SECURE ENCRYPTION OF SUBBLOCKS

Abstract

A computer-implemented method for encrypting blocks of data, the method comprising: Receiving (210), by one or more computer processors, blocks of compressed data; determining (220), by the one or more computer processors, a size, in bytes, of the compressed data; specifying, by the one or more computer processors, a first partially plaintext-filled memory block corresponding to the size, in bytes, of the compressed data; Changing (230), by the one or more computer processors, the first partially plaintext-filled memory block to include: a trailer with an in-block length field representing the number of plaintext data bytes in the first memory block, the plain text, and a non-zero padding sufficient to fill the first memory block, Encrypting (240), by the one or more computer processors, the compressed data and the trailer, resulting in encrypted data, wherein a header of the encrypted data comprises a number of complete encrypted data blocks; and Providing (250), by the one or more computer processors, the encrypted data to a user.

Description

FIELD OF THE INVENTIONThe disclosure relates generally to encrypting digital data. The disclosure relates in particular to the encryption of sub-data blocks.BACKGROUNDMethods for encrypting block data divide target plaintext data into regular-size data blocks, and then apply the encryption algorithm to each block. Since the plaintext may not include a complete number of data blocks, a remainder of plaintext remains. Typical block encryption methods fill the last block of data with the remainder and the necessary number of zeroes to complete the block.Document US 2014 / 0201523 A1 describes a transmission device capable of avoiding unnecessary decryption and preventing a denial-of-service attack. The transmission apparatus that establishes a secure communication channel (SA) between the transmission apparatus and a reception apparatus includes a creation section that creates a packet, an encryption section that determines encryption coverage in the created packet and encrypts data in the encryption coverage based on a ratio of a redundant packet to the packets created by the packet creation section and an instruction from the reception apparatus, and a transmission section that transmits the encrypted packet of the SA.SUMMARYA summary is presented below to provide a basic understanding of one or more embodiments of the disclosure. This summary is not intended to indicate key or critical elements or to outline any scope of the respective embodiments or any scope of the claims. Its sole purpose is to present concepts in simplified form as a prelude to the more detailed description presented later. In one or more embodiments described herein, devices, systems, methods, apparatus, and / or computer program products, which are executed by a computer, enable secure encryption of memory blocks that are partially filled with plain text.Aspects of the invention disclose methods, systems and computer readable media for encrypting data blocks by receiving blocks of compressed data, appending a trailer to the compressed data in bytes of the compressed data, the trailer associated with the size in bytes of the compressed data, encrypting the compressed data and the trailer to yield encrypted data, wherein a header of the encrypted data comprises a number of complete encrypted data blocks, and providing the encrypted data to a user.BRIEF DESCRIPTION OF THE DRAWINGSBy describing some embodiments of the present disclosure in more detail in the accompanying drawings, the foregoing, as well as other objects, features, and advantages of the present disclosure will become more apparent, with the same reference number generally referring to the same components in the embodiments of the present disclosure. FIG. 1 provides a schematic illustration of a computing environment according to an embodiment of the invention. FIG. 2 provides a flow chart illustrating a processing sequence according to an embodiment of the invention. FIG. 3 illustrates a cloud computing environment, according to an embodiment of the invention. FIG. 4 illustrates abstraction model layers according to an embodiment of the invention.DETAILED DESCRIPTIONSome embodiments will be described in more detail with reference to the accompanying drawings, in which the embodiments of the present disclosure are illustrated. However, the present disclosure may be practiced in various ways and thus should not be construed as limited to the embodiments disclosed herein.Deterministic encryption is weak in its ability to protect low entropy plain text. Disclosed embodiments provide ways to protect low entropy plain text input. An example of a low entropy plaintext would be provided by a file system that was used to store a file having a length of N+1 bytes in a fixed block storage system that stores data in fixed length sectors (e.g., 512 or 4096 bytes). If N is evenly divisible by the sector length, this means that the final byte of the file overflows into the last sector required to record it - that is, the final sector contains only one byte.The Advanced Encryption Standard (AES) is a block encryption technique that encrypts 16 bytes (i.e., an AES block) each. Many encryption modes of AES (e.g., ECB, CBC, CFB, OFB, XEX, etc.) always generate an integer of 16-byte blocks of ciphertext. The encryption mode XTS uses ciphertext stealing, which makes it possible to encrypt an encryption of any integer (greater than or equal to 16) bytes into the same number of ciphertext bytes. To efficiently decrypt XTS, one must know the exact length of the ciphertext to be decrypted. An encryption mode, such as deterministic use of XTS-AES, that generates a fixed ciphertext block output for a given key and a 16-byte AES block input, may be weak when the attacker has access to an encryption doctor (i.e., may cause encryption to occur with the key and may capture the resulting ciphertext output).To reduce the granularity of the 'jellyact'compressibility information, disclosed embodiments append bytes of received data prior to encryption. Knowing the exact number of bytes, the fixed block sector (e.g., 4 Kb) to which compression has been made clearly gives more price than knowing only the modulo 16 rounded number of bytes (e.g., if the final AES block 1, 2,... 