Encryption system and method

Abstract

The extension provides a network of computers operating over connected channels including the Internet and within intranets, specifically designed to host data and code without detection and share encrypted messages, including messages with embedded encryption algorithms and keys, without concern for public interception of the transmission. Users can generate new algorithms and keys as frequently as desired, without fear of detection or interception. The extension includes computers referred to as "shadow computers" within the design that are known to be inaccessible except to "whitelisted" and other authentication technology paired companions.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application is based on and claims the benefit of U.S. Provisional Patent Application No. 63 / 311,023, filed February 16, 2022, and U.S. Provisional Patent Application No. 63 / 433,854, filed December 20, 2022, each of which is incorporated by reference in its entirety.

[0002] The present invention relates to systems and methods designed to protect encryption algorithms and associated keys, and user data protected by these algorithms and keys. The systems and methods are also designed to provide enhanced or extended encryption when necessary. Unique data encryption of data in motion between nodes of the Augmented Protection and Encryption System (APES) protects the data from being unencrypted if collected from the Internet transmission system by unintended users, and encrypted Data-at-Rest (DAR) in the node memory of the APES system is protected by the inaccessibility of some APES computers.

[0003] The Advanced Protection and Encryption System (APES) creates a network of computers specifically designed to operate on the Internet and within intranets, hosting data and code without detection and sharing encrypted messages, including messages with embedded encryption algorithms and keys, without fear of public interception of transmissions. APES includes computers referred to as "Shadow Computers (SC)" in the Internet of Things (IoT) that are known but not accessible except by APES-defined companion SCs, restrictions controlled by APES "Invisible Computers" (ICs) creating companions for the SCs. These ICs are defined as "second devices" in U.S. Patent 10,419,131. SCs are not "first devices" in U.S. Patent 10,419,131. APES "Known Computers" (KCs) are first devices in U.S. Patent 10,419,131. Companions, pairs, or clusters of SCs are isolated between APES ICs where access restrictions apply.

[0004] The IC creates accessibility restrictions for the SC from the IoT and creates the environment for the deployment of new encryption / decryption capabilities. Companions are guaranteed that their messages are controlled at the sender and receiver of the communication, and are assumed not to be controlled within the rest of the IoT domain, including the APES KC and all connections between the APES KC and Internet Service Providers (ISPs). Encryption and decryption is done internally to the SC.

[0005] Supercomputers and quantum computers with artificial intelligence (AI) are denied the ongoing connections normally associated with using iterative encryption of specific algorithms and keys, effectively denying unauthorized access and data collection that may enable decryption or learning.

[0006] User-defined specific encryption algorithms or keys are enabled, and APES SC host algorithms and keys are enabled. APES devices can host many discrete encryption strategies or processes, and users can also define their private algorithms and / or keys (new algorithms and keys). Creative thinking can be done using existing schemes, adapting existing schemes, combining old and new schemes to generate one- or multi-dimensional algorithms and keys, including one-off techniques, which are largely ignored as being very cumbersome. However, database tools allow for the creation of unique / personalized encryption strategies and processes. The APES host of encryption tools, especially large database structures, are almost limitless as computer memory and processing power have grown substantially over the past few decades. The APES SC can perform this as a single primary function, encryption / decryption, and be dedicated to only that set of operations, leaving all file related data operations to other protected user systems, or the APES SC can perform additional deep packet inspection. The APES SC is a system of systems, and the APES SC and IC subcomponents can include additional IC protection for subcomponents such as media storage.

[0007] ISPs may provide additional, independent security measures for files served by APES. Legal requirements to remove ISP security measures, such as a court order, will not undo the APES-specific secret encryption. APES encryption is done prior to interfacing with an ISP. [Background technology]

[0008] IoT is growing substantially. Encryption is encouraged as a means to secure data. However, encryption keys are stolen and used. Corrupting encryption / decryption algorithms is yet another concern, and if a computer is hackable, all related processes are potentially alterable or under the control of a malicious actor or organization. Key theft allows an attacker to decrypt messages, and algorithm changes can potentially be applied to deny users any encryption or decryption options. Exacerbating these concerns is quantum computing with artificial intelligence, which could potentially break current encryption by brute force or more sophisticated knowledge, rule, or artificial intelligence based attacks. While increasing key sizes has been a successful strategy to defeat the ever increasing performance of traditional computing, creative uses of quantum computing are predicted to overwhelm any key size increase. New strategies beyond increasing key sizes are being researched to address the risks that quantum computing poses to the encryption process.

[0009] Many specialized computer functions have been targeted by fraudsters. Protecting these computers must be a priority before addressing the purpose of computer actions. U.S. Patent No. 10,419,131 teaches computer isolation and protection, isolating some computers from discovery by removing their addresses from an easily accessible directory of known used Internet Protocol (IP) addresses. These discoverable computers, "ICs" in this application, become data flow governors for discoverable but limited access SCs.

