Figure 9 It describes what can be made by Figure 8 The learning phase implemented by the machine learning system shown in the diagram;

[0025] Figure 10 Details of an exemplary computing system capable of implementing aspects of the present invention are shown;

[0026] Figure 11 A cloud computing environment according to an embodiment of the present invention is described; and

[0027] Figure 12 An abstract model layer according to an embodiment of the present invention is described. Detailed Implementation

[0028] For the sake of brevity, conventional techniques relating to the manufacture and use of the present invention may or may not be described in detail herein. Specifically, various aspects of the computing systems and specific computer programs used to implement the different technical features described herein are well known. Consequently, for the sake of brevity, many conventional implementation details are only briefly mentioned or omitted entirely herein, without providing well-known system and / or process details.

[0029] Many functional units of the system described in this specification have been labeled as modules. Embodiments of the invention are applicable to a wide variety of module implementations. For example, a module can be implemented as hardware circuitry including custom VLSI circuitry or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. Modules can also be implemented in programmable hardware devices such as field-programmable gate arrays, programmable array logic, programmable logic devices, etc. Modules can also be implemented in software for execution by different types of processors. The identified executable code modules may, for example, comprise one or more physical or logical blocks of computer instructions, which may be organized, for example, as objects, procedures, or functions. However, the executable files of the identified modules do not need to be physically located together, but may include different instructions stored in different locations that, when logically joined together, function as a module and achieve the stated purpose of the module.

[0030] For ease of explanation, the different components, modules, sub-functions, etc., of the system described herein are depicted separately. In embodiments of the invention, unless otherwise specified, the operations performed by the various components, modules, sub-functions, etc., may be distributed differently than those shown, without departing from the scope of the various embodiments of the invention described herein.

[0031] For convenience, some technical functions and / or operations described herein use informal expressions to convey meaning. For example, a processor having data stored in its cache memory can be described as a processor that "knows" the data. Similarly, a user sending a command to a processor to load data can be described as the user "telling" the processor to load the data. It should be understood that any such informal expressions in this detailed description should be construed as encompassing, and those skilled in the art will understand that such informal expressions encompass, the corresponding more formal and technical descriptions.

[0032] Turning now to an overview of various aspects of the invention, embodiments of which provide a computer system, a computer-implemented method, and a computer program product that receives an encrypted message and associated resource scaling (RS) data; uses RS constraints in the RS data to determine that the encrypted message does not have mandatory cryptographic processing requirements; determines a cryptographic metric derived from cryptographic operations performed by a processor system; uses the RS constraints and the cryptographic metric to determine and / or predict the non-mandatory cryptographic processing requirements of the encrypted message; uses the determined and / or predicted cryptographic processing requirements to identify and / or select a matching and / or a set of custom cryptographic computing resources from a set of available cryptographic computing resources; and uses the matching and / or the set of custom cryptographic computing resources to perform a custom cryptographic operation (e.g., custom decryption) on the encrypted message.

[0033] In embodiments of the invention, a set of available cryptographic computing resources can be selected to match the different types of cryptographic processing requirements anticipated for different types of encrypted messages that can be transmitted. According to aspects of the invention, cryptographic computing resources aligned with a specific type of encrypted message are those that efficiently apply cryptographic operations to said specific type of encrypted message without wasting cryptographic computing resources. Therefore, embodiments of the invention can be used to match the predicted cryptographic processing requirements of encrypted messages with a customized or customized subset of available cryptographic computing resources, thereby improving the efficiency of how available cryptographic computing resources are applied. Thus, embodiments of the invention perform cryptographic operations in a novel way that improves the efficiency of such cryptographic operations, resulting in the non-wasteful and efficient use of cryptographic computing resources, including those with particularly high security.

[0034] The foregoing and other aspects of the present invention are described herein as RS (Resource Scaling) functionality. Some embodiments of the present invention can be implemented using an open-source container orchestration framework (OS-COF) that has been modified according to aspects of the present invention to incorporate various novel RS functionalities and / or features described herein, thereby forming novel RS-OS-COFs embodying aspects of the present invention. The novel RS-OS-COF can be configured to include a cluster of interconnected physical and / or virtual compute nodes (i.e., machines) configured to provide automated deployment and management of containerized applications, comprising open-source software (e.g., OpenSSL software).

[0035] An RS-OS-COF node cluster can contain two types of nodes: master nodes and one or more worker nodes. The master node is responsible for managing the worker nodes in the cluster. The master node is the entry point for all operations to be performed in the cluster, received from, for example, an application programming interface, a user interface, or an open-source software (OSS) interface. Worker nodes are responsible for running one or more workloads and networking with different workloads running on other worker nodes in the cluster. According to aspects of the invention, the master node of the RS-OS-COF cluster of nodes is modified to include RS functionality, thereby forming an RS-OS-COF worker node.

[0036] The basic scheduling unit in an RS-OS-COF worker node is a container, such as a pod. Containers can coexist on worker nodes and share resources. Each container in RS-OS-COF is assigned a unique container Internet Protocol address within the worker node cluster, which allows applications to use ports without the risk of conflicts. A service is a group of RS-OS-COF containers working together, such as one layer of a multi-tiered application.

[0037] This novel RS-OS-COF can be configured to receive encrypted messages, which can take various forms, including, for example, HTTPS connection requests. A suitable example of RS-OS-COF is... An open-source platform has been modified to incorporate different aspects of the novel RS functionality described herein. In some aspects of the invention, an encrypted message is received at an RS-OS-COF node, and the node requests an OSS to perform cryptographic operations on the encrypted message to decrypt or unpack it, generating a decrypted or unpacked message for downstream processing. In some embodiments of the invention, the OSS may be a modified off-the-shelf OS-COF tool capable of performing known cryptographic operations in a conventional (or known) manner, but modified to route the cryptographic operations to a new RS engine on the RS-OS-COF worker node, at least in part, based on the receipt of a request to perform cryptographic operations on the encrypted message. In embodiments of the invention, the RS engine is configured to provide a hardware implementation of cryptographic operations according to aspects of the invention. In some embodiments of the invention, the RS engine according to aspects of the invention provides improved performance for the implementation and control of cryptographic algorithms and operations compared to known cryptographic operations, resulting in a non-wasteful and efficient use of cryptographic computational resources, including those for particularly high-security cryptographic computation.

[0038] In embodiments of the invention, a new RS dataset (or stream) with multiple fields is associated with an encrypted message and received at the RS-OS-COF. The RS data includes at least one field defining an Operation Policy (OP), and the OP includes multiple subfields defining cryptographic operation constraints applied or utilized by the RS engine when the RS engine determines, predicts, and / or estimates the cryptographic processing requirements of the encrypted message. Furthermore, the RS engine is configured to generate and analyze cryptographic metrics associated with (and derived from) all cryptographic operations performed by the RS-OS-COF. In embodiments of the invention, the cryptographic metrics include information associated with the encrypted message, as well as performance measurements resulting from the cryptographic operations performed by the RS-OS-COF.

[0039] If a cryptographic operation constraint specifies a mandatory cryptographic computation resource that must be applied to the encrypted message, the RS engine performs a set of unpredictable RS operations, where the RS engine does not need to perform any analysis to predict, determine, and / or estimate the cryptographic processing requirements of the encrypted message. In an unpredictable RS operation, the specified mandatory cryptographic computation resource is selected from a set of available cryptographic computation resources and then used to apply the unpredictable cryptographic operation to the encrypted message.

[0040] If the cryptographic operation constraints do not specify mandatory cryptographic computation resources that must be applied to the encrypted message, the RS engine initiates a set of predictive RS operations configured to predict, determine, and / or estimate the cryptographic processing requirements of the encrypted message using operation policy constraints and cryptographic metrics. In embodiments of the invention, predictive RS operations may include: selecting “customized” or “scaled” cryptographic computation resources from a set of available cryptographic computation resources using the predicted cryptographic processing requirements; and may also include applying the “selected,” “customized,” and / or “scaled” cryptographic operations to the encrypted message using the “selected,” “customized,” and / or “scaled” cryptographic computation resources. According to embodiments of the invention, the cryptographic operation constraints of the RS data are specific to the encrypted message associated with the RS data, and different encrypted messages may have different RS data with different OPs.

[0041] In some embodiments of the invention, some or all of the predictive RS operations can be performed using the configuration of modules that collect, dispatch, analyze, and / or manage data traffic moving through the RS engine as the RS engine identifies “selected,” “customized,” and / or “scaled” cryptographic computation resources that apply “selected,” “customized,” and / or “scaled” cryptographic operations to encrypted messages. In some embodiments of the invention, the modules include configurations of an algorithm processing module, a resource management module, and a data traffic-related module. In some embodiments of the invention, the data traffic-related module may include a traffic dispatcher module, a traffic analyzer module, and a traffic metric collector module. In embodiments of the invention, the traffic analyzer module is configured to analyze encrypted messages at least in part based on dispatch principles. Additional details regarding how the module configurations operate to implement some or all of the predictive RS operations are provided below.

