Length-Preserving Encryption Using Primary Keys as IVs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption methods for database tables face challenges in length-preserving encryption, requiring additional storage for initialization vectors and tweaks, and are not secure against chosen-plaintext attacks, especially in legacy systems where modifying the database schema is undesirable.
Innovation Solution
Utilizing database table primary keys as initialization vectors in the Counter Mode (CTR) of block cipher encryption, eliminating the need for separate storage of initialization vectors and applying the block cipher algorithm only once per block, while ensuring security against chosen-plaintext attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard block cipher modes (CTR/GCM) are used for encryption, then encryption security is improved, but additional storage is required for initialization vectors and tweaks
Solution Approach 1:
The patent combines the initialization vector functionality with the existing primary key storage in the database table. Instead of storing IV separately, the system uses the primary key (which already exists in the table) as the IV, thereby merging two functions into one storage location and eliminating the need for additional IV storage columns.
Solution Approach 2:
The primary key in the database table serves multiple functions: it uniquely identifies the row and simultaneously acts as the initialization vector for encryption. This multi-functionality eliminates the need for separate IV storage while maintaining encryption security requirements.
2Adaptability or versatility
If format-preserving encryption is applied to maintain data format, then database schema compatibility is improved, but encryption security against chosen-plaintext attacks is weakened
Solution Approach 1:
The patent applies different encryption characteristics to different parts of the system: the encryption algorithm provides strong security against chosen-plaintext attacks, while the length-preserving property maintains local format compatibility. By using CTR mode with primary key as IV, the system achieves both security and format preservation without compromising either aspect.
Data Source
AI summary
Embodiments are directed to encrypting data of a database table. Embodiments receive the database table, the database table including a plurality of rows, each row including a unique primary key and at least one column of unencrypted data. Embodiments convert each unique primary key into a unique initialization vector (“IV”). For a current row, embodiments encrypt the unencrypted data using a corresponding unique IV for the row, the encrypting including length-preserving encryption. Within each column, embodiments replace the unencrypted data with the encrypted data.