[0010] The world needs new ways to secure data, whether it is on a private network or transiting and / or stored on public networks and systems. Numerous data-centric activities under computer control need to be secured, especially when the data is later discoverable and collectable on public infrastructure, and public storage ("cloud"), communication, and routing are obvious places where data can be illegally collected without sender / receiver awareness. Cloud service providers can host individual or multiple IC-protected SCs as companions to specific users with ICs controlled from on-premise or through special communication connections off-premise (remote). Summary of the Invention

[0011] The present invention relates to an encryption / decryption system and method for securing data in motion between two or more computer systems, i.e., the Extended Protection and Encryption System (APES). The extent to which the computer's IP address is known and accessible in the IoT defines which category, KC or SC or IC, each APES computer is in. Implementation at different locations in the IoT will enable security of all APES protected traffic on the IoT. The encryption / decryption algorithms and keys reside in the SC. Protection from IoT access to known access limited computers (SC) is defined by rules present in neighboring unknown undiscoverable computers (IC). The IC at each location provides the decision on allowing or not allowing connectivity between known access limited computers (SC) in different APES and prohibits all non-APES connectivity. These neighboring computers are not known to the Internet and are not accessible from any node on the Internet, making these inaccessible computers effectively invisible. Secure data occurs when encryption processes, algorithms, and encryption keys are applied to data in motion, encryption processes, algorithms, and encryption keys hosted on known computers with APES.

[0012] In another embodiment, the encryption system and method includes at least two devices communicating with an infrastructure of the IoT, where not all of the computers in the at least two devices are accessible to the IoT, where a first device has some components in the IoT that communicate through the IoT infrastructure, and a second device has some components in the IoT, where the first and second devices each have at least one internal computer that is IoT known and inaccessible, and are exclusively accessible to each other (whitelists and other authentication techniques), where the computer of an additional device defines exclusively accessible (whitelists and other authentication techniques), and where the additional computer is invisible to the IoT.

[0013] Data at rest (DAR) is protected in any APES-protected computer where the data is stored using APES encryption, which may differ from the SC encryption. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 shows a three-module block diagram of the system of the present invention. [Diagram 2] FIG. 1 shows a five-module block diagram of the system of the present invention. [Diagram 3] FIG. 1 shows a seven-module block diagram of the system of the present invention. [Figure 4] The five-module block diagram in FIG. 2 is shown in more detail. [Diagram 5] The five-module block diagram of FIG. 4 is shown in more detail. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Enabling dynamic encryption can be accomplished by an extension of US Patent 10,419,131. The extension creates more isolatable discoverable modules by expanding from the three-module design to a larger number of modules, with each newly added discoverable module being bracketed by a non-discoverable module (the second device from US Patent 10,419,131). The module can be a single computer or a set of computers. This is accomplished by adding two modules, one non-discoverable and one discoverable, to what was the starting configuration (e.g., 3 to 5, or 5 to 7). The restrictive connectivity of the whitelist isolates the computers in the discoverable module(s) bracketed by the non-discoverable module, greatly expanding the speed of algorithms and key substitution for encryption hosted on computers isolated with the whitelist (and other authentication techniques). Using five or more modules compared to the three-module design of US Patent 10,419,131 The design requires new descriptors. In previous designs using two devices, the user computer was protected from hacking using a restricted list, as defined in US Patent No. 10,419,131. APES adds new functionality, namely encryption / decryption for data at rest and data in motion, even when the data is outside the user's domain, such as residing in the IoT domain.

[0016] Three descriptors are used in this application: The descriptor for an IoT accessible computer is the KC (previously defined in US Patent 10,419,131 as a "first device"); The descriptor for a computer known to the IoT but with limited access is the SC; The descriptor for a computer not known to the IoT is the IC (defined in US Patent 10,419,131 as a "second device"); SCs are paired with other SCs, also called companions.

[0017] One or more computers, the invisible computer, define specific communication controller modules and establish the delineation of modules. Figures 2 and 3 show linear transfers using bidirectional arrows between odd numbered modules. Also shown are even numbered modules, with data flow control arrows reflecting their control over the bidirectional transfer arrows. The even numbered modules operate on restricted data, packet headers. If the header data matches the allowed / authorized IP addresses and header authorization techniques, access is authorized. Authorized access is achieved by the even numbered modules gating data between adjacent odd numbered modules.

[0018] As an example, an IoT data packet arrives at module 1, the header is read by the KC in module 1, and the header data is securely shared with the IC in module 2. If the IC in module 2 defines the header IP address as an unwanted IP address, module 2 will refuse to forward the data packet to module 3, and all packets related to that IP address will be filtered out by module 1. Conversely, if the IC in module 2 determines that the header data is from another APES system, module 2 will approve the forwarding of the data packet to module 3, and all packets related to that header authentication will be approved for forwarding from module 1 to module 3. The APES data packet is encrypted, and the inspection tool in module 1 cannot decrypt any content in the packet data field. After the data packet inspection is completed in module 1 (it can achieve more than encryption testing), a flag is enabled and sent to module 2, and module 2 activates the data forwarding from module 1 to module 3. These packets are then flowed to module 3, specifically to the SC Companion of the source SC, where decryption occurs and the unencrypted data is inspected, and assuming no foul play is detected, the data flows deeper into the system. A third scenario is also possible, where module 2 determines that the unencrypted header is from some system in the IoT and not from an unwanted IP address. Module 1 runs tools, including optional decryption with public / private keys, to check for foul play. Module 2 determines that the data is safe to forward to module 3, but there are additional conditions to be met. The first condition is that module 3 has a non-shadow computer that is compatible with the IoT address. If a non-shadow computer in module 3 is selected, then a data packet evaluation of module 3 (similar to that of module 1) is performed. Deep packet inspection of the non-shadow computer in module 3 and other tools are used to ensure that there is no foul play.If the non-shadow computer of module 3 is not available, APES module 1 will not receive a valid transfer authorization from the IC of module 2 and the data file will be filtered out by module 1. In yet another scenario, if a hacker tricks module 2 with a stolen shadow computer header, once the inspection in module 1 is complete, the data will be filtered out by module 1. The data is forwarded to module 3, which forwards it to the SC, where the decryption fails. Module 3 filters the data, and these packets never reach the user system.

