System and method for incremental encryption

A computing method for incremental Advanced Encryption Standard XEX Based Tweaked Codebook Mode with Ciphertext Stealing (AES-XTS) encryption, comprising:

• encrypting a first part of a first data stream using an AES-XTS encryption module configured to receive as inputs a tweak key, a data key, an initial tweak value, and data of the first part, in a first encryption session, to thereby generate an encrypted first part;
• terminating the first encryption session for the first part;
• storing the encrypted first part in an encrypted data store;
• encrypting a second part of the first data stream using the AES-XTS encryption module in a second encryption session commenced after the termination of the first encryption session;
• and
• storing the encrypted second part in the encrypted data store, wherein the second part of the first data stream is encrypted using the tweak key, the data key, a modified tweak value, and data of the second part as inputs to thereby generate an encrypted second part, and
• the modified tweak value for the second part of the first data stream is computed based on the initial tweak value, the tweak key, and a block index of a last cipher block of the first part of the first data stream;
• interleaving, via a stream storage module, requests for encryption of respective parts of the first data stream and a second data stream together over a connection to the AES-XTS encryption module.

A computing system, comprising:

• processing circuitry configured to execute:
• an incremental encryption subsystem including a stream storage module and an encryption module, wherein the stream storage module is configured to interleave requests for encryption of respective parts of a first data stream and a second data stream together over a connection to the encryption module, and the encryption module is configured to process the encryption requests serially, wherein
• for each of the first and second data streams, the stream storage module is configured to send as respective inputs a tweak key, a data key, an initial tweak value, and first part data to the encryption module to cause the encryption module to, generate an encrypted first part of the first data stream in a first serial encryption session, store the encrypted first part of the first data stream, and terminate the first serial encryption session, and generate an encrypted first part of the second data stream in a second serial encryption session, store the encrypted first part of the second data stream, and terminate the second serial encryption session;
• for each of the first and second data streams, the stream storage module is further configured to send as respective inputs the tweak key, the data key, a modified tweak value, and second part data to the encryption module to cause the encryption module to, generate an encrypted second part of the first data stream in a third serial encryption session, store the encrypted second part of the first data stream, and terminate the third encryption session, and generate an encrypted second part of the second data stream in a fourth serial encryption session, store the encrypted second part of the second data stream, and terminate the fourth serial encryption session, wherein
• the respective modified tweak value for each of the first and second streams is computed based upon the respective tweak value, the respective tweak key, and a respective block index of a last cipher block of the first part of the respective first and second stream.