16 bytes).For example, if an attacker knows that there may be only one byte of 'content' in an AES block and the remaining 15 bytes of that AES block are filled with a known value (e.g., zero pad) in this case, the attacker, with access to an encryption doctor, may create the ciphertext that would be created for all 256 possible values of that one byte, thereby creating 256 ciphertext outputs (each with a length of 16 bytes). When the attacker sees one of the 256 ciphertext values (at the expected offset into the resulting ciphertext), the attacker knows which plaintext byte was encrypted.One application that requires deterministic encryption is the extensions that have been devised in Length Preservation Compression (LPC) to enable data duplication. Such an extension is referred to as opportunistic deduplication, which requires the use of convergent encryption (a form of deterministic encryption) of sufficiently compressible data. In the most basic form of LPC, all padding of the last block with zeroes is done to maximize the ability of a downstream compression engine to achieve the maximum possible compression ratio (which is basically just a null removal). In the case where the compressed plain text being encrypted comprises one (or only a few) byte(s) that overflows / overflows into the last AES block to be encrypted, this(s) last(s) byte(s) could easily be determined by means of the above mentioned attack. Disclosed embodiments enable improvements in the security of encrypting the bytes of plaintext data in the last sub-data block.Disclosed embodiments improve the security of encrypted data by filling in a sub-data block with an intra-block length value and a non-zero pad (NZP) prior to encrypting the block. This manner of filling the sub-frame reduces the effectiveness of attacks that are to recognize the plain text of the sub-frame.In one embodiment, methods improve the security of encrypted data by receiving blocks of compressed data, determining a byte size - the size in bytes - of the compressed data, and appending a trailer to the compressed data (the trailer associated with the determined byte size of the compressed data). In this embodiment, the method further encrypts the compressed data and the attached trailer, yielding encrypted data. A header of the encrypted data comprises the number of complete encrypted data blocks of the encrypted data.Aspects of the invention provide an improvement in the art of data encryption. Conventional encryption fills in a final sub-frame with zeroes to simplify data compression tasks. This manner of filling the last sub-block reduces the security of the plain text transmitted in the last data block. By adding an intra-block length value and a non-zero pad, an entire block is provided for encryption instead of the incomplete block of plain text and a remainder of zero padding. Encrypting an entire block including the NZP yields ciphertext that is less susceptible to attack.Aspects of the invention also provide for improvement in computer functionality. More particularly, embodiments of the invention are directed to a particular improvement in the manner in which cryptographic systems, such as AES cryptographic, operate. Disclosed embodiments improve the security of the encrypted plaintext by eliminating ciphertext artifacts resulting from using all zeros to fill in sub-frames.In one embodiment, one or more components of the system may employ hardware and / or software to solve problems that are highly technical in nature (e.g., changing sub-data blocks to include an intra-block length value, a sub-block of plain text, and a non-zero pad, encrypting the filled data block, etc.). These solutions are not abstract and cannot be performed as a series of mental operations by a human due to the processing functions necessary to enable secure encryption of sub-data blocks. Furthermore, some of the processes performed may be performed by a special purpose computer for performing defined tasks related to encryption methods. For example, a special purpose computer may be employed to perform tasks related to stuffing and encrypting sub-blocks of data, or the like.In one embodiment, the method receives compressed ciphertext data, the method may receive uncompressed ciphertext data, and then compress the ciphertext data. After compression, the method determines the number of bytes of the compressed data, the byte size of the compressed data, and determines the number of bytes, 0 to 15, in the last block of the compressed data. In this embodiment, for data in which the length of the compressed data is evenly divisible by the length of the cipher block, the method appends a single byte trailer to the compressed data with four bits of the trailer set to 0000, indicating that zero bytes in the last block of the compressed data are part of the ciphertext. For data with a CDL that is not divisible by the block length, the method appends additional bytes and the trailer, consisting of a single byte, to complete the last block. Four bits of the trailer are set to a value between 0001 and 1111 to indicate the number of bytes of the last block that are part of the compressed data.In one embodiment, the padding data comprises non-deterministic (random) data for compressed data streams whose CDL is less than M blocks. For compressed data whose CDL is larger than M blocks, padding comprises deterministic data, such as part of an output of an encrypted hash function used as an encryption initiation vector (IV).In one embodiment, the method appends one or more blocks of non-deterministic data to the compressed data such that the total number of data blocks equals a defined block threshold of M AES blocks, in addition to the trailer. In