[0019] The obvious nature of any intermediate module is defined as either the intermediate module being APES-only or the intermediate module containing at least one computer that is not an SC. FIG. 5 has a single computer labeled "A" in Module 3 that is distinct from the other computers that are all SCs. If the Module 3 computer in FIG. 5 labeled "A" is not an SC and reflects a version of the intermediate module that has non-SC computers, then traditional IoT communications can take place. If that "A" computer in Module 3 in FIG. 5 is an APES computer, as are all of the rest of the SCs in Module 3 in FIG. 5, then only the "A" companions will be authorized to communicate with "A". If Module 3 in FIG. 5 only has SCs, then FIG. 5 reflects an APES-only device.

[0020] Figure 5 shows additional data communication between odd-numbered and even-numbered modules. For data flowing into the APES from the Internet, the data flow is on data line item 110 in Figure 5, sending non-packet data from KC "1" to IC "2". When packet data is passed from module 1 to module 3, the non-packet data is shared between the computer in module 3 and IC "4" using data lines in bundle item 108.

[0021] There are two versions of APES defined by odd-numbered intermediate modules; one version of APES has only a shadow computer, and therefore non-SC / non-companion source data from IoT is blocked. The other version of APES has a non-shadow computer(s) and can process IoT data originating from sources other than companions. Figure 3 reflects a seven module configuration. Modules 3 and 5 can be purposely configured to block all IoT communications, or it is also possible that only one of the odd-numbered intermediate modules (3 or 5) is configured to block IoT communications. In either case, the IoT is blocked.

[0022] The practical utility of having seven modules made up of incompatible IoT modules (module 3 is IoT enabled and module 5 is not IoT enabled) is to notify the APES intranet of any attempts to infiltrate the APES intranet configuration.

[0023] APES extensions will allow users to securely access new encryption processes, algorithms, and keys over the Internet as companion computers communicate using one-time scripts of unknown keys applied to similarly unknown algorithms (multiple keys and algorithms applied to a single message). Users can change processes, algorithms, and keys as often as they wish, making decryption nearly, if not completely, impossible for anyone other than the intended audience. Processes, algorithms, and key transfer messages should use multiple keys and multiple algorithms, and this combination of algorithms and keys can be mixed, matched, or discarded for future messages. Mathematically, there are an infinite number of multivariate polynomials to be algorithms, and keys can be large or small, or both. When a user-defined process requires that algorithms be morphed within a single packet or message, and different keys are also applied, the overall likelihood of any random decryption is effectively zero.

[0024] Expanding the range of algorithms combined with equally diverse key structures on a SC secured behind an IC and shifting their use has serious consequences for decryption: if the receiving computer has no insight into how the encryption was done (e.g., the process, algorithm(s), and key(s)), the chances of being able to randomly decrypt any message or part of a message approach zero.

[0025] The OVRWatch™ system is a commercialization of U.S. Patent No. 10,419,131 and is a multi-module hardware-software design. The simplest version of the OVRWatch™ system has three modules: Module 1 hardware and software is part of the Internet and is permanently connected to the Internet; Module 1 hosts additional customized software.

[0026] The "second device" of U.S. Patent No. 10,419,131 is incorporated into OVRWatch™ module 2 and also hosts further customized software. OVRWatch™ module 3 hosts customized software in addition to the hardware and software capabilities of the "first device" of U.S. Patent No. 10,419,131. Customized software tools include, but are not limited to, the classic "firewall-like" and "intrusion detection-like" checks in modules 1 and 3.

[0027] Proprietary software, including a firewall, is provided as part of the OVRWatch™ system, but any user-defined firewall or other tools are also accommodated. These applications also extend to NIST (or any other organization that establishes guidance and / or standards) approved solutions for encryption / decryption advances.

[0028] The extensions include expanding the three-module OVRWatch™ shown in FIG. 1 to five modules shown in FIG. 2 by adding one discoverable and one non-discoverable module to the configuration of FIG. 1, and to seven modules shown in FIG. 3 by adding one discoverable and one non-discoverable module to the configuration of FIG. 2. The usefulness of building more than nine or eleven module versions is diminished due to the inherent complexity of compounding devices. However, for truly dangerous adverse situations, higher module configurations (9, 11, 13, etc.) can allow complex internal routing of data within the SC and branching operations can be deployed. Linear process flows such as those shown in FIG. 2 and FIG. 3 are typical. Non-linear loops can create multi-pass encryption and even transfer from one APES at a location to a second non-disclosed APES at the same location for additional processing.

[0029] As mentioned above, an APES can be made to deny all non-APES connectivity; cascading APES can have serious consequences; an internet-facing APES can accept IoT data while a second APES closer to the user system can be configured to only accept APES companion data. In effect, when the second APES blocks all IoT source data except from known companions, internet sources have a response that appears to reflect access to the user's system.

[0030] Encryption resides on the computers of odd numbered modules bracketed by even numbered modules, module 3 in a 5 module configuration, and modules 3 and 5 in a 7 module configuration.

[0031] The numbering of the modules is defined by their proximity to the computer they are protecting. The lower the number, the further away the computer is from the protected one. In a five-module configuration, the (third) computer in the "middle" module is known and potentially accessible, and potentially inaccessible due to the connectivity restrictions imposed by modules 2 and 4 (whitelisting and other authentication techniques).

