Format-Preserving Encryption for Complex Schema Compatibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption techniques fail to preserve complex data formats with multiple parts having different constraints, leading to errors and incompatibilities when encrypting and decrypting data in applications that expect specific formats, such as credit card numbers or social security numbers.
Innovation Solution
A format-preserving encryption system that transforms input data into an intermediate numeric value, applies a fixed-radix encryption algorithm, and then maps the encrypted value back to conform to the original complex data format, ensuring the encrypted data maintains the same structure and constraints as the original data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard encryption algorithms are used to encrypt data, then data confidentiality is improved, but the ciphertext format becomes incompatible with the original data format
Solution Approach 1:
The patent changes the parameters of the encryption process by using format-preserving encryption algorithms that maintain the original data format characteristics. The encryption function E(k, x) produces ciphertext c with the same format as plaintext x, preserving length, character set, and structural constraints while providing cryptographic security.
Solution Approach 2:
The patent introduces an intermediary format-preserving encryption layer between the plaintext and standard encryption algorithms. This intermediary transformation converts the original data into a format that can be encrypted while ensuring the final ciphertext maintains the required format for application compatibility.
2Ease of manufacture
If data is converted to a different format for encryption, then encryption can be applied, but errors and unexpected behavior occur in applications expecting the original format
Solution Approach 1:
The patent segments the encryption process into distinct components: format validation, encryption transformation, and format preservation. By dividing the process into manageable segments with specific responsibilities, it ensures that each component maintains data integrity while providing cryptographic protection.
Solution Approach 2:
The patent performs preliminary actions by validating the input data format before encryption and preparing the encryption parameters in advance. This preliminary validation ensures that the encryption process maintains format compatibility, preventing errors in applications that expect specific data formats.
3Reliability
If ciphertext is generated with different length or character set, then encryption security is improved, but validation and display operations fail
Solution Approach 1:
The patent changes the encryption parameters to produce ciphertext with the same length and character set as the plaintext. By adjusting the encryption function to preserve these parameters, the system maintains both security and operational compatibility for validation and display operations.
Solution Approach 2:
The format-preserving encryption function serves multiple functions simultaneously: it provides cryptographic security, maintains format compatibility, enables validation operations, and supports display operations. This multi-functionality eliminates the need for separate handling of encrypted data in different contexts.
Data Source
AI summary
A method includes receiving input data that includes a plurality of input parts, wherein the input data corresponds to a data schema, wherein the data schema includes a plurality of schema parts, wherein each schema part specifies a set of one or more possible values, and wherein each input part satisfies a respective schema part. The method further includes generating an intermediate numeric value that represents the input data, generating, using a format-preserving encryption algorithm, an encrypted numeric value based on the intermediate numeric value, determining a number of possible values that satisfy the data schema, determining whether the encrypted numeric value satisfies a threshold criterion based on the number of possible values that satisfy the data schema, and responsive to determining that the encrypted numeric value satisfies the threshold criterion, generating, based on the encrypted numeric value, output data that conforms to the data schema.