this embodiment, the last appended block comprises fifteen bytes of non-deterministic data as well as the single byte trailer described above. In this embodiment, four bits of the trailer indicate the number of additional padding blocks added to the compressed data. In this embodiment, the remaining four bits of the trailer indicate the number of bytes of the last block before the added padded blocks comprising compressed data.The compressed data, padding blocks, if any, and the trailer's final block are then encrypted using the selected encryption function. The method determines the number of encrypted blocks. This block number is then provided as part of a two byte header which is appended to the blocks of ciphertext along with the encryption initiation vector. The method then provides the user with the ciphertext, header, and IV.In one embodiment, a method deviates from a simple form of Length Preserving Compression (LPC) to ensure the case where the last AES block is only partially filled. More specifically, whenever the actual length of the compressed data fills only 15 or fewer bytes of the last 16-byte AES block to be recorded, the method handles this block differently. As an example, a length (L) field of LPC is set to N+1, where N is the integer of fully filled AES blocks and the '1' is basically a flag indicating that the last AES block is only partially filled. The invention extends the LPC so that this last AES block is formatted as follows: 1) an intra-block length (IBL) field representing the exact number (1 to 15) of compressed data bytes input to this AES block. The IBL could be as long as only 4 bits (thus representing 16 values), although it would be simplest to use an IBL field of 1 byte length. The IBL field would then be followed by the 15 or fewer plain text (P) bytes. The P bytes would be followed by 0 to 14 bytes of non-zero padding (NZP). Various embodiments utilize different opportunities for the NZP bytes, as described below.In one embodiment, a method for encrypting data includes dividing N+1 bytes of data into data blocks, where N is evenly divisible by the block size. In one embodiment involving the use of Length Preserving Compression (LPC), the method requires storing a data chunk of up to 4 KB in a 4-KB fixed block memory sector. The method fills the 4 KB sector with L, a 2-byte field representing or indicating the length of the compressed plain text to be encrypted, CPT, the compressed plain text whose length is in the range of 1 to 4094-T bytes, where T represents the minimum length of a zero pad to fill the sector. In one embodiment, CPT falls within the range of 1 to 4096-T bytes, where T represents a combination of 2 bytes for L and 16 bytes for the zero pad of the sector. In one embodiment, the plain text may not be sufficiently compressible to fall within the defined CPT range or leave sufficient space for the ZP. In this embodiment, the method encrypts the plaintext directly (i.e., without intermediate data compression) using an encryption mode that does not expand the plaintext so that the encrypted ciphertext fits within the sector.In one embodiment, at any value between 1 and 4094-T, the last 16-byte block of the sector is typically only partially filled with plain text (15 / 16 cases). The method then fills the remainder of this last block with the NZP. In one embodiment, the method evaluates the CPT value to determine whether the last block containing plain text is filled in whole or in part. In one embodiment, the method evaluates the last block containing plaintext data to determine whether that block is completely or partially filled with plaintext data.In disclosed embodiments, the last plaintext block of the AES using an LPC scheme includes an NZP between 1 and 15 bytes. In one embodiment, the method generates a random number having the necessary number of bytes and fills the last AES block with the randomly generated value. In this embodiment, the NZP provides security due to the random nature of the NZP value. Such a random NZP value offers little or nothing with respect to data duplication possibilities, since identical plain text data would have different randomly generated NZP values with very high probability.In one embodiment, the method derives the necessary 1 to 15 bytes for the NZP from an encrypted hash of the plain text of entire blocks of the current memory sector. The method uses the same key intended for use in encrypting the plain text along with a corresponding hash function, such as SHA 256, to derive the hash value. In one embodiment, the key represents a public key of a public-private-key pair in which the recipient retains the private key to be used to decrypt the received AES-encrypted data sectors. The method then shortens the hash value to the necessary number of bytes required by the NZP to fill the last partially filled data block. In this embodiment, the method may generate an encrypted hash of all entire blocks of the current sector (i.e., those blocks that belong to the last partially filled block). In this embodiment, the method may generate the encrypted hash value using any number of the associated blocks from 1 to N, N representing the full number of filled data blocks associated with the last partially filled block.In one embodiment, the method derives the NZP from an encrypted hash value generated using the encryption key and a portion of the ciphertext generated by encrypting entire blocks belonging to the last sub-block. In this embodiment, the method may generate the encrypted hash value using any number from 1 to N whole blocks of ciphertext, where N represents the complete number of whole blocks belonging to the last partially filled block. In this embodiment, the method shortens the generated encrypted hash value to the number of bytes required by the NZP to completely fill the last partially filled data block.In one embodiment, the method generates the NZP from an encrypted hash of the entire plain text of the current sector (i.e., the plain text of entire blocks