[0032] Figure 5 shows a single accessible computer, letter "A", in module 3, satisfying the "potentially accessible" version. In this version of APES, nominal IoT traffic travels through module 3 computer "A".

[0033] Similarly, in the absence of an IoT-accessible Module 3 computer, the user can only access the companion connection via the IoT.

[0034] As defined in US Pat. No. 10,419,131, all computers in even-numbered modules are undiscoverable.

[0035] Functional actions embedded in the computers in the odd-numbered modules include filtering and packet inspection, as well as other techniques to discover unauthorized content.

[0036] The lowest numbered modules in any configuration (such as module 1 in a 3-module and module 1 on a 5-module) perform the same function. Similarly, the highest numbered modules in each configuration (module 3 in a 3-module and module 5 in a 5-module) perform the same function. Significant differences in module functionality occur in the odd-numbered, isolable "middle" module(s), i.e., module 3 in a 5-module and modules 3 and 5 in a 7-module, etc.

[0037] The computers of the intermediate modules that perform the encryption / decryption functions have very limited whitelist and authentication access. Filtering out unwanted communication channel traffic (IP address and other protocol traffic) is generally referred to as "blacklisting" and is a core function of the OVRWatch™ system. Conversely, "whitelisting and other authentication techniques" ensure that communication channel traffic (IP address and other channel traffic) is from known and trusted sources. Other techniques include authenticated computers, IP and MAC devices.

[0038] Module 1 performs external interface functionality, including but not limited to source and routing checks, packet inspection tools (which are constantly updated), and any other tools deemed necessary or desirable. Similarly, the highest numbered module performs similar functions as Module 1, plus secures the input / output ports of the protected system. These actions are the basic odd-numbered (e.g., 3, 5, 7, 9, ...) module system requirements that are implemented. In a layered defense where multiple OVRWatch™ are deployed, the input / output ports of the protected system should only be addressed by the OVRWatch™ that is closest to the protected system.

[0039] The even-numbered modules are the "gatekeepers" that control instantaneous connectivity between adjacent odd-numbered modules. IoT connectivity is continuous only to module 1, and all higher level odd-numbered modules achieve connectivity to the nearest lower-numbered odd-numbered module when an adjacent even-numbered module grants a data connection; for example, module 5 can only connect to module 3 when granted by module 4.

[0040] The rules in even-numbered modules are compared to the data inspection rules in odd-numbered modules. Simple. An automated tool for a high throughput system can have header data inspected by even numbered modules, but these are comparison checks using whitelist and authentication techniques, and may be blacklist depending on customer defined requirements.

[0041] In a simple strategy within the intermediate modules (e.g., 3 out of 5), a single SC is used for encryption-decryption actions and a different SC is used to host the encryption algorithms and / or keys, and an SC is always required for algorithm and / or key management. A more complex strategy uses two SCs for the operations, separating the paths for encryption and decryption. Much more complex strategies are possible, including separate SCs for different communities of users. For example, financial records are managed by a different shadow computer than medical records, and yet another has personnel files. Each community of users defines its own subcommunity. Those skilled in the art of computer and computing system architecture will find examples as varied as they are sufficient to create many architectures from any number of components. Although the terminology varies, the framework is general enough to allow customization.

[0042] Another use of a shadow computer could be to separate file types, separate audio from data, or to more intelligently filter audio sources from each other using different encryption to prevent the entire conversation from being compromised if one end of the conversation is captured as plaintext and encrypted.

[0043] The installation of changeable algorithms and keys on any Shadow Computer can be accomplished using the Internet or directly by a system administrator, and those algorithms and keys can be distributed securely, utilizing previously installed algorithms and keys that should never be reused (which is the most risk-averse "should"), since an infinite number of algorithms and keys can now be shared. New strategies arise for managing both keys (a traditional action) and algorithms.

[0044] These designated SCs are known to the Internet (they have IP addresses). However, these SCs are not accessible except by other known SCs (aka companions), and their functions can be very specific to one or more purposes, such as encryption algorithms and key control, and other purposes can be added. When any IP address (external or internal) tries to connect to any Shadow Computer, the request is filtered by the controlling inaccessible even-numbered computer that regulates the optical link. The optical link is enabled by the even-numbered module, and data is transferred between the odd-numbered modules adjacent to the odd-numbered module hosting the Shadow Computer if the Internet or Intranet node making the request is on the access list (whitelists and other authorization techniques) for the Shadow Computer. Whitelists and / or other authorization techniques reside in the even-numbered modules (modules 2 and 4 in the 5-module version of OVRWatch™).

[0045] The third and fifth modules are the central modules in a seven-module version of the OVRWatch™ system. It is modules 2, 4, and 6 that control the data flow into and out of the seven-module SC. With multiple modules hosting SCs, a vast array of new strategies are opened up to the user. Complex encryption / decryption can be used, in fact multi-pass or multi-dimensional systems can be developed, where data can be processed in module 3, then module 5, then back to module 3, etc.

[0046] Controlling the communication channels (IP addresses and other) for the central module(s). For even numbered modules, there is a simple technique for authorizing the inclusion of whitelisting to prevent any unwanted access to their central module IP addresses. Because the even numbered modules' IP addresses are not accessible, they are not subject to attacks, modifications, etc., and are therefore perfect guardians of the pairing protocol between central modules located within the vast reach of the Internet. As an example, if two 5-module devices are "central module paired", located hundreds of miles apart and using a communication path that includes the Internet to carry messages, then authenticated (including whitelisted) paired partners located within their respective modules 2 will be able to accept messages from their paired partners and not accept messages from other (unauthenticated / paired) devices.

