Method, system, and program for implementing resource scaling for cryptographic communications

Abstract

A resource scaling implementation method for cryptographic communications is provided. Based on a determination that constraints of a cryptographic function associated with an encrypted message do not include a mandatory cryptographic computational resource requirement, a first resource scaling operation is performed that includes an analysis of a cryptographic metric associated with a processor. The cryptographic metric includes information associated with the encrypted message along with performance measurements of cryptographic functions performed by the processor. The cryptographic function constraints and cryptographic metric analysis results are used to determine cryptographic processing requirements of the encrypted message and to match the cryptographic processing requirements to selected cryptographic computational resources of a set of cryptographic computational resources to identify a customized set of cryptographic computational resources that match the cryptographic processing requirements of the encrypted message. The customized set of cryptographic computational resources is used to perform the customized cryptographic function on the encrypted message.

Description

[Technical Field]

[0001] The present invention relates generally to programmable computer systems and, more particularly, to computer systems, computer-implemented methods, and computer program products for automatically matching and scaling cryptographic computational resources to anticipated and / or required requirements for decrypting encrypted communications, including encrypted connection requests, such as, for example, hypertext transfer protocol secure (HTTPS) messages. [Background technology]

[0002] HTTPS is a secure version of HTTP and is the primary protocol used to transmit data between web browsers and website servers. HTTP is encrypted to improve the security of data transmission. This encryption is especially important when users transmit sensitive data, such as when logging into a financial account, email service, or health insurance company website. HTTPS encrypts communications using a cryptographic protocol. This protocol is known as transport layer security (TLS) and was formerly known as secure sockets layer (SSL). The TLS (or SSL) protocol secures communications by using what is known as an asymmetric public key infrastructure. This type of security system uses two different keys: a private key and a public key. The private key is controlled and kept secret by the website owner. The private key resides on the web server and is used to decrypt information encrypted with the public key. The public key is available to anyone who wants to interact with the server securely. Information encrypted with the public key can only be decrypted with the private key.

[0003] Sensitive application data can be sealed by secure enclaves on worker nodes. A secure enclave is an isolated, trusted region of memory where critical aspects of application functionality are protected, helping to keep sensitive application data unaltered and confidential. In other words, a secure enclave is an encrypted portion of main memory. Secure enclaves are hardened by processor-based security mechanisms. The security of tagging sealed cryptographic keys derived from a specific machine's hardware (e.g., the worker node's processor chip) is highly secure.

[0004] The operational performance of a computer system's computer processing units (CPUs) can be degraded depending on the amount and nature of the processing tasks the CPU must perform. Cryptographic acceleration and coprocessors attempt to improve hardware performance by assisting the CPU with required tasks. Cryptographic acceleration is a software-based tool that attempts to accelerate overall system performance by providing additional hardware, such as a coprocessor, that allows cryptographic algorithms to perform cryptographic operations (or functions) separately from the CPU processing core, thereby freeing the CPU processing core to focus on other functions and operations. A coprocessor is an auxiliary processor in that it is configured to take over the execution of selected processor-intensive tasks of an associated CPU, allowing the CPU to focus its computing resources on tasks that are essential to the overall system.

[0005] Known cryptographic accelerators and coprocessors do not address the efficiency of cryptographic operations. For example, web servers typically utilize open-source software (e.g., OpenSSL®) to perform HTTPS decryption due to performance and key protection considerations. Suitable open-source software (OSS) may include an engine that distributes or routes encrypted connection requests received by the web server to a determined cryptographic computing resource. However, the determined cryptographic computing resource may not be specifically aligned with (or match) the cryptographic operations required by the encrypted connection request. For example, under certain conditions, the appropriate cryptographic processing for an encrypted connection request must be performed in a high-security computing resource (e.g., a cloud hardware security module (HSM)), while under other conditions, the appropriate cryptographic processing for an encrypted connection request does not need to be performed in a high-security computing resource.

[0006] Thus, known techniques for performing cryptographic operations do not improve the efficiency of such cryptographic operations and result in wasteful and inefficient overuse of cryptographic computational resources, including particularly high-security cryptographic computational resources. Summary of the Invention

[0007] An embodiment of the present invention includes a computer-implemented method using a processor system to access an operation policy (OP) for resource-scaling (RS) data associated with an encrypted message, the OP defining cryptographic operation constraints. Based at least in part on a determination that the cryptographic operation constraints do not include mandatory cryptographic computational resource requirements, a first resource scaling operation is performed, including performing an analysis of cryptographic metrics associated with the processor system. The cryptographic metrics include information associated with the encrypted message along with performance measurements resulting from cryptographic operations performed by the processor system. The results of the analysis of the cryptographic operation constraints and cryptographic metrics are used to determine cryptographic processing requirements for the encrypted message and are further used to match the determined cryptographic processing requirements to selected cryptographic computational resources from a set of available cryptographic computational resources, thereby identifying or selecting a customized set of cryptographic computational resources that match the cryptographic processing requirements of the encrypted message. The customized set of cryptographic computational resources is used to perform the customized cryptographic operation on the encrypted message.

[0008] Technical advantages provided by the aforementioned embodiments of the present invention include splitting out all mandatory cryptographic resource requirements and ensuring that mandatory requirements are applied appropriately, since mandatory requirements typically apply to encrypted messages with higher security levels that require more secure cryptographic resources. By splitting out messages with mandatory cryptographic resource requirements, the remaining message types can be more efficiently matched to the cryptographic computational resources required by those messages. By using both cryptographic constraints and cryptographic metrics to match the remaining message types to the cryptographic computational resources required by those messages, the actual historical performance of cryptographic hardware can be leveraged to improve this matching operation.

[0009] The foregoing embodiments of the present invention may further include configuring the open source cryptographic software to receive a request to perform a cryptographic operation on an encrypted message and to route the request to a processor system instead of performing the request.

[0010] Technical advantages provided by the foregoing embodiments of the present invention include allowing existing open source software to be efficiently modified to incorporate features and functionality of various embodiments of the present invention.

[0011] The foregoing embodiments of the present invention may further include having the first resource scaling operation include capturing a first set of updated cryptographic metrics resulting from performing the customized cryptographic operation on the encrypted message using the customized set of cryptographic computational resources, and updating the cryptographic metrics using the first set of updated cryptographic metrics.

[0012] Technical advantages provided by the aforementioned embodiments of the present invention include enabling a computer-implemented method to accumulate data from each iteration of the computer-implemented method and using the accumulated data to improve subsequent iterations of the computer-implemented method.

[0013] Embodiments of the present invention also provide a computer system and a computer program product for having substantially the same features as the computer-implemented methods described above.

[0014] Additional features and advantages are realized through the techniques of the present invention. Other embodiments and aspects of the invention are described in detail herein and are considered a part of the claimed invention. For a better understanding of the present invention, together with its advantages and features, reference is made to the description and drawings.

[0015] The subject matter which is regarded as the invention is particularly pointed out and distinctly claimed in the claims at the conclusion of this specification. The foregoing and other features and advantages of the invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0016] [Figure 1] 1 illustrates a communication system embodying aspects of the present invention; [Figure 2] FIG. 1 is a flow diagram illustrating a computer-implemented method embodying aspects of the present invention. [Figure 3] FIG. 1 illustrates a communication system architecture embodying aspects of the present invention. [Figure 4] FIG. 1 illustrates a system embodying aspects of the present invention. [Figure 5] 1 is a diagram illustrating a data field of a resource-scaling envelope (RS-EVP) data extension in accordance with an embodiment of the present invention. [Figure 6] 1 illustrates both a system and a method in accordance with an aspect of the present invention. [Figure 7] 1 illustrates both a system and a method in accordance with an aspect of the present invention. [Figure 8] FIG. 1 illustrates a machine learning system utilized to implement aspects of the present invention. [Figure 9] FIG. 9 illustrates the learning stages implemented by the machine learning system shown in FIG. 8. [Figure 10] FIG. 1 illustrates details of an exemplary computing system in which aspects of the present invention may be implemented. [Figure 11] FIG. 1 illustrates a cloud computing environment in accordance with an embodiment of the present invention. [Figure 12] FIG. 1 illustrates an abstract model layer according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0017] For purposes of brevity, prior art related to making and using embodiments of the present invention may or may not be described in detail herein. In particular, various aspects of computing systems and specific computer programs for implementing various technical features described herein are well known. Thus, for the sake of brevity, many conventional implementation details are only briefly described or omitted entirely herein, without providing details of well-known systems and / or processes.

[0018] Many of the functional units of the systems described herein are labeled as modules. Embodiments of the present invention apply to a wide variety of module implementations. For example, a module may be implemented as a hardware circuit comprising custom VLSI circuits or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. A module may also be implemented in programmable hardware devices such as field programmable gate arrays, programmable array logic, or programmable logic devices. A module may also be implemented in software for execution by various types of processors. For example, an identified module of executable code may include one or more physical or logical blocks of computer instructions organized, for example, as an object, procedure, or function. Nevertheless, the executable file of an identified module need not be physically located together and may include heterogeneous instructions stored in different locations that, when logically combined together, function as a module and achieve the module's specified purpose.

[0019] The various components, modules, sub-functions, etc. of the systems shown herein are shown separately for ease of illustration and description. In embodiments of the invention, the operations performed by the various components, modules, sub-functions, etc. may be distributed differently than shown, unless specifically stated otherwise, without departing from the scope of the various embodiments of the invention described herein.

[0020] For convenience, some of the technical functions and / or operations described herein are conveyed using informal terms. For example, a processor with data stored in a cache memory may be described as the processor "knowing" the data. Similarly, a user sending a data read command to a processor may be described as the user "instructing" the processor to read the data. It is understood that any such informal terms in this Detailed Description should be read to cover, and one skilled in the art will understand, the corresponding more formal technical description of, the informal terms.