of the sector as well as the plain text of the last partially filled block). In this embodiment, the method may use the plain text from the last sub-block as well as the plain text from any number between 1 and N blocks of the sector, where N represents the complete number of whole data blocks of the sector. The method may use blocks, starting with the first entire block and proceeding in the forward direction, or starting with the last entire block and proceeding in the reverse direction to generate the encrypted hash value. For example, the method may use the plain text from the first whole block as well as M additional whole blocks, where M is between 0 and N-1, plus the partial plain text of the last block. As another example, the method may generate the encrypted hash value from the plain text of the last partially filled data block as well as the last entire data block before the partially filled data block plus M additional data blocks counted back from the last entire block, where M is between 0 and N-1. In this embodiment, the method shortens the encrypted hash value as needed to fill the last partially filled data block.In one embodiment, the method uses a remainder portion of an encrypted hash value generated as an initialization vector (IV) for AES encryption. As an example, IV = hk = hash (Kd | |P), where Kd represents the key and P represents the plain text used in generating the IV. In this embodiment, the method uses 12 bytes of the generated value as the IV, while the hash function, such as SHA 256, generates a 32-byte output value. In this embodiment, the method uses as many of the remaining 20 bytes of the generated value as needed to fill the partial entire last data block.In one embodiment, after filling the last partially filled data block of the sector with a corresponding NZP, the method encrypts the last data block using AES and an IV generated as described above. In this embodiment, the method provides the ciphertext generated by encrypting the last data block to the set of ciphertexts generated by encrypting the other data blocks of the sector. The method provides the complete set of ciphertexts for distribution to one or more receivers of the encrypted data. In this embodiment, the one or more recipients receive the set of ciphertexts and decrypt the ciphertexts using a private key of the public-private-key pair.In one embodiment, the method continues encrypting the data blocks after filling the partially filled data block with the IBL length value and the N XP. In one embodiment, the method encrypts the data blocks associated with the sub-block before filling the sub-block and uses at least a portion of the ciphertext of these blocks in generating the NZP.In one embodiment, the method uses wide block encryption to encrypt all data blocks of the sector as a whole, which reduces the effectiveness of attacks based on a final data block that contains only a subset of plain text. In this embodiment, the method uses encryption such as wide block encryption, such as encryption mix encryption 2 EME2, to encrypt the set of data blocks.FIG. 1 provides a schematic representation of example network resources associated with practicing the disclosed inventions. The inventions may be practiced in the processors of any of the disclosed elements that process an instruction stream. As shown in the figure, a networked client device 110 is wirelessly connected to a server subsystem 102. A client device 104 is wirelessly connected to the server subsystem 102 via a network 114. The client units 104 and 110 include a time-series data encryption program (not shown) along with sufficient data processing resources (processor, main memory, network transfer hardware) to execute the program. As shown in FIG. 1, server subsystem 102 includes a server computer 150. FIG. 1 illustrates a block diagram of components of server computer 150 within networked computer system 1000, according to an embodiment of the present invention. It should be appreciated that FIG. 1 illustrates only a single embodiment and does not imply any limitations on the environments in which various embodiments may be practiced. Many changes can be made to the environment depicted.The server computer 150 may include processor(s) 154, main memory 158, persistent memory 170, transfer unit 152, input / output (I / O) interface(s) 156, and transfer fabric 140. The transfer fabric 140 provides transfers between a cache 162, the main memory 158, the persistent storage 170, the transfer unit 152, and the input / output (I / O) interface(s) 156. The communication fabric 140 may be embodied with any architecture configured to pass data and / or control information between processors (such as microprocessors, communication and network processors, etc.), system memory, peripheral devices, and any other hardware components within a system. For example, the transmission fabric 140 may be implemented with one or more buses.The main memory 158 and the persistent storage 170 are computer readable storage media. In this embodiment, the main memory 158 includes a random access memory (RAM) 160. Generally, main memory 158 may comprise any suitable volatile or non-volatile computer readable storage media. Cache 162 is a high speed memory that improves the performance of processor / processors 154 by holding recently accessed data and nearly recently accessed data from main memory 158.Program instructions and data used to practice embodiments of the present invention, e.g., data encryption program 175, are stored in persistent memory 170 for execution and / or access by one or more of the respective processors 154 of server computer 150 via cache 162. In this embodiment, persistent storage 170 includes a magnetic hard disk drive. Alternatively or in addition to a magnetic hard disk drive, persistent memory 170 may include a solid state hard disk drive, a semiconductor storage unit, a read only memory (ROM), an erasable programmable read only memory (EPROM), a flash memory, or any other computer readable