Format-Preserving Encryption for Base64 Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Format-preserving encryption methods, such as VFPE, face challenges when applied to Base64 encoded data, particularly in maintaining the same size and character set as the original plaintext, and ensuring security without increasing storage or processing overhead, especially when reusing keys/IV combinations.
Innovation Solution
The method involves encoding raw binary data into Base64 format, applying format-preserving encryption using VFPE with a unique key derived from a static key and message-specific identifying information, and employing length-preservation or length-obfuscation techniques to maintain the Base64 format and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Shape
If format-preserving encryption is applied to Base64 encoded data, then the data size and character set are preserved, but security is compromised if key/IV combination is reused
Solution Approach 1:
The patent applies dynamics by making the encryption key dynamic rather than static. Each message receives a unique key derived from the static key combined with message-specific identifying information (such as message timestamp, sequence number, or content hash). This ensures that even though the encryption algorithm and data format remain consistent, the key changes with each message, preventing security compromises from key reuse while maintaining format preservation.
2Reliability
If multiple rounds of encryption are performed, then encryption strength is improved, but processing overhead increases significantly
Solution Approach 1:
The patent changes the parameter of encryption rounds from multiple rounds to a single round of format-preserving encryption. By using VFPE (Visa FPE) which is designed as a stream cipher rather than a block cipher, the system achieves strong encryption with minimal processing overhead. The unique key derivation mechanism compensates for the reduced number of encryption rounds, maintaining security without the performance penalty of multiple encryption passes.
3Reliability
If database schema is changed to store encrypted data, then data security is improved, but storage space increases
Solution Approach 1:
The patent changes the parameter of encryption approach from traditional block encryption to format-preserving encryption. FPE encrypts data in place without changing the size or character set of the data, so a 9-byte SSN remains a 9-byte encrypted value. This eliminates the need to increase storage field size from 9 to 16 bytes, maintaining compact storage while achieving strong encryption through the unique key derivation mechanism.
4Adaptability or versatility
If Base64 encoding is applied to binary data, then data compatibility is improved, but encryption security is compromised since original data can be recovered
Solution Approach 1:
The patent applies preliminary action by performing Base64 encoding on the binary data before encryption. This ensures that the data is in the correct format for FPE processing. The combination of Base64 encoding followed by FPE with unique key derivation provides both compatibility (Base64 text format) and security (FPE encryption with per-message keys), preventing the vulnerability where original data could be recovered from Base64-encoded ciphertext.
Data Source
AI summary
A computer-implemented method for encrypting binary data may include encoding raw binary data in Base64 format to generate Base64 binary data. The Base64 binary data may be encrypted, by a computer processor, using format-preserving encryption to generate Base64 ciphertext. The Base64 ciphertext may be validatable by a Base64 validator.