Masked Integrity Checksum for Encrypted Data Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for verifying the integrity of encrypted data in secure electronic entities either compromise confidentiality by handling clear data or are vulnerable to false validation due to the dependency of integrity sums on encryption keys, making them unsuitable for data stored with different keys.
Innovation Solution
A method involving masking encrypted data with a random data mask, applying a cryptographic function, and calculating an integrity sum using a checksum function, ensuring confidentiality by maintaining the data masked throughout the process, and verifying integrity by comparing masked sums.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the first solution (decrypting then calculating integrity sum) is used, then integrity verification is achieved, but confidentiality is compromised due to handling of clear data
Solution Approach 1:
The patent introduces a masking mechanism as an intermediary between the encrypted data and the integrity verification process. A mask is applied to the encrypted data before integrity checking, preventing direct access to the clear plaintext while still enabling verification. This mediator allows the system to verify integrity without exposing confidential information.
2Object-affected harmful factors
If the second solution (calculating integrity sum on encrypted data) is used, then confidentiality is maintained, but false validation vulnerability occurs due to hacker replacement attacks
Solution Approach 1:
The patent applies a masking operation preliminarily to the encrypted data before the integrity verification process. This preliminary action transforms the encrypted data into a masked form that cannot be easily manipulated by hackers to produce valid integrity sums, thereby preventing false validation attacks while maintaining confidentiality.
3Reliability
If integrity sum is constructed dependent on encrypted data and encryption key, then integrity verification works for single-key scenarios, but adaptability fails when data is encrypted with different keys
Solution Approach 1:
The patent segments the integrity verification process into two independent components: the masking operation applied to the encrypted data, and the integrity sum calculation. This segmentation allows the system to handle different encryption keys independently while maintaining verification accuracy, as the masking process does not depend on the specific key used to encrypt the data.
Data Source
AI summary
A method for determining a first integrity sum including the following steps: determining a first masked item of data by application of an “exclusive OR” operation between a first item of data and a first data mask; —determining a second item of data by application to the first masked item of data of a first cryptographic function, the second item of data being masked by a second data mask; —determining a second integrity sum associated with the second item of data by application to the second item of data of a checksum function; and determining the first integrity sum by application of an “exclusive OR” operation between the second integrity sum and a third integrity sum associated with the second data mask. A computer program and an electronic entity are also described.