Format-Preserving Encryption for Checksum-Constrained Data Strings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional encryption algorithms alter the format of data items, making it difficult to selectively access or process sensitive information, and existing format-preserving encryption algorithms may disrupt data relationships and checksums, causing compatibility issues with software applications.
Innovation Solution
Format-preserving encryption and decryption algorithms that maintain the original format of data strings, using a block cipher-based approach to ensure that encrypted strings retain the same format as the plaintext, with mechanisms to check and maintain checksum validity and apply encryption/decryption repeatedly until desired constraints are met.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption algorithms (AES, DES) are used to encrypt data, then data security is improved, but the format of the encrypted data is altered making it incompatible with legacy systems
Solution Approach 1:
The patent applies parameter changes by modifying the encryption algorithm's output parameters to match the input format. The FPE algorithm transforms the ciphertext parameters (length, character set, format) to match the plaintext parameters while maintaining cryptographic security through the use of format-preserving cryptographic functions.
Solution Approach 2:
The patent segments the encryption process into distinct phases: format validation, cryptographic transformation, and format preservation. This segmentation allows the system to apply conventional secure encryption while maintaining format compatibility through structured processing steps.
2Reliability
If entire files are encrypted using conventional algorithms, then data security is improved, but selective access to portions of data becomes impossible
Solution Approach 1:
The patent segments the data into individual record-level units that can be encrypted and accessed independently. This allows selective encryption of specific records or fields within a file while maintaining the ability to access other portions of the data without decryption, resolving the contradiction between full-file security and selective access.
Solution Approach 2:
The patent applies encryption partially to only the sensitive portions of data that require protection, rather than encrypting entire files. This partial action approach maintains security for sensitive fields while allowing efficient access to non-sensitive data, balancing security requirements with operational efficiency.
3Adaptability or versatility
If FPE algorithms are used to preserve data format, then format compatibility is improved, but data relationships and checksums may be disrupted
Solution Approach 1:
The patent applies preliminary actions by validating and preserving critical data relationships and checksums before the encryption process. The system identifies dependent data elements and maintains their relationships through pre-processing steps, ensuring that encrypted output maintains the same validity checks as plaintext input.
Solution Approach 2:
The patent implements feedback mechanisms where the encryption process continuously validates data relationships and checksums during transformation. If validation fails, the system adjusts the cryptographic transformation to maintain data integrity, creating a feedback loop that ensures both format preservation and relationship maintenance.
Data Source
AI summary
Format preserving encryption (FPE) cryptographic engines are provided for performing encryption and decryption on strings. A plaintext string may be converted to ciphertext by repeated application of a format preserving encryption cryptographic algorithm. Following each application of the format preserving cryptographic algorithm, the resulting version of the string may be analyzed to determine whether desired string constraints have been satisfied. If the string constraints have not been satisfied, further applications of the format preserving cryptographic algorithm may be performed. If the string constraints have been satisfied, the current version of the string may be used as an output for the cryptographic engine.