Opportunistic Authentication of Encrypted Data via Compression and MAC

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current implementations of length-preserving compression (LPC) do not provide data integrity protection, which is essential for ensuring the authenticity and integrity of data, especially in data deduplication processes within storage systems.

Innovation Solution

A method that compresses data, encrypts it if the compressed size is below a threshold, creates a message authentication code (MAC), and adds a zero pad and MAC to the encrypted data to create a formatted string, while abandoning compression if the size exceeds the threshold and encrypting the uncompressed data instead, thereby ensuring data integrity through opportunistic authentication.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Quantity of substance

If length-preserving compression is applied to encrypted data, then storage efficiency is improved, but data integrity protection is lost

Engineering Contradiction:

Improvestorage efficiencyVSAvoiddata integrity protection

Core Design Contradiction:

Quantity of substanceVSReliability

Solution Approach 1:

The patent applies compression to the plaintext data before encryption, rather than attempting to compress encrypted data. This preliminary compression action allows the system to achieve storage efficiency improvements while maintaining the ability to provide integrity protection through standard encryption and authentication mechanisms applied to the compressed-then-encrypted data.

Inventive Principle:

Principle #10Preliminary action

2Volume of moving object

If compression is applied to reduce data size, then storage space is saved, but data authenticity protection is compromised

Engineering Contradiction:

Improvedata sizeVSAvoiddata authenticity

Core Design Contradiction:

Volume of moving objectVSReliability

Solution Approach 1:

The patent performs compression as a preliminary step before encryption and authentication. By compressing the plaintext first, the system reduces the data volume that needs to be encrypted and stored, while the subsequent encryption and MAC generation steps ensure that authenticity and integrity protection are maintained on the compressed data.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent changes the state of the data from uncompressed to compressed form before applying encryption. This parameter change in data representation allows the system to achieve smaller storage requirements while the encryption and authentication mechanisms ensure that the compressed data maintains its authenticity and integrity protections.

Inventive Principle:

Principle #35Parameter changes

3Quantity of substance

If deterministic encryption is used for data deduplication, then storage efficiency is improved, but data integrity verification becomes difficult

Engineering Contradiction:

Improvestorage efficiencyVSAvoidintegrity verification

Core Design Contradiction:

Quantity of substanceVSDifficulty of detecting and measuring

Solution Approach 1:

The patent applies compression before deterministic encryption, which allows the encrypted output to have a predictable size based on the compressed input. This preliminary compression enables the deterministic encryption to produce consistent results for identical inputs, facilitating deduplication while the separate MAC calculation provides integrity verification capability.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a message authentication code (MAC) as an intermediary mechanism that works alongside deterministic encryption. The MAC provides explicit integrity verification capability, mediating between the deterministic encryption's deduplication function and the need for integrity verification, allowing both goals to be achieved simultaneously.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Productivity

If current LPC implementation is used, then compression and encryption are achieved, but data integrity protection is not provided

Engineering Contradiction:

Improvecompression and encryption performanceVSAvoiddata integrity protection

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent merges multiple security functions into a unified process: compression of plaintext, encryption of the compressed data, and generation of a message authentication code (MAC) for integrity verification. By combining these operations in sequence, the system achieves both the productivity benefits of compression/encryption and the reliability benefits of integrity protection that were missing from current LPC implementations.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent creates a multi-functional processing pipeline that simultaneously achieves compression, encryption, and integrity protection. The system is designed to handle multiple security requirements through a single integrated approach, making the LPC implementation universally applicable to scenarios requiring both storage efficiency and data integrity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11917072B2Implementing opportunistic authentication of encrypted data

Publication Date: 2024.02.27 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

A computer-implemented method according to one embodiment includes compressing an uncompressed instance of data to create a compressed instance of data; encrypting the compressed instance of data in response to determining that a size of the compressed instance of data is less than a predetermined threshold; creating a message authentication code (MAC) for the encrypted compressed instance of data; and adding a variable-length zero pad and the MAC to the encrypted compressed instance of data to create a formatted string.