[0021] Briefly outlining aspects of the present invention, embodiments of the present invention provide a computer system, computer-implemented method, and computer program product that receive an encrypted message and associated resource-scaling (RS) data, use RS constraints in the RS data to determine that the encrypted message does not have mandatory cryptographic processing requirements, determine a cryptographic metric derived from cryptographic operations performed by a processor system, use the RS constraints and the cryptographic metric to determine and / or predict non-mandatory cryptographic processing requirements for the encrypted message, use the determined and / or predicted cryptographic processing requirements to identify and / or select matching cryptographic computation resources and / or a customized set of cryptographic computation resources from a set of available cryptographic computation resources, and perform a customized cryptographic operation (e.g., customized decryption) on the encrypted message using the matching cryptographic computation resources and / or the customized set of cryptographic computation resources.

[0022] In embodiments of the present invention, a set of available cryptographic computational resources may be selected to match different types of cryptographic processing requirements expected for different types of encrypted messages to be transmitted. In accordance with aspects of the present invention, cryptographic computational resources that match a particular type of encrypted message are cryptographic computational resources that efficiently apply cryptographic operations to the particular type of encrypted message without wasting cryptographic computational resources. Thus, embodiments of the present invention may be used to match the predicted cryptographic processing requirements of an encrypted message to an adapted or customized subset of available cryptographic computational resources, thereby improving the efficiency of how the available cryptographic computational resources are applied. Thus, embodiments of the present invention perform cryptographic operations in novel ways that improve the efficiency of such cryptographic operations, resulting in a lean and efficient use of cryptographic computational resources, including particularly high-security cryptographic computational resources.

[0023] The foregoing and other aspects of the present invention are described herein as resource scaling (RS) capabilities. Some embodiments of the present invention may be implemented using an open-source container orchestration framework (OS-COF) that has been modified in accordance with aspects of the present invention to incorporate various new RS capabilities and / or features described herein, thereby forming a new RS-OS-COF that embodies aspects of the present invention. The new RS-OS-COF may be configured to include open-source software (e.g., OpenSSL software) and a cluster of interconnected physical and / or virtual computing nodes (i.e., machines) configured to provide automated deployment and management of containerized applications.

[0024] An RS-OS-COF cluster of nodes can include two types of nodes: a master node and one or more worker nodes. The master node is responsible for managing the worker nodes in the cluster. The master node is the entry point for all operations performed within the cluster, received, for example, from an application programming interface, user interface, or open-source software (OSS) interface. The worker nodes are responsible for running one or more workloads and networking with different workloads running on other worker nodes in the cluster. In accordance with an embodiment of the present invention, the master node of an RS-OS-COF cluster of nodes is modified to include RS functionality, thereby forming an RS-OS-COF working node.

[0025] The basic scheduling unit within an RS-OS-COF worker node is a container, such as a pod. Containers are co-located on worker nodes and share resources. Each container in RS-OS-COF is assigned a unique Container Internet Protocol address within a cluster of worker nodes, allowing applications to use ports without risk of conflict. A service is a set of containers in RS-OS-COF that work together, such as one tier of a multi-tier application.

[0026] The new RS-OS-COF can be configured to receive encrypted messages, which can take various forms, including, for example, HTTPS connection requests. An example of a suitable RS-OS-COF is the Kubernetes® open source platform, modified to incorporate various aspects of the new RS functionality described herein. In some aspects of the invention, an encrypted message is received at an RS-OS-COF node, which performs a cryptographic operation on the encrypted message and issues a request to the OSS to decrypt or unpackage the encrypted message and generate a decrypted or unpackaged message for downstream processing. In some embodiments of the invention, the OSS can be a modified commercially available OS-COF tool that has the capability to perform known cryptographic operations in a conventional (or known) manner, but that has been modified to route the cryptographic operation to a new RS Engine in an RS-OS-COF worker node based, at least in part, on receiving a request to perform the cryptographic operation on the encrypted message. In embodiments of the invention, the RS Engine is configured to provide a hardware implementation of the cryptographic operation in accordance with aspects of the invention. In some embodiments of the present invention, implementation of an RS engine and control of cryptographic algorithms and operations in accordance with aspects of the present invention provides improved performance over known cryptographic operations, and in particular results in lean and efficient use of cryptographic computational resources, including high-security cryptographic computational resources.

[0027] In an embodiment of the present invention, a new set (or stream) of RS data, including multiple fields, is associated with an encrypted message and received at the RS-OS-COF. The RS data includes at least one field defining an Operation Policy (OP), which includes multiple subfields defining cryptographic operation constraints to be applied or utilized by the RS engine when determining, predicting, estimating, or performing a combination thereof, the cryptographic processing requirements of the encrypted message. In addition, the RS engine is configured to generate and analyze cryptographic metrics associated with (and derived from) all cryptographic operations performed by the RS-OS-COF. In an embodiment of the present invention, the cryptographic metrics include information associated with the encrypted message along with performance measurements resulting from the cryptographic operations performed by the RS-OS-COF.

[0028] If the cryptographic operation constraints specify required cryptographic computational resources that must be applied to the encrypted message, the RS engine performs a set of non-predictive RS operations, and the RS engine does not need to perform any analysis to predict, determine, or infer the cryptographic processing requirements of the encrypted message, or any combination thereof. In a non-predictive RS operation, the specified required cryptographic computational resources are selected from among a set of available cryptographic computational resources and then used to apply the non-predictive cryptographic operations to the encrypted message.

[0029] If the cryptographic operation constraints do not specify the required cryptographic computational resources that must be applied to the encrypted message, the RS engine initiates a set of predictive RS operations configured to predict, determine, or estimate, or a combination thereof, the cryptographic processing requirements of the encrypted message using the operation policy constraints and the cryptographic metrics. In embodiments of the present invention, the predictive RS operations may include using the predicted cryptographic processing requirements to select a “customized” or “scaled” cryptographic computational resource from among a set of available cryptographic computational resources, and may further include applying a “selected,” “customized,” or “scaled” cryptographic operation to the encrypted message using the “selected,” “customized,” or “scaled” cryptographic computational resource, or a combination thereof. In accordance with embodiments of the present invention, the cryptographic operation constraints of the RS data are specific to the encrypted message with which the RS data is associated, and different encrypted messages may contain different RS data with different OPs.

[0030] In some embodiments of the present invention, some or all of the predictive RS operations may be performed using a configuration of modules that collect, dispatch, analyze, or manage data traffic passing through the RS engine, in the process of the RS engine identifying “selected,” “customized,” and / or “scaled” cryptographic computation resources that apply “selected,” “customized,” and / or “scaled” cryptographic operations to the encrypted message. In some embodiments of the present invention, the modules include a configuration of algorithm processing modules, resource management modules, and data traffic-related modules. In some embodiments of the present invention, the data traffic-related modules may include a traffic dispatcher module, a traffic analyzer module, and a traffic metrics collector module. In embodiments of the present invention, the traffic analyzer module is configured to analyze the encrypted message based at least in part on dispatch principles. Further details of how the configuration of modules operates to implement some or all of the predictive RS operations are described herein below.

[0031] In some embodiments of the present invention, some or all of the predictive RS operations may be performed using a first classifier trained to perform classification and / or prediction tasks using machine learning algorithms and models. In some embodiments of the present invention, the first classifier may be trained to perform the task of predicting non-essential cryptographic processing requirements of encrypted messages using cryptographic operation constraints and cryptographic metrics. In some embodiments of the present invention, some or all of the predictive RS operations may be performed using a second classifier trained to perform classification and / or prediction tasks using machine learning algorithms and models. In some embodiments of the present invention, the second classifier may be trained to perform the task of using the cryptographic processing requirements predicted by the first classifier, together with a description of the capabilities of a set of available cryptographic computing resources, to identify a customized set of cryptographic computing resources (selected from a set of available cryptographic computing resources) that matches or satisfies the predicted cryptographic processing requirements (without unduly wasting cryptographic computing resources).

[0032] In accordance with an aspect of the present invention, encrypted messages may be implemented as a Resource Scaling Envelope (RS-EVP) data extension. In OSS, an envelope is a symmetric key encrypted using a public key. Because encryption and decryption using a symmetric key is computationally expensive, messages are not directly encrypted using such a key; instead, they are encrypted using a symmetric "session" key, which is itself then encrypted using a public key. This combination of a symmetric session key encrypted using a public key is called an envelope in OSS.

[0033] Technical effects and advantages provided by the foregoing embodiments of the present invention described herein include splitting out all mandatory cryptographic resource requirements and ensuring that the mandatory requirements are applied appropriately, since mandatory cryptographic resource requirements typically apply to encrypted messages with higher security levels that require more secure cryptographic resources. By splitting out messages with mandatory cryptographic resource requirements, the remaining message types can be more efficiently matched to the cryptographic computational resources required by those messages. By using both cryptographic constraints and cryptographic metrics to match the remaining message types to the cryptographic computational resources required by those messages, the actual historical performance of the cryptographic hardware can be leveraged to improve this matching operation.

[0034] Technical effects and advantages provided by the embodiments of the present invention described herein further include allowing existing open source software to be efficiently modified to incorporate features and functionality of various embodiments of the present invention.

[0035] Technical effects and advantages provided by the embodiments of the present invention described herein further include enabling the computer-implemented method to accumulate data from each iteration of the computer-implemented method and using the accumulated data to improve subsequent iterations of the computer-implemented method.

[0036] Describing aspects of the present invention in more detail, FIG. 1 illustrates an RS-OS-COF system 100 in accordance with an embodiment of the present invention. As shown, system 100 includes an external entity 110 that communicates with an application pod 120 via a wired or wireless network connection 112. External entity 110 can be any communication element capable of transmitting encrypted messages, such as HTTPS messages 114 containing RS data 116, via network connection 112. In accordance with aspects of the present invention, application node 120 includes one or more nodes 130, at least one of which includes an RS engine 140. The node 130 is configured to utilize the OSS 160, the RS data 116, and the cryptographic indicators 170 to cognitively select one or more of a set of available cryptographic computation resources 180 (i.e., one or more of CCR-A 182A, CCR-B 182B, CCR-C 182C, and CCR-D 182D), apply a customized cryptographic operation to the HTTPS message 114 using the selected cryptographic computation resource(s) from the set of cryptographic computation resources 180 to generate a decrypted or unpacked HTTP message 131, and send the decrypted HTTP message 131 to the application container 150 for downstream processing.

