COMBINED HIDDEN DYNAMIC RANDOM-ACCESS DEVICES UTILIZING SELECTABLE KEYS AND KEY LOCATORS FOR COMMUNICATING RANDOMIZED DATA TOGETHER WITH SUB-CHANNELS AND CODED ENCRYPTION KEYS

Abstract

Devices that conceal transmission(s) transmitted to and/or reveal transmission(s) received from these devices comprising at least one executable coded cipher key(s) at least one executable coded encryption key (ECEK) device that securitizes transmission(s) that uses executable cipher coded key(s), and at least one executable coded decryption key (ECDK) device that reveals transmission(s) such that a combined device is a RDDS/ECDK device that transmits randomized data with data sub-channels and with ECEKs; and that also utilizes at least one executable coded cipher key(s), such that transmission(s) sent to an encrypter/decrypter memory that stores transmission(s) while the transmission(s) is concealed and/or revealed. When concealing/revealing operation(s) are completed the transmission(s) is sent to at least one transmitter such that the concealing/revealing operation of the transmission(s) is controlled and manipulated by the executable coded cipher key(s), wherein the executable coded cipher key(s) remain in the computer memory long enough to achieve securitization completion.

Claims

1. One or more combined devices that encrypt data transmitted to or decrypt data or both transmit and decrypt data received from said one or more combined devices that utilize one or more master keys comprising; at least one encrypter or decrypter or both an encrypter and a decrypter such that encryption or decryption or both encryption and decryption of said data or associated data files or both data and data files utilize one or more master keys and one or more key selectors, wherein said master keys and key selectors produce a specific set of one or more encryption keys that encrypt or decrypt or both encrypt and decrypt said data or associated data files or both said data and said data files such that one or more key selectors coincide with at least one value that directly corresponds with created cipher data or cipher data files or both cipher data and cipher data files, and wherein said key selectors and said cipher data and said cipher data files produce result data and result data files such that said cipher data and cipher data files together with said result data and result data files are sealed in that produced encrypted data and encrypted data files are only encrypted and decrypted with one or more master keys and one or more key selectors, wherein said master keys are executable coded cipher keys and wherein said data or associated data files or both said data and said associated data files are a form of transmission(s) that are signals and wherein said one or more combined systems further comprises; a forward error correction encoder that encodes transmission(s) and provides a known degree of forward error correction to said transmission(s); a sub-channel encoder; a transmission(s) combiner that combines transmission(s) from said forward error correction encoder with transmission(s) from said sub-channel encoder; a transmission(s) encrypter that receives combined transmission(s) from said transmission(s) combiner, wherein said transmission(s) encrypter receives one or more encrypter keys (KE) and said combined transmission(s), such that said combined transmission(s) are encrypted by said transmission(s) encrypter and sent to a transmission(s) transmitter and wherein said transmission(s) are in a form of cipher text; a transmission(s) receiver that receives said cypher text and sends said cypher text to a transmission(s) decrypter, such that said cypher text is decrypted and wherein said one or more combined systems further comprise; at least one executable coded cipher key(s), and at least one executable coded encryption key (ECEK) device that encrypts transmission(s) that uses executable cipher coded key(s), and at least one executable coded decryption key (ECDK) device that decrypts transmission(s) that also uses said at least one executable coded cipher key(s), such that a combined device is a RDDS/ECDK device that transmits randomized encrypted data with data sub-channels and with executable coded encryption keys; at least one computer processing unit (CPU) with computational capabilities that is connected to and controls a computer memory via an address bus and a data bus such that said address bus accesses a designated range of computer memories and range of memory bits and said data bus provides a flow of transmission(s) into and out of said CPU and computer memory, and wherein said computer memory contains encrypter/decrypter memory that possesses at least one encryption space location and at least one decryption space location for said executable coded cipher key(s), such that transmission(s) is sent to said encrypter/decrypter memory that stores said transmission(s) while said transmission(s) is encrypted or decrypted or both encrypted and decrypted and wherein, when encryption/decryption is completed said transmission(s) is sent to at least one transmitter such that encryption/decryption of said transmission(s) is controlled and manipulated by said executable coded cipher key(s), wherein said executable coded cipher key(s) remain in said computer memory and achieves encryption/decryption completion.

2. The one or more combined devices of claim 1, wherein said key selectors themselves are encrypted and decrypted.

3. The one or more combined devices of claim 1, wherein said executable cipher keys contain meta data.

4. The one or more combined devices of claim 1, comprising a real or virtual master distributed auto-synchronous array (DASA) database or both one or more real and virtual master distributed auto-synchronous array (DASA) databases located within or external to said one or more combined devices that at least stores and retrieves data and that includes at least two or more partial distributed auto-synchronous array (DASA) databases wherein said partial DASA databases function in either an independent manner, a collaborative manner or both, and wherein said master and partial DASA databases allow for bi-directional transmission of data to and from multiple partial user devices, to and from multiple partial access devices or to and from both partial user and partial access devices, wherein said one or more partial user and access devices store and provide at least partial copies of portions of said master DASA database and wherein said master DASA database, said partial DASA databases or both partial and master DASA databases are linked and communicate with each other as well as one or more logging and monitoring databases capable of statistical and numerical calculations utilizing said data, wherein said tools authenticate using a first set of computing operations, validates using a second set of computing operations, and wherein a third set of computing operations controls access for a specified set of users.

5. The one or more combined devices of claim 4, wherein said master and partial DASA databases analyze and provide information in a form of data and act to control one or more output devices, wherein said output devices create user devices.

