Format-Preserving In-Place Encryption for Legacy Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Legacy systems face challenges when integrating encryption, requiring changes to database schemas and back-end validation rules due to the need for fixed-length block ciphers, leading to storage inefficiencies and widespread system modifications.
Innovation Solution
In-place encryption scheme that maintains the original data type format for encrypted data, using a tuple of algorithms including key generation, encryption, and decryption, allowing encryption of date fields into corresponding date formats without altering schema types, and preserving back-end validation rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If block cipher encryption is applied to legacy systems, then data security is improved, but database schema changes and system modifications are required
Solution Approach 1:
The encryption process is segmented into distinct components: a format-preserving encryption module that handles the cryptographic transformation and a key management module that handles key generation and storage. This segmentation allows the encryption functionality to be added as a separate layer without requiring modifications to the existing database schema or legacy system components.
Solution Approach 2:
A format-preserving encryption layer is introduced as an intermediary between the legacy system and the data storage layer. This intermediary component translates plaintext data into ciphertext while maintaining the original data format, allowing encrypted data to be stored in existing database fields without schema changes. The intermediary handles all cryptographic operations transparently to the legacy system.
2Reliability
If block cipher encryption is applied to legacy systems, then data security is improved, but storage space is wasted due to expanded data types
Solution Approach 1:
The encryption method changes the cryptographic parameters to use format-preserving encryption algorithms that produce ciphertext of the same length and format as the plaintext. This allows encrypted data to occupy the same storage space as original data, eliminating the storage overhead associated with traditional block cipher encryption that requires expanding data types to accommodate fixed-length blocks.
3Reliability
If traditional encryption methods are used, then data confidentiality is achieved, but back-end validation rules must be reimplemented
Solution Approach 1:
The encryption implementation uses local quality by applying format-preserving encryption only to specific data fields that require confidentiality, while leaving other fields and system components unchanged. This selective application allows existing validation rules to continue functioning for unencrypted fields and for encrypted fields where the format is preserved, eliminating the need to reimplement validation rules across the entire system.
Data Source
AI summary
A method includes obtaining first text information in a first format, converting the first text information to an offset value from a base time in a second format, generating an encryption key, encrypting the offset value with the encryption key to produce an encrypted offset value in the second format, converting the encrypted offset value to second text information in the first format, and outputting the second text information as encrypted text corresponding to the first text information.