Format-Preserving Encryption Engine for Legacy Data Compatibility

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional encryption algorithms alter the format of data strings during encryption, making it difficult to store and access encrypted data in legacy systems and preventing selective access to sensitive information, as they cannot preserve the original format of data items like social security numbers or credit card numbers.

Innovation Solution

Format-preserving encryption and decryption engines that process data strings to remove extraneous characters, encode them using an index, and then encrypt using a format-preserving block cipher, ensuring the encrypted data maintains the original format by post-processing to restore removed elements, such as spaces and checksums.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional encryption algorithms (AES, DES) are used to encrypt data, then data security is improved, but the format of the encrypted data is altered making it incompatible with legacy systems

Engineering Contradiction:

Improvedata securityVSAvoidformat compatibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent applies parameter changes by modifying the encryption process to preserve format parameters. The format-preserving encryption engine changes the encryption parameters to ensure that the length and character set of the encrypted output match the original input format, allowing encrypted data to remain compatible with legacy database schemas and applications while maintaining security.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent introduces a format-preserving encryption engine as an intermediary between conventional encryption algorithms and the data storage system. This intermediary component receives input data, applies format-preserving encryption transformations, and outputs encrypted data that maintains the original format, thereby mediating between security requirements and legacy system compatibility.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If entire files are encrypted using conventional algorithms, then data security is improved, but selective access to portions of data becomes impossible

Engineering Contradiction:

Improvedata securityVSAvoidselective data access

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent applies segmentation by dividing the encryption process into independent format-preserving encryption engine instances that can operate on individual data elements, records, or fields rather than requiring encryption of entire files. This allows selective encryption and decryption of specific portions of data while maintaining security, enabling applications to access only the encrypted data elements they need without decrypting entire files.

Inventive Principle:

Principle #1Segmentation

3Reliability

If data format is altered during encryption, then encryption security is improved, but storage and processing in existing systems becomes difficult

Engineering Contradiction:

Improveencryption securityVSAvoidsystem implementation

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS7864952B2Data processing systems with format-preserving encryption and decryption engines

Publication Date: 2011.01.04 MICRO FOCUS LLC

AI summary

A data processing system is provided that includes format-preserving encryption and decryption engines. A string that contains characters has a specified format. The format defines a legal set of character values for each character position in the string. During encryption operations with the encryption engine, a string is processed to remove extraneous characters and to encode the string using an index. The processed string is encrypted using a format-preserving block cipher. The output of the block cipher is post-processed to produce an encrypted string having the same specified format as the original unencrypted string. During decryption operations, the decryption engine uses the format-preserving block cipher in reverse to transform the encrypted string into a decrypted string having the same format.