6. One or more combined systems that encrypt data transmitted to or decrypt data or both transmit and decrypt data received from said one or more combined systems that utilize one or more master keys comprising; at least one encrypter or decrypter or both an encrypter and a decrypter such that encryption or decryption or both encryption and decryption of said data or associated data files or both data and data files utilize one or more master keys and one or more key selectors, wherein said master keys and key selectors produce a specific set of one or more encryption keys that encrypt and/or decrypt said data or associated data files or both data and data files such that one or more key selectors coincide with at least one value that directly corresponds with created cipher data or cipher data files or both cipher data and cipher data files, and wherein said key selectors and said cipher data and said cipher data files produce result data and result data files such that said cipher data and cipher data files together with said result data and result data files are sealed in that produced encrypted data and encrypted data files are only encrypted and decrypted with one or more master keys and one or more key selectors, wherein said master keys are executable coded cipher keys and wherein said data or associated data files or both said data and said associated data files are a form of transmission(s) that are signals and wherein said one or more combined systems further comprises; a forward error correction encoder that encodes transmission(s) and provides a known degree of forward error correction to said transmission(s); a sub-channel encoder; a transmission(s) combiner that combines transmission(s) from said forward error correction encoder with transmission(s) from said sub-channel encoder; a transmission(s) encrypter that receives combined transmission(s) from said transmission(s) combiner, wherein said transmission(s) encrypter receives one or more encrypter keys (KE) and said combined transmission(s), such that said combined transmission(s) are encrypted by said transmission(s) encrypter and sent to a transmission(s) transmitter and wherein said transmission(s) are in a form of cipher text; a transmission(s) receiver that receives said cypher text and sends said cypher text to a transmission(s) decrypter, such that said cypher text is decrypted and wherein said one or more combined systems further comprise; at least one executable coded cipher key(s), and at least one executable coded encryption key (ECEK) device that encrypts transmission(s) that uses executable cipher coded key(s), and at least one executable coded decryption key (ECDK) device that decrypts transmission(s) that also uses said at least one executable coded cipher key(s), such that a combined device is a RDDS/ECDK device that transmits randomized encrypted data with data sub-channels and with executable coded encryption keys; at least one computer processing unit (CPU) with computational capabilities that is connected to and controls a computer memory via an address bus and a data bus such that said address bus accesses a designated range of computer memories and range of memory bits and said data bus provides a flow of transmission(s) into and out of said CPU and computer memory, and wherein said computer memory contains encrypter/decrypter memory that possesses at least one encryption space location and at least one decryption space location for said executable coded cipher key(s), such that transmission(s) is sent to said encrypter/decrypter memory that stores said transmission(s) while said transmission(s) is encrypted or decrypted or both encrypted and decrypted and wherein, when encryption/decryption is completed said transmission(s) is sent to at least one transmitter such that encryption/decryption of said transmission(s) is controlled and manipulated by said executable coded cipher key(s), wherein said executable coded cipher key(s) remain in said computer memory and achieves encryption/decryption completion.

7. The one or more combined systems of claim 6, wherein said key selectors themselves are encrypted and decrypted.

8. The one or more combined systems of claim 6, wherein said executable cipher keys contain meta data.

9. The one or more combined systems of claim 6, comprising a real or virtual master distributed auto-synchronous array (DASA) database or both one or more real and virtual master distributed auto-synchronous array (DASA) databases located within or external to said one or more combined systems that at least stores and retrieves data and that includes at least two or more partial distributed auto-synchronous array (DASA) databases wherein said partial DASA databases function in either an independent manner, a collaborative manner or both an independent and collaborative manner, and wherein said master and partial DASA databases allow for bi-directional transmission of data to and from multiple partial user devices, to and from multiple partial access devices or to and from both partial user and partial access devices, wherein said one or more partial user and access devices store and provide at least partial copies of portions of said master DASA database and wherein said master DASA database, said partial DASA databases or both partial and master DASA databases are linked and communicate with each other as well as one or more logging and monitoring databases capable of statistical and numerical calculations utilizing said data, wherein said tools authenticate using a first set of computing operations, validates using a second set of computing operations, and wherein a third set of computing operations controls access for a specified set of users.

10. The one or more combined systems of claim 9, wherein said master and partial DASA databases analyze and provide information in a form of data and act to control one or more output devices, wherein said output devices create user devices.

Description

BRIEF DESCRIPTION OF THE FIGURES

[0038] So that the above recited features and advantages of the present disclosure can be understood in detail, a more particular description of the invention and reference to embodiments are provided and illustrated in the appended figures. It is to be noted, however, that the appended drawings illustrate only typical embodiments of the present disclosure and are therefore not to be considered limiting the scope or other equally effective embodiments.

[0039] FIG. 1 is a flow diagram for the Dynamically Selectable Encryption System (DSES) without the Hidden Portion

[0040] FIG. 2 is a flow diagram for the Dynamically Selectable Decryption System (DSDS) without the Hidden Portion

[0041] FIG. 3 is a flow diagram that describes the Dynamically Selectable Encryption System (DSES) with the Hidden Portion

[0042] FIG. 4 is a flow diagram that describes the Dynamically Selectable Decryption System (DSDS) with the Hidden Portion

[0043] FIG. 5 is a flow diagram that describes the Dynamically Selectable Encryption System (DSES) with and Indirect Hidden Portion

[0044] FIG. 6 is a flow diagram that describes the Dynamically Selectable Decryption System (DSDS) with and Indirect Hidden Portion

[0045] FIG. 7 is a flow diagram that provides one example of a detailed End-to-End Hidden Encryption System Utilizing a Sophisticated Dynamic Encrypter

[0046] FIG. 8 is a flow diagram that provides one example of a detailed End-to-End Hidden Encryption System Utilizing a Sophisticated Dynamic Decrypter

[0047] FIG. 9 is a schematic that provides at least one embodiment that illustrates the combination of two transceiver devices utilizing both encrypters and decrypters.

[0048] FIG. 10 is a flowchart describing a device that communicates randomized encrypted data with sub-channels (REDS) together with executable coded encryption key (ECEK) device that encrypts and/or decrypts data using executable coded keys (1075), which is a REDS/ECEK device. This REDS/ECEK device transmits randomized encrypted data with data sub-channels and with executable coded encryption keys.