[0037] FIG. 2 illustrates a computer-implemented method 200 according to an embodiment of the present invention. Method 200 is performed by RS-OS-COF system 100 (shown in FIG. 1). Where appropriate, the description of method 200 references corresponding elements of system 100 shown in FIG. 1. According to an embodiment of the present invention, method 200 begins at blocks 202 and 204, where application pod 120 receives an encrypted message (e.g., HTTPS message 114) (block 202) and RS engine 140 accesses RS data 116 associated with the received encrypted message (block 204). At block 206 of method 200, RS engine 140 extracts or accesses an operation policy (OP) from RS data 116, which defines OP constraints for performing cryptographic operations on the received encrypted message.

[0038] At decision block 208, the RS engine 140 determines whether the OP constraint defines or specifies that the encrypted message must be cryptographically processed using a particular CCR from CCRs 180. If the answer to the question at decision block 208 is yes, the method 200 moves to block 210, where the RS engine 140 selects a required CCR from CCRs 180 (e.g., CCR-D 182D) and performs a forced cryptographic operation on the encrypted message using the selected CCR from CCRs 180. The method 200 moves from block 210 to block 212, where the RS engine 140 develops cryptographic metrics (CM) from the performance of the forced cryptographic operation on the encrypted message. In accordance with an embodiment of the present invention, the CM developed in block 212 is added to the CM used in block 218 (not yet described). Accordingly, after multiple iterations of the method 200, the CM used in block 218 has accumulated throughout the multiple iterations of the method 200. From block 212, method 200 moves to decision block 214 to determine whether additional encrypted messages have been sent. If the answer to the question at decision block 214 is no, method 200 moves to block 216 and ends. If the answer to the question at decision block 214 is yes, method 200 returns to block 202 to receive the next encrypted message.

[0039] Returning to decision block 208, if the answer to the question at decision block 208 is "no," method 200 moves to block 216, where RS engine 140 accesses and analyzes the accumulated CM and / or OP constraints. At decision block 220, RS engine 140 uses the OP constraints and the results of the CM analysis (performed at decision block 220) to predict the cryptographic requirements of the encrypted message and attempts to match the predicted cryptographic requirements to a selected CCR from available CCRs 180.

[0040] According to some aspects of the present invention, the operation described in decision block 220 may be performed by configuring RS Engine 140 to perform a prediction of cryptographic requirements for encrypted messages and / or match the predicted cryptographic requirements to a selected CCR from available CCRs 180 using a configuration of modules that collect, dispatch, analyze, and / or manage data traffic passing through RS Engine 140. In some embodiments of the present invention, the configuration of modules includes a configuration of algorithm processing module 420 (shown in FIG. 4), a resource management module 430 (shown in FIG. 4), and modules related to data traffic. In some embodiments of the present invention, the modules related to data traffic may include a traffic dispatcher module 442 (shown in FIG. 4), a traffic analyzer module 446 (shown in FIG. 4), and a traffic metrics collector module 444 (shown in FIG. 4). In embodiments of the present invention, traffic analyzer module 446 is configured to analyze encrypted messages based at least in part on dispatching principle 446A (shown in FIG. 4). Further details of how the configuration of modules operates to perform some or all of the actions indicated in decision block 220 are described herein below.

[0041] According to aspects of the present invention, the operations described in decision block 220 may be performed by configuring RS engine 140 to use classifier 810 (shown in FIG. 8 ), including machine learning algorithm 812 (shown in FIG. 8 ) and model 816 (shown in FIG. 8 ), to make a prediction of the cryptographic requirements of an encrypted message, and / or match the predicted cryptographic requirements to a selected CCR from available CCRs 180. In some embodiments of the present invention, decision block 220 may be implemented by training a first classifier to perform the task of predicting non-essential cryptographic processing requirements of an encrypted message using the cryptographic operation constraints and cryptographic metrics. A second classifier may be trained to use the cryptographic processing requirements predicted by the first classifier, together with a description of the capabilities of a set of available cryptographic computing resources, to identify a customized set of cryptographic computing resources (selected from a set of available cryptographic computing resources) that matches or satisfies the predicted cryptographic processing requirements (without excessively wasting cryptographic computing resources). Further details of how the classifier 810 is trained and used to perform the predictive and / or classification operations utilized to perform the operations defined in decision block 220 are described herein below.

[0042] If the answer to the question at decision block 220 is "no," the method 200 moves to block 226, where the RS engine 140 selects a default set of CCRs 180 (e.g., all non-mandatory CCRs among the CCRs 180) and performs default cryptographic operations on the encrypted message using the default set of CCRs 180. The method 200 moves from block 226 to block 212, where the RS engine 140 develops a cryptographic metric (CM) from performing the default cryptographic operations on the encrypted message at block 226. In accordance with an embodiment of the present invention, the CM developed at block 212 is added to the CM used at block 218. Accordingly, after multiple iterations of the method 200, the CM used at block 218 has accumulated throughout the multiple iterations of the method 200. The method 200 moves from block 212 to decision block 214 to determine whether additional encrypted messages are being sent. If the answer to the question at decision block 214 is "no," then method 200 moves to block 216 and ends. If the answer to the question at decision block 214 is "yes," then method 200 returns to block 202 to receive the next encrypted message.

[0043] Returning to decision block 220, if the answer to the query at decision block 220 is yes, the method 200 moves to block 222 where the RS engine 140 performs a cryptographic operation on the encrypted message using the matched or scaled CCR of the CCR 180 identified at decision block 220. The method 200 moves from block 222 to block 224 where the RS engine 140 develops a CM from performing the matched and / or scaled cryptographic operation on the encrypted message. In accordance with an embodiment of the present invention, the CM developed in block 224 is added to the CM used in block 218. The method 200 moves from block 224 to decision block 214 to determine whether additional encrypted messages are being sent. If the answer to the query at decision block 214 is no, the method 200 moves to block 216 and ends. If the answer to the question at decision block 214 is yes, then the method 200 returns to block 202 to receive the next encrypted message.

[0044] FIG. 3 illustrates an RS-OS-COF system 100A in accordance with an embodiment of the present invention. System 100A leverages the functional principles of system 100 (shown in FIG. 1). However, system 100A provides additional details of how the functional principles illustrated in system 100 are applied within a particular computing environment. As shown in FIG. 3, system 100A includes an external entity (not shown) that wirelessly communicates with node cluster 130A and set of cryptographic computation resources (CCRs) 180A via antenna 302. The external entity can be any communication element capable of transmitting encrypted messages, such as HTTPS messages 114 containing RS data 116, via a wireless communication path to antenna 302, in accordance with an embodiment of the present invention. Node cluster 130A includes a master node 132A and multiple worker nodes 132B, 132C, and 132D configured and arranged as shown. Master node 132A includes an application pod that houses a web server and application programs. The web server of the master node 132A may be implemented as an open-source HAProxy (High Availability Proxy) server 310. The HAProxy server 310 is configured to receive HTTPS messages 114 containing RS data 116. The application program of the master node 132A includes an RS engine 312. The worker nodes 132B and 132C each include an application pod and application program configured and arranged as shown to perform specific tasks for the node cluster 130A under the control and direction of the master node 132A. The worker node 132D is specifically designed to support resource scaling operations performed by the master node 132A in accordance with an embodiment of the present invention. More specifically, the worker node 132D includes an application pod 322 containing a cryptographic computation resource (CCR) application program 320 configured to support resource scaling operations (e.g., method 200 shown in FIG. 2) performed by the RS engine 312.CCR 320 includes cryptographic resources that may be accessed and scaled in accordance with embodiments of the present invention, and illustrates that any resource may be utilized and scaled using various embodiments of the present invention.

[0045] The node cluster 130A is communicatively coupled to a set of cryptographic computation resources (CCRs) 180A. In accordance with an embodiment of the present invention, the RS engine 312 and the CCR application program 320 are configured and arranged to evaluate instructions in the RS data 116 and analyze cryptographic metrics collected by the node cluster 130A to identify and select a combination of CCRs 180A, which may be any combination of a cloud hardware security module (HSM) 360, a database as a service (DBaaS) 362, a cryptographic express card 364, a central processor assist for cryptographic function (CPACF) coprocessor 366, and additional CCRs 368. The selected combination of CCRs 180A is customized for the specific cryptographic processing needs of the HTTPS message 114, as determined by the RS engine 312 and the CCR application program 320.

[0046] In an embodiment of the present invention, Cloud HSM 360 is a dedicated cryptographic processor designed for protecting the lifecycle of cryptographic keys. Cloud HSM 360 is configured to generate, process, and store keys. Cloud HSM 360 can be used to build a user's own public key infrastructure for processing applications and signature activities. Cloud HSM 360 protects the user's cryptographic infrastructure by securely managing, processing, and storing cryptographic keys within a hardened, tamper-resistant device. In an embodiment of the present invention, DBaaS instance 362 is a key component of the secondary service model of cloud computing and anything as a service (XaaS), which represents a general category of services related to cloud computing and remote access. XaaS recognizes the numerous products, tools, and technologies currently delivered to users as a service over the Internet. Essentially, DBaaS instance 362 is a managed service configured to provide access to databases used with applications and their associated data, a more structured approach compared to storage as a service (STaaS). The DBaaS instance 362 may also include a database manager component that controls all the underlying database instances through an API that is accessible by users through an administration console, typically a web application, that allows users to manage and configure the databases and even provision and de-provision database instances.

[0047] In an embodiment of the present invention, Crypto Express card 364 is an I / O-connected card that implements additional cryptographic functions. Crypto Express card 364 is a coprocessor and can support a wide range of callable services, including secure and clear key support for PKA decryption, digital signature verification, and digital signature generation (including RSA and ECC variants). Alternatively, Crypto Express card 364 can be configured as an accelerator to achieve better throughput at the expense of supporting fewer services. In an embodiment of the present invention, central processor assist for cryptographic function (CPACF) coprocessor 366 is a coprocessor that performs symmetric key encryption and calculates message digests using DES, TDES, AES-128, AES-256, SHA-1, and SHA-256 ciphers in hardware. DES, TDES, AES-128, and AES-256 are used for symmetric key encryption. SHA-1 and SHA-256 are used for message digests. In an embodiment of the present invention, additional CCR 368 may include any other CCR used to efficiently apply a cryptographic operation to the type of HTTPS message sent as HTTPS message 114 .

