Format-Preserving Encryption for Legacy Data Compatibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional encryption techniques alter the format of data, making it difficult to store and access encrypted data in legacy systems and disrupting compatibility between applications, especially when selective access to sensitive information is required.
Innovation Solution
A format-preserving cryptographic system that uses a key server to provide cryptographic keys for authorized entities, allowing for the selective encryption and decryption of data while maintaining its original format, using techniques like embedding validity period information in checksums to ensure compatibility and secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption algorithms (AES, DES) are applied to encrypt data, then data security is improved, but the format of the data is altered, causing compatibility problems with legacy systems
Solution Approach 1:
The patent applies parameter changes by modifying the encryption algorithm to operate on formatted data representations rather than raw data. The format-preserving encryption algorithm encrypts data while maintaining its original format parameters (data type, length, structure), allowing encrypted data to be stored in the same database tables and processed by legacy applications without format changes.
2Reliability
If entire files are encrypted using bulk encryption, then data security is improved, but access efficiency deteriorates because the entire file must be decrypted to access any portion of the data
Solution Approach 1:
The patent applies segmentation by dividing the data into individual records or fields that can be encrypted and accessed independently. Instead of encrypting entire files, the format-preserving encryption allows selective encryption of specific data elements, enabling applications to access only the necessary portions of data without decrypting the entire dataset.
3Reliability
If conventional encryption is applied to numeric strings, then data security is improved, but the format of the string is altered, making it difficult to store in the same database tables
Solution Approach 1:
The patent applies parameter changes by designing the encryption algorithm to preserve data format parameters. The format-preserving encryption maintains the original data type, length, and structure of numeric strings, allowing encrypted data to be stored in the same database tables as unencrypted data without requiring schema changes or format conversions.
Data Source
AI summary
Key requests in a data processing system may include identifiers such as user names, policy names, and application names. The identifiers may also include validity period information indicating when corresponding keys are valid. When fulfilling a key request, a key server may use identifier information from the key request in determining which key access policies to apply and may use the identifier in determining whether an applicable policy has been satisfied. When a key request is authorized, the key server may generate a key by applying a one-way function to a root secret and the identifier. Validity period information for use by a decryption engine may be embedded in data items that include redundant information. Application testing can be facilitated by populating a test database with data that has been encrypted using a format-preserving encryption algorithm. Parts of a data string may be selectively encrypted based on their sensitivity.