[0049] FIG. 11 is a flowchart describing a device that communicates randomized decrypted data with sub-channels (RDDS) that receives randomized encrypted data with data sub-channels together with a device that uses an executable coded decryption key, (ECDK) devices that decrypts data using executable coded keys (1125). This combined device is a RDDS/ECDK device. The RDDS/ECDK device transmits randomized encrypted data with data sub-channels and with executable coded encryption keys.

[0050] FIG. 11A is a schematic diagram that illustrates devices utilized initially represented in simple block form for FIGS. 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, and 11 (1-11).

[0051] FIG. 12 is a schematic which provides at least one embodiment of the computer enabled access control (securitization) system, which contains, in this instance, a real or virtual master distributed auto-synchronous array (DASA) database.

[0052] FIG. 12A is a schematic diagram that illustrates devices utilized initially represented in simple block form for FIG. 12. So that the above recited features and advantages of the present disclosure can be understood in detail, a more particular description of the invention and reference to embodiments are provided and illustrated in the appended figures. It is to be noted, however, that the appended drawings illustrate only typical embodiments of the present disclosure and are therefore not to be considered limiting the scope or other equally effective embodiments.

DETAILED DESCRIPTION

[0053] Specifically, FIG. 1 is a flow diagram (100) for operation of the Dynamically Selectable Encryption System (DSES) Encrypter (100 A) without the Hidden Portion. The master key (110) is used by a dynamically selectable encryption key generator (130) together with the key selector value (120) to produce a data encryption key (KE) in a dynamic fashion. The key (KE) maybe changed at any time based upon a change in the key selector value (120). The key selector value (120) is sent to the decryption token (150). Encrypter (170) receives data (160) which may be in the form of plaintext and encrypts the data according to the value of the key (KE). Encrypted output data (180) is accepted from encrypter (170) which may be provided in the form of cypher-text. The combination of the decryption token (150) and the encrypted output data (180) now becomes available as encrypted communication signals.

[0054] The encryption process described above is for dynamically encrypted data on the move. For dynamically encrypted data at rest, shown as an optional feature by using dashed lines, the decryption token (150) is utilized by a memory storage system (190) as the block address to store the encrypted output data (180) at that specific block address. In this manner every block of memory in the memory storage system is encrypted with a unique encryption key (KE).

[0055] FIG. 2 is a flow diagram (200) for operation of the Dynamically Selectable Decryption System (DSDS) Decrypter (200A) without the Hidden Portion. The master key (210) has the same value as its matching master key (110) for the DSES as described in FIG. 1. The combination of the decryption token (150) and the encrypted output data (180) which has become available as communication signals (see FIG. 1) are received as a decryption token (250) and as encrypted input data (280).

[0056] The decryption token (250) becomes the key selector value (120). The master key (210) is used by a dynamically selectable decryption key generator (230) together with the key selector value (120) to produce a decryption key (KD) in a dynamic fashion. The decryption key (KD) maybe changed at any time based upon the value of the key selector (120). The key selector value (120) is sent to the key selector receiver (220).

[0057] Decrypter (270) receives encrypted input data (280) which may be in the form of cyphertext and decrypts the data according to the value of the decryption key (KD). Decrypted output data receiver (260) from decrypter (270) may be provided in the form of plaintext. Both the values of the original key selector value (120) and the original data (160) are available as decrypted communication signals from the key selector receiver (220) and the decrypted output data receiver, (260), respectively. At this point the communication signals using devices and the associated system have been securely transmitted through a dynamic encryption/decryption tunnel.

[0058] The decryption process described above is for dynamically encrypted data on the move. For dynamically decrypted data at rest, shown as an optional feature by using dashed lines, the key locater (120) is utilized by a memory storage system (290) as the block address to recover the encrypted output data (180) at that specific block address. In this manner every block of memory in the memory storage system is encrypted and decrypted with a unique encryption key (KE).

[0059] FIG. 3 is a flow diagram (300) for operation of the Dynamically Selectable Encryption System (DSES) Encrypter (300A) with a Direct Hidden Portion. The master key (110) is used by a dynamically selectable encryption key generator (130) together with the key selector (120) to produce a data encryption key (KE) in a dynamic fashion. The key (KE) maybe changed at any time based upon a change in the key selector value (120). The key selector value (120) is sent to an encryption token encrypter (340) along with the master key (110). The encryption token encrypter (340) encrypts the key selector value (120) and produces a hidden encryption token (350). Encrypter (170) receives data (160) which may be in the form of plaintext and encrypts the data according to the value of the key (KE). Encrypted output data (180) is accepted from encrypter (170) which may be provided in the form of cyphertext. The combination of the hidden encryption token (350) and the encrypted output data (180) now becomes available as encrypted communication signals.

[0060] The encryption process described above is for dynamically encrypted data on the move. For dynamically encrypted data at rest, shown as an optional feature by using dashed lines, the key selector value (120) or the hidden decryption token (350) is utilized by a memory storage system (190) as the block address to store the encrypted output data (180) at that specific block address. In this manner every block of memory in the memory storage system is encrypted with a unique encryption key (KE).

[0061] FIG. 4 is a flow diagram (400) for operation of the Dynamically Selectable Decryption System (DSDS) Decrypter (400A) with a Direct Hidden Portion. The master key (210) has the same value as its matching master key (110) for the DSES as described in FIG. 1. The combination of the hidden encryption token (350) and the encrypted output data (180) which has become available as communication signals (see FIG. 3) are received as an encrypted decryption token (450) and as encrypted input data (280).

[0062] The encrypted decryption token (450) is sent to a decryption token decrypter (440) along with the master key (210). The decryption token decrypter (440) decrypts the encrypted decryption token (450) and produces the key selector value (120). The master key (210) is used by a dynamically selectable decryption key generator (230) together with the key selector value (120) to produce a decryption key (KD) in a dynamic fashion. The decryption key (KD) maybe changed at any time based upon the value of the key selector value (120). The key selector value (120) is sent to the key selector receiver (220).