[0042] In some embodiments of the invention, a first classifier may be used to perform some or all of the prediction RS operations. The first classifier is trained to perform classification and / or prediction tasks using machine learning algorithms and models. In some embodiments of the invention, the first classifier may be trained to perform the task of predicting non-mandatory cryptographic processing requirements for encrypted messages using cryptographic operation constraints and cryptographic metrics. In some embodiments of the invention, a second classifier trained to perform classification and / or prediction tasks using machine learning algorithms and models may be used to perform some or all of the prediction RS operations. In some embodiments of the invention, a second classifier may be trained to perform the task of identifying or satisfying (without excessive waste of cryptographic computing resources) the predicted cryptographic processing requirements (obtained from a set of available cryptographic computing resources) using the cryptographic processing requirements predicted by the first classifier, along with a description of the capabilities of a set of available cryptographic computing resources.

[0043] According to aspects of the invention, encrypted messages can be implemented as Resource Scaled Envelope (RS-EVP) data extensions. In OSS, an envelope is a symmetric key encrypted with a public key. Because encryption and decryption using a symmetric key are computationally expensive, messages are not encrypted directly using such a key, but rather using a symmetric "session" key, which itself is then encrypted with the public key. This combination of a symmetric session key encrypted with a public key is referred to as an envelope in OSS.

[0044] The technical effects and benefits provided by the embodiments of the invention described herein include segmenting any mandatory cryptographic resource requirements to ensure that such requirements are applied appropriately, as mandatory cryptographic resource requirements are typically applied to higher-security encrypted messages that demand more secure cryptographic resources. By segmenting messages with mandatory cryptographic resource requirements, the remaining message types can be matched more effectively with their required cryptographic computational resources. By using both cryptographic constraints and cryptographic metrics to match the remaining message types with their required cryptographic computational resources, this matching operation can be improved by leveraging the actual historical performance of cryptographic hardware.

[0045] The technical effects and benefits provided by the embodiments of the invention described herein also include allowing existing open-source software to be effectively modified to incorporate the features and functionality of various embodiments of the invention.

[0046] The technical effects and benefits provided by the embodiments of the invention described herein also include allowing the computer-implemented method to accumulate data from each iteration of the computer-implemented method and to use the accumulated data to improve subsequent iterations of the computer-implemented method.

[0047] Now we turn to a more detailed description of various aspects of the invention. Figure 1An RS-OS-COF system 100 according to an embodiment of the present invention is illustrated. As shown, system 100 includes an external entity 110 that communicates with application pod 120 via a wired or wireless network connection 112. External entity 110 may be any communication element capable of transmitting encrypted messages such as HTTPS messages 114 with RS data 116 via network connection 112. Application pod 120 includes one or more nodes 130, wherein at least one node includes an RS engine 140 according to various aspects of the present invention. Node 130 is configured to cognitively select one or more of a set of available cryptographic computation resources 180 (i.e., one or more of CCR-A182A, CCR-B182B, CCR-C182C, and CCR-D182D) using OSS160, RS data 116, and cryptographic metrics 170; apply custom cryptographic operations to HTTPS message 114 using the selected cryptographic computation resources from the set of cryptographic computation resources 180 to generate a decrypted or unpacked HTTP message 131; and send the decrypted HTTP message 131 to application container 150 for downstream processing.

[0048] Figure 2 A computer-implemented method 200 according to various aspects of the present invention is described. Method 200 is implemented by an RS-OS-COF system 100 (e.g., Figure 1 (As shown) Execution. Where appropriate, the description of method 200 will refer to... Figure 1 The corresponding elements of system 100 are shown. According to an aspect of the invention, method 200 begins at blocks 202, 204, wherein application pod 120 receives an encrypted message (e.g., HTTPS message 114) (block 202), and wherein RS engine 140 accesses RS data 116 associated with the received encrypted message (block 204). At block 206 of method 200, RS engine 140 extracts or accesses the operation policy (OP) of RS data 116, wherein the OP defines OP constraints for performing cryptographic operations on the received encrypted message.

[0049] In decision box 208, RS engine 140 determines whether the OP constraint defines or specifies whether the encrypted message must be cryptographically processed using some of the CCRs in CCRs 180. If the answer to the query in decision box 208 is yes, method 200 moves to box 210, where RS engine 140 selects one or more of the desired CCRs 180 (e.g., CCR-D 182D) and uses one or more of the selected CCRs 180 to perform a forced cryptographic operation on the encrypted message. Method 200 moves from box 210 to box 212, where RS engine 140 develops a cryptographic metric (CM) from the execution of the forced cryptographic operation on the encrypted message. According to an embodiment of the invention, the CM developed in box 212 is added to the CM used in box 218 (not yet described). Thus, the CM used in box 218 is accumulated throughout the multiple iterations of method 200. Method 200 moves from box 212 to decision box 214 to determine whether to transmit an additional encrypted message. If the answer to the query at decision box 214 is no, then method 200 moves to box 216 and ends. If the answer to the query at decision box 214 is yes, then method 200 returns to box 202 to receive the next encrypted message.

[0050] Returning to decision box 208, if the answer to the query in decision box 208 is no, method 200 moves to box 216, where RS engine 140 accesses and analyzes the accumulated CM and / or OP constraints. In decision box 220, RS engine 140 attempts to predict the cryptographic requirements of the encrypted message using the results of the OP constraint and CM analysis (performed in decision box 220) and matches the predicted cryptographic requirements with the selected CCR from the available CCRs 180.

[0051] According to some aspects of the invention, the operations described in decision box 220 can be performed by configuring RS engine 140 to use modules that collect, dispatch, analyze, and / or manage data traffic moving through RS engine 140 to predict cryptographic requirements for encrypted messages and / or match the predicted cryptographic requirements with a selected CCR from available CCRs 180. In some embodiments of the invention, the module configuration includes algorithm processing module 420 ( Figure 4 (as shown in the image), Resource Management Module 430 ( Figure 4 (as shown in the diagram) and the configuration of data traffic-related modules. In some embodiments of the present invention, the data traffic-related modules may include a traffic dispatcher module 442 (shown in the diagram). Figure 4 (as shown in the image), Flow Analyzer Module 446 ( Figure 4 (shown in) and flow metric collector module 444 ( Figure 4(as shown in the diagram). In an embodiment of the invention, the flow analyzer module 446 is configured to be at least partially based on dispatch principle 446A (as shown in the diagram). Figure 4 (As shown in the diagram) Analyzing encrypted messages. The following sections provide additional details on how the module is configured to operate in order to implement some or all of the operations depicted in decision box 220.

[0052] According to an aspect of the invention, the operation described at decision box 220 can be performed by configuring RS engine 140, which can be configured to use classifier 810 ( Figure 8 As shown in the figure, the classifier has a machine learning algorithm 812 ( Figure 8 (as shown) and Model 816 ( Figure 8 (As shown) to predict the cryptographic requirements of an encrypted message and / or match the predicted cryptographic requirements with a selected CCR from the available CCRs 180. In some embodiments of the invention, decision box 220 can be implemented by training a first classifier to perform the task of predicting non-mandatory cryptographic requirements of an encrypted message using cryptographic operation constraints and cryptographic metrics. A second classifier can be trained to perform the task of identifying a customized set of cryptographic computational resources (obtained from the set of available cryptographic computational resources) that match or satisfy the predicted cryptographic requirements (without excessive waste of cryptographic computational resources) using the cryptographic requirements predicted by the first classifier, along with a description of the functional capabilities of a set of available cryptographic computational resources. Additional details are subsequently provided regarding how classifier 810 can be trained and used to perform prediction and / or classification operations that can be used to perform the operations defined in decision box 220.

[0053] If the answer to the query at decision box 220 is no, method 200 moves to box 226, where RS engine 140 selects a default set of CCRs 180 (e.g., all non-mandatory CCRs of CCR 180) and uses the default set of CCRs 180 to perform a default cipher operation on the encrypted message. Method 200 moves from box 226 to box 212, where RS engine 140 develops a ciphermetric (CM) from the execution of the default cipher operation on the encrypted message at box 226. According to an embodiment of the invention, the CM developed at box 212 is added to the CM used at box 218. Thus, after multiple iterations of method 200, the CM used at box 218 is accumulated throughout the multiple iterations of method 200. Method 200 moves from box 212 to decision box 214 to determine whether to transmit an additional encrypted message. If the answer to the query at decision box 214 is no, method 200 moves to box 216 and ends. If the answer to the query at decision box 214 is yes, then method 200 returns to box 202 to receive the next encrypted message.

[0054] Returning to decision box 220, if the answer to the query at decision box 220 is yes, method 200 moves to box 222, where RS engine 140 uses one or more of the matching or scaling of CCR 180 identified at decision box 220 to perform cryptographic operations on the encrypted message. Method 200 moves from box 222 to box 224, where RS engine 140 develops a CM from the performance of the matching and / or scaling cryptographic operations on the encrypted message. According to an embodiment of the invention, the CM developed in box 224 is added to the CM used in box 218. Method 200 moves from box 224 to decision box 214 to determine whether to transmit an additional encrypted message. If the answer to the query at decision box 214 is no, method 200 moves to box 216 and ends. If the answer to the query at decision box 214 is yes, method 200 returns to box 202 to receive the next encrypted message.