[0048] 4-7 illustrate various aspects of the RS-OS-COF architecture 100B in accordance with an embodiment of the present invention. Before describing the details of the RS-OS-COF architecture, definitions and explanations of some terms used in FIGS. 4-7 are provided. The term “traffic” represents data movement associated with the execution of cryptographic operations, including cryptographic requests to the cryptographic computation resource (CCR) 180A and cryptographic responses returned from the cryptographic computation resource (CCR) 180A. “Response time” may be the duration for which each cryptographic operation is processed. “Success / Failure” is the result of the cryptographic operation currently being processed. “Success” indicates that the cryptographic operation is error-free and the cryptographic computation resource (CCR) 180A returns a “success” response. The cryptographic traffic indicators 462 include indicators and logs generated while the cryptographic operation is being processed. The cryptographic traffic indicators 462 include “response time,” “success / failure,” etc.

[0049] A cryptographic resource pattern is a collection of "tenant profile," "constraints," "cost," "control interface," and "capability interface." The cryptographic resource pattern is the input for the traffic analyzer 446 for analysis. "Static" refers to the type of "tenant profile," "constraints," "cost," "control interface," and "capability interface." These do not change frequently. A "tenant profile" contains general information about the resources owned by a tenant. "Constraint" has the same meaning as conformance and refers to security standards such as FIPS140. "Cost" refers to pricing, such as cost per algorithm, cost per CPU / memory / machine / disk / crypto card, and cost per throughput. A "resource control interface" 431 controls resources using a set of methods, such as resource expansion and resource contraction. The "resource control interface" 431 can be used to increase or decrease resources in the system. A "capability interface" 432 includes cryptographic methods and persistence methods. A cryptographic method is a cryptographic algorithm used to perform encryption, decryption, signing, verification, etc. The encryption method includes, but is not limited to, EC, RSA, DH, Ciphers, Hash, and the like.

[0050] The resource metrics collector 436 collects metrics and logs from cryptographic computing resources while they are running. "Dynamic" refers to dynamic metrics and log data generated while the resources are running, including "current traffic workload," "historical data and trends," and "stability and reliability." "Current traffic workload" refers to metrics and logs of the workload of a cryptographic computing resource. The resource workload can be, for example, idle, normal, and overloaded. "Historical data and trends" refers to metrics and logs of the past traffic workload of a cryptographic resource. "Stability and reliability" refers to metrics and logs used to evaluate the stability and / or reliability of a cryptographic computing resource. If a resource is frequently out of service, its stability and reliability are poor. All of the above generate metrics and logs while the resource is running, and these metrics and logs can be collected by the resource metrics collector 436.

[0051] The "module" referenced in the term "different computing modules" represents one of the cryptographic computing resources (CCRs) 180A. The "cost model" is a description related to pricing. For example, the traffic dispatcher 442 may dispatch a cryptographic operation to one of the cryptographic computing resources (CCRs) 180A with a lower cost (e.g., a customer).

[0052] The dispatch policy 466A is used by the traffic dispatcher module 442 to dispatch traffic to the optimal cryptographic computation resource 320, 180A. The dispatch policy 466A consists of an "inversion threshold," "precondition-based priority," "per-algorithm cost," "response time," and "suitability resource." As the workload increases, the performance of the cryptographic computation resource may suddenly degrade when throughput reaches a certain threshold. The "inversion threshold" refers to that threshold. The "precondition-based priority" refers to a condition that must be met before other algorithms can be executed. For example, as shown in Figure 5, CIPHER 510A represents a set of symmetric encryption / decryption algorithms, such as AES and DES. HASH 510B represents a set of hash algorithms, such as SHA and MD5. Other algorithms include asymmetric encryption algorithms. In some situations, Algorithm 1 depends on Algorithm 2. For example, Algorithm 1 may require the output from Algorithm 3 as input. In this situation, Algorithm 2 is Algorithm 1's PRE-CONDITION 510. "Cost per algorithm" refers to the cost (or price) per cryptographic operation in a cryptographic computing resource. "Response time" refers to the duration of one cryptographic operation being processed in a cryptographic computing resource. "Compliant resource" refers to a situation where a cryptographic operation has compatibility requirements and should be delivered to a compatibility-certified cryptographic computing resource.

[0053] The term "cost" refers to pricing, such as cost per algorithm, cost per CPU / memory / machine / disk / crypto card, or cost per throughput, or a combination thereof. "Cost model" refers to pricing choices, such as economic preferences that can influence the traffic dispatcher 442 to dispatch traffic to a target cryptographic computation resource that has a lower price than other cryptographic computation resources. "Enterprise" preferences can influence the traffic dispatcher 442 to dispatch traffic to a target cryptographic computation resource that may have a higher price but a faster response time.

[0054] The algorithm processing module 420 and registration module 422 have the following purposes: When cryptographic operations (e.g., cryptographic requests) come in with EVP data, the algorithm processing module 420 attaches an RS-EVP data extension 450 to each cryptographic operation and then sends the cryptographic operations to the traffic analyzer 446. The registration module 422 is an existing module in OpenSSL and can be used to register an OpenSSL Engine with OpenSSL.

[0055] A "compliance module" referenced in SAFETY-SENSITIVE512 can be a module that meets security compliance. For example, IBM Cloud® Hyper Protect Crypto Services is a FIPS 140-2 Level 4 validated hardware security module.

[0056] The "real-time requirements" referenced in REAL_TIME 514 may be the time requirements of a cryptographic operation. A cryptographic operation has time requirements to be processed within a short period of time. For example, a cryptographic operation may have real-time requirements that require completion of processing and receipt of a response message within 100 milliseconds.

[0057] I / O 516 can be a cryptographic computational resource that can store persistent data, such as keys. I / O 516 is intended to highlight the ability to maintain persistent data. I / O 516 can be a database 471 or a cloud HSM 475 in RESOURCES 518. However, not all RESOURCES 518 have the ability to maintain persistent data.

[0058] The EVP request is an envelope request sent from OpenSSL to engine 312A. The EVP data contains the parameters and functions for one algorithm. The RS-EVP data extension 450 is an extension of the EVP request.

[0059] The resource control interface 431 consists of a set of methods for controlling cryptographic computation resources, such as expanding resources and shrinking resources. The resource control interface 431 can be used to increase / decrease resources within a system. In cloud computing, cloud scalability refers to the ability to increase or decrease IT resources as needed to meet changing demands. "Scaling" refers to adding resources within a system. "Shrinking" refers to removing resources from a system.

[0060] The capabilities interface 432 includes cryptographic methods and persistence methods. Cryptographic methods are cryptographic algorithms used to perform encryption, decryption, signing, verification, etc. Cryptographic methods include, but are not limited to, EC, RSA, DH, Ciphers, Hash, etc. Persistence methods are load / store related methods that may be used to persist data on hardware. Persistence methods include, but are not limited to, key load / store.

[0061] The information interface 433 includes a set of methods for collecting information about the tenant profile, constraint information, and cost information of resources. "Tenant profile" includes general information about the cryptographic computing resources owned by the tenant. "Constraint" has the same meaning as conformance and refers to some security standard such as FIPS 140-2. "Cost" refers to pricing, such as cost per algorithm, cost per CPU / memory / machine / disk / crypto card, or cost per throughput, or a combination thereof.

[0062] The discovery module 434 collects registration information from the resource control interface 431 , the capability interface 432 , and the information interface 433 , registers it in the register of the module 434 , and then delivers this information to the pusher 435 .

[0063] The pusher 435 collects static data from the discovery module 434 and dynamic data from the resource indicator collector 436, then pushes these data to the traffic analyzer 446 for analysis. The static data includes data from the resource control interface 431, the capability interface 432, and the information interface 433. The dynamic data includes current traffic workload, historical data and trends, and stability and reliability data.

[0064] The resource metrics collector 436 collects metrics and logs from these sources while the cryptographic computing resources are running. "Current traffic workload" refers to metrics and logs of the workload of the cryptographic computing resources. The workload of the cryptographic computing resources can be idle, normal, and overloaded. "Historical data and trends" refers to metrics and logs of the past traffic workload of the cryptographic computing resources. "Stability and reliability" refers to metrics and logs used to evaluate the stability and / or reliability of the cryptographic computing resources. If the resource is frequently out of service, the stability and reliability are poor. All of the above generate metrics and logs while the resources are running, and these metrics and logs can be collected by the resource metrics collector 436.

[0065] Referring now to Figures 4-7 in more detail, Figure 4 is a block diagram illustrating an RS-OS-COF architecture 100B in accordance with an embodiment of the present invention. Architecture 100B includes and leverages the functional principles of system 100 (shown in Figure 1) and system 100A (shown in Figure 3). However, architecture 100B provides additional details of how the functional principles illustrated in systems 100 and 100A are applied within a particular computing environment. As shown in Figure 4, moving from top to bottom, the first tier of architecture 100B includes various web servers used to receive HTTPS messages 114 containing RS data 116. The first tier may include an Nginx® web server 410, an HAProxy web server 310A, SSL utilities 412, and support for additional web servers 414. The second tier of architecture 100B includes a set of OSS elements 160A, corresponding to OSS 160 (shown in Figure 1). The OSS element 160A includes various algorithms (e.g., ECDHE (Ephemeral Elliptic Curve Diffie-Hellman), EC key generation, etc.) configured and arranged to perform encryption and decryption operations.

