Ciphertext GMAC Parity for Storage Error Correction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current error detection and correction systems in storage and memory systems often rely on non-standard cryptographic algorithms, limiting their acceptance and adoption in governmental and institutional environments, where NIST-approved cryptographic primitives are required for cryptographic integrity.
Innovation Solution
Implementing a Memory Authentication, Cryptographic Integrity, and Correction (MAGIC) regimen using standard NIST-approved cryptographic primitives, such as AES-XTS encryption and Galois Message Authentication Code (GMAC), to provide error detection, correction, and device recovery, while encrypting plaintext data blocks to produce ciphertext blocks and determining parity using the GMAC authentication tag.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If nonstandard cryptographic algorithms are used for error detection and correction, then error detection and correction functionality is achieved, but acceptance and adoption in governmental and institutional environments is limited
Solution Approach 1:
The patent changes the cryptographic parameter from nonstandard algorithms to NIST-approved standard algorithms (such as AES and GMAC). This parameter change maintains the error detection and correction functionality while improving compatibility and acceptance in governmental and institutional environments that require compliance with NIST cryptographic standards.
2Reliability
If decryption is serialized with computation of integrity tags, then security is maintained, but processing efficiency is reduced
Solution Approach 1:
The patent performs preliminary actions by computing the GMAC authentication tag on the ciphertext blocks before decryption occurs. This allows the integrity verification to be prepared in advance, enabling parallel processing of decryption and integrity verification, thereby improving processing efficiency without compromising security.
Solution Approach 2:
The patent segments the cryptographic processing into distinct phases: encryption with GMAC tag generation on ciphertext, transmission, and verification. This segmentation allows the integrity tag computation to be performed independently on the ciphertext blocks, enabling parallel processing and improving overall system productivity while maintaining security through separate verification paths.
3Device complexity
If plaintext-based authentication code is used, then implementation is simpler, but resistance to authentication code substitution attacks is reduced
Solution Approach 1:
The patent introduces ciphertext blocks as an intermediary between the plaintext and the authentication code generation. Instead of computing the authentication code directly from plaintext, the system first encrypts the plaintext to produce ciphertext blocks, then computes the GMAC authentication tag on these ciphertext blocks. This intermediary step enhances security by ensuring the authentication code is derived from the encrypted data, making substitution attacks more difficult while maintaining implementation feasibility through the use of standard cryptographic primitives.
Data Source
AI summary
The present disclosure is directed to systems and methods for the secure transmission of plaintext data blocks encrypted using a NIST standard encryption to provide a plurality of ciphertext data blocks, and using the ciphertext data blocks to generate a Galois multiplication-based authentication tag and parity information that is communicated in parallel with the ciphertext blocks and provides a mechanism for error detection, location and correction for a single ciphertext data block or a plurality of ciphertext data blocks included on a storage device. The systems and methods include encrypting a plurality of plaintext blocks to provide a plurality of ciphertext blocks. The systems and methods include generating a Galois Message Authentication Code (GMAC) authentication tag and parity information using the ciphertext blocks. The GMAC authentication tag may be encrypted to provide a GIMAC authentication tag that is communicated in parallel with the ciphertext blocks to one or more recipient systems or devices.