Format-Preserving Encryption Engine Embedding Key Version Metadata
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cryptographic systems face difficulties in supporting key rollover while maintaining the format of sensitive data, such as Social Security Numbers, which cannot be altered during encryption and decryption, making it challenging to store additional information like key version numbers without modifying existing database structures.
Innovation Solution
The system employs format-preserving encryption and embedding techniques to encrypt data strings without altering their format, allowing additional information like key version numbers to be embedded within the data strings using a larger character set, enabling key rollover support without adding new database fields.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If format-preserving encryption is used to encrypt sensitive data, then the data format is preserved, but additional information such as key version numbers cannot be stored
Solution Approach 1:
The patent embeds key version numbers and other metadata within the encrypted data string itself by utilizing the expanded character space. The encryption engine maps data to an expanded character space that can accommodate both the encrypted content and the embedded metadata, effectively nesting one piece of information within another without requiring separate storage fields.
Solution Approach 2:
The patent transitions from a single-dimension storage approach (separate fields for data and metadata) to a multi-dimensional approach by utilizing the character space dimension. By expanding the character space and embedding metadata within the data string, the system adds an informational dimension without increasing the structural dimension of the database schema.
2Adaptability or versatility
If additional data fields are added to store key version numbers, then key rollover support is enabled, but database structure modifications are required
Solution Approach 1:
The patent merges the storage of encrypted data and metadata (key version numbers) into a single data string. Instead of using separate database fields for data and metadata, the encryption engine combines both into one embedded structure, eliminating the need for additional database fields and simplifying the database schema.
Solution Approach 2:
The encrypted data string serves multiple functions simultaneously: it stores the encrypted sensitive data, embeds the key version number, and maintains the original data format. This multi-functionality eliminates the need for separate storage mechanisms and reduces database complexity.
3Loss of information
If data is mapped to expanded character space to embed extra information, then additional information can be stored, but inflexible data formats cannot be supported
Solution Approach 1:
The patent changes the character space parameter of the data string by utilizing an expanded character set that includes both the original character set and additional characters. This parameter change allows the data string to accommodate both the original format requirements and the embedded metadata, making the system adaptable to inflexible data formats.
Solution Approach 2:
The encryption engine dynamically adjusts the character space mapping based on the data type and format requirements. For inflexible formats like Social Security Numbers, the engine uses only the necessary portion of the expanded character space while still embedding metadata, making the solution adaptable to different data format constraints.
Data Source
AI summary
A data processing system is provided that includes applications, databases, encryption engines, and decryption engines. Encryption and decryption engines may be used to perform format-preserving encryption on data strings stored in a database. Encryption and decryption engines may include embedded-format-preserving encryption and decryption engines. Embedded-format-preserving encryption engines may be used to encrypt data strings and embed information in data strings. Information corresponding to a format-preserving encryption operation of a data string may be embedded in an associated data string. The associated data string may be encrypted before or after embedding the information in the associated data string. The embedded information may include key management data that corresponds to a managed encryption key that was used to encrypt the data string.