[0047] Which algorithms and keys are installed on any Shadow Computer is user defined. The system manager should be a human who controls the process. Thus, at least one of the SCs has an additional interface that allows direct, separate, and well-defined human interaction. Additional security measures can be applied to eliminate the risk of human exposure. Those added security features are also user controlled and are not part of this application, other than to note that there are measures that provide security for human interaction with the system that hosts the SC.

[0048] There are autonomous versions of algorithm and key development that can rely on input from the actions of individuals in response to system queries. Automated queries can solicit input from users, and the order and content of the mode responses can become a seed generator. One seed generator scheme has a set of files shuffle their contents generating a new polynomial for the algorithm definition; similarly, a secondary seed can shuffle an array of random numbers generated in association with the algorithm, generating a new key. The algorithm and key can be other structures, polynomials are just one approach.

[0049] In another autonomous version of algorithm and key development, the reset values ​​can reorder controlled files, large arrays of numbers. These large arrays are seeds for the algorithms and keys, similar to the "individual actions in response to queries" above. Hundreds to thousands or tens of thousands of values ​​can be shuffled in memory of multiple SCs and shared using still active algorithms and keys.

[0050] Encrypted messages from seemingly authenticated sources, including whitelisted IP addresses, would not have characteristics that are required to spoof packet headers and traffic, but are unknown to the fraudster. Multiple behavioral controls can be added to make important messages, such as new encryption algorithm loads, conform to internally known limits, a simple example being timestamp windows. In some domains, this is called a "Command Access Period" (CAP). If the spoof is outside of the allowable allocated timestamp window, the entire message is dropped. Another behavioral control could be that multiple messages from multiple IP addresses are required (similar to multi-factor authentication). Even more controls can be installed to protect the option to upload new algorithms (or key systems). All of these concepts are common in normal security systems.

[0051] One obvious solution to quantum computing and AI is to constantly change algorithms and keys, but this is problematic as new algorithms and keys fail when their management fails. It brings new threats and disruptions. Balancing these competing challenges is a business decision, risk vs. cost. Building processes within a computer to generate encryption code is not new, as noted with reference to U.S. Patents 5,614,900 and 10,917,403. The Blowfish encryption was written in the 1990s. Other products and algorithms have been declared, including the Skipjack algorithm used in U.S. chip manufacturing.

[0052] Without specific user requirements, it is impossible to define the exact encryption and key model that any user will deploy. Suffice it to say that "experts" in these matters will deploy the tools they feel will best serve their community of users based on a risk-reward analysis. The architecture of the SC, with its whitelists and other authentication protections, enables a whole realm of opportunities for encryption experts.

[0053] Less obvious filtering can be commercially interesting because content can be filtered by the software or prevented from being filtered. Content filtering can remove sales and / or advertisements that users wish to ignore.

[0054] The APES device can be integrated into electronic devices or aftermarket extensions.

[0055] APES reflects a system that can accommodate existing custom tools for encryption, including the use of database concepts. An essential aspect of any database is a means to track changes and maintain control over the database system, with robust recovery in case of system failure.

[0056] As an example, the coefficient terms (A, B, C) of a quadratic polynomial are hosted (Ax 2 +Bx+C)If one defines a two-dimensional array of a 10,000 by 3 element database supporting one-variable polynomials, with the database version as number 628, the start pointer position as 8,197, and establishing array transitions every 18,000 bits, these three values ​​(628, 8,197, and 18,000) can be placed in the header to provide all the necessary decryption parameters. Additional header data can include the date of parameter selection, the location of the parameter section, etc.

[0057] A change of encryption after 18,000 unencrypted bits moves the database pointer from position 8,197 to 8,198 and causes three new coefficients to be used for the "A", "B", and "C" polynomial parameters. This process continues, moving the pointer and getting new coefficients, until no new unencrypted bits are available for encryption. It is interesting to select the values ​​in the header (628, 8,197, and 18,000) with their own offsets as well. 628 could actually mean 286 or 826, and likewise 8,197 could be 1,879 using numbers but in a slightly different order. The header bits can have flags set in them to aid in keying in the correct sense.

[0058] One packetization scheme for the encrypted bits is to keep the encrypted contents in a buffer and concatenate them to form new packets.

[0059] The version number 628 is updated periodically and can change the contents of the database. When updated, the version shuffles the 10,000 x 3 elements of the database contents, replacing some old content with different content that has not been used before and can also include new data.

[0060] Another version of the database may host different mathematical representations, rather than a database of 10,000 by 3 elements, the database may be 15,000 by 11 elements, allowing for greater complexity of polynomials involving multiple variables, etc. With a few bytes of header data, many different encryption strategies may be deployed by the user. Similarly, the dimensional nature of the database may be larger, three-dimensional, or more than three-dimensional. Which dimensions are used is selectable. Database management tools allow for these and other structures.

[0061] Another packetization scheme for the encrypted bits is to hold the encrypted contents in a temporary buffer and concatenate them to form a new packet.Another scheme is to encrypt a packet, assume that the original single packet is expanded to two or more packets, fill the unused parts of the newly defined packet, and concatenate the encrypted packet.

[0062] The version number may be updated periodically, which coincides with a "shuffling" or "replacement" of the database contents.

[0063] In another configuration, the algorithm database and the key database are separated and hosted on different Shadow Computers.