[0066] The third layer of architecture 100B includes an RS engine 312A, a resource management module 430, a traffic dispatcher module 442, a traffic analyzer module 446, and a traffic metrics collector module 444, configured and arranged as shown. The RS engine 312A includes an algorithm processing module 420 and a registration module 422. The fourth layer of architecture 100B includes a set of cryptographic computation resources (CCRs) 180B, which may include a database 471, a file system 472, a host CPU 473, a container CPU 474, a cloud HSM 475, a crypto card 476, a crypto coprocessor 477, and an additional CCR 368. The database 471 and the file system 472 are CCRs used to store keys. The cloud HSM 475, the crypto card 476, and the crypto coprocessor 477 are hardware CCRs used to perform cryptographic operations (e.g., encryption / decryption). The host CPU 473 and the container CPU 474 are CPU resources used for cryptographic operations (e.g., encryption / decryption). The cloud HSM 475 is essentially a cryptographic card located in the cloud (e.g., the cloud computing system 50 shown in FIG. 11). FIG. 4 also shows the resource scaling envelope (RS-EVP) data extension 450 along with the cryptographic metrics 160. The cryptographic metrics 160 include a cryptographic traffic metric 462, a cryptographic computational resource pattern data 464, and a cryptographic computational resource metric 466.

[0067] The RS-EVP data extension 450 includes operational policies that express constraints on how the RS engine 312A processes the HTTP message 114 and the RS-EVP data extension 450 within the OpenSSL envelope of the OSS element 160A. The cryptographic traffic metrics include response times, success stories, failure stories, and other metrics related to data traffic passing through the architecture 100B when performing cryptographic operations. The cryptographic computational resource pattern 464 is static data that defines various parameters, including, for example, tenant profiles, constraints, costs, control interfaces, and capability interfaces. The cryptographic computational resource metrics 466 are dynamic data that define various dynamically changing data, such as current traffic, workload, historical data, historical trends, stability, and reliability.

[0068] The resource management module 430 is used to scale the CCR module 180B according to a traffic model, a cost model, or both. The traffic dispatcher 442 sends traffic to different computing modules according to a cost model. The traffic metrics collector module collects traffic metrics generated by the architecture 100B based on which the architecture performs the resource scaling operations described herein (e.g., method 200 shown in FIG. 2). The traffic analyzer module 446 analyzes encrypted messages (e.g., HTTPS messages 114) based on dispatch policies that define policies such as inversion thresholds, precondition-based priorities, per-algorithm costs, response times, and resource suitability. The traffic dispatcher 442, traffic metrics collector 444, traffic analyzer 446, and resource management 430 reside in the master node 132A. In some embodiments of the present invention, elements may reside in the RS engine 312 or may be in the same tier as the RS engine 312 from an architectural perspective.

[0069]

[0070]

[0033] Figure 5 illustrates a block diagram of an RS-EVP data extension 450A in accordance with an embodiment of the present invention. While RS-EVP data extension 450A corresponds to RS-EVP data extension 450 (shown in Figure 4), RS-EVP data extension 450A provides additional details of how fields defining operational policies and operational policy constraints are implemented in some embodiments of the present invention. As shown in Figure 5, RS-EVP data extension 450A includes multiple fields, including OPT_POLICY 451 (operation policy), EC_GROUP 452 (curve-related information), EC_POINT 453 (calculated point within the curve), BIGNUM 454 (base point within the curve, i.e., private key), POINT_CONV_FORM 455 (for encoding of elliptic curve points), and additional field 456.

[0071] OPT_POLICY 451 defines operational policy constraints 502. Operational policy constraints 502 include PRE-CONDITION 510 (conditions that must be met before other algorithms are executed), SAFETY_SENSITIVE 512 (must be processed by a conformance module), REAL_TIME 514 (HTTPS message 114 has real-time requirements), I / O 516 (persistent requirements and target devices), and RESOURCES 518 (enforces the CCR that must be used to perform cryptographic operations on HTTPS message 114). CIPHER 510A, HASH 510B, and additional preconditions 510C are examples of what PRE-CONDITION 510 can define. Encryption / decryption hardware 516A, crypto coprocessor 477, cloud HSM 475, CPACF coprocessor 366, database 471, and additional CCR 368 are examples of required CCRs that may be invoked by I / O 516 and / or RESOURCES 518. As described in more detail later herein, when I / O 516 and RESOURCES 518 identify a required CCR, traffic analyzer 446 sends HTTPS message 114 to traffic dispatcher 442 for dispatching to the target CCR. If I / O 516 and RESOURCES 518 do not identify a required CCR, traffic analyzer 446 evaluates HTTPS message 114, OPT_POLICY 451, and cryptographic metrics 460 to predict and / or determine cryptographic requirements for HTTPS message 114, and then recommends CCR combination 180A that matches the predicted and / or determined cryptographic requirements of HTTPS message 114.

[0072] FIG. 6 illustrates both architecture 100B and a method 602 performed by architecture 100B in accordance with an embodiment of the present invention. Generally, traffic metrics collector 444 collects and transmits cryptographic traffic metrics 462 to traffic analyzer 446, which generates cryptographic computation resource patterns 462 and instructs traffic dispatcher 442 to dispatch traffic to different computing modules. The cryptographic traffic metrics 444 include user-level metrics representing associated user-level cryptographic requests, performance metrics representing the performance of HTTPS messages 114 (e.g., response time, CPU usage, memory cost, network usage, etc.), accessed resource security level metrics representing the security level of the accessed resource, success / failure metrics representing the historical success rate of cryptographic services, and access frequency metrics representing the access frequency of cryptographic services. Traffic dispatcher 442 then sends traffic to different computing modules according to a cost model guided by traffic analyzer 446.

[0073] Inputs to the cryptographic traffic analyzer 446 include cryptographic traffic metrics from the cryptographic traffic metrics collector 444, RS-EVP data extensions 450, 450A from the algorithm processing module 420, and cryptographic computation resource patterns / metrics from the resource management module 430. Outputs of the cryptographic traffic analyzer 446 include dispatch policies that include inversion thresholds, precondition-based priorities, cost per algorithm invocation, response time, and resource suitability.

[0074] Method 602 will now be described in the context of how steps S1-S7 can proceed in a first example. At S1, algorithm processing module 420 sends an ECDHE request along with RS-EVP data extension 450A to traffic analyzer 446. The value of I / O 516 in RS-EVP data extension 450A is "non-persistent." The value of RESOURCES 518 variable in RS-EVP data extension 450A is fixed container CPU 474. At S2, traffic analyzer module 446 receives this request generated at S1 and detects that the resource contains the required resource; therefore, no further analysis needs to be performed; the request is simply sent to traffic dispatcher module 442. At S3, traffic dispatcher module 442 dispatches the request to container CPU 474 of CCR 180B. At S4, the traffic metrics collector module 444 collects cryptographic metrics 160, including performance metrics, success rate metrics, access frequency metrics, etc., of the container CPU 474. At S5, the traffic metrics collector 444 pushes the collected cryptographic metrics to the traffic analyzer 446. At S6, the resource management module 430 pushes cryptographic metrics 160 related to the performance of cryptographic operations by the container CPU 474 to the traffic analyzer 446. At S7, the traffic analyzer 446 generates a dispatch policy 446A based on inputs from S1, S4, and S6 and uses the dispatch policy 446A to dispatch further cryptographic requests. The traffic analyzer 446 utilizes an interface provided by the resource management module 430 to scale the CCR 180B and / or reduce it to match the cryptographic operations required by the HTTPS message 114.

[0075] Method 602 will now be described in the context of how steps S1-S7 can proceed in a second example. At S1, algorithm processing module 420 sends an EC key generation request along with RS-EVP data extension 450A to traffic analyzer 446. The value of I / O 516 in RS-EVP data extension 450A is "persistent." The value of RESOURCES 518 variable in RS-EVP data extension 450A is fixed cloud HSM 475. At S2, traffic analyzer module 446 receives this request generated at S1 and detects that the resource contains the required resource, so no further analysis needs to be performed and the request is simply sent to traffic dispatcher module 442. At S3, traffic dispatcher module 442 dispatches the request to cloud HSM 475 of CCR 180B. At S4, traffic metrics collector module 444 collects cryptographic metrics 160 information, including cloud HSM 475 performance metrics, success rate metrics, access frequency metrics, etc. At S5, traffic metrics collector 444 pushes the collected cryptographic metrics to traffic analyzer 446. At S6, resource management module 430 pushes cryptographic metrics 160 related to the performance of cryptographic operations by cloud HSM 475 to traffic analyzer 446. At S7, traffic analyzer 446 generates dispatch policy 446A based on input from S1, S4, and S6 and uses dispatch policy 446A to dispatch further cryptographic requests. Traffic analyzer 446 utilizes an interface provided by resource management module 430 to scale CCR 180B and / or reduce it to match the cryptographic operations required by HTTPS message 114.

[0076] 7 illustrates a diagram depicting both a subset of architecture 100B and a method 702 performed by architecture 100B in accordance with an aspect of the present invention. More particularly, FIG. 7 illustrates resource management module 430A and provides further details regarding how resource management module 430 (shown in FIG. 7) is implemented in accordance with an embodiment of the present invention. As shown in the figure, resource management module 430A includes resource control interface 431, capability interface 432, information interface 433, discovery module 434, pusher 435, and resource indicator collector 436, configured and arranged as shown in the figure.

[0077] Method 702 will now be described with reference to how steps S11-S15 are performed by the portion of architecture 100B shown in FIG. 7. At S11, within resource management module 430A, discovery module 434 receives data and information from resource control interface 431 (scaling, scaling), capability interface 432 (encryption method, persistence method), and information interface 433 (tenant profile, constraints, cost). Encryption methods include EC, RSA, DH, Ciphers, Hash, etc. Information interface 433 retrieves resource-related information regarding tenant profile, constraints, cost, etc. using so-called "retrieval" methods. At S12, resource metrics collector 436 collects current traffic workload, historical data, historical trends, and dynamic metrics regarding stability and reliability. At S13, pusher 435 receives input from resource metrics collector 436 resulting from execution of S12. At S13', the pusher 435 receives input from the discovery module 434 and the resource index collector 436 resulting from execution of S11. At S14, the pusher 435 pushes the cryptographic computation resource pattern 464 and the cryptographic computation resource index 466 to the traffic analyzer module 446. The cryptographic computation resource pattern 464 is pushed statically once. The cryptographic computation resource index 466 is pushed dynamically periodically. At S15, the traffic analyzer 466 utilizes the resource control interface 431 to scale the CCR 180B and / or reduce it to match the cryptographic operations required by the HTTPS message 114.