[0063] Decrypter (270) receives encrypted input data (280) which may be in the form of cyphertext and decrypts the data according to the value of the decryption key (KD). Decrypted output data receiver (260) from decrypter (270) may be provided in the form of plaintext. Both the values of the original key selector (120) and the original data (160) are available as decrypted communication signals from the key selector receiver (220) and the decrypted output data receiver, (260), respectively. At this point the communication signals using devices and the associated system have been securely transmitted through a dynamic encryption/decryption tunnel.

[0064] The decryption process described above is for dynamically encrypted data on the move. For dynamically decrypted data at rest, shown as an optional feature by using dashed lines, the key selector value (120) or the encrypted decryption token (450) is utilized by a memory storage system (290) as the block address to recover the encrypted output data (180) at that specific block address. In this manner every block of memory in the memory storage system is encrypted and decrypted with a unique encryption key (KE).

[0065] FIG. 5 is a flow diagram (500) for operation of the Dynamically Selectable Encryption System (DSES) Encrypter (500A) with an Indirect Hidden Portion. The master key (110), in this configuration, is the source for a first key derivation communication processor (512) and second key derivation communication processor (514). These key derivation communication processors (512, 514) utilize information from the master key (110) to provide variants of the original master key (110). The first key and second key derivation communication processors (512, 514) are distinguishable from each other in that they use unique initialization vectors and/or algorithms to each produce uniquely different derived keys. The master key (110) is provided to the first key derivation communication processor (512) that is used by a dynamically selectable encryption key generator (130) together with the key selector value (120) to produce a data encryption key (KE) in a dynamic fashion. The key (KE) maybe changed at any time based upon a change in the key selector value (120). In addition the same master key (110) is provided to the second key derivation communication processor (514). The key selector value (120) is sent to a decryption token encrypter (340) along with the second key derivation communication processor (514). The decryption token encrypter (340) encrypts the key selector value (120) and produces an indirect hidden encryption token (550). Encrypter (170) receives data (160) which may be in the form of plaintext and encrypts the data according to the value of the key (KE). Encrypted output data (180) is accepted from encrypter (170) which may be provided in the form of cyphertext. The combination of the indirect hidden encryption token (550) and the encrypted output data (180) now becomes available as encrypted communication signals.

[0066] The encryption process described above is for dynamically encrypted data on the move. For dynamically encrypted data at rest, shown as an optional feature by using dashed lines, the key selector value (120) or the indirect hidden encryption token (550) is utilized by a memory storage system (190) as the block address to store the encrypted output data (180) at that specific block address. In this manner every block of memory in the memory storage system is encrypted with a unique encryption key (KE).

[0067] FIG. 6 is a flow diagram (600) for operation of the Dynamically Selectable Decryption System (DSDS) Decrypter (600A) with an Indirect Hidden Portion. The master key (210) has the same value as its matching master key (110) for the DSES as described in FIG. 1. The master key (210), in this configuration, is the source for a first key derivation communication processor (512) and second key derivation communication processor (514). These key derivation communication processors (512, 514) utilize information from the master key (210) to provide variants of the original master key (210). As in FIG. 5, the first key and second key derivation communication processors (512, 514) are distinguishable from each other in that they use unique initialization vectors and/or algorithms to each produce uniquely different derived keys.

[0068] The combination of the indirect hidden encryption token (550) and the encrypted output data (180) which has become available as communication signals (see FIG. 5) are received as an indirect encrypted decryption token (650) and as encrypted input data (280).

[0069] The master key (210) is provided to the second key derivation communication processor (514). The indirect encrypted decryption token (650) is sent to an indirect decryption token decrypter (640) along with the second derivation communication processor (514). The indirect decryption token decrypter (640) decrypts the indirect encrypted decryption token (650) and produces the key selector value (120).

[0070] The master key (210) is provided to the first key derivation communication processor (512) that is used by a dynamically selectable decryption key generator (230) together with the key selector value (120) to produce a decryption key (KD) in a dynamic fashion. The key (KD) maybe changed at any time based upon a change in the key selector value (120). The key selector value (120) is sent to the key selector receiver (220).

[0071] Decrypter (270) receives encrypted input data (280) which may be in the form of cyphertext and decrypts the data according to the value of the decryption key (KD). Decrypted output data receiver (260) from decrypter (270) may be provided in the form of plaintext. Both the values of the original key selector (120) and the original data (160) are available as decrypted communication signals from the key selector receiver (220) and the decrypted output data receiver, (260), respectively. At this point the communication signals using devices and the associated system have been securely transmitted through a dynamic encryption/decryption tunnel.

[0072] The decryption process described above is for dynamically encrypted data on the move. For dynamically decrypted data at rest, shown as an optional feature by using dashed lines, the key selector value (120) or the indirect encrypted decryption token (650) is utilized by a memory storage system (290) as the block address to recover the encrypted output data (280) at that specific block address. In this manner every block of memory in the memory storage system is encrypted and decrypted with a unique encryption key (KE).