storage medium capable of storing program instructions or digital information.The volumes used by the persistent storage 170 may also be interchangeable. For example, a replaceable hard disk drive may be used for the persistent storage 170. Other examples include optical and magnetic disks, thumb drives, and smart cards that are loaded into a drive for transfer to another computer readable storage medium that is also part of persistent storage 170.The transfer unit 152 in these examples enables transfers with other computing systems or units, including resources of the client computing units 104 and 110. In these examples, the communication unit 152 includes one or more network interface cards. The transmission unit 152 may provide transmissions through the use of physical or wireless, or both physical and wireless transmission links. Software distribution programs, as well as other programs and data used for an execution of the present invention, may be downloaded by the transfer unit 152 into the persistent storage 170 of the server computer 150.The I / O interface(s) 156 enable / enable input and output of data to other entities that may be connected to the server computer 150. For example, the I / O interface(s) 156 may provide a connection to (an) external device(s) 190 such as a keyboard, keypad, touch screen, microphone, digital camera, and / or other suitable input device. The external unit(s) 190 may also include removable computer readable storage media such as thumb drives, removable optical or magnetic disks, and memory cards. Software and data used to practice embodiments of the present invention, e.g., data encryption program 175 on server computer 150, may be stored on such removable computer readable storage media and loaded into persistent memory 170 via (an) I / O interface(s) 156. The I / O interface(s) 156 is / are also connected to a screen 180.The screen 180 provides a mechanism to display data to a user, and may be, for example, a computer monitor. The screen 180 may also function as a touch-sensitive screen, such as a screen of a tablet computer.FIG. 2 provides a flowchart 200 illustrating example activities associated with practicing the disclosure. After the program boot at block 210, the data encryption program 175 executing on one or more processors such as those illustrated in FIG. 1 receives compressed or uncompressed plaintext data. For uncompressed plaintext data, the method executes a data compression routine that yields compressed plaintext data. At block 220, the method determines a byte size of the compressed data, which includes determining the number of compressed data bytes present in a last block of the compressed data. As an example, the method divides the total number of compressed data by a block byte size to determine the number of full blocks of compressed data as well as the number of bytes in a final sub-block of compressed data. At block 230, the method changes the sub-data blocks by adding a trailer, which indicates the number of bytes in the sub-data block, to the plain text of the sub-data block.In one embodiment, the method appends an intra-block length value, where the intra-block length value represents a 2-byte value for the length of the plain text. In addition to the intra-block length field and the plain text, the method fills the remainder of the sub-block with non-zero padding. The non-zero padding may represent a generated random number, an encrypted hash of plain text from the other blocks of the sector belonging to the sub-block, an encrypted hash of the secret text from the other blocks of the sector belonging to the sub-block, or a remainder of an encrypted hash value generated as an initialization vector for an encryption function used by the method.At block 240, the method encrypts the combined compressed data and the attached trailer. In one embodiment, the method appends additional data blocks to the compressed data to meet a minimum data block threshold requirement for the encryption algorithm. In one embodiment, the method uses a block encryption program to individually encrypt each block of the sector. In one embodiment, the method uses a wide block encryption program to encrypt all blocks of the sector as a set.At block 250, the method provides a user with the encrypted data as well as an external header that includes an indication of the total number of encrypted blocks and an encryption initiation vector. As an example, the encrypted data provided has the format: header; IV; ciphertext; zero pad, where the zero pad represents blocks of data sufficient to fill an output size of an encryption algorithm.It should be understood from the outset that implementing the teachings provided herein is not limited to a cloud computing environment, although this disclosure includes a detailed description of cloud computing. Rather, embodiments of the present invention may be practiced in conjunction with any other type of now known or later invented computing environment.Cloud computing is a service provisioning model for facilitating smooth, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, main memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with a provider of the service. This cloud model may include at least five properties, at least three service models, and at least four implementation models.The properties are as follows:On-demand self service: A cloud user can provide data processing functions such as server time and network storage automatically on a one-side basis as required without requiring human interaction with the provider of the services.Broad Network Access: Functions are available over a network that are accessed by standard mechanisms that support use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).Resource Pooling: The provider's computing resources are merged to serve multiple users using a multi-tenant model, where different physical and virtual resources are dynamically allocated and re-allocated as needed. There is a felt location independence because the