Format-preserving encryption via rotating block encryption
AssigneeCA, Inc.
InventorDouglas Neil Hoover
Life of this patent
Estimating the term…
Abstract
Methods and systems are described for format-preserving encryption. Format-preserving encryption on an entire format F may be achieved by performing format-preserving encryption on one or more subsets of F and then applying one or more permutation rounds in such a way that all elements of F enter a subset to be encrypted. A predetermined number of encryption rounds and a predetermined number of permutation rounds may be interleaved until all elements are thoroughly mixed. The resultant output data may be saved in a database in the same format as the original input data, meet all constraints of the database, and pass all validity checks applied by software supporting the database.
Claims26
A method for encrypting a set of objects in a format to create an encrypted set of objects in the format, the method comprising:
- receiving the set of objects in the format, wherein the format is associated with one or more conditions that the set of objects satisfy;
- encoding each of the objects in the set of objects as an integer in a set of integers, the encoding generates an encoded set of objects;
- selecting one or more first disjoint subsets of the encoded set of objects;
- encrypting each of the selected one or more first disjoint subsets to create a partially-encrypted set of objects that comprises the encrypted one or more first disjoint subsets and one or more unencrypted subsets;
- permuting the partially-encrypted set of objects;
- selecting one or more second disjoint subsets of the permuted partially-encrypted set of objects;
- encrypting each of the selected one or more second disjoint subsets to create an encrypted set of objects that comprises the encrypted one or more second disjoint subsets;
- and
- decoding the encrypted set of objects to form a set of encrypted decoded objects, the encrypted decoded set of objects in the same format that the set of objects were received.
A system for encrypting a set of objects in a format to create an encrypted set of objects in the format, the system comprising:
- a memory;
- a processor;
- and
- a storage device, wherein:
- the memory is configured to receive the set of objects in the format, wherein the format is associated with one or more conditions that the set of objects satisfy;
- the processor is configured to:
- encode each of the objects in the set of objects as an integer in a set of integers, the encoding generates a set of encoded objects;
- select one or more first disjoint subsets of the set of encoded objects;
- encrypt each of the selected one or more first disjoint subsets to create a partially-encrypted set of objects that comprises the encrypted one or more first disjoint subsets and one or more unencrypted subsets;
- permute the partially-encrypted set of objects;
- select one or more second disjoint subsets of the permuted partially-encrypted set of objects;
- encrypt each of the selected one or more second disjoint subsets to create an encrypted set of objects that comprises the encrypted one or more second disjoint subsets;
- decode the encrypted set of objects to form a set of encrypted decoded objects, the encrypted decoded set of objects in the same format that the set of objects were received;
- and
- store the encrypted decoded set of objects on the storage device in the same format that the set of objects was received.
A non-transitory computer-readable medium comprising computer-readable instructions recorded thereon that, when executed by a processor, cause the processor to:
- encode each object in a set of objects that have a particular format as an integer in a set of integers, the encoding generates a set of encoded objects;
- select one or more first disjoint subsets of the set of encoded objects;
- encrypt each of the selected one or more first disjoint subsets to create a partially-encrypted set of objects that comprises the encrypted one or more first disjoint subsets and one or more unencrypted subsets;
- permute the partially-encrypted set of objects;
- select one or more second disjoint subsets of the permuted partially-encrypted set of objects;
- encrypt each of the selected one or more second disjoint subsets to create an encrypted set of objects that comprises the encrypted one or more first disjoint subsets;
- decode the encrypted set of objects to form a set of encrypted decoded objects, the encrypted decoded set of objects having the particular format;
- and
- store the encrypted decoded set of objects on the computer-readable medium in the particular format.
Dependencies are inferred from the claim text.