[0073] FIG. 7 is a flow diagram (700) for operation of the Dynamically Selectable Dynamic Encryption System (DSDES) Encrypter (700A) with an Indirect Hidden Portion. The master key (110), in this configuration, is the source for a first key derivation communication processor (512) and second key derivation communication processor (514). These key derivation communication processors (512, 514) utilize information from the master key (110) to provide variants of the original master key (110). The first key and second key derivation communication processors (512, 514) are distinguishable from each other in that they use unique initialization vectors and/or algorithms to each produce uniquely different derived keys. The master key (110) is provided to the first key derivation communication processor (512) that is used by a dynamically selectable encryption key generator (130) together with the key selector value (120) to produce a data encryption key (KE) in a dynamic fashion. The key (KE) maybe changed at any time based upon a change in the key selector value (120). In addition the same master key (110) is provided to the second key derivation communication processor (514). The key selector value (120) is sent to a data combiner (775) along with control data from the dynamic encrypter (770) that includes descriptive information about the nature of dynamic encrypted output data (780) such as length, padding, and encryption parameters. The decryption token encrypter (340) encrypts the combined data from the data combiner (775) and produces an indirect hidden dynamic decryption token (750). Dynamic encrypter (770) receives data (160) which may be in the form of plaintext and encrypts the data according to the value of the key (KE). The dynamic encrypter functions to provide new encryption keys for every block of encrypted data of some length along with padding to further adjust the data (string) length as required. The length, padding, and encryption parameters are available for proper decryption and supplied to the data combiner (775). Dynamic encrypted output data (780) is accepted from dynamic encrypter (770) which may be provided in the form of cyphertext. The combination of the indirect hidden dynamic decryption token (750) and the dynamic encrypted output data (780) now becomes available as dynamic encrypted communication signals.

[0074] The dynamic encryption process described above is for dynamically encrypted data on the move. For dynamically encrypted data at rest, shown as an optional feature by using dashed lines, the key selector value (120) is utilized by a memory storage system (190) as the block address to store the dynamic encrypted output data (780) at that specific block address. In this manner every block of memory in the memory storage system is encrypted with a unique encryption key (KE). In the case of storing dynamically encrypted data at rest, fixed data block sizes are used that obviates the need for including control data from the dynamic encrypter (770) for completing decryption.

[0075] FIG. 8 is a flow diagram (800) for operation of the Dynamically Selectable Dynamic Decryption System (DSDDS) Decrypter (800A) with an Indirect Hidden Portion. The master key (210) has the same value as its matching master key (110) for the DSES as described in FIG. 1. The master key (210), in this configuration, is the source for a first key derivation communication processor (512) and second key derivation communication processor (514). These key derivation communication processors (512, 514) utilize information from the master key (110) to provide variants of the original master key (210). As in FIG. 5, the first key and second key derivation communication processors (512, 514) are distinguishable from each other in that they use unique initialization vectors and/or algorithms to each produce uniquely different derived keys.

[0076] The combination of the indirect hidden dynamic decryption token (750) and the dynamic encrypted output data (780) which has become available as communication signals (see FIG. 7) are received as an indirect dynamic encrypted decryption token (850) and as dynamic encrypted input data (880).

[0077] The master key (210) is provided to the second key derivation communication processor (514). The indirect encrypted dynamic decryption token (850) is sent to an indirect decryption token decrypter (640) along with the second derivation communication processor (514).

[0078] The indirect decryption token decrypter (640) decrypts the indirect dynamic encrypted decryption token (850) and sends it to the data splitter (875). The data splitter (875) separates the key selector value (120) from the control data which is sent to dynamic decrypter (870). The control data contains information such as length, padding, and decryption parameters.

[0079] The master key (210) is provided to the first key derivation communication processor (512) that is used by a dynamically selectable decryption key generator (230) together with the key selector value (120) to produce a decryption key (KD) in a dynamic fashion. The key (KD) maybe changed at any time based upon a change in the key selector value (120). The key selector value (120) is sent to the key selector receiver (220).

[0080] Dynamic decrypter (870) receives encrypted dynamic input data (880) which may be in the form of cyphertext and decrypts the data according to the value of the decryption key (KD). The dynamic decrypter (870) functions to provide new decryption keys for every block of decrypted data along with padding as required. The length, padding, and encryption parameters are available for proper decryption and supplied by the data splitter (875). Decrypted output data receiver (260) from dynamic decrypter (870) may be provided in the form of plaintext. Both the values of the original key selector (120) and the original data (160) are available as decrypted communication signals from the key selector receiver (220) and the decrypted output data receiver, (260), respectively. At this point the communication signals using devices and the associated system have been securely transmitted through a dynamic encryption/decryption tunnel.

[0081] The decryption process described above is for dynamically encrypted dynamic data on the move. For dynamically decrypted data at rest, shown as an optional feature by using dashed lines, the key selector value (120) is utilized by a memory storage system (290) as the block address to recover the encrypted dynamic output data (880) at that specific block address. In this manner every block of memory in the memory storage system is encrypted and decrypted with a unique decryption key (KD). In the case of storing dynamically encrypted data at rest, fixed data block sizes are used that obviates the need for including control data from the dynamic decrypter (870) for completing decryption.

[0082] FIG. 9 is a schematic (900) depicting the combination of two transceiver devices utilizing both encrypters and decrypters with memory. Communication signals from a first source (910) are sent through connection (920) to the first transceiver (930). The first transceiver (930) securely connects encrypted data through connection (940) through unsecured network (950). The second transceiver (970) securely connects encrypted data through another connection (960) through unsecured network (950). Communication signals from a second source (990) are sent through connection (980) to the second transceiver (970).

[0083] In order to secure communication signals from the first source (910) to the second source (990), the following process is required. The signals (910) enter the first transceiver (930) through connection (920) and travel to the (DSES) Encrypter (932). The (DSES) Encrypter (932) is controlled by the computer (931) to dynamically encrypt and transmit the communication signals to the DSDS Decrypter (973) via an unsecured network (950). Encrypted signals arrive at the second transceiver (970) to the DSDS Decrypter (973) controlled by computer (971). DSDS Decrypter (973) decrypts the signals and sends them to the second source (990) thorough connection (980). This accomplishes sending secured signals from a first source (910) to a second source (990) by utilizing the dynamic encryption system of the present disclosure. The communication signals can be conversely secured by sending them from the second source (990) to the first source (910) utilizing the DSES Encrypter (972) in the second transceiver (970) as well as the DSDS Decrypter (933) in the first transceiver (930). This completes the process for securing data in transit.

