Format-Preserving Encryption Using Digit Segmentation and Permutation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing format-preserving encryption methods are inefficient and insecure when applied to message spaces that are non-binary or have a binary space shorter than the block length of a general block cipher, particularly in decimal spaces or spaces smaller than 128 bits, as they struggle to maintain format and security.
Innovation Solution
A format-preserving encryption device and method that uses a unit block tweakable encryption unit and block permutation unit to encrypt and decrypt specific digits of a plain text or cipher text, utilizing numerical values of remaining digits and an external tweak, with repeated processing to maintain the data format, enabling efficient and secure encryption/decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If Knuth Shuffle is used for format-preserving encryption, then any message space can be encrypted, but the calculation amount and memory amount increase linearly with message space size, making it difficult to apply to message spaces larger than 10,000
Solution Approach 1:
The message is divided into multiple digits or blocks, and encryption is performed on each digit/block separately using a Feistel network structure. This segmentation allows the encryption to handle large message spaces efficiently by processing smaller units in parallel or sequence, rather than treating the entire message space as a single unit like Knuth Shuffle.
Solution Approach 2:
The patent employs a Feistel network with dynamic round functions that can adapt to different message spaces. The encryption process uses multiple rounds of permutation and substitution with varying keys and tweak values, creating a dynamic structure that maintains security while improving processing efficiency for large message spaces compared to static approaches like Knuth Shuffle.
2Productivity
If a block cipher method is used that combines Feistel permutation with a block cipher (as described in NPL6), then encryption can be repeated for a predetermined number of times, but the method is efficient and secure only when the target message space is slightly smaller than 2^n, while efficiency or security significantly decreases when the size becomes smaller than 2^n by a certain amount
Solution Approach 1:
The patent applies different processing strategies to different parts of the message based on its size and structure. For messages of various lengths, the system adjusts the number of rounds, the tweak values, and the permutation patterns locally to optimize both efficiency and security for each specific message space size, rather than using a fixed approach that degrades performance for certain sizes.
Solution Approach 2:
The encryption method dynamically changes parameters such as the number of Feistel rounds, tweak values, and permutation patterns based on the message space size and other input characteristics. This allows the system to maintain high efficiency for messages close to 2^n while preserving security for smaller message spaces by adjusting these parameters appropriately.
3Ease of operation
If existing format-preserving encryption methods are applied to non-binary or binary spaces shorter than block cipher length, then data format can be maintained, but the methods are inefficient and insecure for such message spaces
Solution Approach 1:
The patent transforms the encryption approach by introducing additional dimensions to the Feistel network structure, including multiple tweak values, variable round counts, and layered permutation operations. This dimensional expansion allows the system to maintain format preservation while achieving robust security and efficiency for non-binary and short binary message spaces that traditional methods struggle with.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
[Subject] To provide a format-preserving encryption device and the like that enables efficient and secure encryption/decryption while maintaining the data format. [Solution] An encryption device 10 includes: an unit block tweakable encryption module 101 that encrypts a specific digit of a plain text by using numerical values of remaining respective digits excluding the specific digit of the plain text and an external tweak that is input concurrently with the plain text; a block permutation module 102 that permutates respective digits including the encrypted specific digit of the plain text per digit based on a predetermined rule; and a counter update module 103 that causes processing by the unit block tweakable encryption unit and the block permutation unit to repeat for a predetermined number of times. A decryption device 20 performs the reverse processing to the encryption device 10.