Data security for format-preserving data transforming

1 . A method of providing data security comprising:

generating respective tags for a plurality of data segments in a dataset;

deriving respective temporal keys associated with the respective tags for the plurality of data segments from a master key;

transforming the plurality of data segments from a plaintext to a ciphertext using the respective temporal keys as a first input and the respective tags as a second input; and

updating the master key to prevent the master key from being used to derive a temporal key for reverse-transforming a selected data segment of the plurality of data segments from the ciphertext to the plaintext while maintaining an ability to derive respective temporal keys for reverse-transforming remaining data segments other than the selected data segment of the plurality of data segments, rendering the selected data segment inaccessible.

2 . The method of claim 1 , wherein the master key is changed to an updated master key when receiving an indication to change the selected data segment.

3 . The method of claim 2 , wherein the updating of the master key comprises revoking access to deriving, from the updated master key, the temporal key to reverse-transform the selected data segment from the ciphertext to the plaintext.

4 . The method of claim 2 , further comprising:

replacing the master key with the updated master key; and

deleting the master key.

5 . The method of claim 1 , wherein the updating of the master key comprises revoking access to decrypting the ciphertext of the selected data segment.

6 . The method of claim 1 , wherein the transforming of the plurality of data segments comprises encrypting the plurality of data segments using a format-preserving encryption algorithm.

7 . The method of claim 1 , wherein the respective tags for the plurality of data segments are different from each other.

8 . The method of claim 1 , further comprising:

generating a secret key as the master key to derive the respective temporal keys for the plurality of data segments.

9 . The method of claim 1 , further comprising:

receiving an indication to delete the selected data segment from the dataset, and deleting the selected data segment from the dataset.

10 . A system to provide data security, the system comprising:

a memory to store a dataset comprising a plurality of data segments;

a processor to:

generate respective tags for the plurality of data segments;

derive respective temporal keys associated with the respective tags for the plurality of data segments from a master key;

transform the plurality of data segments in the dataset from a plaintext to a ciphertext using the respective temporal keys as a first input and the respective tags as a second input; and

update the master key to prevent the master key from being used to derive a temporal key for reverse-transforming a selected data segment of the plurality of data segments from the ciphertext to the plaintext while maintaining an ability to derive respective temporal keys for reverse-transforming remaining data segments other than the selected data segment of the plurality of data segments, rendering the selected data segment inaccessible.

11 . The system of claim 10 , wherein the processor is to further change the master key to an updated master key when receiving an indication to change the selected data segment.

12 . The system of claim 11 , wherein the processor is to further revoke access to deriving, from the updated master key, the temporal key to reverse-transform the selected data segment from the ciphertext to the plaintext.

13 . The system of claim 10 , wherein the processor is to further revoke access to decrypting the ciphertext of the selected data segment.

14 . The system of claim 10 , wherein the processor is to further encrypt the plurality of data segments using a format-preserving encryption algorithm.

15 . The system of claim 10 , wherein the processor is to further generate a secret key as the master key to derive the temporal keys for the plurality of data segments.

16 . The system of claim 10 , wherein the processor is to further receive an indication to delete the selected data segment from the dataset, and delete the selected data segment from the dataset after the receiving the indication.

17 . A non-transitory computer-readable medium having computer-executable instructions stored thereon that, upon execution, cause one or more processors to perform operations comprising:

generating respective tags for a plurality of data segments in a dataset;

deriving respective temporal keys associated with the respective tags for the plurality of data segments from a master key;

transforming the plurality of data segments from a plaintext to a ciphertext using the respective temporal keys as a first input and the respective tags as a second input; and

updating the master key to prevent the master key from being used to derive a temporal key for reverse-transforming a selected data segment of the plurality of data segments from the ciphertext to the plaintext while maintaining an ability to derive respective temporal keys for reverse-transforming remaining data segments other than the selected data segment of the plurality of data segments, rendering the selected data segment inaccessible.

18 . The computer-readable medium of claim 17 , wherein the operations further comprise changing the master key to an updated master key when receiving an indication to change the selected data segment.

19 . The computer-readable medium of claim 18 , wherein the operations further comprise revoking access to deriving, from the updated master key, the temporal key to reverse-transform the selected data segment from the ciphertext to the plaintext.

20 . The computer-readable medium of claim 17 , wherein the operations further comprise encrypting the plurality of data segments using a format-preserving encryption algorithm.