[0084] For data at rest for memory stored in storage devices, in order to securely store, seal and recover communication signals from the first source (910), the process described below is required. The first source (910) provides signals that enter the first transceiver (930) through the connection (920) and travel to the (DSES) Encrypter (932). The (DSES) Encrypter (932) is controlled by the computer (931) to dynamically encrypt, store and seal the communication signals to a first storage memory (935). To recover sealed storage signals from the first storage memory (935), the computer (931) removes dynamically encrypted communication signals from the first storage memory (935) and delivers the signals to the DSDS decrypter (933) which dynamically decrypts the signals allowing the unencrypted signals to flow back to the first source (910) through connection (920). The same process as described regarding data at rest is followed within the second transceiver (970) and second source (990).

[0085] FIG. 10 is a flowchart (1000) describing a device (1000A) that communicates randomized encrypted data with sub-channels (REDS) together with executable coded encryption key (ECEK) device that encrypts and/or decrypts data using executable coded keys (1075), which is a REDS/ECEK device. This REDS/ECEK device transmits randomized encrypted data with data sub-channels and with executable coded encryption keys. Beginning with a data source (1010) which could be plaintext, the data is sent to forward error correction encoder (1020) which encodes the data and provides a known degree of forward error correction to the data. This function enlarges the transmitted data by adding various error checking features that may include rows, columns, and diagonal checksums. The forward error corrected data is sent to the data combiner (1060). A random number generator (1030) provides a random number for a sub-channel data encoder (1050). Sub-channel data combiner (1040) which is comprised of inputs from temporal information (1041), message authentication codes (1042) and user datasuch as user ID data (1043), is sent to the sub-channel data encoder (1050). At this point, the sub-channel data encoder (1050) has received the required or desired input for the data sub-channels. The sub-channel data encoder (1050) now encodes the sub-channel data and sends it to the data combiner (1060). The data combiner (1060) combines the forward error corrected data with the sub-channel data. This combined data is sent to the executable coded encryption key device, an ECEK device, (1070 A), and into the encrypter/decrypter memory (1070) which stores the data while it is being encrypted and/or decrypted. The ECEK device (1070A) encrypts data using executable coded keys (1075). When the encryption/decryption is completed the data is sent to a transmitter (1090). The process of encryption/decryption is controlled by the executable coded keys (1075). The executable coded keys (1075) need only remain in computer memory for at least the duration of the encryption/decryption process. Executable coded keys (1075) control the execution of encryption/decryption subroutine primitives (1080). The subroutine primitives (1080) read, modify, and write the encrypter/decrypter memory (1070). This allows for the executable coded keys (1075) to control the encryption/decryption process of reading, modifying, and writing the encrypter/decrypter memory (1070) by utilizing the subroutine primitives (1080). This allows for the executable coded keys (1075) to be removed from a computer memory (not shown), as computer memory no longer contains instructions to encrypt and/or decrypt the data residing in the encrypter/decrypter memory (1070). As a result, it is impossible to reverse compile the code because the code no longer resides in computer memory. In addition, it is impossible to steal or copy the coded keys (1075) because they also no longer reside in computer memory. In the present disclosure, the encryption/decryption instructions reside in the key itself, for which no source code exists, i.e., there is no source code for the key.

[0086] The executable coded keys (1075) simply contain the typical binary randomized bits that are the same or similar to those contained in today's symmetric encryption keys. These bits may be interpreted by the encrypt/decrypt binary primitive interpreter (1082) which then dispatches control to the balance of the binary primitive subroutine libraries (1084, 1086). The binary primitive subroutine libraries (1084, 1086) are chosen functions which provide instructions to encrypt or decrypt the data in encrypt/decrypt memory (1070). While encrypting, the encryption set of primitives (1084) are utilized by bits in executable coded keys (1075) to produce encryption functions. While decrypting, a decryption set of primitives (1086), utilizes the same bits found in the executable coded keys (1075) which provide matching but inverse functions that are required to decrypt the data. For decryption, the bits used from the executable coded keys (1075) are utilized in a reverse order when compared with those utilized during and for encryption.

[0087] At this point data source (1010) has been combined with sub-channel data (1050) which includes randomness so that a fully randomized and encrypted data output has been realized and transmitted through transmitter (1090).

[0088] FIG. 11 is a flowchart (1100) describing a device (1100A) that communicates randomized decrypted data with sub-channels (RDDS) that receives randomized encrypted data with data sub-channels together with a device that uses an executable coded decryption key, (ECDK) devices that decrypts data using executable coded keys (1125). This combined device is a RDDS/ECDK device. The RDDS/ECDK device transmits randomized encrypted data with data sub-channels and with executable coded encryption keys.

[0089] Beginning with data receiver (1110) which could be cypher-text data is sent to the executable coded encryption key device, an ECEK device, (1120A), and into the encrypter/decrypter memory (1120) which stores the data while it is being encrypted and/or decrypted. The ECEK device (1120A) encrypts data using executable coded keys (1125). When the encryption/decryption is completed the data is sent to a transmitter (1130). The process of encryption/decryption is controlled by the executable coded keys (1125). The executable coded keys (1125) need only remain in computer memory for at least the duration of the encryption/decryption process. Executable coded keys (1125) control the execution of encryption/decryption subroutine primitives (1180). The subroutine primitives (1180) read, modify, and write the encrypter/decrypter memory (1120). This allows for the executable coded keys (1125) to control the encryption/decryption process of reading, modifying, and writing the encrypter/decrypter memory (1120) by utilizing the subroutine primitives (1180). This allows for the executable coded keys (1125) to be removed from a computer memory (not shown), as computer memory no longer contains instructions to encrypt and/or decrypt the data residing in the encrypter/decrypter memory (1120). As a result, it is impossible to reverse compile the code because the code no longer resides in computer memory. In addition, it is impossible to steal or copy the coded keys (1125) because they also no longer reside in computer memory. In the present disclosure, the encryption/decryption instructions reside in the key itself, for which no source code exists, i.e., there is no source code for the key.