[0055] Figure 3 An RS-OS-COF system 100A according to an embodiment of the present invention is described. System 100A utilizes system 100 (in...) Figure 1 The functional principles shown in System 100 are illustrated in [the diagram]. However, System 100A describes additional details of how the functional principles shown in System 100 can be applied to specific computing environments. For example... Figure 3 As shown, system 100A includes an external entity (not shown) that wirelessly communicates with node cluster 130A and a set of cryptographic computing resources (CCR) 180A via antenna 302. According to various aspects of the invention, the external entity can be any communication element capable of transmitting encrypted messages (e.g., HTTPS messages 114) with RS data 116 to antenna 302 via a wireless communication path. Node cluster 130A includes a master node 132A and multiple worker nodes 132B, 132C, 132D configured and arranged as shown. Master node 132A includes an application pod housing a web server and applications. The web server of master node 132A can be implemented as an open-source HAProxy (High Availability Proxy) server 310. HAProxy server 310 is configured to receive HTTPS messages 114 with RS data 116. The application of master node 132A includes an RS engine 312. Worker nodes 132B and 132C each include application pods and applications, which are configured and arranged as shown to perform certain tasks of the node cluster 130A under the control and guidance of master node 132A. Worker node 132D is specifically designed to support resource scaling operations performed by master node 132A according to aspects of the invention. More specifically, worker node 132D includes application pod 322, which contains resources configured to support resource scaling operations performed by RS engine 312 (e.g., ...). Figure 2The method 200 shown is a Cryptographic Computer Resource (CCR) application 320. CCR 320 includes cryptographic resources that can be accessed and scaled according to embodiments of the invention, indicating any resource that can be scaled using various embodiments of the invention.

[0056] Node cluster 130A is communicatively coupled to a set of cryptographic computing resources (CCRs) 180A. According to aspects of the invention, RS engine 312 and CCR application 320 are configured and set to evaluate instructions in RS data 116 and analyze cryptographic metrics collected by node cluster 130A to identify and select any combination of CCRs 180A, which may be any combination of cloud HSM (Hardware Security Module) 360; DBaaS (Database as a Service) 362; encryption high-speed card 364; CPACF (Central Processing Unit Auxiliary Encryption Function) coprocessor 366; and additional CCRs 368. The selected combination of CCRs 180A is tailored to the specific cryptographic processing requirements of HTTPS messages 114 determined by RS engine 312 and CCR application 320.

[0057] In embodiments of the invention, the Cloud HSM 360 is a dedicated cryptographic processor designed to protect the lifecycle of cryptographic keys. The Cloud HSM 360 is configured to generate, process, and store keys. The Cloud HSM 360 can be used to establish a user's own public key infrastructure for processing application and signing activities. The Cloud HSM 360 protects the user's cryptographic infrastructure by securely managing, processing, and storing cryptographic keys within a hardened, tamper-proof device. In embodiments of the invention, the DBaaS instance 362 is a key component of the cloud computing secondary service model and XaaS (anything as a service), which describes a general category of services related to cloud computing and remote access. XaaS recognizes the vast number of products, tools, and technologies now delivered to users as services via the Internet. Essentially, the DBaaS instance 362 is a management service configured to provide access to databases to be used with applications and their associated data, a more structured approach compared to storage as a service. The DBaaS instance 362 may also include a database manager component that controls all underlying database instances via an API. This API can be accessed by users via a management console (usually a web application), which allows users to manage and configure the database, and even provision or deprovision database instances.

[0058] In embodiments of the invention, the encryption high-speed card 364 is an I / O add-on card that implements additional encryption functions. The encryption high-speed card 364 is a coprocessor and can support a wider range of callable services, including secure and clear key support for PKA decryption, digital signature verification, and digital signature generation (including RSA and ECC variants). Alternatively, the encryption high-speed card 364 can be configured as an accelerator to provide better throughput at the cost of supporting fewer services. In embodiments of the invention, the CPACF (Central Processing Unit Assist for Encryption Functions) coprocessor 366 is a coprocessor that performs symmetric-key encryption and computes message digests in hardware using DES, TDES, AES-128, AES-256, SHA-1, and SHA-256 cryptography. DES, TDES, AES-128, and AES-256 are used for symmetric-key encryption. SHA-1 and SHA-256 are used for message digests. In embodiments of the invention, the additional CCR 368 can include any other CCR that can be used to efficiently apply cryptographic operations to the type of HTTPS message that can be sent as HTTPS message 114.

[0059] Figures 4 to 7 Various aspects of the RS-OS-COF architecture 100B according to embodiments of the present invention are described. Before describing the details of the RS-OS-COF architecture, the following will be provided. Figures 4 to 7 Definitions and descriptions of some terms used herein. The term "traffic" describes the data movement associated with the execution of cryptographic operations, which includes encryption requests to the Cryptographic Computation Resource (CCR) 180A and encryption responses returned from the Cryptographic Computation Resource (CCR) 180A. "Response time" can be the duration for processing each cryptographic operation. "Success / Failure" is the result of the cryptographic operation currently being processed. "Success" indicates that the cryptographic operation has no errors and the Cryptographic Computation Resource (CCR) 180A returns a "success" response. Cryptographic traffic metric 462 contains metrics and logs generated during the cryptographic operations being processed. It includes "response time," "success / failure," etc.

[0060] The cryptographic resource schema is a collection of "tenant profiles," "constraints," "costs," "control interfaces," and "capability interfaces." The cryptographic resource schema is the input to the traffic analyzer 446 used for analysis. "Static" indicates the type of "tenant profiles," "constraints," "costs," "control interfaces," and "capability interfaces." These do not change frequently. The "tenant profile" contains general information about the resources owned by the tenant. "Constraints" have the same meaning as compliance, meaning security standards such as FIPS 140. "Costs" refer to pricing, such as cost per algorithm; cost per CPU / memory / machine / disk / cryptographic card; and cost per throughput. The "resource control interface" 431 uses a range of methods to control resources, such as increasing or decreasing resources. It can be used to increase / decrease resources in the system. The "capability interface" 432 includes encryption methods and persistence methods. Cryptographic methods are cryptographic algorithms that can be used for encryption, decryption, signing, verification, etc. They include, but are not limited to, EC methods, RSA methods, DH, cryptography, hashing, etc.

[0061] Resource Metrics Collector 436 collects metrics and logs from the cryptographic resource while the resource is running. "Dynamic" refers to the dynamic metrics and log data generated during resource runtime, including "Current Traffic Workload," "Historical Data and Trends," and "Stability and Reliability." "Current Traffic Workload" refers to the metrics and logs of the cryptographic resource's workload. The resource's workload can be, for example, idle, normal, or overloaded. "Historical Data and Trends" refers to the metrics and logs of the cryptographic resource's historical traffic workload. "Stability and Reliability" refers to the metrics and logs that can be used to assess the stability and / or reliability of the cryptographic resource. Poor stability and reliability are associated with frequent resource failures. All of the above metrics and logs are generated during resource runtime and can be collected by Resource Metrics Collector 436.

[0062] The term "module" as used in the phrase "different computing modules" refers to one of the cryptographic computing resources (CCR) 180A. "Cost model" is a description related to pricing. For example, traffic dispatcher 442 can dispatch cryptographic operations to one of the cheaper (e.g., to the customer) cryptographic computing resources (CCR) 180A.

[0063] Distribution strategy 466A is used by traffic distributor module 442 to distribute traffic to optimal cryptographic computing resources 320 and 180A. It includes a "spinning threshold," "precondition-based priority," "cost per algorithm," "response time," and "compliance resources." As workload increases, the performance of cryptographic computing resources can degrade sharply when throughput reaches a threshold. The "spinning threshold" refers to this threshold. "Precondition-based priority" refers to the conditions that must be met before other algorithms can be executed. For example, such as... Figure 5As shown, CIPHER 510A represents a series of symmetric encryption / decryption algorithms, such as AES and DES. HASH 510B represents a series of hash algorithms, such as SHA and MD5. Other algorithms include asymmetric encryption algorithms. In some cases, Algorithm 1 depends on Algorithm 2. For example, Algorithm 1 may require the output from Algorithm 3 as input. In this case, Algorithm 2 is a PRE-CONDITION 510 for Algorithm 1. "Cost per algorithm" refers to the cost (or price) of each cryptographic operation in a cryptographic computation resource. "Response time" refers to the duration of a cryptographic operation being processed in a cryptographic computation resource. "Compliance resource" refers to a situation where a cryptographic operation has a compliance requirement that should be delivered to a compliance-certified cryptographic computation resource.

[0064] The term "cost" refers to pricing, such as cost per algorithm, cost per CPU / memory / machine / disk / cryptographic card, and / or cost per throughput. "Cost model" refers to pricing choices, such as economic preferences that can influence traffic dispatcher 442 to allocate traffic to target cryptographic computing resources with lower prices than other resources. "Enterprise" preferences can influence traffic dispatcher 442 to allocate traffic to target cryptographic computing resources that may have higher prices but faster response times.

[0065] Algorithm processing module 420 and registration module 422 serve the following purposes. When a cipher operation (e.g., a cipher request) arrives along with EVP data, algorithm processing module 420 appends RS-EVP data extension 450 to each cipher operation and then sends the cipher operation to traffic analyzer 446. Registration module 422 is an existing module in OpenSSL that can be used to register the OpenSSL engine with OpenSSL.

[0066] The "compliance module" referenced in SAFETY-SENSITIVE 512 can be a module that meets security compliance requirements. For example, Hyper Protect Crypto Services is a hardware security module that is FIPS 140-2 Level 4 certified.