[0078] Further details of machine learning techniques used to implement aspects of the present invention disclosed herein are now provided. Various predictive and / or decision functions of the processors described herein may be implemented using machine learning and / or natural language processing techniques. Generally, machine learning techniques are performed on so-called "neural networks," which are implemented as programmable computers configured to execute a set of machine learning and / or natural language processing algorithms. Neural networks incorporate knowledge from a variety of disciplines, including neurophysiology, cognitive science / psychology, physics (statistical mechanics), control theory, computer science, artificial intelligence, statistics / mathematics, pattern recognition, computer vision, parallel processing, and hardware (e.g., digital / analog / VLSI / optical).

[0079] The fundamental function of neural networks and their machine learning algorithms is to recognize patterns by interpreting unstructured sensor data through a type of machine perception. Unstructured real-world data in its native form (e.g., images, audio, text, or time series data) is converted into a numerical form (e.g., vectors with magnitude and direction) that can be understood and manipulated by a computer. Machine learning algorithms perform multiple iterations of learning-based analysis on real-world data vectors until patterns (or relationships) contained in the real-world data vectors are revealed and learned. The learned patterns / relationships serve as predictive models used to perform various tasks, including, for example, classifying (or labeling) real-world data and clustering real-world data. Classification tasks often rely on the use of labeled datasets to train neural networks (i.e., models) to recognize correlations between labels and data. This training is known as supervised learning. Examples of classification tasks include identifying objects in an image (e.g., stop signs, pedestrians, crosswalk signs, etc.), recognizing gestures in a video, detecting voices, detecting voices in audio, identifying specific speakers, transcribing speech into text, etc. Clustering tasks identify similarities between objects; they group objects according to features they share that distinguish them from other groups of objects. These groups are known as "clusters."

[0080] Examples of machine learning techniques that may be used to implement aspects of the present invention will now be described with reference to Figures 8 and 9. A machine learning model constructed and arranged in accordance with embodiments of the present invention will be described with reference to Figure 8. An exemplary computing system and network architecture capable of implementing one or more of the embodiments of the present invention described herein will be described in detail with reference to Figure 10.

[0081] FIG. 8 illustrates a block diagram of a classifier system 800 capable of implementing various prediction and decision aspects of the invention described herein. More specifically, the functionality of system 800 is used in embodiments of the invention to generate various models and / or sub-models used to implement the prediction and decision functions in embodiments of the invention. System 800 includes multiple data sources 802 in communication with classifier 810 via network 804. In some embodiments of the invention, data sources 802 can bypass network 804 and feed directly to classifier 810. Data sources 802 provide data / information inputs to be evaluated by classifier 810 in accordance with embodiments of the invention. Data sources 802 also provide data / information inputs used by classifier 810 to train and / or update model 816 created by classifier 810. Data sources 802 may be implemented as a wide variety of data sources, including, but not limited to, sensors configured to collect real-time data, data repositories (including training data repositories), and outputs from other classifiers. Network 804 can be any type of communications network, including, but not limited to, a local network, a wide area network, a private network, the Internet, and the like.

[0082] The classifier 810 may be implemented as an algorithm executed by a programmable computer, such as the processing system 1000 (shown in FIG. 10 ). As shown in FIG. 8 , the classifier 810 includes a set of machine learning (ML) algorithms 812, a natural language processing (NLP) algorithm 814, and a model 816, which is a relational (or predictive) algorithm generated (or learned) by the ML algorithm 812. The algorithms 812, 814, and 816 of the classifier 810 are shown separately for ease of illustration and explanation. In embodiments of the invention, the functions performed by the various algorithms 812, 814, and 816 of the classifier 810 may be distributed differently than shown in the figure. For example, if the classifier 810 is configured to perform an entire task that includes subtasks, the set of ML algorithms 812 may be divided so that some of the ML algorithms 812 perform each subtask and some of the ML algorithms 812 perform the entire task. Furthermore, in some embodiments of the invention, the NLP algorithm 814 may be integrated within the ML algorithm 812.

[0083] The NLP algorithms 814 include speech recognition functionality that enables the classifier 810, and more particularly the ML algorithms 812, to receive natural language data (text and speech) and apply elements of language processing, information retrieval, and machine learning to derive meaning from the natural language input and potentially perform actions based on the derived meaning. The NLP algorithms 814 used in accordance with embodiments of the present invention may also include speech synthesis functionality that enables the classifier 810 to convert results 820 into natural language (text and speech) and communicate aspects of the results 820 as natural language communications.

[0084] The NLP algorithms 814 and ML algorithms 812 receive and evaluate input data (i.e., training data and data under analysis) from the data sources 802. The ML algorithms 812 include the functionality necessary to interpret and utilize the format of the input data. For example, if the data sources 802 include image data, the ML algorithms 812 may include visual recognition software configured to interpret the image data. The ML algorithms 812 apply machine learning techniques to the received training data (e.g., data received from one or more of the data sources 802) to create / train / update over time one or more models 816 that model the overall task and subtasks that the classifier 810 is intended to complete.

[0085] 8 and 9 collectively, FIG. 9 illustrates an example of a learning phase 900 performed by an ML algorithm 812 to generate the aforementioned model 816. During the learning phase 900, a classifier 810 extracts features from training data and converts them into a vector representation that is recognized and analyzed by the ML algorithm 812. The feature vectors are analyzed by the ML algorithm 812 to “classify” the training data for the target model (or model task) and to identify relationships among the classified training data. Examples of suitable implementations of the ML algorithm 812 include, but are not limited to, neural networks, support vector machines (SVMs), logistic regression, decision trees, and hidden Markov models (HMMs). The learning or training performed by the ML algorithm 812 can be supervised, unsupervised, or a hybrid that includes aspects of supervised and unsupervised learning. Supervised learning is when training data is already available and classified / labeled. Unsupervised learning is when training data is not classified / labeled and therefore must be developed through the iteration of a classifier 810 and ML algorithm 812. Unsupervised learning can utilize additional learning / training methods, including, for example, clustering, anomaly detection, neural networks, deep learning, etc.

[0086] When the ML algorithm 812 has sufficiently trained the model 816, a data source 802 generating "real world" data is accessed and the "real world" data is applied to the model 816 to generate a usable version of the results 820. In some embodiments of the invention, the results 820 may be fed back to the classifier 810 and used by the ML algorithm 812 as additional training data to update and / or refine the model 816.

[0087] In an aspect of the present invention, the ML algorithm 812 and the model 816 can be configured to apply confidence levels (CL) to individual results / decisions among their results / decisions (including result 820) in order to improve the overall accuracy of a particular result / decision. If the ML algorithm 812 or the model 816 or both make a determination or generate a result that the value of CL is below a predetermined threshold (TH) (i.e., CL < TH), this result / decision can be classified as having a "reliability" low enough to justify the conclusion that this decision / result is not valid, and this conclusion can be used to determine when, how, or whether this decision / result is processed in downstream processing, or a combination thereof. When CL > TH, this decision / result can be considered valid, and this conclusion can be used to determine when, how, or whether this decision / result is processed in downstream processing, or a combination thereof. Many different predetermined TH levels can be provided. Decisions / results with CL > TH can be ranked from the highest CL > TH to the lowest CL > TH in order to prioritize when, how, or whether this decision / result is processed in downstream processing, or a combination thereof.

[0088] In an aspect of the present invention, the classifier 810 can be configured to apply a confidence level (CL) to the result 820. If the classifier 810 determines that the CL in the result 820 is below a predetermined threshold (TH) (i.e., CL < TH), the result 820 can be classified as being low enough to justify a "not reliable" classification in the result 820. When CL > TH, the result 820 can be classified as being high enough to justify the determination that the result 820 is valid. Many different predetermined TH levels can be provided such that results 820 with CL > TH are ranked from the highest CL > TH to the lowest CL > TH. <http: / / 0x

[0089] FIG. 10 illustrates an example computer system 1000 that may be used to implement any of the computer-based components of the various embodiments of the invention described herein. The computer system 1000 includes an exemplary computing device (“computer”) 1020 configured to perform various aspects of semantic monitoring operations based on the subject matter described herein in accordance with aspects of the invention. In addition to the computer 1020, the exemplary computer system 1000 includes input / output components 1030 that connect the computer 1020 to additional systems (not shown), which may include one or more wide area networks (WANs) and / or local area networks (LANs), such as the Internet, an intranet, or a wireless communications network, or a combination thereof. The computer 1020 and the additional systems communicate via a network 1034, for example, to transmit data therebetween.

[0090] The exemplary computer 1020 includes a processor core 1022, a main memory (“memory”) 1028, and input / output components 1030, which communicate via a bus 1032. The processor core 1022 includes a cache memory (“cache”) 1024 and a control 1026, which includes a branch prediction structure and associated search, hit, detect, and update logic, which are described in further detail below. The cache 1024 may include multiple cache levels (not shown) that are on-chip or off-chip with the processor 1022. The memory 1028 may include various stored data, e.g., instructions, software, routines, etc., that are transferred to and from the cache 1024 by the control 1026 for execution by the processor 1022, for example. The input / output components 1030 may include one or more components, such as a display, keyboard, modem, network adapter, etc. (not shown), that facilitate local and / or remote input / output operations to and from the computer 1020.

[0091] Although this disclosure includes a detailed description of cloud computing, it should be understood that implementation of the teachings described herein is not limited to cloud computing environments. Rather, embodiments of the present invention may be implemented in conjunction with any other type of computing environment now known or later developed.

[0092] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computational resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) and for rapidly provisioning and releasing these resources with minimal administrative effort or interaction with a service provider. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0093] The features are as follows:

[0094] On-demand self-service: Cloud customers can unilaterally and automatically provision computing power, such as server time and network storage, as needed, without the need for human interaction with the service provider.

[0095] Wide network access: Cloud capabilities are available over the network and can be accessed using standard mechanisms, facilitating usage by heterogeneous thin- or thick-client platforms (e.g., mobile phones, laptops, and PDAs).

[0096] Resource Pool: The provider's computing resources are pooled and offered to multiple consumers using a multi-tenant model, with various physical and virtual resources dynamically allocated and reallocated according to demand. There is a sense of location independence, where consumers typically have no control or knowledge regarding the exact location of the resources offered, although at a higher level of abstraction they may be able to specify a location (e.g., country, state, or data center).