[0090] The executable coded keys (1125) simply contain the typical binary randomized bits that are the same or similar to those contained in today's symmetric encryption keys. These bits may be interpreted by the encrypt/decrypt binary primitive interpreter (1182) which then dispatches control to the balance of the binary primitive subroutine libraries (1184, 1186). The binary primitive subroutine libraries (1184, 1186) are chosen functions which provide instructions to encrypt or decrypt the data in encrypt/decrypt memory (1120). While encrypting, the encryption set of primitives (1184) are utilized by bits in executable coded keys (1125) to produce encryption functions. While decrypting, a decryption set of primitives (1186), utilizes the same bits found in the executable coded keys (1125) which provide matching but inverse functions that are required to decrypt the data. For decryption, the bits used from the executable coded keys (1125) are utilized in a reverse order when compared with those utilized during and for encryption.

[0091] The encrypter/decrypter memory (1120) now possesses the decrypted data and allows the decrypted data to be sent to the forward error correction decoder (1130). The forward error correction decoder (1130) provides two data outputs. The first output is the forward error corrected data which is sent to the corrected data receiver (1140). As before, the data could be in plain text form. The second output from the forward error correction decoder (1130) sends the decrypted data to a sub-channel data decoder (1150). The sub-channel data decoder (1150) decodes the sub-channel data, sending the received random number to the random number receiver (1160) and the sub-channel data to the sub-channel data splitter (1170). Sub-channel data splitter (1170) splits the sub-channel data into sub-channel data receivers (1171, 1172, and 1173) which correspond to temporal information (1171), message authentication codes (1172) and user datasuch as user ID data (1173).

[0092] At this point, the data received from the data receiver (1110) has been split into both the corrected data receiver (1140) as well as the sub-channel data receivers (1171, 1172, and 1173) and the random number receiver (1160). After the operation described in FIG. 10 has evolved, the initial point source data (1010), the random number generator (1030), and the sub-channel data (1041, 1042, 1043) has now been fully de-randomized, decrypted, and recovered into the corrected data receiver (1140) as well as both the random number receiver (1160) and the sub-channel data receivers (1171, 1172, and 1173).

[0093] FIG. 11A is a schematic diagram that illustrates devices utilized initially represented in simple block form for FIGS. 1,2,3,4,5,6,7,8, 9, 10, and 11. More specifically, FIG. 11A further illustrates and demonstrates actual and various devices using exploded view callouts from that depicted in the schematic diagram shown in FIG. 11A and described above (in e.g. FIGS. 1-11). The list of devices associated with callouts 100A, 200A, 300A, 400A, 500A, 600A, 700A, 800A, 910, 930, 970, and 990, 1000A and 1100A (in FIGS. 1-11) can represent DASA database(s) as well as user devices and/or access devices including desktop or stand-alone computer terminals replete with hard drives, laptop computers, cellular or smart telephones, computer tablets such as the iPad and even printed circuit boards or integrated circuits (ICs). Further, elaborating on the virtual user devices as described above, these can be created and are shown as real output device(s). It remains important to understand that these real devices can be used to create virtual user devices.

[0094] As stated above, further examples of many to many connections are also included herein as communication data connections with the list of 100A, 200A, 300A, 400A, 500A, 600A, 700A, 800A, 910, 930, 970, and 990, 1000A, and 1100A devices. Data communication amplifiers, repeaters, and/or range extenders which optionally assist in ensuring signal integrity and strength, over various communication distances can be located in the data communication flow paths connecting the DASA databases, user devices, and/or access devices.

[0095] Specifically, FIG. 12 is a schematic which provides at least one embodiment of the computer enabled access control (securitization) system (1200), which contains, in this instance, a real or virtual master distributed auto-synchronous array (DASA) database (1210), depicted as a cloud, that at least stores and retrieves data and that includes at least two or more partial distributed auto-synchronous array (DASA) databases D1, D2, D3, shown as (1220, 1222, and 1224) so that the partial DASA databases 1220(D1), 1222(D2), and 1224(D3)) are capable of functioning in an independent and/or collaborative manner (1230), and such that the master DASA database (1210) and partial DASA databases (1220, 1222, and 1224) allow for bi-directional transmission of data, shown as (1220a), (1220b), and (1220c) for 1220 (D1) as well as for 1222 (D2) with transmissions (1222a), (1222b), and (1222c). Simply for the purposes of illustration, these transmissions are shown to be different than the transmissions shown to exist for (1224), D3 as will be further explained below. It should be noted that the D3 transmissions can be identical to those of D1 and/or D2 and that multiple databases D1 . . . Dn can exist.

[0096] The multiple partial user devices U1, U2, U3 are shown as (1240), (1250), and (1260) respectfully. The multiple partial user devices in this instance include 2 sets of records in U1(1240); U1R1(1245) and U2R2 (1246), 3 set of records in U2(1250); U2R1(1255), U2R2(1256), and U2R3 (1257), and 5 sets of records in U3 (1260); U3R1(1265), U3R2 (1266), U3R3(1267), U3R4 (1268), and U3R5 (1269). Each of these user devices contains optional computing capabilities (1241, 1251, and 1261) that also provide for overall optional read/write functionality (1242). Multiple partial access devices (A11270 and A21275) exist that can store and provide at least partial copies, U1 (1240) with a set of records U1R1 and U1R2(1245, 1246), U2 (1250), with sets of records U2R1, (1255), U2R2, (1256), and U2R3, (1257). Access device A2 (1275), in this case possesses 3 sets of records, U1 (1240), with records U1R1, (1245) and U1R2, (1246), U3, (1260), with 5 sets of records U3R1 through U3R5; (1265-12269) and U4 (1290), which is a virtual user device, that in this instance contains 7 records, U4R1 through R7 that are represented as U4R1(1293), U4R2(1294), U4R3(1295), U4R4(1296), U4R5(1297), U4R6(1298), and U4R7(1299). The virtual user device, U4 (1290) is created by output device(s) (1291) e.g. printers, scanners, tokens, stamps, RFID tags, encoders, wave scanners, electromagnetic devices, etc. which subsequently create virtual user devices (U4). In other cases, it is possible that these user devices could be a collection of both real and virtual user devices that also can be connected to a partial database D3 (1224).

