Partial Authentication Tag Aggregation for Interleaved Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current encryption solutions, such as AES-GCM, do not allow for the pausing and resuming of encryption and authentication activities on one data stream to prioritize another stream with stricter latency requirements, due to the nature of authentication tags generated, which renders them unusable for authenticating the entire data record.
Innovation Solution
Implementing a partial tag recovery and accumulation engine that recovers and aggregates segment tags from a third-party authentication-encryption engine to generate a complete authentication tag usable for the entire data record, enabling flexible and dynamic re-prioritization of encryption activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If encryption activities are paused and resumed on a data record to allow processing of higher-priority records, then productivity and latency requirements are improved, but the authentication tags generated become unusable for authenticating the complete data record
Solution Approach 1:
The patent segments the authentication tag generation process into multiple partial tags, each corresponding to a segment of the data record processed during interleaved operations. These partial tags are generated independently for different segments and can be accumulated later to form the complete authentication tag, enabling pausing and resuming of encryption without losing authentication capability.
Solution Approach 2:
The patent performs preliminary authentication operations on data segments before the complete record is assembled. Partial authentication tags are generated in advance for each segment during the interleaved encryption process, and these are later combined to form the final authentication tag, allowing encryption operations to be paused and resumed without compromising authentication.
2Device complexity
If a single authentication-encryption engine is used for all data streams, then device complexity is reduced, but the ability to meet stringent latency requirements for high-priority streams deteriorates
Solution Approach 1:
The patent implements dynamic prioritization of data streams by allowing the encryption engine to pause processing of lower-priority streams and allocate resources to higher-priority streams when needed. The interleaved authentication-encryption scheme enables flexible scheduling without requiring multiple dedicated engines, as the partial tag accumulation mechanism maintains authentication integrity across dynamic processing sequences.
3Adaptability or versatility
If self-developed encryption code is used instead of third-party engines, then adaptability to specific requirements is improved, but reliability and error-proneness deteriorate
Solution Approach 1:
The patent introduces a partial tag recovery and accumulation engine as an intermediary layer between the third-party authentication-encryption engine and the data processing system. This intermediary enables flexible interleaved operations and priority-based scheduling while relying on the proven reliability of legacy third-party encryption code, avoiding the need to rewrite or modify the core encryption logic.
Data Source
AI summary
A method supporting interleaved authentication-encryption operations for different data records provides for constructing authentication tag usable to authenticate a transmitted data record from multiple different tag segments generated by an authentication-encryption engine in association with different segments of the data record. The method provides for recovering a first partial tag from a first segment tag received from an authentication-encryption engine by performing one or more operations effective to reverse certain operations performed by the third-party authentication-encryption engine. One or more additional partial tags may be similarly recovered from additional tag segments subsequently output from the third-party authentication-encryption engine in association with the data record, and a complete authentication tag for the data record may be generated based on the recovered first partial tag and each of the one or more additional recovered partial tags.