[0067] The "real-time requirement" mentioned in REAL_TIME 514 can refer to the time requirement of a cryptographic operation. A cryptographic operation has a time requirement to be processed within a short period of time. For example, a cryptographic operation might have a real-time requirement to fully process and receive a response message within 100 milliseconds.

[0068] I / O 516 can be a cryptographic computing resource capable of storing persistent data, such as keys. I / O 516 is used to emphasize the ability to maintain persistent data. It can be a database 471 or a cloud HSM 475 within resource 518. However, not all resources 518 have the ability to maintain persistent data.

[0069] An EVP request is an envelope request sent from OpenSSL to Engine 312A. The EVP data contains parameters and functions related to an algorithm. RS-EVP Data Extension 450 is an extension of the EVP request.

[0070] Resource control interface 431 includes a series of methods for controlling cryptographic computing resources, such as scaling up and scaling down resources. It can be used to increase / decrease resources in the system. Cloud scalability in cloud computing refers to the ability to increase or decrease IT resources as needed to meet changing demands. "Scale-up" refers to increasing resources entering the system. "Scal-down" refers to decreasing resources from the system.

[0071] Capability interface 432 includes encryption methods and persistence methods. Cryptographic methods are cryptographic algorithms that can be used for encryption, decryption, signing, verification, etc. Cryptographic methods include, but are not limited to, EC methods, RSA methods, DH, cryptography, hashing, etc. Persistence methods are load / store related methods that can be used to store data on hardware. Persistence methods include, but are not limited to, loading / storing keys.

[0072] Information Interface 433 includes a series of methods for collecting cost information about tenant profiles, constraints, and resources. A “tenant profile” contains general information about the cryptographic computing resources owned by a tenant. “Constraints” has the same meaning as compliance, which refers to security standards such as FIPS 140-2. “Cost” refers to pricing, such as the cost per algorithm, the cost per CPU / memory / machine / disk / cryptographic card, and / or the cost per throughput.

[0073] The discovery module 434 collects registration information from the resource control interface 431, capability interface 432 and information interface 433 and registers it in the register of the module 434, and then delivers this information to the pusher 435.

[0074] The pusher 435 collects static data from the discovery module 434 and dynamic data from the resource metric collector 436, and then pushes the data to the traffic analyzer 446 for analysis. Static data includes data from the resource control interface 431, capability interface 432, and information interface 433. Dynamic data includes current traffic workload data, historical data and trends, as well as stability and reliability.

[0075] Resource Metrics Collector 436 collects metrics and logs from the cryptographic computing resource during its operation. "Current Traffic Workload" refers to the metrics and logs of the cryptographic computing resource's workload. The workload of the cryptographic computing resource can be idle, normal, or overloaded. "Historical Data and Trends" refers to the metrics and logs of the cryptographic computing resource's historical traffic workload. "Stability and Reliability" refers to the metrics and logs that can be used to assess the stability and / or reliability of the cryptographic computing resource. Frequent resource failures indicate poor stability and reliability. All of the above metrics and records are generated during resource operation and can be collected by Resource Metrics Collector 436.

[0076] Turn now Figures 4 to 7 A more detailed description, Figure 4 This is a block diagram depicting an RS-OS-COF architecture 100B according to various aspects of the present invention. Architecture 100B includes and utilizes system 100 (in... Figure 1 (shown in) and System 100A (in Figure 3 The functional principles shown in the diagram are illustrated below. However, architecture 100B depicts additional details on how the functional principles shown in systems 100 and 100A can be applied to specific computing environments. For example... Figure 4 As shown, moving from top to bottom, the first layer of architecture 100B includes various network servers that can be used to receive HTTPS messages 114 with RS data 116. The first layer may include Web server 410, HAProxy web server 310A, SSL utility 412, and additional web server support 414. The second layer of architecture 100B includes components corresponding to OSS160 (…). Figure 1 The OSS element 160A comprises a set of OSS elements (shown in the diagram). OSS element 160A includes various algorithms (e.g., ECDHE (Elliptic Curve Diffie-Hellman Short-Term), EC Key Generation, etc.) that are configured and set to perform encryption and decryption operations.

[0077] The third layer of architecture 100B includes an RS engine 312A, a resource management module 430, a traffic dispatcher module 442, a traffic analyzer module 446, and a traffic metric collector module 444, configured and arranged as shown in the figure. The RS engine 312A includes an algorithm processing module 420 and a registration module 422. The fourth layer of architecture 100B includes a set of cryptographic computing resources (CCRs) 180B, which may include a database 471, a file system 472, a host CPU 473, a container CPU 474, a cloud HSM 475, a cryptographic card 476, a cryptographic coprocessor 477, and an additional CCR 368. The database 471 and file system 472 are CCRs used for key storage. The cloud HSM 475, cryptographic card 476, and cryptographic coprocessor 477 are hardware CCRs used to perform cryptographic operations (e.g., encryption / decryption). The host CPU 473 and container CPU 474 are CPU resources used for cryptographic operations (e.g., encryption / decryption). Cloud HSM 475 is essentially located in the cloud (e.g., Figure 11 The password card on the cloud computing system 50 shown. Figure 4 The Resource Scaling Envelope (RS-EVP) data extension 450 and cryptographic metrics 160 are also depicted. Cryptographic metrics 160 include encrypted traffic metrics 462, cryptographic computation resource pattern data 464, and cryptographic computation resource metrics 466.

[0078] RS-EVP Data Extension 450 includes operational policies describing how RS Engine 312A processes HTTP messages 114 and constraints of RS-EVP Data Extension 450 within the OpenSSL envelope of OSS Component 160A. Cryptographic traffic metrics include response time, successful instances, failed instances, and other metrics related to data traffic through Architecture 100B during cryptographic operations. Cryptographic Computing Resource Mode 464 is static data defining various parameters including, for example, tenant profiles, constraints, costs, control interfaces, and capability interfaces. Cryptographic Computing Resource Metric 466 is dynamic data defining various dynamically changing data such as current traffic, workload, historical data, historical trends, stability, and reliability.

[0079] Resource management module 430 is used to scale up and down CCR module 180B according to traffic models and / or cost models. Traffic dispatcher 442 sends traffic to different computation modules according to cost models. Traffic metric collector module is based on the architecture that performs the resource scaling operations described herein (e.g., Figure 2The method 200 shown collects traffic metrics generated by architecture 100B. Traffic analyzer module 446 analyzes encrypted messages (e.g., HTTPS messages 114) based on a dispatch strategy that defines policies such as redirection thresholds, precondition-based priority, per-algorithm cost, response time, and compliance resources. Traffic dispatcher 442, traffic metric collector 444, traffic analyzer 446, and resource management 430 reside in master node 132A. In some embodiments of the invention, from an architectural perspective, these components may reside in RS engine 312 or may be in the same layer as RS engine 312.

[0080] Figure 5 A block diagram illustrating an RS-EVP data extension 450A according to an embodiment of the present invention is described. RS-EVP data extension 450A corresponds to RS-EVP data extension 450 (… Figure 4 (As shown in the diagram), however, the RS-EVP data extension 450A provides additional details on how to define fields for operating policies and operating policy constraints in some embodiments of the invention. For example... Figure 5 As shown, RS-EVP Data Extension 450A has multiple fields, including OPT_POLICY451 (operation policy), EC_GROUP452 (curve-related information), EC_POINT453 (calculated points in the curve), BIGNUM454 (base points in the curve, i.e., private keys), POINT_CONV_FORM455 (encoding of elliptic curve points), and an additional field 456.

[0081] OPT_POLICY451 defines operation policy constraint 502. Operation policy constraint 502 includes PRE-CONDITION 510 (conditions that must be met before executing other algorithms), SAFETY_SENSITIVE 512 (must be processed by the compliance module), REAL_TIME 514 (HTTPS message 114 has real-time requirements), I / O 516 (persistence requirements and target device), and resource 518 (authorization must be used for the CCR to perform cryptographic operations on HTTPS message 114). CIPHER 510A, HASH 510B, and additional prerequisites 510C are instances of what PRE-CONDITION 510 can define. Encryption / decryption hardware 516A, cryptographic coprocessor 477, cloud HSM 475, CPACF coprocessor 366, database 471, and additional CCR 368 are examples of mandatory CCRs that can invoke I / O 516 and / or resource 518. As described in more detail below, if I / O 516 and resource analyzer 518 identify a mandatory CCR, then traffic analyzer 446 sends HTTPS message 114 to traffic dispatcher 442 for dispatch to the target CCR. If I / O 516 and resource analyzer 518 do not identify a mandatory CCR, then traffic analyzer 446 evaluates HTTPS message 114, OPT_POLICY 451, and cipher metric 460 to predict and / or determine the cipher requirements of HTTPS message 114, and then recommends a combination of CCR 180A that matches the predicted and / or determined cipher requirements of HTTPS message 114.

[0082] Figure 6 A diagram illustrating an architecture 100B according to various aspects of the present invention and a method 602 performed by the architecture 100B is described. Typically, a traffic metric collector 444 collects encrypted traffic metrics 462 and sends them to a traffic analyzer 446 to generate a cryptographic computing resource pattern 462, thereby instructing a traffic dispatcher 442 to distribute traffic to different computing modules. The encrypted traffic metrics 444 include user-level metrics representing the user level associated with the encrypted request; performance metrics representing the performance of the HTTPS message 114 (e.g., its response time, CPU usage, memory cost, network usage, etc.); security level metrics representing the security level of the accessed resource; success / failure metrics representing the historical success rate of the encrypted service; and access frequency metrics representing the frequency of access to the encrypted service, etc. Guided by the traffic analyzer 446, the traffic dispatcher 442 sends traffic to different computing modules according to a cost model.