user generally has no control over the exact location of the resources provided, but may be able to specify a location at a higher level of abstraction (e.g., country, state, or data center).Rapid Elasticity: Functions can be provided quickly and elastically for a fast horizontal scaling (scale out), in some cases also automatically, and enabled for a fast scale-in quickly. The functions available for providing often appear unlimited to the user and they can be purchased in any quantity at any time.Measured Service: Cloud systems automatically control and optimize the use of resources by utilizing a measurement function at a certain level of abstraction that is appropriate for the type of service (e.g., storage, processing, bandwidth, and active user accounts). The use of resources can be monitored, controlled and reported, thereby providing transparency to both the provider and the user of the service being used.The service models are as follows:Software as a Service (SaaS): The function provided to the user is to use the provider's applications running in a cloud infrastructure. The applications are accessible from various client devices via a thin client interface, such as a web browser (e.g., web-based email). The user does not manage or control the underlying cloud infrastructure, including the network, server, operating systems, storage or even individual application functions, with the possible exception of limited user-specific application configuration settings.Platform as a Service (PaaS): The function provided to the user is to deploy user-created applications created using provider-supported programming languages and tools in the cloud infrastructure. The user does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems or memories, but has control over the applications used and possibly over configurations of the application hosting environment.Infrastructure as a Service (laaS): The function provided to the user is to provide processing, storage, networks, and other basic computing resources, where the user is able to deploy and execute any software that may include operating systems and applications. The user does not manage or control the underlying cloud infrastructure, but has control over operating systems, memory, deployed applications, and possibly limited control over selected network components (e.g., host firewalls).The models of deployment are as follows:Private Cloud: The cloud infrastructure is operated solely for one organization. It may be managed by the organization or a third party, and may be located in the own rooms or in foreign rooms.Communication Cloud: The cloud infrastructure is shared among multiple organizations and supports a specific user community that has shared issues (e.g., mission, security requirements, policies, and policy compliance considerations). It may be managed by the organizations or a third party, and may be located in the own rooms or in foreign rooms.Public Cloud: The cloud infrastructure is provided to the general public or a large industry group and belongs to an organization selling cloud services.Hybrid Cloud: The cloud infrastructure is a composition of two or more clouds (private, user community, or public) that, while remaining individual entities, are interconnected by standardized or proprietary technology that enables data and application portability (e.g., cloud target group distribution for load balancing between clouds).A cloud computing environment is service-oriented with focus on state independence, low coupling, modularity, and semantic interoperability. Within the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.Referring to FIG. 3, an illustrative cloud computing environment 50 is illustrated. As shown, cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud users, such as a personal digital assistant (PDA) or cellular telephone 54A, desktop computer 54B, laptop computer 54C, and / or automobile computer system 54N, may communicate. The nodes 10 can communicate with each other. They may be grouped (not shown) physically or virtually in one or more networks such as the private, community, public, or hybrid clouds described hereinabove, or a combination thereof. This enables cloud computing environment 50 to offer infrastructure, platforms, and / or software as services for which a cloud user does not need to keep resources on a local computing device. It should be appreciated that the types of computing devices 54A-N shown in FIG. 3 are intended to be illustrative only, and that computing nodes 10 and cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or over any type of network-callable connection (e.g., using a web browser).Referring to FIG. 4, a set of functional abstraction layers provided by the cloud computing environment 50 (FIG. 3 ) is shown. It should be understood from the outset that the components, layers, and functions shown in FIG. 4 are intended to be illustrative only and embodiments of the invention are not limited thereto. As illustrated, the following layers and corresponding functions are provided:A hardware and software layer 60 includes hardware and software components. Examples of hardware components include: mainframe computer 61; reduced instruction set computer (RISC) architecture based servers 62; servers 63; blade servers 64; storage units 65; and networks and network components 66.Virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers 71; virtual storage 72; virtual networks 73, including virtual private networks; virtual applications and operating systems 74; and virtual clients 75.In one example, a management layer 80 may provide the functions described below. Resource provider 81 provides dynamic data processing resource conservation as well as other resources used to perform tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking when using resources within the cloud computing environment as well as accounting for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud users and tasks, as well as protection for data and other