[0097] Rapid Elasticity: Cloud capacity can be quickly and elastically provisioned, in some cases automatically, to scale out quickly, and quickly released to scale in quickly. Capacity available for provisioning often appears to consumers as unlimited, available for purchase in any quantity at any time.

[0098] Metered Services: Cloud systems leverage metering capabilities to automatically control and optimize resource usage at several levels of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of utilized services.

[0099] The service model is as follows:

[0100] SaaS (Software as a Service): The consumer is provided with the ability to use the provider's applications running on a cloud infrastructure. Those applications can be accessed from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or individual application features, except for the possibility of setting limited user-specific application configuration settings.

[0101] PaaS (Platform as a Service): The ability offered to a consumer is to deploy applications they create or acquire, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the configuration of the application hosting environment.

[0102] Infrastructure as a Service (IaaS): The capability provided to a consumer is the provisioning of processing, storage, network, and other basic computing resources, upon which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating system, storage, deployed applications, and in some cases, limited control over selected network components (e.g., host firewalls).

[0103] The deployment model is as follows:

[0104] Private Cloud: This cloud infrastructure is operated solely for the organization, can be managed by the organization or a third party, and can reside on-premise or off-premise.

[0105] Community Cloud: This cloud infrastructure is shared by multiple organizations to support a specific community with shared interests (e.g., mission, security requirements, policy, and compliance considerations). It can be managed by these organizations or a third party and can reside on-premises or off-premises.

[0106] Public Cloud: This cloud infrastructure is available for use by the general public or large industry organizations and is owned by an organization that sells cloud services.

[0107] Hybrid cloud: This cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain distinct but are joined together by standardized or proprietary technologies that allow for data and application portability (e.g., cloud bursting to balance load between clouds).

[0108] A cloud computing environment is a service-oriented environment that emphasizes statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that consists of a network of interconnected nodes.

[0109] Referring now to FIG. 11 , an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers (e.g., a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automobile computer system 54N) can communicate. The nodes 10 may communicate with each other. The nodes 10 may be physically or virtually grouped in one or more networks (not shown), such as a private cloud, community cloud, public cloud, or hybrid cloud, or combinations thereof, as previously described herein. This enables the cloud computing environment 50 to provide an infrastructure, platform, and / or SaaS that does not require cloud consumers to maintain resources on their local computing devices. It should be understood that the types of computing devices 54A-N shown in FIG. 11 are intended as examples only, and that the computing node 10 and cloud computing environment 50 may communicate with any type of computer-controlled device via any type of network and / or network-addressable connection (e.g., a connection using a web browser).

[0110] Referring now to Figure 12, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 11) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 12 are intended to be illustrative only, and that embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0111] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframe 61, RISC (Reduced Instruction Set Computer) architecture-based server 62, server 63, blade server 64, storage device 65, and network and network components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0112] The virtualization layer 70 comprises an abstraction layer capable of providing virtual entities such as virtual servers 71 , virtual storage 72 , virtual networks including virtual private networks 73 , virtual applications and operating systems 74 , and virtual clients 75 .

[0113] In one example, the management layer 80 may provide the following functions: Resource provisioning 81 dynamically procures computing and other resources used to execute tasks within the cloud computing environment; Metering and pricing 82 tracks costs as resources are utilized within the cloud computing environment and sends bills or invoices for the utilization of those resources; in one example, these resources may include application software licenses; Security verifies the identity of cloud users and tasks and protects data and other resources; User portal 83 provides users and system administrators with access to the cloud computing environment; Service level management 84 allocates and manages cloud computing resources to meet required service levels; and Service Level Agreement (SLA) planning and execution 85 proactively prepares and procures cloud computing resources in accordance with SLAs in anticipation of future demand.

[0114] The Workload Layer 90 provides examples of functionality available in a cloud computing environment. Examples of workloads and functionality provided by this layer include mapping and navigation 91, software development and lifecycle management 92, virtual classroom education delivery 93, data analytics processing 94, transaction processing 95, and automatic scaling of cryptographic computing resources to match the cryptographic processing requirements of encrypted communications 96.

[0115] The present invention may be a system, method, and / or computer program product, at any possible level of technical detail of integration. The computer program product may include one or more computer-readable storage media containing computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0116] A computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device, such as, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes portable floppy disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices such as punch cards or ridge-in-groove structures on which instructions are recorded, and any suitable combination thereof. As used herein, computer-readable storage media should not be construed as being ephemeral signals, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over wires.

[0117] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or storage device over a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). This network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface within each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium within each computing / processing device.

[0118] Computer-readable program instructions for carrying out the operations of the present invention may be source or object code written in any combination of one or more programming languages, including assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, configuration data for integrated circuits, or object-oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer as a standalone software package, partially on the user's computer and on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, to carry out aspects of the present invention, electronic circuitry including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute computer-readable program instructions to individualize the electronic circuitry by utilizing state information of the computer-readable program instructions.

[0119] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, are implemented by computer-readable program instructions.

[0120] These computer-readable program instructions may be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to create a machine, where the instructions, executed by the processor of the computer or other programmable data processing apparatus, create means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may be stored on a computer-readable storage medium and capable of directing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer-readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions for performing aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0121] Computer-readable program instructions may be loaded into a computer, other programmable data processing apparatus, or other device such that the instructions, which execute on the computer, other programmable apparatus, or other device, perform the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams, thereby causing a series of operable steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process.

[0122] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, comprising one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or in the reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart diagrams, and combinations of blocks included in the block diagrams and / or flowchart diagrams, are implemented by a special-purpose hardware-based system that performs the specified function(s) or operation(s) or executes a combination of special-purpose hardware and computer instructions.

[0123] As noted previously herein, the prior art related to making and using aspects of the present invention is well known and may or may not be described in detail herein. However, to provide background, various cryptographic methods and definitions utilized in implementing one or more embodiments of the present invention will now be described in further detail.

[0124] Digital certificates support public key cryptography, in which each party involved in a communication or transaction has a key pair, called a public key and a private key. Each party's public key is made public, while the private key is kept secret. A public key is a number associated with a particular entity and intended to be known by anyone who needs to interact with that entity in a trusted manner. A private key is a number that is meant to be known only to the particular entity (i.e., kept secret). In a standard public key cryptosystem, a private key corresponds to exactly one public key.

[0125] In a public key cryptosystem, all communications involve only the public key; the private key is never transmitted or shared, so that confidential messages can be generated using only public information and decrypted using only the private key, which is owned only by the intended recipient. Furthermore, public key cryptography can be used for privacy (i.e., encryption) as well as authentication (i.e., digital signatures). Public key cryptography is thus an asymmetric scheme that uses a key pair (specifically, a public key used to encrypt data along with a corresponding private key used to decrypt the data). The public key can be made public to the world, while the private key is kept secret. Any entity with a copy of the public key can then encrypt information, which can be decrypted and read by an entity in possession of the private key.

[0126] Encryption is the transformation of data into a form that cannot be read by anyone who does not have a private decryption key; encryption ensures privacy by keeping the information content hidden from all unintended parties, even those who can view the encrypted data. Authentication is a process that allows the recipient of a digital message to be certain of the sender's identity and / or the integrity of the message. For example, if the sender encrypts a message, the recipient's public key is used to convert the data in the original message into the contents of the encrypted message. The sender uses the public key to encrypt the data, and the recipient uses the private key to decrypt the encrypted message.

[0127] A certificate is a digital document that vouches for the identity and key ownership of an entity, such as an individual, a computer system, or a particular server running on that system. Certificates are issued by a certification authority. A certificate authority (CA) is an entity trusted to sign or issue certificates for other people or entities, and is usually a trusted third party in a transaction. The CA usually has some type of legal responsibility for ensuring the binding between the public key and its owner, allowing the entity that signed the certificate to be trusted. Many such certification authorities exist, and they are responsible for verifying the identity and key ownership of an entity when issuing a certificate.

[0128] When a certification authority issues a certificate for an entity, the entity provides its public key and some information about itself. A software tool, such as a specialized web browser, can digitally sign this information and send it to the certification authority, which can be a company or other entity that provides trusted third-party certification authority services. The certification authority then generates and returns the certificate. The certificate can include other information, such as dates for which the certificate is valid and a serial number. Some of the values ​​provided by the certification authority, which serves as a neutral, trusted implementation service based in part on validation requirements, are published in certification service practices (CSPs).

[0129] Typically, after a CA receives a request for a new digital certificate, including the requesting entity's public key, the CA signs the requesting entity's public key using the CA's private key and places the signed public key in a digital certificate. Anyone who receives the digital certificate during a transaction or communication can then use the CA's public key to verify the signed public key in the certificate. The intent is that the entity's certificate verifies that the entity owns the particular public key. Several standards exist that define the information in a certificate and describe the data format of that information.

[0130] The terms "cipher," "cryptosystem," "encryption," and equivalent terms are used herein to describe secure information and communications technologies derived from mathematical concepts, including, for example, rule-based calculations called algorithms designed to transform messages in ways that are difficult to decipher without authorization. Ciphers use a set of procedures known as cryptographic algorithms, encryption algorithms, or ciphers to encrypt and decrypt messages to secure communications between computer systems and applications. A cipher suite may use a first algorithm for encryption, a second algorithm for message authentication, and a third algorithm for key exchange. Cryptographic algorithms, incorporated into protocols and written into software executed on operating systems and networked computer systems, include public and private key generation for data encryption / decryption, digital signatures and verification for message authentication, and key exchange operations.

[0131] The term "asymmetric key encryption algorithm" and equivalents are used herein to refer to a public or asymmetric key algorithm that uses a key pair: a public key associated with the creator / sender to encrypt the message, and a private key known only to the originator to decrypt the information.

[0132] The term "key" and equivalents are used herein to refer to a random string of bits created expressly to scramble or unscramble data. Keys are designed using algorithms intended to ensure that all keys are unpredictable and unique. The longer the key constructed in this manner, the more difficult it is to crack the encryption code. A key may be used to encrypt, decrypt, or perform both functions, depending on the type of encryption software used.