[0083] The inputs to the cryptographic traffic analyzer 446 include cryptographic traffic metrics from the cryptographic traffic metric collector 444; RS-EVP data extensions 450 and 450A from the algorithm processing module 420; and cryptographic computational resource patterns / metrics from the resource management module 430. The outputs of the cryptographic traffic analyzer 446 include a dispatch policy, which includes a redirection threshold, precondition-based priority, cost per algorithm call, response time, and compliance resources.

[0084] Method 602 will now be described in the context of how steps S1-S7 can be performed in the first example. In S1, the algorithm processing module 420 sends the ECDHE request along with the RS-EVP data extension 450 to the traffic analyzer 446. The value of I / O 516 in the RS-EVP data extension 450A is "not present". The value of the resource 518 variable in the RS-EVP data extension 450A Ext is fixed for container CPU 474. In S2, the traffic analyzer module 446 receives the request generated in S1 and finds that the resource has a mandatory resource, so no further analysis is needed, and the request is sent only to the traffic dispatcher module 442. In S3, the traffic dispatcher module 442 dispatches the request to container CPU 474 of CCR 180B. In S4, the traffic metric collector module 444 collects information on the cryptographic metrics 160, which includes performance metrics, success rate metrics, access frequency metrics of container CPU 474, etc. In S5, the traffic metric collector 444 pushes the collected cryptographic metrics to the traffic analyzer 446. In S6, the resource management module 430 pushes the cryptographic metrics 160 related to the cryptographic operations performed by the container CPU 474 to the traffic analyzer 446. In S7, the traffic analyzer 446 generates a dispatch policy 446A based on the inputs from S1, S4, and S6, and uses the dispatch policy 446A for further encryption request dispatch. The traffic analyzer 446 utilizes the interface provided by the resource management module 430 to amplify and / or reduce the CCR 180B to match the cryptographic operations required for the HTTPS message 114.

[0085] Method 602 will now be described in the context of how steps S1-S7 can be performed in the second example. In S1, the algorithm processing module 420 sends an ECKeyGen request to the traffic analyzer 446 of the RS-EVP data extension 450. The value of I / O 516 in RS-EVP data extension 450A is "persistent". The value of the resource 518 variable in RS-EVP data extension 450A Ext is cloud HSM 475, which is fixed. In S2, the traffic analyzer module 446 receives the request generated in S1 and finds that the resource has a mandatory resource, so no further analysis is needed, and the request is simply sent to the traffic dispatcher module 442. In S3, the traffic dispatcher module 442 dispatches the request to the cloud HSM 475 of CCR 180B. In S4, the traffic metric collector module 444 collects information on the cryptographic metrics 160, which includes performance metrics, success rate metrics, access frequency metrics, etc. of the cloud HSM 475. In S5, the traffic metric collector 444 pushes the collected cryptographic metrics to the traffic analyzer 446. In S6, the resource management module 430 pushes the cryptographic metrics 160 related to the cryptographic operations performed by the cloud HSM 475 to the traffic analyzer 446. In S7, the traffic analyzer 446 generates a dispatch policy 446A based on the inputs from S1, S4, and S6, and uses the dispatch policy 446A for further encryption request dispatch. The traffic analyzer 446 utilizes the interface provided by the resource management module 430 to amplify and / or reduce the CCR 180B to match the cryptographic operations required for the HTTPS message 114.

[0086] Figure 7 The diagrams depict a subset of architecture 100B and a method 702 performed by architecture 100B according to various aspects of the present invention. More specifically, Figure 7 The resource management module 430A is described, which provides information about the resource management module 430 (in... Figure 7 Additional details on how this can be implemented according to an embodiment of the invention are shown below. As shown, the resource management module 430A includes a resource control interface 431, a capability interface 432, an information interface 433, a discovery module 434, a pusher 435, and a resource metric collector 436, configured and arranged as shown.

[0087] Now, referring to steps S11 to S15, we will see how... Figure 7The architecture 100B shown is used as part of the execution of method 702. In S11, within the resource management module 430A, the discovery module 434 receives data and information from the resource control interface 431 (zoom in, zoom out), the capability interface 432 (cryptographic methods, persistence methods), and the information interface 433 (tenant profiles, constraints, costs). Cryptographic methods include EC methods, RSA methods, DH, cryptography, hashing, etc. The information interface 433 uses a so-called "get" method to retrieve resource-related information about tenant profiles, constraints, costs, etc. In S12, the resource metric collector 436 collects dynamic metrics about current traffic workload, historical data, historical trends, and stability & reliability. In S13, the pusher 435 receives input from the resource metric collector 436 generated by the execution of S12. In S13', the pusher 435 receives input from the resource metric collector 436 generated by the execution of S11 from the discovery module 434. In S14, pusher 435 pushes the cryptographic computation resource pattern 464 and cryptographic computation resource metric 466 to traffic analyzer module 446. The cryptographic computation resource pattern 464 is pushed statically once. The cryptographic computation resource metric 466 is pushed dynamically periodically. In S15, traffic analyzer 466 uses resource control interface 431 to amplify and / or reduce CCR 180B to match the cryptographic operations required by HTTPS message 114.

[0088] Additional details will now be provided regarding machine learning techniques that can be used to implement the various aspects of the invention disclosed herein. The different prediction and / or determination functions of the processors described herein can be implemented using machine learning and / or natural language processing techniques. Typically, machine learning techniques operate on so-called “neural networks,” which can be implemented as programmable computers configured to run sets of machine learning and / or natural language processing algorithms. Neural networks combine knowledge from a variety of disciplines, including neurophysiology, cognitive science / psychology, physics (statistical mechanics), control theory, computer science, artificial intelligence, statistics / mathematics, pattern recognition, computer vision, parallel processing, and hardware (e.g., digital / analog / VLSI / optics).

[0089] The fundamental function of neural networks and their machine learning algorithms is to identify patterns by interpreting unstructured sensor data through a form of machine perception. Unstructured real-world data in its native form (e.g., images, sounds, text, or time-series data) is transformed into a digital form (e.g., vectors with magnitudes and directions) that can be understood and manipulated by a computer. Machine learning algorithms perform multiple iterations of learning-based analysis on the real-world data vectors until the patterns (or relationships) contained within the real-world data vectors are uncovered and learned. The learned patterns / relationships are used as a predictive model, which can be used to perform various tasks, including, for example, the classification (or labeling) and clustering of real-world data. Classification tasks typically depend on training a neural network (i.e., a model) using a labeled dataset to identify the correlations between labels and data. This is known as supervised learning. Examples of classification tasks include identifying objects in images (e.g., stop signs, pedestrians, lane markings, etc.), identifying gestures in videos, detecting speech, detecting speech in audio, identifying specific speakers, transcribing speech into text, and so on. Clustering is a task that identifies similarities between objects. It groups these similarities based on these common characteristics and distinguishes them from other groups of objects. These groups are called "clusters".

[0090] Reference Figure 8 and Figure 9 Examples of machine learning techniques that can be used to implement various aspects of the present invention are described. References will be made to... Figure 8 This describes a machine learning model configured and arranged according to an embodiment of the present invention. References will be made to... Figure 10 A detailed description of example computing systems and network architectures that enable the implementation of one or more embodiments of the invention described herein is provided.

[0091] Figure 8A block diagram illustrating a classifier system 800 capable of implementing various prediction and determination aspects of the invention described herein is depicted. More specifically, the functionality of system 800 is used in embodiments of the invention to generate various models and / or sub-models capable of implementing prediction and determination functions in embodiments of the invention. System 800 includes multiple data sources 802 communicating with classifier 810 via network 804. In some aspects of the invention, data sources 802 may bypass network 804 and be directly fed into classifier 810. Data sources 802 provide data / information inputs to be evaluated by classifier 810 according to various embodiments of the invention. Data sources 802 also provide data / information inputs that can be used by classifier 810 to train and / or update model 816 created by classifier 810. Data sources 802 may be implemented as a wide variety of data sources, including but not limited to sensors configured to collect real-time data, data repositories (including training data repositories), and outputs from other classifiers. Network 804 may be any type of communication network, including but not limited to local area networks, wide area networks, private networks, the Internet, etc.

[0092] The classifier 810 can be implemented by a programmable computer (such as a processing system 1000). Figure 10 The algorithm executed is shown in the diagram. Figure 8 As shown, classifier 810 includes a set of machine learning (ML) algorithms 812, natural language processing (NLP) algorithms 814, and a model 816 as a relation (or prediction) algorithm generated (or learned) by the ML algorithms 812. For ease of illustration and explanation, algorithms 812, 814, and 816 of classifier 810 are depicted separately. In embodiments of the invention, the functions performed by the various algorithms 812, 814, and 816 of classifier 810 may be distributed differently than shown. For example, when classifier 810 is configured to perform an overall task with sub-tasks, the suite of ML algorithms 812 may be segmented, such that a portion of ML algorithms 812 performs each sub-task, and a portion of ML algorithms 812 performs the overall task. Furthermore, in some embodiments of the invention, NLP algorithm 814 may be integrated within ML algorithm 812.