resources. A user portal 83 provides users and system administrators with access to the cloud computing environment. Management of the service scope 84 provides for the allocation and management of cloud computing resources so that the required service objectives are achieved. Planning and satisfying Service Level Agreement (SLA) 85 provides the arrangement in advance and the acquisition of cloud computing resources for which a future request is anticipated according to an SLA.A workload layer 90 provides examples of the functionality for which the cloud computing environment may be used. Examples of workloads and functions that may be provided by this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom training provision 93; data analytics processing 94; transaction processing 95; and data encryption program 175.The present invention may be a system, method and / or computer program product at any level of technical detail integration. The invention may be advantageously practiced in any system, single or parallel, which processes an instruction stream. The computer program product may comprise a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention.The computer readable storage medium may be a physical device that can retain and store instructions for use by a system for executing instructions. The computer readable storage medium may be, for example, but is not limited to, an electronic storage unit, a magnetic storage unit, an optical storage unit, an electromagnetic storage unit, a semiconductor storage unit, or any suitable combination thereof. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a removable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions stored thereon, and any suitable combination thereof. A computer readable storage medium, or a computer readable storage device, is not to be construed as transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses propagating through fiber optic cables), or electrical signals transmitted through a wire, as used herein.Computer readable program instructions described herein may be downloaded from a computer readable storage medium to respective data processing / processing units or via a network such as the Internet, a local area network, a wide area network and / or a wireless network to an external computer or storage unit. The network may include copper transmission cables, lightwave transmission conductors, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing unit receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the corresponding computing / processing unit.Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, integrated circuit configuration data, or either source code or object code written in any combination of one or more programming languages, including object oriented programming languages such as Smalltalk, C++, or the like, and procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuits, including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuits to perform aspects of the present invention.Aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It is noted that each block of the flowcharts and / or the block diagrams, and combinations of blocks in the flowcharts and / or the block diagrams, may be executed by computer readable program instructions.These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions executed via the processor of the computer or other programmable data processing apparatus produce a means for implementing the functions / steps specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions may also be stored on a computer readable storage medium that can control a computer, programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored in common comprises an article of manufacture including instructions that implement aspects of the function / step specified in the flowchart and / or block diagrams block or blocks.The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of process steps to be performed on the computer, other programmable apparatus, or other device to produce a computer implemented process, such that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / steps specified in the flowchart and / or block diagram block or blocks.The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions that includes one or more executable instructions for executing the specified logical function(s). In some alternative implementations, the functions indicated in the blocks may occur in a different order than shown in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may sometimes be executed in the reverse order depending on the appropriate functionality. It is further noted that each block of the block diagrams and / or the flowcharts, as well as combinations of blocks in the block diagrams and / or the flowcharts, may be implemented by special purpose hardware-based systems that perform the specified functions or steps, or perform combinations of special purpose hardware and computer instructions.References in the specification to "a single embodiment," "an embodiment," "an example embodiment," etc., indicate that the described embodiment may include a particular feature, structure, or characteristic(s), any embodiment may include, but is not limited to, the particular feature, structure, or characteristic. Moreover, these formulations do not necessarily refer to the same embodiment. Furthermore, when a particular feature(s) structure, or characteristic(s) is described in connection with an embodiment, it is understood that it is within the knowledge of one skilled in the art to specify a feature(s) structure, or characteristic(s) in connection with other embodiments whether or not it is expressly described.The terminology used herein is for the purpose of describing particular embodiments only and is not to be taken as limiting the invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other / other features, integers, steps, operations, elements, components, and / or groups thereof.The descriptions of the various embodiments of the present invention have been provided for purposes of illustration, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. The terminology used herein was chosen to best explain the principles of the embodiment, the practical application, or technical improvement over technologies found in the market, and to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