[0097] In this case, virtual U4 (1290), U4R1 (1293) is a printed bar code ticket that could be provided in a paper or electronic format. U4R2 (1294) is a QR code printed on a more durable plastic medium or electronic format. U4R3 (1295) is an electronic record sent to a user's personal smart display device (e.g. an application on a cell phone) which displays a QR code on its screen. U4R5-U4R7 (1296-1299), in this case are RFID tags that provide for bi-directional nearfield communications. Each of these records within the virtual U4 device (1290) are produced by appropriate output devices (1291) for each media type. In the case of U4R3(1295) which is for a smart or intelligent application and for U4R4-U4R7 (1296-1299) which is a read-write device, these records can be distinguished from a single photographic copy so that only the designated users/user devices can possess the authentic and validated records. The read-write capability allows for verification of the actual token, which is not possible for records U4R1 (1293) and U4R2(1294), which are simple images. The simple images must still be used in sequence, in a single instance, unless tolerance rules provide otherwise.

[0098] Here the master DASA database (1210) and/or partial DASA databases (1220, 1222, and 1224) are linked and communicate with one or more logging and monitoring database(s) (1205) capable of statistical and numerical calculations utilizing or otherwise involving the data. An alarm function can also be implemented with or without the assistance of temporal devices (such as clocks and other timepieces).

[0099] FIG. 12 also provides, as an example, a set of process rules which are carried out directly or indirectly as computer operations (1280) that are followed to authenticate (1281), validate (1282) and determine access (1283) for user devices. These rules apply to all access devices, including access devices, A1 (1270) and A2 (1275). There can be, and often are, different rules that should be followed for other access devices. The flow path provided indicates that the access device(s) authenticates (1281) using a first set of rules, validates (1282) using a second set of rules, and includes a third set of rules that controls access (1283) using data that has been supplied by the user devices to ensure access to only a specified set of users under specified conditions.

[0100] The process rules are finalized with an access decision (1284) which includes at least two options. One option is an access decision (1285) that includes the process of allowing user access and verifies the user has invoked their privileges. This may include, for example, physical access such as opening doors or logical access such as unlocking data within databases or communication systems. Normally the user would be alerted to the system when allowing access. The user's activity then may be monitored by the access process to ensure that they have utilized their access within certain limitations. Physical limitations may be provided by enabling door monitoring switches, floor-mats, man traps, video analysis, etc. Logical limitations may be monitored by keyboard and/or data access and the like. Temporal limitations may be employed as required. Access may further be limited by counting the number of access/egress attempts. In the case of access denial (1286), the user will be normally notified of the denial of access and optional alarming may take place. Reporting of the activity is normally returned from the access device(s) (e.g. 1270, 1275) to the master DASA database (1210), which also provides for logging the data, meta-data and associated information to the external logging and monitoring database (105).

[0101] FIG. 12A further illustrates and demonstrates actual and various devices using exploded view callouts from that depicted in the schematic diagram shown in FIG. 12 and described above. Specifically, (1205), the monitoring database, is shown as linked, residing within, and/or processed by a server or other computer microprocessor(s). In addition, the DASA database (1210) and/or partial DASA databases (1220, 1222, and 1224) are linked and communicate with the same or different (in some cases hardware) server(s) or other computer microprocessor(s). In addition, the multiple partial user devices U1, U2, U3 shown as (1240), (1250), and (1260) respectfully, as well as the multiple partial access devices, (1270), (1275) are shown as one or more of several hardware devices including a desktop computer terminal and hard drive, a laptop computer, a cellular or smart phone, a tablet, such as an iPad, and even a printed circuit board or integrated circuit (IC).

[0102] Further, elaborating on the virtual user device, U4 (1290) as described above, can be created and are shown as real output device(s) (1291) e.g. printers, scanners, tokens, stamps, RFID tags, (1293, 1294) existing on or in cell phones or scanners (1295) and/or functioning encoders, wave scanners, and/or electromagnetic devices (1296-1299). It is important to understand that these real devices can be used to create virtual user devices (U4)as shown in FIG. 12.

[0103] The availability of such a system allows for stronger security regarding the degree of confidentiality with more confidence. Employing this system further establishes the goal to help encryption systems develop a larger acceptance reputation. Such acceptance provides a consequent increase in usage and a worldwide strengthening of data communications, electronic mail, and commercial electronic transactions.

[0104] While most of the foregoing discussion about the present encryption technique has focused on the use of databases, lists and tables for storing transaction specific codes, it may be preferred in some applications having limited memory to provide an algorithm for calculating the next transaction specific code. The concept of tolerance described earlier may be incorporated either by setting an acceptable range of values for the transaction specific code (output of the algorithm) or the designated portion itself (input to the algorithm), the later being the equivalent of back calculating the designated portion and verifying that it is within the range of tolerance.

[0105] The computer readable media described within this application is non-transitory. In most if not all cases, the transmission of data is transmitted via signals that are non-transitory signals.

[0106] In addition, each and every aspect of all references mentioned herein are hereby fully incorporated by reference.

[0107] In compliance with the patent laws, the subject matter disclosed herein has been described in language more or less specific as to structural and methodical features. However, the scope of protection sought is to be limited only by the following claims, given their broadest possible interpretations. The claims are not to be limited by the specific features shown and described, as the description above only discloses example embodiments. While the foregoing is directed to preferred embodiments of the present invention, other and further embodiments of the invention may be devised without departing from the basic scope thereof, and the scope thereof is determined by the claims which follow.