14 results about "Format-preserving encryption" patented technology

Disclosed in the present invention are a method and device for enhancing the security of FF1 format preserving encryption. The method comprises: randomly selecting a key, and transforming the key by using an SM3 algorithm-based keyed cryptographic hash algorithm, so as to obtain a derived key; when encrypting plaintext data by using a format preserving encryption FF1 algorithm, for data B, performing hash value calculation involving the derived key, so as to serve as an intermediate quantity R, wherein the plaintext data comprises data A and the data B; processing the intermediate quantity R and the derived key by using a symmetric block cryptographic operation, so as to generate an intermediate quantity S; and on the basis of the intermediate quantity S and the data A, generating ciphertext data. The present invention can increase the difficulty in cracking format preserving encryption.

The invention discloses an encryption method, device and equipment and a readable storage medium in the technical field of security assurance, and the method comprises the steps: obtaining target data, and recognizing sensitive data in the target data; splitting the sensitive data to obtain first data and second data; encrypting the first data by using a format preserving encryption algorithm to obtain a first ciphertext; encrypting the second data by using a dictionary algorithm to obtain a second ciphertext; splicing the first ciphertext and the second ciphertext to obtain a sensitive data ciphertext; and replacing the sensitive data in the target data with the sensitive data ciphertext to obtain tokenized target data. According to the method, the FPE and the dictionary algorithm are combined for encryption processing, so that each data ciphertext still keeps the format of the original sensitive data, meanwhile, the one-to-one mapping relation between the plaintext and the ciphertext corresponding to the FPE is broken, and the sensitive data can be prevented from being decoded by analyzing the data before and after large-scale encryption. The method has the technical effect that the sensitive data can be effectively protected.

A plaintext is received. For example, a plaintext may be a text record that is to be encrypted and then stored in a database. A determination is made to see if a size of the plaintext is above a threshold. The threshold is based on an efficiency of a Format Preserving Encryption (FPE) algorithm. In response to the size of the plaintext being above the threshold: the plaintext is divided into a plurality of blocks based on a block size; each of the blocks are individually encrypted using the FPE algorithm; and each of the blocks are stored as a single FPE cyphertext. This makes the FPE encryption process much more effacement than has previously been achieved. For example, the FPE process may be 30% more efficient depending on the size of the plain text.

The present invention provides a robust and effective solution to an organization by enabling them to implement a system (110) for facilitating format preserving encryption capability such that the encrypted data will not be available with its original value in a big data system and render sensitive field data as non-sensitive. Thus, sensitive data may be hidden from data-stores / warehouses without worrying about downstream access to the data. The system (110) proposed may also preserve the data type and format of datasets but not limited to the like. The system encrypts a dataset with a unique key (404) and then allows a privileged user (902) to decrypt the encrypted dataset with the unique key (404) and view the decrypted values without getting access to the sensitive original dataset.

A computer-implemented solution is provided to allow electronic locks to implement commands more complex than simply opening or closing, such as timeframe-dependent commands, without requiring an access to the Internet at the time of access. At a remote computer, such as a cloud server, computer-readable instructions initially provided in a sequence of plain text characters, are encrypted into a user code using format preserving encryption (FPE) (e.g. FF3-1). The user code is communicated to the user. The user can then input the user code into the electronic lock via a numerical keypad or other suitable means. The lock is provided with computer functionalities which include a functionality to decrypt the cipher text of the user code back into plain text programming instructions using a decryption key, and execute it. The execution can involve determining whether one or more authorization condition is / are satisfied.

Disclosed herein are system, method, and computer program product embodiments for tokenization by obfuscating a length of personal information through addition of one or more digits and modifying a base of the input string before encryption. In one process, a security string is added to a user information input string of a first length and first base to generate a second string of a longer length, a format preserving encryption (FPE) is performed to generate a new string of the another length and base, and converted into a token of the first length but different base.

Embodiments of the present disclosure relate to vaultless format-preserving tokenization systems and methods. Some methods include encoding a first data set to produce encoded input data; generating a secure tweak for the encoded input data based on a token format schema by: encoding a tweak input to produce an encoded tweak input; and hashing the encoded tweak input along with a unique hashing key to generate the secure tweak; applying a format preserving encryption algorithm that utilizes the encoded input data, the secure tweak, and a unique encryption key to generate ciphertext output; and generating a token from the ciphertext output.

