Format-Preserving Encryption Engine for Legacy Data Compatibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional encryption algorithms alter the format of data, making it difficult to store and access encrypted sensitive information, such as credit card numbers, in legacy systems, and preventing selective access to different parts of encrypted data.
Innovation Solution
Format-preserving encryption and decryption engines that maintain the original format of data strings during encryption and decryption operations, using index mappings and a block cipher structure like the Luby-Rackoff construction, allowing selective access to different parts of encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption algorithms are used to encrypt sensitive data, then data security is improved, but the data format is altered making it incompatible with legacy systems
Solution Approach 1:
The patent applies parameter changes by modifying the encryption algorithm's output parameters to match the input format constraints. The FPE system changes the parameter space of the cipher output to be constrained within the same domain as the input (e.g., 16-digit numbers, alphanumeric strings), thereby maintaining format compatibility while providing encryption security.
Solution Approach 2:
The patent introduces an intermediary conversion process that transforms the original data into an intermediate representation, applies encryption, then converts back to the original format. This intermediary step allows the use of strong encryption algorithms while maintaining output format compatibility with legacy systems.
2Reliability
If entire files are encrypted using conventional algorithms, then data security is improved, but selective access to portions of data becomes impossible
Solution Approach 1:
The patent applies segmentation by dividing the encryption process into independent block operations that can be selectively applied to different portions of data. Each data element can be encrypted or decrypted independently, allowing selective access to specific records or fields without decrypting entire files, while maintaining cryptographic security through the use of block cipher structures.
3Reliability
If data is encrypted with conventional algorithms, then security is improved, but the encrypted data cannot be stored in the same database tables as unencrypted data
Solution Approach 1:
The patent changes the parameter constraints of the encryption output to match the original data type specifications. By ensuring that encrypted output maintains the same format parameters (data type, length, character set) as the input, the system allows encrypted data to be stored in the same database tables and accessed by the same applications without requiring system restructuring.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Format-preserving encryption and decryption processes are provided. The encryption and decryption processes may use a block cipher. A string that is to be encrypted or decrypted may be converted to a unique binary value. The block cipher may operate on the binary value. If the output of the block cipher that is produced is not representative of a string that is in the same format as the original string, the block cipher may be applied again. The block cipher may be repeatedly applied in this way during format-preserving encryption operations and during format-preserving decryption operations until a format-compliant output is produced. Selective access may be provided to portions of a string that have been encrypted using format-preserving encryption.