[0064] Another configuration allows the algorithm and key transitions to be asynchronous, and even greater complexity can be achieved if the asynchronous transitions are unequal amounts of bits, such that the algorithm can be changed every 1000 bytes of unencrypted data and the key is changed at intervals other than 1000 bytes.

[0065] The mathematics underlying the encryption can come from a vast number of disciplines, including classical mathematics, linguistics, images, icons, music, or anything that can constitute a set.

[0066] Algebra, trigonometry, topology, complex variables, and many other areas of mathematics can be considered. Other icons, colors, images, sounds, and languages ​​known or created can be used. Large database management tools are routinely used to build large arrays with multi-dimensional content. There are parameters in the process of encryption that can be reset, reused, skipped, and / or shifted in databases, etc., making it impractical to attempt to discover the means of encryption even if copies of the data are captured by unauthorized collections while the data is traveling on public infrastructure communication systems.

[0067] All of these strategies have limitations, but in practice the options are limited only by the available bits in the message. Complex messages can be expansive or compressive. Typically encryption produces more bits than the original message (expansion), but complex symbols can host more data (compression). For example, traditional fiber optic carriers use many photons (thousands to millions) to transmit one bit. However, novel carrier strategies that define the timing between any two photons as a data word result in massive compression. This is the NASA interplanetary communication baseline. Similarly, language experts have many examples of images as words or stories (massive compression).

[0068] In a closed system SC, any number of advances in data compression are practical. Because the user community is restricted, entirely new structures can be used.

[0069] File management is important for all these encryption strategies. Default files are a necessary reset when decryption of a message fails. Building robust file backing systems has been a mainstay of database design for decades. Tools for defining and repairing unintentional errors in databases are common. Somewhere within the user's SC domain, the user needs to install their own toolset.

[0070] In Figure 3, the intermediate modules, number 3 and number 5, are routed linearly, meaning that external data flows into the protected system following a series of steps, from module 1 to module 3 to module 5 and finally to module 7. The linear chain resembles a classical hydrocarbon molecular chain in its connectivity pattern and can be interrupted by special pathways that allow branching from the main sequence. Such branches can create complex pathways, especially when a large number of SCs are used.

[0071] Branching is especially useful when a module is the last in a series that allows IoT interfacing (non-SCs exist in the module). In the case of previous logic where SC mismatches were deliberately introduced, the non-SC data routing can be "non-linearly processed" and moved into a processing system designed to analyze potential fraudulent intent. In this scenario, module 3 has an IoT-accessible computer and module 5 does not, and their data in module 3's IoT-accessible computer can be routed to a separate node from the linear processing.

[0072] In yet another mode, the "non-linear processing" is repeating processing steps, for example double encryption.

[0073] Optical connectivity controls can be used to selectively define unique routing based on header data and authentication techniques. Such routing can create a means for a fraudster to "dead end" a series of packets when performing data exfiltration (stealing data from a protected system). Similarly, external packets can be routed to a computer that acts as a "honey pot" that has either a defensive no response or an offensive response to external sources.

[0074] Optical routing can also mean that communications channel traffic, including its headers, may generate multiple receivers; just as the Internet can, and does, provide multiple routes for packets, APES can mimic that characteristic.

[0075] Layering these cryptographically capable modules, such as cascading multiple 5-modules, has the effect of complex layers of encryption.

[0076] Users operating at different levels of security can insert a unique SC for each unique level of security. Consider an enterprise where senior management has communications with many subgroups with significantly different objectives, accounting, legal, marketing, etc., there may be a justification (e.g., corporate policy or government regulation) for isolating these subgroup interfaces at the senior management level.

[0077] The complexity of this application arises not because of creating security in some complex algorithm, but because of a huge number of algorithms, from thousands to billions depending on the user's requirements. Similarly, the keys are expanded to a huge number, rather than a larger number of bits in a single key. In a One-Time Pad (OTP) operation, the decryption is performed by a computer under the control of the encryption / decryption computer. These two large arrays in the database combine to make it impossible or nearly impossible to crack. Unlike current encryption / decryption strategies where a crack opens the door to decrypt many messages, if a user is willing to split the message into smaller segments, a successful crack of a single OTP message or part of an OTP message does not disclose anything about other messages, except that the cracked code is not an option for decrypting additional messages.

[0078] Managing these arrays of algorithms and keys is also a more manageable task with modern computers and associated messages: with memory now scalable into gigabytes on single board computers, and database systems being commonplace, the concept of a large managed database is an obvious candidate for generating billions of algorithms and keys.

[0079] Advanced multi-dimensional mathematical systems can be different for different users, so the fraud collector has more than simple prime factorization to consider. How a particular user defines their database entries is an option that is unique to that user. Multi-dimensional aspects can be applied to processes, algorithms, or keys in any combination.

[0080] Hosting the client's private processes, algorithms and keys, as well as process, algorithm and key management tools, as well as means to facilitate the coordination of updates of processes, algorithms and keys, and other related tools, are all contained in the SC. The possibility to filter out all executable code can be successfully achieved through this process.

[0081] When connections are allowed or not allowed, Internet versus Intranet patterns emerge. What distinguishes the Internet from an Intranet are the rules of connection.

[0082] Yet another aspect of the five modular units, within the message secured by any of the mathematics, is that the message is useful in generating and distributing more algorithms and keys over the Internet as an intranet.