Disclosed herein are system, method, and computer program product embodiments for vaultless tokenization. Alphanumeric values may be determined based on numeric values generated from a hash of numeric user information shuffled through a plurality of randomly generated alphanumeric tables. The numeric user information and the alphanumeric values may be used to generate a table index. Shuffled numeric user information may be generated based on the table index and a plurality of randomly generated numeric tables, and transformed to alphanumeric user information (e.g., via format-preserving encryption, additive cipher, etc.). Each character of the alphanumeric user information may be shuffled through a different alphanumeric table of the plurality of alphanumeric tables identified for the character based on the table index. Moreover, an alphanumeric token may be generated based on the shuffled characters of the alphanumeric user information.

The invention discloses a reserved format encryption and decryption method based on a national secret ZUC algorithm and an identifiable mechanism, and relates to the field of Chinese and English mixed reserved format encryption, and the method comprises the steps: carrying out the multi-field structured analysis of an original message space, generating a high-randomness key stream through the national secret ZUC algorithm, carrying out the symmetric encryption, and finally mapping a ciphertext back to the original message space. And the ciphertext format is completely consistent with the original text. The method has high security guarantee, is designed based on the correlation of fields in the format space, and designs a universal format-preserving encryption method and system. Personal sensitive information safety can be effectively guaranteed, and meanwhile the requirements of various databases for data format consistency are met.

Techniques for Precision-Preserving Format-Preserving Encryption (PPFPE) to protect numeric values and strings with leading / trailing and special characters, while preserving their precision, both as a protected value (e.g., ciphertext) and when decrypted are provided. In one aspect, a plaintext string is parsed to detect a first and last sentinel characters, wherein any character(s) preceding the first sentinel character comprises a leading character(s) and any character(s) following the last sentinel character comprises a trailing character(s). Any leading character(s) preceding the first sentinel character and / or any trailing character(s) following the last sentinel character are passed through. A ciphertext string is generated by encrypting the first and last sentinel character using one or more subsets of a set of encryption characters; and encrypting the portion of the plaintext string between the first and last sentinel character using the set of encryption characters.

Systems are methods are used for facilitating identify anonymization by using controlled masking and encryption of user identifiers, such as UUIDs. A system that manages a UUID converts the UUID into a set of one or more different unique versions of the UUID for one or more corresponding different partner system(s) by removing and replacing masked portions of the UUID and by selectively encrypting the non-masked portions of the UUID. New masked portions added to the new version(s) of the UUID identify different corresponding partner(s) and / or rules to be applied by the different partner(s) when handling the different unique version(s) of the UUID(s). Partner systems that receive the new versions of the UUID identify and utilize the new masked portions to deterministically control decrypting and / or other processing of the new version of the UUID.

A method of generating a plurality of different one time tokens, the method comprising: acquiring a first numerical value from a predetermined sequence of consecutive numerical values; applying format preserving encryption to the acquired first numerical value to generate a first numerical one time token; acquiring a second numerical value from the predetermined sequence of consecutive numerical values, the acquired second numerical value being different to the acquired first numerical value; and applying the format preserving encryption to the acquired second numerical value to generate a second numerical one time token

A computer-implemented method of tokenisation is described. A first value for a data field is provided, which is determined in accordance with a set of data field rules - this is carried out for a set of first values which are or represent account numbers for payment devices. These are stored in a secure database. For each of this set of first values, some or all places in the data field of the first value are encrypted using format preserving encryption to provide an encrypted first token also complying with the set of data field rules. The set of encrypted first tokens is used in place of the set of first values in one or more operations associated with the data field in performance or authorisation of a digital transaction in a computing environment, within a transaction processing system, that is directly accessible to human operators. A computing device adapted to implement such a method is also described.

The application discloses a reserved format encryption and decryption method based on a national secret ZUC algorithm and a distinguishable mechanism, relates to the field of mixed English and Chinese reserved format encryption, and achieves complete consistency between a ciphertext format and an original text through the following steps: performing multi-field structured analysis on an original message space, generating a high-randomness key stream by using the national secret ZUC algorithm to perform symmetric encryption, and finally mapping the ciphertext into the original message space, thereby achieving complete consistency between a ciphertext format and an original text. The method has high security guarantee, is designed based on the correlation of fields in a format space, and designs a general reserved format encryption method and system. The method can effectively guarantee the safety of personal sensitive information and simultaneously supports the requirement of various databases on data format consistency.