Format Preserving Encryption Key Rotation via Ciphertext Embedding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Format-preserving encryption (FPE) systems face challenges in managing rotating encryption keys, as they are unable to inherently support key rotation without compromising the fixed length of ciphertext, leading to inefficiencies in decryption and key management.
Innovation Solution
The solution embeds a key identifier within the ciphertext using a mapping table, allowing the identification of the correct encryption key without increasing the length of the ciphertext, enabling efficient key rotation and management by compressing a portion of the ciphertext to create space for the key ID, which can be read as plaintext.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If key rotation is implemented in FPE systems, then security is improved, but the fixed length constraint of ciphertext is compromised
Solution Approach 1:
The patent embeds the key identifier within the ciphertext structure itself, nesting the key ID information inside the existing ciphertext format. This allows the ciphertext to carry additional information (key identifier) without changing its external length, resolving the contradiction between security through key rotation and maintaining fixed ciphertext length.
Solution Approach 2:
The patent modifies the interpretation of ciphertext parameters by allocating specific portions of the ciphertext to represent key identifiers. By changing how the ciphertext parameters are structured and interpreted, the system can embed key rotation information while maintaining the same overall ciphertext length.
2Productivity
If key identifier is embedded in ciphertext, then key management efficiency is improved, but ciphertext structure complexity increases
Solution Approach 1:
The patent segments the ciphertext into distinct functional portions, with specific segments allocated for key identifier information. This segmentation allows the encryption system to efficiently manage key rotation by clearly demarcating where key identification information is stored, improving key management efficiency while organizing the ciphertext structure in a manageable way.
Solution Approach 2:
The ciphertext structure is designed to serve multiple functions simultaneously: it contains the encrypted data, the key identifier, and maintains the fixed length format. This multi-functionality improves key management efficiency by embedding all necessary information in a single structure, while the standardized multi-purpose format actually reduces overall system complexity.
Data Source
AI summary
Aspects of the disclosure provide a technological improvement to a cipher by improving data security of format-preserving encryption (FPE), by, inter alia, embedding specific key identifiers for rotating keys directly into ciphertext. Aspects of the disclosure relate to methods, computer-readable media, and apparatuses for improving data security in a format-preserving encryption (FPE) context by using specific methods of rotating and identifying the appropriate encryption key from among numerous rotating keys stored in a key data store. Specific to FPE, a plaintext of the data and its corresponding ciphertext of the data remain the same in length/size; yet the methods, computer-readable media, and/or apparatuses disclosed herein permit embedding of an identification of a specific key among the plurality of rotating keys for the particular ciphertext without compromising the technical requirements of FPE.