[0133] The term "private key" and equivalents are used herein to refer to a key that is paired with a public key to operate an algorithm for encrypting and decrypting text. A private key is created as part of public key cryptography during asymmetric key encryption and is used to decrypt messages and convert them into a readable format. Public and private keys are paired for secure communication. The private key is shared only with the initiator of the key to ensure security. For example, A represents the message sender and B represents the message receiver. A and B each have their own public and private key pair. A, the message initiator or sender, sends a message to B. A's message is encrypted using B's public key, while B decrypts A's received message using B's private key. To ensure that A is the original message sender, a digital signature or digital certificate is used. To verify this, B follows the following steps: Since A must have previously encrypted the digital signature or certificate using its private key, B decrypts the digital signature using A's public key, and if the digital signature is readable, it is authenticated using a certification authority (CA). Thus, sending an encrypted message requires the sender to use the recipient's public key and the sender's private key to encrypt a digital certificate, which the recipient then uses to decrypt the message, while the sender's public key is used to decrypt the digital certificate.

[0134] The term "public key" and equivalents are used herein to refer to a type of cryptographic key created in a public key cryptography cipher that uses an asymmetric key encryption algorithm. The public key is used to convert a message into an unreadable form. Decryption is performed using a different but matching private key. The public and private keys are paired to enable secure communication.

[0135] The terms "digital signature" and equivalents are used herein to refer to techniques incorporating public key cryptography methods that allow a consumer of digitally signed data to validate that the data has not been altered, deleted, or added. In an exemplary digital signature technique / configuration, a "signer" hashes the record data and encrypts this hash using the signer's private key. The encrypted hash is the signature. A consumer of the record data can hash the same record data and then decrypt the signature using the public key to obtain the signer's hash. A consumer wishing to validate the record can compare the consumer's hash with the signer's hash. If these two hash values ​​match, the content and source of the record's data are verified.

[0136] The term "elliptic curve cryptography" (ECC) describes algorithms that use the mathematical properties of elliptic curves to generate public-key cryptosystems. Like all public-key cryptography, ECC is based on mathematical functions that are easy to compute in one direction but very difficult to reverse. In the case of ECC, this difficulty lies in the infeasibility of computing the discrete logarithm of a random elliptic curve element with respect to a known base point, the "elliptic curve discrete logarithm problem" (ECDLP). The "elliptic curve digital signature algorithm" (ECDSA) is a signature algorithm widely used for public-key cryptography that uses EC.

[0137] A coprocessor is an auxiliary processor that takes over responsibility for performing selected processor-intensive tasks from its associated central processing unit (CPU), allowing the CPU to focus its computing resources on tasks that are essential to the overall system. Coprocessor tasks can include input / output (I / O) interfacing, cryptography, string processing, floating-point arithmetic, signal processing, and more. A coprocessor can include one or more embedded systems (ES). An ES is a computer system that performs one or more dedicated functions within a larger mechanical and / or electronic system. An example of an ES is a bootstrap loader (or boot loader), which acts as a mediator between the computer's hardware and operating system. In some computer configurations, the coprocessor itself can be considered an embedded system.

[0138] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural unless the context clearly indicates otherwise. The terms "comprises" and / or "comprising," when used herein, indicate the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups thereof, or combinations thereof.

[0139] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments or designs. The terms "at least one" and "one or more" can include any integer greater than or equal to one (i.e., 1, 2, 3, 4, etc.). The term "plurality" can include any integer greater than or equal to two (i.e., 2, 3, 4, 5, etc.). The term "connected" can include both an indirect "connected" and a direct "connected."

[0140] The terms "about," "substantially," and the like are intended to include the degree of error associated with measurement of a particular quantity based on the equipment available at the time of filing this application. For example, "about," "substantially," and the like can include a range of ±8%, or 5%, or even 2% of a particular value.

[0141] While the present invention has been described in detail in connection with only a limited number of embodiments, it should be readily understood that the invention is not limited to such disclosed embodiments. Rather, it can be modified to incorporate any number of variations, alterations, substitutions, and equivalent arrangements consistent with the scope of the invention. Additionally, while various embodiments of the invention have been described, it should be understood that aspects of the invention may include only some of the described embodiments. Accordingly, the present invention should not be deemed limited by the foregoing description, but is limited only by the appended claims.

Claims

1. 1. A computer-implemented method for performing a cryptographic operation, the computer-implemented method comprising: receiving, using a processor system, resource scaling (RS) data associated with the encrypted message; using the processor system to access an Operation Policy (OP) of the RS data, the OP defining cryptographic operation constraints; and performing a first resource scaling operation based at least in part on a determination that the cryptographic operation constraints do not include a mandatory cryptographic resource requirement, the first resource scaling operation comprising: using the processor system to perform an analysis of a cryptographic metric associated with the processor system; The cryptographic index is information associated with the encrypted message; and said executing including performance measurements of cryptographic operations performed by said processor system; using the results of the analysis of the cryptographic operating constraints and the cryptographic metrics; determining the cryptographic processing requirements of said encrypted message; and Matching the cryptographic processing requirements to selected cryptographic computing resources from a set of available cryptographic computing resources, and identifying a customized set of cryptographic computing resources selected to match the cryptographic processing requirements of the encrypted message. and and performing a customized cryptographic operation on the encrypted message using the customized set of cryptographic computational resources.

2. based at least in part on a determination that the cryptographic operation constraint includes the mandatory cryptographic computational resource requirement; routing the encrypted message to a set of required cryptographic computation resources identified by the required cryptographic computation resource requirements; 2. The computer-implemented method of claim 1, further comprising: performing a second resource scaling operation comprising: performing a requisite cryptographic operation on the encrypted message using the requisite set of cryptographic computational resources.

3. receiving a request to perform a cryptographic operation on the encrypted message; 10. The computer-implemented method of claim 1, further comprising: configuring open source cryptographic software to: route the request to the processor system instead of executing the request.

4. 4. The computer-implemented method of claim 3, wherein the open source cryptographic software comprises open source Secure Sockets Layer (SSL) software.

5. capturing a first set of updated cryptographic metrics resulting from the first resource scaling operation performing the customized cryptographic operation on the encrypted message using the customized set of cryptographic computational resources; 2. The computer-implemented method of claim 1, further comprising: updating the cryptographic metrics using the updated first set of cryptographic metrics.

6. The first resource scaling operation comprises: capturing a first set of updated cryptographic metrics resulting from performing the customized cryptographic operation on the encrypted message using the customized set of cryptographic computational resources; updating the cryptographic metrics using the updated first set of cryptographic metrics; The second resource scaling operation comprises: capturing a second set of updated cryptographic metrics resulting from performing the requisite cryptographic operations on the encrypted message using the requisite set of cryptographic computational resources; 3. The computer-implemented method of claim 2, further comprising updating cryptographic metrics using the updated second set of cryptographic metrics.

7. the processor comprising a predictive model trained to utilize a machine learning algorithm to determine the cryptographic processing requirements of the encrypted message; the information associated with the encrypted message includes a cryptographic computational resource pattern including static data; The computer-implemented method of claim 1 , wherein the performance measurements include cryptographic metrics that include dynamic data that changes.

8. 1. A computer system comprising a memory communicatively coupled to a processor system, the processor system comprising: receiving resource scaling (RS) data associated with the encrypted message; accessing an Operation Policy (OP) of the RS data, the OP defining cryptographic operation constraints; and performing a first resource scaling operation based at least in part on a determination that the cryptographic operation constraints do not include mandatory cryptographic computational resource requirements, the first resource scaling operation comprising: analyzing cryptographic metrics associated with the processor system, The cryptographic index is information associated with the encrypted message; and the analysis including performance measurements of cryptographic operations performed by the processor system; and using the results of the analysis of the cryptographic operating constraints and the cryptographic metrics; determining the cryptographic processing requirements of said encrypted message; and Matching the cryptographic processing requirements to selected cryptographic computing resources from a set of available cryptographic computing resources, and identifying a customized set of cryptographic computing resources selected to match the cryptographic processing requirements of the encrypted message. and and performing a customized cryptographic operation on the encrypted message using the customized set of cryptographic computational resources.

9. based at least in part on a determination that the cryptographic operation constraint includes the mandatory cryptographic computational resource requirement; routing the encrypted message to a set of required cryptographic computation resources identified by the required cryptographic computation resource requirements; and performing a requisite cryptographic operation on the encrypted message using the requisite set of cryptographic computational resources.

10. receiving a request to perform a cryptographic operation on the encrypted message; 10. The computer system of claim 8, further comprising: configuring open source cryptographic software to: route the request to the processor system instead of executing the request.

11. 11. The computer system of claim 10, wherein the open source cryptographic software comprises open source Secure Sockets Layer (SSL) software.

12. capturing a first set of updated cryptographic metrics resulting from the first resource scaling operation performing the customized cryptographic operation on the encrypted message using the customized set of cryptographic computational resources; 9. The computer system of claim 8, further comprising: updating the cryptographic metrics using the updated first set of cryptographic metrics.

13. The first resource scaling operation comprises: capturing a first set of updated cryptographic metrics resulting from performing the customized cryptographic operation on the encrypted message using the customized set of cryptographic computational resources; updating the cryptographic metrics using the updated first set of cryptographic metrics; The second resource scaling operation comprises: capturing a second set of updated cryptographic metrics resulting from performing the requisite cryptographic operations on the encrypted message using the requisite set of cryptographic computational resources; 10. The computer system of claim 9, further comprising: updating cryptographic metrics using the updated second set of cryptographic metrics.

14. the processor comprising a predictive model trained to utilize a machine learning algorithm to determine the cryptographic processing requirements of the encrypted message; the information associated with the encrypted message includes a cryptographic computational resource pattern including static data; 10. The computer system of claim 8, wherein the performance measurements include cryptographic metrics that include dynamic data that changes.

15. A computer program that causes a computer to execute the computer-implemented method described in any one of claims 1 to 7.

16. A storage medium on which the computer program described in claim 15 is stored in a computer-readable storage medium.

Images