US 12,362,907 B2
Format-preserving data encryption
Xinyu Lin, San Jose, CA (US); Jethro Gideon Beekman, Eindhoven (NL); and Jeffrey Seyfried, Cupertino, CA (US)
Assigned to Fortanix, Inc., Santa Clara, CA (US)
Filed by Fortanix, Inc., Mountain View, CA (US)
Filed on May 20, 2022, as Appl. No. 17/750,124.
Prior Publication US 2023/0379138 A1, Nov. 23, 2023
Int. Cl. H04L 9/06 (2006.01)
CPC H04L 9/0618 (2013.01) 19 Claims
OG exemplary drawing
 
1. A method comprising:
receiving, at a computing device, input data that includes a plurality of input parts, wherein the input data corresponds to a data schema, wherein the data schema includes a plurality of schema parts, wherein each schema part specifies a set of one or more possible values, and wherein each input part satisfies a respective schema part;
generating an intermediate numeric value using a plurality of input digits that represent the input data, wherein the intermediate numeric value is based on a weighted sum of the plurality of input digits in accordance with a determined weight of each input digit;
generating, using a format-preserving encryption algorithm, an encrypted numeric value based on the intermediate numeric value;
determining a number of possible values that satisfy the data schema;
determining whether the encrypted numeric value satisfies a threshold criterion, wherein the threshold criterion is based on the number of possible values that satisfy the data schema; and
responsive to determining that the encrypted numeric value satisfies the threshold criterion, generating, based on the encrypted numeric value, output data that conforms to the data schema, wherein generating the output data comprises:
determining a plurality of encrypted digits, wherein each encrypted digit corresponds to a respective schema part, wherein a weighted sum of the encrypted digits corresponds to the encrypted numeric value, and each of the encrypted digits satisfies a constraint associated with the respective schema part; and
generating a plurality of output parts, wherein each output part conforms to a respective schema part and is based on the encrypted digit that corresponds to the respective schema part, wherein the output data comprises the plurality of output parts.