[0093] NLP algorithm 814 includes a speech recognition function that allows classifier 810, and more specifically ML algorithm 812, to receive natural language data (text and audio) and apply elements of language processing, information retrieval, and machine learning to derive meaning from the natural language input and potentially take action based on the derived meaning. NLP algorithm 814 used according to an aspect of the invention may also include a speech synthesis function that allows classifier 810 to translate result 820 into natural language (text and audio) to convey aspect of result 820 as natural language communication.

[0094] NLP and ML algorithms 814, 812 receive and evaluate input data (i.e., training data and data to be analyzed) from data source 802. ML algorithm 812 includes the functionality necessary to interpret and utilize the format of the input data. For example, if data source 802 includes image data, ML algorithm 812 may include visual recognition software configured to interpret the image data. ML algorithm 812 applies machine learning techniques to the received training data (e.g., data received from one or more data sources 802) to create / train / update one or more models 816 over time, which model the overall task and sub-tasks that classifier 810 is designed to perform.

[0095] Now for joint reference Figure 8 and Figure 9 , Figure 9 An example of a learning phase 900 performed by ML algorithm 812 to generate the aforementioned model 816 is described. In learning phase 900, classifier 810 extracts features from the training data and transforms these features into vector representations that can be identified and analyzed by ML algorithm 812. ML algorithm 812 analyzes the feature vectors to "classify" the training data for the target model (or the model's task) and reveals relationships and connections between the classified training data. Examples of suitable implementations of ML algorithm 812 include, but are not limited to, neural networks, support vector machines (SVM), logistic regression, decision trees, hidden Markov models (HMM), etc. The learning or training performed by ML algorithm 812 can be supervised, unsupervised, or a mixture of aspects of supervised and unsupervised learning. Supervised learning occurs when training data is already available and has been classified / labeled. Unsupervised learning occurs when training data has not been classified / labeled, and therefore must be developed through iterations of classifier 810 and ML algorithm 812. Unsupervised learning can utilize additional learning / training methods, including, for example, clustering, anomaly detection, neural networks, deep learning, etc.

[0096] When model 816 is fully trained by ML algorithm 812, data source 802 that generates "real-world" data is accessed, and the "real-world" data is applied to model 816 to generate a usable version of result 820. In some embodiments of the invention, result 820 may be fed back to classifier 810 and used by ML algorithm 812 as additional training data for updating and / or refining model 816.

[0097] In aspects of the invention, ML algorithm 812 and model 816 can be configured to apply confidence levels (CL) to different results / determinations (including result 820) in their results / determinations in order to improve the overall accuracy of a particular result / determination. When ML algorithm 812 and / or model 816 makes a determination or generates a result with a CL value below a predetermined threshold (TH) (i.e., CL < TH), the result / determination can be classified as having a sufficiently low “confidence” to justify the conclusion that the determination / result is invalid, and this conclusion can be used to determine when, how, and / or whether the determination / result is processed in downstream processing. If CL > TH, the determination / result can be considered valid, and this conclusion can be used to determine when, how, and / or whether these determinations / results are processed in downstream processing. Many different predetermined TH levels can be provided. Determinations / results with CL > TH can be ranked from the highest CL > TH to the lowest CL > TH to distinguish the priority of when, how, and / or whether the determination / result is processed in downstream processing.

[0098] In various aspects of the invention, classifier 810 may be configured to apply a confidence level (CL) to result 820. When classifier 810 determines that the CL in result 820 is below a predetermined threshold (TH) (i.e., CL < TH), result 820 may be classified as low enough to justify the "no confidence" classification in result 820. If CL > TH, then result 820 may be classified as high enough to justify the valid determination of result 820. A number of different predetermined TH levels may be provided such that results 820 with CL > TH can be sorted from the highest CL > TH to the lowest CL > TH.

[0099] Figure 10 An example of a computer system 1000 is illustrated, which can be used to implement any computer-based component of the various embodiments of the invention described herein. The computer system 1000 includes an exemplary computing device (“computer”) 1002 configured to perform various aspects of content-based semantic surveillance operations described herein according to various aspects of the invention. In addition to the computer 1002, the exemplary computer system 1000 includes a network 1014 that connects the computer 1002 to additional systems (not depicted) and may include one or more wide area networks (WANs) and / or local area networks (LANs), such as the Internet, intranets, and / or wireless communication networks. The computer 1002 and the additional systems communicate via the network 1014, for example, to transfer data between them.

[0100] Exemplary computer 1002 includes a processor core 1004, main memory (“memory”) 1010, and input / output components (IPS) 1012 communicating via a bus 1003. Processor core 1004 includes cache memory (“cache”) 1006 and control 1008, which includes a branch prediction structure and associated search, hit, detection, and update logic, as described in more detail below. Cache 1006 may include multiple cache levels (not depicted) on or off-chip from processor 1004. Memory 1010 may include various data stored therein, such as instructions, software, routines, etc., which may, for example, be transferred to or from cache 1006 by control 1008 for execution by processor 1004. One or more IPS components 1012 may include one or more components, such as a display, keyboard, modem, network adapter, etc., facilitating local and / or remote input / output operations to / from computer 1002 (not depicted).

[0101] It should be understood in advance that while this disclosure includes a detailed description of cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0102] Cloud computing is a service delivery model that enables convenient, on-demand access to a shared pool of configurable computing resources (e.g., a shared pool of configurable computing resources). These resources include networks, network bandwidth, servers, processing power, storage, applications, virtual machines, and services, which can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0103] The features are as follows:

[0104] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power, such as server time and network storage, as needed, without requiring human interaction with the service provider.

[0105] Extensive network access: Capabilities are available through networks and accessed via standard mechanisms that facilitate the use of heterogeneous thin client or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0106] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence because consumers typically do not have control or knowledge of the exact location of the resources provided, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0107] Rapid flexibility: The ability to provide capacity quickly and flexibly, automatically scaling down and up rapidly in some situations to scale up rapidly. For consumers, the available supply capacity often appears unlimited and can be purchased in any quantity at any time.

[0108] Measuring services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0109] The service model is as follows:

[0110] Software as a Service (SaaS): This provides consumers with the ability to use the provider's applications running on cloud infrastructure. Applications can be accessed from different client devices via thin client interfaces such as web browsers (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities, with possible exceptions such as limited user-specific application configuration settings.

[0111] Platform as a Service (PaaS): This provides consumers with the ability to deploy applications created or acquired by the consumer using programming languages ​​and tools supported by the provider onto cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the deployed applications and the configuration of any application hosting environment.

[0112] Infrastructure as a Service (IaaS): The capabilities offered to consumers are processing, storage, networking, and other basic computing resources that enable consumers to deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but rather have control over the operating system, storage, deployed applications, and potentially limited control over selected networking components (e.g., host firewalls).

[0113] The deployment model is as follows:

[0114] Private cloud: A cloud infrastructure that operates solely for an organization. It can be managed by the organization or a third party and can exist on-site or off-site.

[0115] Community cloud: A cloud infrastructure shared by several organizations and supporting a specific community with shared concerns (e.g., tasks, security requirements, policies, and compliance considerations). It can be managed by an organization or a third party and can exist on-site or off-site.

[0116] Public cloud: Makes cloud infrastructure available to the public or large industry groups and is owned by an organization that sells cloud services.

[0117] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain a single entity but are bound together by standardized or proprietary technologies that enable data and applications to be ported (e.g., cloud bursting for load balancing between clouds).

[0118] Cloud computing environments are service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is the infrastructure comprising a network of interconnected nodes.

[0119] See now Figure 11 The diagram illustrates an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 to which local computing devices used by cloud consumers can communicate. These local computing devices include, for example, personal digital assistants (PDAs) or cellular phones 54A, desktop computers 54B, laptop computers 54C, and / or automotive computer systems 54N. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platforms, and / or software as services that cloud consumers do not need to maintain on their local computing devices. It should be understood that... Figure 11 The types of computing devices 54A-N shown are intended to be illustrative only, and computing node 10 and cloud computing environment 50 can communicate with any type of computerized device via any type of network and / or network-addressable connectivity (e.g., using a web browser).

[0120] See now Figure 12 This demonstrates a cloud computing environment of 50 ( Figure 11 This provides a set of functional abstraction layers. It should be understood beforehand that... Figure 12 The components, layers, and functions shown are intended to be illustrative only, and embodiments of the invention are not limited thereto. As described, the following layers and corresponding functions are provided:

[0121] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: a mainframe 61; a RISC (Reduced Instruction Set Computer) based server 62; a server 63; a blade server 64; a storage device 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0122] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual server 71; virtual storage 72; virtual network 73, including virtual private network; virtual application and operating system 74; and virtual client 75.

[0123] In one example, management layer 80 may provide the following functionalities: Resource Provisioning 81 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and Pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User Portal 83 provides access to the cloud computing environment for consumers and system administrators. Service Level Management 84 provides cloud resource allocation and management to ensure that required service levels are met. Service Level Agreement (SLA) Planning and Fulfillment 85 provides pre-scheduling and procurement of cloud resources based on anticipated future needs according to the SLA.