[0083] Detailed Description of the Drawings FIG. 1 shows a block diagram of a three-module OVRWatch™, where module 1, 1101 is an interface between the Internet or a local router, etc. and module 3, 1103. Optical link 1104 is the physical conductor for data movement between module 1, 1101 and module 3, 1103. Module 3, 1103 is an interface between a user device (not shown) and module 1, 1101. Module 2, 1102 controls optical link 104. Module 2, 1102 is not discoverable as defined in U.S. Pat. No. 10,419,131. Modules 1 and 3, 1101 and 1103, respectively, are discoverable as defined in U.S. Pat. No. 10,419,131.

[0084] FIG. 2 shows a block diagram of a five-module OVRWatch™, where module 1, 201 is the interface between the Internet or a local router, etc. and module 3, 203. Module 3, 203 represents at least two computers, not explicitly shown, one computer used to handle normal communications and the other computer being a shadow computer. Optical link 206 is the physical conductor for data movement between module 1, 201 and module 3, 203. Module 2, 202 controls optical link 206. Module 2, 202 is a 5-module OVRWatch™, as described in U.S. Pat. No. 5,399,321. No. 10,419,131. Module 4, 204 controls optical link 207. Module 4, 204 is not discoverable as defined in U.S. Pat. No. 10,419,131. Module 3, 203 is the interface between module 1, 201 and module 5, 205. Optical link 207 is the physical conductor for data movement between module 3, 203 and module 5, 205.

[0085] In an alternative description of module 3, 203, module 3, 203 has only SC devices and therefore only companion connections are allowed.

[0086] FIG. 3 shows a block diagram of a seven-module OVRWatch™, where module 1, 301 is an interface between the Internet or a local router, etc. and module 3, 303. Module 3, 303 represents at least two computers, not explicitly shown, one used to handle normal communications and the other a shadow computer. Module 3, 303 shares the functionality of a hosting SC with module 5, 305. Optical link 308 is the physical conductor for data movement between module 1, 301 and module 3, 303. Module 2, 302 controls optical link 308. Module 2, 302 is not discoverable as defined in U.S. Pat. No. 10,419,131. Module 4, 304 controls optical link 308. Module 4, 304 is not discoverable as defined in U.S. Pat. No. 10,419,131. Module 3, 303 is the interface between module 1, 301 and module 5, 305. Optical link 309 is the physical conductor for data movement between module 3, 303 and module 5, 305. Module 6, 306 controls optical link 310. Module 6, 306 is not discoverable as defined in U.S. Pat. No. 10,419,131. Module 5, 305 is the interface between module 3, 303 and module 7, 307. Optical link 310 is the physical conductor for data movement between module 5, 305 and module 7, 307.

[0087] In an alternative description of module 3, 303, module 3, 303 has only SC devices and therefore only companion connections are allowed.

[0088] In an alternative description of module 5, 305, module 5, 305 has only SC devices and therefore only companion connections are allowed.

[0089] Figure 4 shows the block diagram of the five modules of Figure 2 in more detail. The ovals are the optical transceivers (item 40) shown 16 times. Module 1 is "Internet-enabled" and module 5 is "protected system-enabled" and the computers of these modules 1 and 5 are IoT known, discoverable and accessible. Modules 2 and 4 are "gatekeepers" that are "invisible" since their IP addresses are not known, discoverable and accessible from any source. Module 3 has two classes of computers, class 1 is 3 Alpha that is IoT known, discoverable and accessible, and the second class has three computers in this figure, 3 Bravo, 3 Charlie and 3 Delta that are discoverable and not accessible from the IoT. SC. The IP address of the SC is included in the header data field of the address associated with the packetized data.

[0090] 3 Bravo, 3 Charlie, and 3 Delta are discoverable and accessible to other SCs in other devices via the Module 2 and 4 whitelist structures.

[0091] FIG. 5 shows the five module block diagram of FIG. 4 in more detail.

[0092] The diagram shows the types of computers in a five-module system: unknowable hidden computers (#2 and #4) that are discoverable but accessible only by identified companion shadow processes (computers B through F in module 3), and known, discoverable, Internet-accessible computers (#1, A, and #5).

[0093] If computer 3A of module 3 were an SC, then the entire five module configuration would be an intranet with normal communications with accessible computers.

[0094] No power isolation or port limitations or software are shown, however, optical signals are represented by items 112, 113, 114, and 115.

[0095] A high level block diagram is shown in Figure 5. The additional data lines between the even-odd modules show how the head data is used to determine permissions and data transfer between the odd-odd modules.

[0096] Five modules are shown in Figure 5. Modules 1, 2, 3, 4, and 5 are items 101, 102, 103, 104, and 105, respectively. Optical signals are defined by items 112, 113, 114, and 115. Control signals are defined by items 106, 107, 108, 109, 110, and 111.

[0097] While embodiments and applications of the present invention have been shown and described, it will be apparent to one skilled in the art having the benefit of this disclosure that many more modifications than those described above are possible without departing from the inventive concepts herein. Accordingly, the invention is not to be restricted except in the spirit of the appended claims and equivalents thereto.

Claims

1. 1. An encryption system for securing data in motion comprising two or more computer systems having known and unknown undiscoverable Internet Protocol addresses for various computers within the computer systems at different locations, wherein the known computers within the computer systems are protected from being addressed by anyone other than one another, and wherein the protection for the known computers is defined by rules present in adjacent unknown undiscoverable computers at each location that provide decision-making regarding allowing or not allowing connectivity between the known computers in the different computer systems, wherein these adjacent computers are not known to the Internet and are not addressable from any node on the Internet, and wherein secure data is generated when an encryption algorithm and an encryption key are applied to the data in motion, and wherein the encryption algorithm and the encryption key are hosted on a known computer with the computer systems.

