Variable-Size Format-Preserving Encryption With Reduced Format Leakage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Format-preserving encryption methods for variable-size data objects face security issues due to format information leakage, as they often preserve the exact format of the non-encrypted data in the encrypted data, revealing information that can identify or exclude possible input sets.
Innovation Solution
A computer-implemented method that compresses or encodes the data object to a format compatible with an inner encryption algorithm, encrypts the compressed or encoded version, and then decompresses or decodes it to produce a format-preserved encrypted version, ensuring that format information is subject to encryption and reducing leakage by altering the length and structure of the encrypted output.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If format-preserving encryption preserves the exact format of the non-encrypted data, then the encrypted data maintains usability and compatibility, but format information leakage occurs that can identify or exclude possible input sets
Solution Approach 1:
The encryption process is segmented into three distinct stages: compression/encoding of the plaintext, encryption of the compressed data, and decompression/decoding of the encrypted data. This segmentation allows format preservation at the output level while ensuring that the intermediate encrypted representation does not leak format information, as the compression step transforms the original format before encryption occurs
Solution Approach 2:
The compression or encoding operation is performed as a preliminary action before the actual encryption takes place. By compressing or encoding the plaintext first, the original format characteristics are transformed into a different representation that, when encrypted and then decompressed, produces ciphertext that appears format-preserved but does not actually leak the original format information
2Ease of manufacture
If variable-size data objects are encrypted using fixed-size format methods, then encryption can be performed, but the encrypted output reveals size information that can identify or exclude possible input sets
Solution Approach 1:
The invention changes the size parameter of the data through compression or encoding operations. By transforming variable-size plaintext into compressed representations and then through encryption and decompression, the output size becomes decoupled from the input size, preventing size information leakage while maintaining encryption applicability to variable-size data objects
3Ease of operation
If the encrypted data retains the original format characteristics, then format validation is simplified, but security is reduced due to information leakage
Solution Approach 1:
The process segments format preservation from the encryption core: the compression and decompression operations handle format transformation and restoration, while the encryption operation works on the compressed intermediate representation. This ensures that format validation can be performed on the output without compromising security, as the encryption of the compressed data prevents format information leakage
Solution Approach 2:
The compressed or encoded version of the plaintext serves as an intermediary between the original plaintext and the final encrypted output. This intermediary representation allows the encryption to operate on transformed data, and the subsequent decompression produces format-preserved output without the encryption itself leaking format information
Data Source
AI summary
A computer-implemented method of encrypting a data object of variable size utilizing an inner encryption algorithm can take a variable size input and of outputting, as its output, an encrypted version of the variable size input. The method comprises compressing or encoding the data object in its totality to obtain a compressed or encoded version of the data object in a format compatible with the inner encryption algorithm, encrypting, by the inner encryption algorithm, the compressed or encoded version of the data object to obtain an encrypted version of the data object, and decompressing or decoding the encrypted version of the data object to obtain a decompressed or decoded version of the encrypted version of the data object, which constitutes a format-preserved encrypted version of the data object.