[0124] Workload tier 90 provides examples of functionalities that can leverage a cloud computing environment. Examples of workloads and functionalities that can be provided from this tier include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analytics and processing 94; transaction processing 95; and cryptographic processing requirements that automatically scale up or down cryptographic computing resources to match encrypted communications 96.

[0125] This invention can be a system, method, and / or computer program product with any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to execute aspects of the invention.

[0126] Computer-readable storage media can be tangible devices capable of retaining and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital universal disk (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or protrusions in slots having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses passing through fiber optic cables), or electrical signals transmitted through wires.

[0127] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a suitable computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or to an external computer or external storage device. The network may include copper cables, optical fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the suitable computing / processing device.

[0128] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as a standalone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may execute computer-readable program instructions by utilizing state information from the computer-readable program instructions to personalize the electronic circuitry in order to perform aspects of this invention.

[0129] The present invention will now be described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0130] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner, such that the computer-readable storage medium storing the instructions includes an article of manufacture containing instructions that implement aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0131] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce computer-implemented processing, such that the instructions executed on the computer, other programmable apparatus, or other device perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0132] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than indicated in the figures. For example, depending on the functions involved, two consecutively shown blocks may actually be executed substantially simultaneously, or these blocks may sometimes be executed in reverse order. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0133] As previously noted, conventional techniques related to the manufacture and use of aspects of the present invention are well known and therefore may or may not be described in detail herein. However, for the sake of context, a more detailed description now will be provided of various cryptographic methods and definitions that may be used to implement one or more embodiments of the present invention.

[0134] Digital certificates support public-key cryptography, where each party involved in a communication or transaction has a pair of keys called a public key and a private key. The public key of each party is public while the private key is kept secret. A public key is a number associated with a specific entity and is intended to be known by everyone who needs to have trusted interaction with that entity. A private key is a number that is believed to be known only to the specific entity, i.e., kept secret. In a typical public-key cryptosystem, the private key corresponds exactly to one public key.

[0135] Within a public-key cryptosystem, because all communication involves only the public key and no private key is ever transmitted or shared, confidential messages can be generated using only public information and decrypted using only the private key unique to the intended recipient. Furthermore, public-key cryptography can be used for authentication (i.e., digital signatures) and for privacy (i.e., encryption). Therefore, public-key cryptography is an asymmetric scheme using a pair of keys—specifically, a public key for encrypting data, and a corresponding private key or key for decrypting the data. The public key can be published to the world, while the private key remains secret. Any entity with a copy of the public key can then encrypt information that an entity possessing the secret / private key can decrypt and read.

[0136] Encryption is the process of transforming data into a form that no one can read without a secret decryption key; encryption ensures privacy by keeping the content of the information hidden from anyone, even those who could see the encrypted data. Authentication is the process by which the recipient of a digital message can be certain of the sender's identity and / or the integrity of the message. For example, when the sender encrypts a message, the recipient's public key is used to transform the data within the original message into the content of the encrypted message. The sender uses the public key to encrypt the data, and the recipient uses the private key to decrypt the encrypted message.

[0137] A certificate is a digital document that guarantees the identity and key ownership of an entity (such as an individual, a computer system, a specific server running on that system, etc.). Certificates are issued by certificate authorities. A Certificate Authority (CA) is an entity, typically a trusted third party in a transaction, that is trusted to sign or issue certificates for other people or entities. CAs usually have some legal responsibility for the binding between their public keys and their owners, which allows people to trust the entity that signs the certificate. Many such certificate authorities exist, and they are responsible for verifying the identity and key ownership of the entity when issuing a certificate.

[0138] When a Certificate Authority (CA) issues a certificate to an entity, that entity provides its public key and some other information. Software tools, such as specially equipped web browsers, can digitally sign this information and send it to the CA. A CA can be a company or other entity that provides trusted third-party CA services. The CA then generates the certificate and returns it. The certificate may contain additional information, such as the certificate's expiration date and serial number. Part of the value provided by CAs is based in part on their verification requirements, acting as neutral and trusted introductory services publicly available in their Certification Service Practice (CSP).

[0139] Typically, after a Certificate Authority (CA) receives a request for a new digital certificate containing the public key of the requesting entity, the CA uses its private key to sign the requesting entity's public key and places the signed public key within the digital certificate. Anyone who receives the digital certificate during a transaction or communication can then use the CA's public key to verify the signed public key within the certificate. The intent of a certificate is for an entity to verify that it possesses a specific public key. Several standards exist that define the information within a certificate and describe the data format of that information.

[0140] The terms “cryptography,” “cryptographic system,” “encryption,” and their equivalents are used herein to describe secure information and communication techniques derived from mathematical concepts, including, for example, rule-based computations known as algorithms, which are configured to transform messages in a manner that is difficult to decipher without authorization. Cryptography uses a set of processes known as cryptographic algorithms, encryption algorithms, or encryption to encrypt and decrypt messages in order to protect communications between computer systems and applications. A cipher suite may use a first algorithm for encryption, a second algorithm for message authentication, and a third algorithm for key exchange. Cryptographic algorithms, which can be embedded in protocols and written into software running on operating systems and networked computer systems, involve the generation of public and private keys for data encryption / decryption; digital signatures and verification for message authentication; and key exchange operations.

[0141] The term “asymmetric key encryption algorithm” and its equivalents are used herein to describe a public-key or asymmetric-key algorithm that uses a pair of keys, where the public key associated with the creator / sender is used to encrypt the message, and the private key known only to the initiator is used to decrypt the message.

[0142] The term "key" and its equivalents are used in this document to describe the explicit creation of random bit strings used for scrambling and descrambling data. Keys are designed using algorithms intended to ensure that each key is unpredictable and unique. The longer the key is constructed in this way, the harder it is to crack the encryption code. The key can be used to encrypt, decrypt, or perform both functions, depending on the type of encryption software used.

[0143] The term "private key" and its equivalents are used herein to describe the key paired with a public key to set up algorithms used for text encryption and decryption. A private key is created as part of public-key cryptography during asymmetric key encryption and is used to decrypt messages and convert them into a readable format. Public and private keys are paired for secure communication. The private key is shared only with the key's originator to ensure security. For example, A and B represent the message sender and message receiver, respectively. Each has its own pair of public and private keys. The message originator or sender, A, sends a message to B. A's message is encrypted using B's public key, and B uses its private key to decrypt A's received message. A digital signature or digital certificate is used to ensure that A is the original message sender. To verify this, B uses the following steps: B uses A's public key to decrypt the digital signature, because A must have previously used its private key to encrypt the digital signature or certificate; and if readable, the digital signature is certified by a Certification Authority (CA). Therefore, sending an encrypted message requires the sender to encrypt the digital certificate using the receiver's public key and its own private key. Therefore, the receiver uses its own private key for message decryption, while the sender's public key is used for digital certificate decryption.

[0144] The term "public key" and its equivalents are used herein to describe a type of encryption key created in public-key cryptography using asymmetric key encryption algorithms. The public key is used to convert messages into an unreadable format. Decryption is performed using a different but matching private key. Public and private keys are paired to achieve secure communication.

[0145] The term "digital signature" and its equivalents are used here to describe techniques that combine public-key cryptography to allow consumers of digitally signed data to verify that the data has not been altered, deleted, or added. In an example digital signature technique / configuration, the "signer" hashes the record data and encrypts the hash using the signer's private key. The encrypted hash is the signature. Consumers of the record data can hash the same record data and then use the public key to decrypt the signature and obtain the signer's hash. Consumers attempting to verify the record can compare their hash with the signer's hash. When the two hash values ​​match, the record's data content and source are verified.

[0146] The term "elliptic curve cryptography" (ECC) describes algorithms that use the mathematical properties of elliptic curves to generate public-key cryptosystems. Like all public-key cryptography, ECC is based on a mathematical function that is simple to compute in one direction but difficult to reverse. In the case of ECC, this difficulty lies in the infeasibility of computing the discrete logarithm of random elliptic curve elements with respect to a known base point, or the "Elliptic Curve Discrete Logarithm Problem" (ECDLP). The Elliptic Curve Digital Signature Algorithm (ECDSA) is a widely used public-key cryptographic signature algorithm that uses EC.

[0147] A coprocessor is a supplementary processor that takes over the responsibility of performing selected processor-intensive tasks from its associated central processing unit (CPU), allowing the CPU to focus its computational resources on tasks essential to the overall system. Coprocessor tasks may include input / output (I / O) interface, encryption, string processing, floating-point arithmetic, signal processing, etc. A coprocessor may include one or more embedded systems (ES). An ES is a computer system that performs one or more specialized functions within a larger mechanical and / or electronic system. An example of an ES is a bootloader (or bootloader program) that acts as an intermediary between the computer's hardware and operating system. In some computer configurations, the coprocessor itself can be considered an embedded system.

[0148] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used herein, unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “the” are intended to include the plural forms. When used in this specification, the terms “comprises” and / or “comprising” designate the presence of the stated features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or combinations thereof.

[0149] The term "exemplary" is used herein to mean "used as an example, illustration, or illustration." Any implementation or design described herein as "exemplary" is not necessarily to be construed as superior to or better than other implementations or designs. The terms "at least one" and "one or more" can include any integer greater than or equal to 1, i.e., one, two, three, four, etc. The term "multiple" can include any integer greater than or equal to 2, i.e., two, three, four, five, etc. The term "connection" can include both indirect "connection" and direct "connection."