A computer-executed method for encrypting data blocks, the method comprising: receiving (210), by one or more computer processors, blocks of compressed data; determining (220), by the one or more computer processors, a size, in bytes, of the compressed data; indicating, by the one or more computer processors, a first partially plaintext-filled memory block corresponding to the size, in bytes, of the compressed data; Changing (230), by the one or more computer processors, the first memory block partially filled with plaintext to include: a trailer having an intra-block length field representing the number of plaintext data bytes in the first memory block, the plaintext, and a non-zero padding sufficient to fill the first memory block, encrypting (240), by the one or more computer processors, the compressed data, and the trailer, resulting in encrypted data, wherein a header of the encrypted data includes a number of full encrypted data blocks; and providing (250), by the one or more computer processors, the encrypted data to a user.The computer-executed method of claim 1, wherein the non-zero padding comprises non-deterministic data.The computer-executed method of claim 1, wherein the non-zero padding comprises deterministic data associated with at least a portion of the compressed data.The computer-executed method of claim 1, further comprising appending, by the one or more computer processors, at least one block of data to the compressed data, the at least one block comprising the trailer.The computer-executed method of claim 4, further comprising appending, by the one or more computer processors, sufficient blocks of data to meet a data block threshold.The computer-executed method of claim 1, wherein encrypting the first memory block comprises encrypting the first memory block and all memory blocks belonging to the first memory block using a wide block encryption function.A computer program product for encrypting data blocks, the computer program product comprising one or more computer readable storage units and program instructions stored together on the one or more computer readable storage units, the stored program instructions comprising: program instructions for receiving (210) blocks of compressed data; program instructions for determining (220) a size, in bytes, of the compressed data; program instructions for indicating a first partially plaintext-filled storage block; program instructions for altering (230) the first partially plaintext-filled storage block to comprise: a trailer having an intra-block length field representing the number of plaintext data bytes in the first storage block, the plaintext, and a non-zero padding sufficient to fill the first storage block; Program instructions to encrypt (240) the compressed data and trailer yielding encrypted data, wherein a header of the encrypted data comprises a number of complete encrypted data blocks; and program instructions to provide (250) the encrypted data to a user.The computer program product of claim 7, wherein the non-zero padding comprises a generated random number.The computer program product of claim 7, wherein the non-zero padding comprises deterministic data associated with at least a portion of the compressed data.The computer program product of claim 7, wherein the stored program instructions further comprise program instructions to attach at least one block of data to the compressed data, the at least one block comprising the trailer.The computer program product of claim 10, wherein the stored program instructions further comprise program instructions to append enough blocks of data to meet a data block threshold.The computer program product of claim 7, wherein encrypting the first memory block comprises encrypting the first memory block and all memory blocks belonging to the first memory block using a wide block encryption function.A computer system for encrypting data blocks, the computer system comprising: one or more computer processors; one or more computer readable storage units; and stored program instructions on the one or more computer readable storage units for execution by the one or more computer processors, the stored program instructions comprising: program instructions to receive (210) blocks of compressed data; program instructions to determine (220) a size, in bytes, of the compressed data; program instructions to indicate a first memory block partially filled with plaintext; Program instructions for altering (230) the first memory block partially filled with plaintext to include: an intra-block length field representing the number of plaintext data bytes in the first memory block, the plaintext, and a non-zero padding sufficient to fill the first memory block; program instructions for encrypting (240) the compressed data and the trailer, yielding encrypted data, wherein a header of the encrypted data has a number of complete encrypted data blocks; and program instructions for providing (250) the encrypted data to a user.The computer system of claim 13, wherein the non-zero padding comprises a generated random number.The computer system of claim 13, wherein the non-zero padding comprises deterministic data associated with at least a portion of the compressed data.The computer system of claim 13, wherein the stored program instructions further comprise program instructions to attach at least one block of data to the compressed data, the at least one block comprising the trailer.The computer system of claim 13, wherein encrypting the first memory block comprises encrypting the first memory block and all memory blocks belonging to the first memory block using a wide block encryption function.

Images