2. 2. The encryption system of claim 1, wherein the encryption algorithm is hosted on a single computer within the computer system and the keys associated with the encryption algorithm are hosted on different computers within the computer system, and different levels of security derived from different algorithms can be on additional algorithm hosted computers within the computer system, and different levels of security derived from different keys can be on additional keys hosted computers within the computer system.

3. 3. The encryption system of claim 2, wherein relationships of levels of computers at one location are correlated to the same levels of computers at a different location, said locations being connected by public fiber and routing of said Internet, and only correlated levels can communicate with each other.

4. 1. A cryptographic system comprising at least two devices in communication with an Internet of Things (IoT) infrastructure, wherein not all of the computers in the at least two devices are addressable from the IoT, a first device having some components in the IoT that communicates with a second device having some components in the IoT via the IoT infrastructure, each of the first device and the second device having at least one IoT-known discoverable internal computer that is mutually exclusively whitelisted, an additional device's computer defines the whitelist, and the additional computer is invisible to the IoT.

5. 5. The cryptographic system of claim 4, wherein invisible is defined as unknown, not discoverable, and not addressable by the IoT.

6. 5. The encryption system of claim 4, wherein the two devices are shadow computers that are discoverable, whitelisted computers known to the Internet of Things that provide encryption and decryption services to users of an intranet via the IoT infrastructure.

7. A device is further defined as a set of modules, where Module 1 hosts at least one known, discoverable, addressable computer that represents the device's connectivity to the IoT, and Module 2 hosts an unknown, non-discoverable, addressable computer that provides data flow control between Module 1's computer and Module 3's computer.

5. The encryption system of claim 4, wherein module 4 hosts an unknown, non-discoverable, non-addressable invisible computer, module 3 hosts at least one computer that is known, discoverable and addressable, module 3 also hosts at least one shadow computer that is known, discoverable and inaccessible to said IoT computer, any module 3 shadow computer can address module 3 shadow computers of other devices, encryption and decryption is performed on the shadow computers, module 4 hosts an unknown, non-discoverable, non-addressable invisible computer that provides data flow control between module 3 computers including the shadow computer and module 5 computers, module 5 hosts at least one known, discoverable and addressable computer that represents connectivity of said device to said user's system.

8. 8. The encryption system of claim 7, wherein the shadow computer encryption / decryption process is further defined as a database-driven content for management of algorithms, keys, and pointers for tracking the use of algorithms and keys, where a user can define a unique mathematical structure from any branch of mathematics having possible cryptographic values ​​including, but not limited to, algebra, geometry, calculus, topology, and multidimensional abstractions, and the database is updated with data previously transmitted in messages between shadow computers in devices operating as the intranet using the IoT infrastructure.

9. 10. The encryption system of claim 8, wherein the inter-device addressability of the IoT inaccessible computer is whitelisted and / or authenticated by additional computers in the device, the additional computers being unknown, non-discoverable, non-addressable computers, providing data flow control between the known, discoverable, inaccessible computers in a multi-device environment, and whitelisting Internet Protocol addresses.

10. 10. The encryption system of claim 1, configured with an extension to allow a user to securely access new encryption algorithms and keys over the Internet when whitelisted companion isolable computers communicate using a one-time script of unknown keys applied to equally unknown algorithms of keys and algorithms applied to a single message.

11. 2. The encryption system of claim 1, wherein the even-numbered modules are gatekeepers that control instantaneous connectivity between adjacent odd-numbered modules, and the even-numbered modules are compared to the data checking rules of the odd-numbered modules.

12. 2. The encryption system of claim 1, wherein the encryption is performed at module 3 (middle module) of a 5-module system.

13. 2. The encryption system of claim 1, wherein encryption is performed in modules 3 and 5 (paired intermediate modules) of a seven module system.

14. 2. The encryption system of claim 1, wherein higher order systems (9 modules or more) have more computers in the intermediate modules.

15. 1. A method for securing data in motion, comprising: Two or more computer systems located at different locations, with known and unknown undiscoverable Internet Protocol addresses of various computers within said computer systems. using a known system in which known computers in the computer system are protected from being addressed by anyone other than each other; the protection for the known computers includes using rules present in neighboring unknown, undiscoverable computers at each location to provide decision making regarding allowing or not allowing connectivity between the known computers in the different computer systems; said protection using those neighboring computers that are not known to the Internet and are not addressable from any external node on said Internet; The secure data is generated by applying an encryption algorithm and an encryption key to the data in motion hosted on a known computer in the computer system; and A method comprising:

16. hosting the encryption algorithm on a single computer within the computer system; hosting the keys associated with the encryption algorithms on different computers within the computer system; deriving different levels of security from the algorithm on additional algorithms hosted on a computer in the computer system; deriving different levels of security from different keys on additional keys hosting computers within said computer system; 16. The method of claim 15, comprising:

17. correlating the relationship of a level of a computer at one location to the same level of a computer at a different location; connecting by public fiber and routing of the Internet, where only correlated levels can communicate with each other; The method of claim 15 further comprising:

18. 16. The method of claim 15 further comprising the step of an even numbered module controlling the address of a central module.

19. 20. The method of claim 18, wherein the even-numbered modules prevent unwanted access to the address of the central module.

20. 16. The method of claim 15, wherein bracketing the encryption / decryption computer among unknown, non-discoverable, non-addressable invisible computers creates the basis for private intranet encryption / decryption.

Images