[0150] The terms “about,” “substantially,” and their equivalents are intended to include the degree of error associated with a measurement based on a specific quantity of equipment available at the time of application. For example, “about,” “substantially,” and their equivalents may include a range of ±8%, 5%, or 2% of a given value.

[0151] Although the invention has been described in detail with reference to only a limited number of embodiments, it should be readily understood that the invention is not limited to these disclosed embodiments. Instead, modifications can be made to the invention to incorporate any number of variations, alterations, substitutions, or equivalent arrangements not described to date but commensurate with the scope of the invention. Furthermore, while various embodiments of the invention have been described, it should be understood that aspects of the invention may include only some of the described embodiments. Therefore, the invention should not be considered as limited by the foregoing description, but only by the scope of the appended claims.

Claims

1. A computer-implemented method for performing cryptographic operations, the computer-implemented method comprising: The processor system receives resource scaling (RS) data associated with encrypted messages; Operation policy (OP) for accessing RS data using the processor system, wherein the OP defines cryptographic operation constraints; Based at least in part on the determination that the cryptographic operation constraints do not include mandatory cryptographic resource requirements, a first resource scaling operation is performed, the first resource scaling operation including: The processor system is used to perform analysis of the cryptographic metrics associated with the processor system; The cryptographic measure includes: Information associated with the encrypted message; and Performance measurement of cryptographic operations performed by the processor system; Using the results of the analysis based on the cryptographic operation constraints and the cryptographic metrics: Determine the cryptographic processing requirements for the encrypted message; and Matching the cryptographic processing requirement with a selected set of available cryptographic computing resources to identify a set of customized cryptographic computing resources selected to match the cryptographic processing requirement of the encrypted message; and The set of custom cryptographic computing resources is used to perform custom cryptographic operations on the encrypted message.

2. The computer-implemented method according to claim 1 further includes: Based at least in part on the determination of the cryptographic operation constraints, including the mandatory cryptographic computation resource requirements, a second resource scaling operation is performed, the second resource scaling operation including: The encrypted message is routed to a set of mandatory cryptographic computation resources identified by the mandatory cryptographic computation resource requirement; and The set of mandatory cryptographic computation resources is used to perform mandatory cryptographic operations on the encrypted message.

3. The computer-implemented method according to claim 1 further includes configuring the open-source cryptographic software as follows: Receive a request to perform a cryptographic operation on the encrypted message; and Instead of executing the request, the request is routed to the processor system.

4. The computer-implemented method according to claim 3, wherein, The open-source cryptographic software includes open-source Secure Sockets Layer (SSL) software.

5. The computer-implemented method according to claim 1, wherein: The first resource scaling operation further includes capturing a first set of updated cryptographic metrics generated by performing the custom encryption operation on the encrypted message using the set of custom cryptographic computing resources; as well as Update the password measure with the password measure updated in the first set.

6. The computer-implemented method according to claim 2, wherein: The first resource scaling operation also includes: Capture a first set of updated cryptographic metrics generated by performing the custom cryptographic operation on the encrypted message using the aforementioned set of custom cryptographic computational resources; and Update the password measure with the first set of updated password measures; and The second resource scaling operation also includes: Capture a second set of updated cryptographic metrics generated by performing a forced cryptographic operation on the encrypted message using the aforementioned set of forced cryptographic computational resources; and Update the password metric with the second set of updated password metric.

7. The computer-implemented method according to claim 1, wherein: The processor includes a prediction model trained to use machine learning algorithms to determine the cryptographic processing requirements of the encrypted message; The information associated with the encrypted message includes a cryptographic computation resource pattern containing static data; and The performance measurement includes cryptographic metrics, which include dynamic data that has changed.

8. A computer system including a memory communicatively coupled to a processor system, wherein, The processor system is configured to perform operations, including: Receive resource scaling (RS) data associated with encrypted messages; Operation policy (OP) for accessing the RS data, wherein the OP defines cryptographic operation constraints; Based at least in part on the determination that the cryptographic operation constraints do not include mandatory cryptographic computation resource requirements, a first resource scaling operation is performed, the first resource scaling operation including: Analysis of cryptographic metrics associated with the processor system; The cryptographic measure includes: Information associated with the encrypted message; and Performance measurement of cryptographic operations performed by the processor system; Using the results of the analysis based on the cryptographic operation constraints and the cryptographic metrics: Determine the cryptographic processing requirements for the encrypted message; and Matching the cryptographic processing requirement with a selected set of available cryptographic computing resources to identify a set of customized cryptographic computing resources selected to match the cryptographic processing requirement of the encrypted message; and The set of custom cryptographic computing resources is used to perform custom cryptographic operations on the encrypted message.

9. The computer system according to claim 8, further comprising: Based at least in part on the determination of the cryptographic operation constraints, including the mandatory cryptographic computation resource requirements, a second resource scaling operation is performed, the second resource scaling operation including: The encrypted message is routed to a set of mandatory cryptographic computation resources identified by the mandatory cryptographic computation resource requirement; and The set of mandatory cryptographic computation resources is used to perform mandatory cryptographic operations on the encrypted message.

10. The computer system of claim 8, further comprising configuring open-source cryptographic software as follows: Receive a request to perform a cryptographic operation on the encrypted message; and Instead of executing the request, the request is routed to the processor system.

11. The computer system according to claim 10, wherein, The open-source cryptographic software includes open-source Secure Sockets Layer (SSL) software.

12. The computer system according to claim 8, wherein: The first resource scaling operation further includes capturing a first set of updated cryptographic metrics generated by performing the custom cryptographic operation on the encrypted message using the set of custom cryptographic computing resources; as well as Update the password measure with the password measure updated in the first set.

13. The computer system according to claim 9, wherein: The first resource scaling operation also includes: Capture a first set of updated cryptographic metrics generated by performing the custom cryptographic operation on the encrypted message using the aforementioned set of custom cryptographic computational resources; and Update the password measure with the first set of updated password measures; and The second resource scaling operation also includes: Capture a second set of updated cryptographic metrics generated by performing a forced cryptographic operation on the encrypted message using the aforementioned set of forced cryptographic computational resources; and Update the password metric with the second set of updated password metric.

14. The computer system according to claim 8, wherein: The processor includes a prediction model trained to use machine learning algorithms to determine the cryptographic processing requirements of the encrypted message; The information associated with the encrypted message includes a cryptographic computation resource pattern containing static data; and The performance measurement includes cryptographic metrics, which include dynamic data that has changed.

15. A computer program product for performing cryptographic operations, the computer program product comprising a computer-readable program stored on a computer-readable storage medium, wherein, When the computer-readable program is executed on a processor system, the computer-readable program causes the processor system to perform a processor system method, the method comprising: Receive resource scaling (RS) data associated with encrypted messages; Operation policy (OP) for accessing the RS data, wherein the OP defines cryptographic operation constraints; Based at least in part on the determination that the cryptographic operation constraints do not include mandatory cryptographic computation resource requirements, a first resource scaling operation is performed, the first resource scaling operation including: Analysis of cryptographic metrics associated with the processor system; The cryptographic measure includes: Information associated with the encrypted message; and Performance measurement of cryptographic operations performed by the processor system; Using the results of the analysis based on the cryptographic operation constraints and the cryptographic metrics: Determine the cryptographic processing requirements for the encrypted message; and Matching the cryptographic processing requirement with a selected set of available cryptographic computing resources to identify a set of customized cryptographic computing resources selected to match the cryptographic processing requirement of the encrypted message; and The set of custom cryptographic computing resources is used to perform custom cryptographic operations on the encrypted message.

16. The computer program product according to claim 15, wherein, The processor system method further includes: Based at least in part on the determination of the cryptographic operation constraints, including the mandatory cryptographic computation resource requirements, a second resource scaling operation is performed, the second resource scaling operation including: The encrypted message is routed to a set of mandatory cryptographic computation resources identified by the mandatory cryptographic computation resource requirement; and The set of mandatory cryptographic computation resources is used to perform mandatory cryptographic operations on the encrypted message.

17. The computer program product according to claim 15, wherein, The processor system method further includes configuring open-source cryptographic software as follows: Receive a request to perform a cryptographic operation on the encrypted message; and Instead of executing the request, the request is routed to the processor system.

18. The computer program product according to claim 17, wherein, The open-source cryptographic software includes open-source Secure Sockets Layer (SSL) software.

19. The computer program product according to claim 16, wherein: The first resource scaling operation also includes: Capture a first set of updated cryptographic metrics generated by performing the custom cryptographic operation on the encrypted message using the aforementioned set of custom cryptographic computational resources; and Update the password measure with the first set of updated password measures; and The second resource scaling operation also includes: Capture a second set of updated cryptographic metrics generated by performing a forced cryptographic operation on the encrypted message using the aforementioned set of forced cryptographic computational resources; and Update the password metric with the second set of updated password metric.

20. The computer program product according to claim 15, wherein: The processor includes a prediction model trained to use machine learning algorithms to determine the cryptographic processing requirements of the encrypted message; The information associated with the encrypted message includes a cryptographic computation resource pattern containing static data; and The performance measurement includes cryptographic metrics, which include dynamic data that has changed.

Images