Post Encoding Processor for Known Plaintext Attack Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption systems, such as DVB CSA, are vulnerable to known plaintext attacks due to the potential for identifying and exploiting repeated plaintext packets, which can lead to the determination of the cryptographic key.
Innovation Solution
A system that includes an encoder, a post encoding processor, and an encryption processor to identify and modify data packets with suspected known plaintext, either by removing the payload, replacing it with random data, or reducing its length, and adding an adaptation field, while using different keys for each cryptoperiod to prevent attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data packets with known plaintext are encrypted using the same key, then encryption efficiency is maintained, but security is compromised due to vulnerability to known plaintext attacks
Solution Approach 1:
The encryption key is changed dynamically for each cryptoperiod instead of remaining static. The post-encoder identifies packets with known plaintext and applies different encryption keys to different packets or packet groups, making the encryption system adaptive and resistant to known plaintext attacks where the same key would be exploited
Solution Approach 2:
The encryption process is segmented into different cryptoperiods, where each cryptoperiod uses a different encryption key. This divides the encryption space into multiple secure segments, preventing an attacker from using knowledge of one plaintext-ciphertext pair to decrypt other packets encrypted with different keys
2Productivity
If all data packets are encrypted with the same key, then processing speed is maintained, but security against known plaintext attacks deteriorates
Solution Approach 1:
The post-encoder performs preliminary identification of packets containing known plaintext before the encryption process. This allows the system to pre-determine which packets require special handling with different keys, enabling efficient processing while maintaining security by avoiding the need to re-encrypt already-processed packets
3Reliability
If packets with known plaintext are modified after encoding, then security against plaintext attacks is improved, but device complexity increases
Solution Approach 1:
A post-encoder intermediary component is introduced between the encoder and encryption processor. This intermediary identifies packets with known plaintext and modifies them (by changing payload data or adding adaptation fields) before encryption, providing a dedicated security layer without requiring complex integration into the core encoding or encryption algorithms
Data Source
AI summary
A Headend system including a encoder to encode input data yielding a plurality of data packets, each of the packets having a header and a payload, a post encoding processor to identify ones of the data packets having a payload with a suspected known plaintext, and modify at least some of the identified packets, and an encryption processor to encrypt at least some of the data packets yielding encrypted data packets. Related apparatus and methods are also described.