Format Preserving Encryption Key Rotation via Ciphertext Embedding

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Format-preserving encryption (FPE) systems face challenges in managing and rotating encryption keys, particularly in maintaining data security and efficiency when dealing with confidential information like credit card numbers and social security numbers, as they require key rotation without increasing overhead or compromising encryption integrity.

Innovation Solution

The implementation of a mechanism that embeds specific key identifiers within the ciphertext, allowing for the identification and use of the correct encryption key from a pool of rotating keys, without altering the fixed length of the encrypted data, using a mapping table to compress and translate key identifiers into the ciphertext, enabling efficient key rotation and secure data storage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If key rotation is implemented in FPE systems, then data security is improved, but system complexity and overhead increase

Engineering Contradiction:

Improvedata securityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The encryption key is segmented into two parts: a data encryption key (DEK) and a key encryption key (KEK). The DEK is used to encrypt the actual data, while the KEK encrypts the DEK. This segmentation allows key rotation to occur at the DEK level without requiring re-encryption of the data, thereby improving security while minimizing system complexity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary key generation and encryption setup before data storage. Encryption keys are generated and stored in advance, and the FPE algorithm is pre-configured with the necessary key management infrastructure. This preliminary action enables seamless key rotation without disrupting data access operations.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If key rotation is implemented in FPE systems, then data security is improved, but processing time increases

Engineering Contradiction:

Improvedata securityVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

By segmenting the key management into DEK and KEK layers, the system enables rapid DEK rotation without requiring time-consuming re-encryption of data. The KEK remains stable and is used to efficiently manage multiple DEKs, reducing the time overhead associated with key rotation operations.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system uses format-preserving encryption to generate ciphertext copies that maintain the original data format. When key rotation is needed, the system can efficiently generate new encrypted versions without requiring extensive processing time, as the FPE algorithm preserves the structural properties of the data.

Inventive Principle:

Principle #26Copying

3Productivity

If key identifiers are embedded in ciphertext, then key management efficiency is improved, but ciphertext length increases

Engineering Contradiction:

Improvekey management efficiencyVSAvoidciphertext length

Core Design Contradiction:

ProductivityVSLength of moving object

Solution Approach 1:

The system embeds key identifiers locally within the ciphertext structure using format-preserving encryption. The FPE algorithm incorporates the key ID in a way that preserves the original data format and length, allowing efficient key management without increasing ciphertext length. This is achieved by mapping the key ID to a corresponding encrypted value that fits within the existing data structure.

Inventive Principle:

Principle #3Local quality

4Quantity of substance

If mapping tables are used to compress key identifiers, then storage efficiency is improved, but computational overhead increases

Engineering Contradiction:

Improvestorage efficiencyVSAvoidcomputational overhead

Core Design Contradiction:

Quantity of substanceVSPower

Solution Approach 1:

The system uses mapping tables that leverage the parameters of format-preserving encryption to compress key identifiers. The FPE algorithm transforms the key ID into an encrypted form that maintains the original data format, achieving storage efficiency without requiring complex computational operations. The mapping table is designed to work seamlessly with the FPE parameters, minimizing computational overhead.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS11669629B2Progressive key rotation for format preserving encryption (FPE)

Publication Date: 2023.06.06 BANK OF AMERICA CORP

AI summary

Aspects of the disclosure provide a technological improvement to a cipher by improving data security of format-preserving encryption (FPE), by, inter alia, embedding specific key identifiers for rotating keys directly into ciphertext. Aspects of the disclosure relate to methods, computer-readable media, and apparatuses for improving data security in a format-preserving encryption (FPE) context by using specific methods of rotating and identifying the appropriate encryption key from among numerous rotating keys stored in a key data store. Specific to FPE, a plaintext of the data and its corresponding ciphertext of the data remain the same in length/size; yet the methods, computer-readable media, and/or apparatuses disclosed herein permit embedding of an identification of a specific key among the plurality of rotating keys for the particular ciphertext without compromising the technical requirements of FPE.