Granted Patent B2

US 8,769,279 · App. 13/081,450 · Granted Jul 1, 2014

Abstract

Claims (41)

1. A computer program product, comprising a computer usable, non-transitory storage medium having a computer readable program code embodied therein, said computer readable program code adapted to be executed to implement a method for deterministically encrypting data, said method comprising:

selecting clear text data comprising a plaintext symbol set of a variable block size;

selecting a symbol set corresponding to the plaintext symbol set, wherein the symbol set is an arbitrary string symbol set comprising N members, each of which represents a data element in the plaintext symbol set;

encrypting the plaintext symbol set to the encrypted symbol set using a first key and a second key, the encrypting comprising the operations of:

defining a first portion and a second portion of the plaintext symbol set,

encrypting a data string using the first key to generate the second key,

determining a number of encryption rounds that will be performed to create the encrypted symbol set, and

producing the encrypted symbol set by successively performing encryption rounds for the number determined, wherein each encryption round comprises the operations of:

encrypting the first portion using the second key to generate an encrypted first portion while preserving the second portion as an unencrypted second portion, combining the encrypted first portion with the unencrypted second portion using a modulo operation to create a new second portion, replacing the first portion in the plaintext symbol set with the unencrypted second portion, and replacing the second portion in the plaintext symbol set with the new second portion; and

wherein the encrypted symbol set comprises the first portion and the second portion after performing the encryption rounds for the number determined, and the encrypted symbol set has the same frniat as the plaintext symbol set, has the same length as the plaintext symbol set, and uses the symbol set of the plaintext symbol set.

2. The computer program product of claim 1 , wherein the data string comprises a tweak and wherein the operation of encrypting the data string comprises:

defining first and second parameters based on the tweak; and

encrypting a combination of the first and second parameters using the first key to generate the second key.

3. The computer program product of claim 2 , wherein encrypting the combination of the first and second parameters using the first key to generate the second key comprises:

encrypting the first parameter with the first key to obtain an encrypted first parameter;

combining the encrypted first parameter with the second parameter;

and encrypting the combination of the encrypted first parameter and the second parameter using the first key.

4. The computer program product of claim 2 , wherein encrypting the combination of the first and second parameters using the first key to generate the second key comprises using the first key to encrypt the concatenation of the first and second parameters.

5. The computer program product of 1 , wherein the data string comprises a tweak and wherein the operation of encrypting the data string comprises:

creating a first parameter using the tweak; and

encrypting the first parameter with the first key using a block encryption cipher.

6. The computer program product of claim 1 , wherein the plaintext symbol set comprises token information.

7. The computer program product of claim 1 , wherein the plaintext symbol set comprises track data in a standard bankcard track data format, and wherein the encrypted symbol set is produced in the same format as the plaintext bankcard track data.

8. The computer program product of claim 1 , wherein the plaintext symbol set comprises track data comprising a symbol selected from the group consisting of decimal digits zero through nine, the encrypted symbol set comprises a symbol selected from the group consisting of decimal digits zero through nine, and the modulo operation is a modulo 10 addition operation or module 10 subtraction operation.

9. The computer program product of claim 1 , wherein the plaintext symbol set comprises a symbol selected from the group consisting of alphanumeric upper and lower case characters and decimal digits zero through nine, and the encrypted symbol set comprises a symbol selected from the group consisting of alphanumeric upper and lower case characters and decimal digits zero through nine, the modulo operation is a modulo 62 addition operation or module 62 subtraction operation.

10. The computer program product of claim 1 , wherein the data string comprises a tweak, the tweak comprising an unencrypted portion of the bank identification number (BIN).

11. The computer program product of claim 10 , wherein the tweak further comprises the last four digits of the account number.

12. The computer program product of claim 1 , wherein the data string comprises a tweak having variable length.

13. The computer program product of claim 12 , wherein the tweak further comprises an expiration date.

14. The computer program product of claim 1 , further comprising transmitting the encrypted symbol set to a remote device.

15. The computer program product of claim 1 , further comprising transmitting the encrypted symbol set to a remote device over a public network.

16. A computer program product, comprising a computer usable, non-transitory storage medium having a computer readable program code embodied therein, said computer readable program code adapted to be executed to implement a method for deterministically decrypting data, comprising:

receiving encrypted data comprising a encrypted symbol set of a variable block size;

selecting a symbol set corresponding to the encrypted symbol set, wherein the symbol set is an arbitrary string symbol set comprising N members, each of which represents a data element in the encrypted symbol set;

decrypting the encrypted symbol set using a first key and a second key to produce a plaintext symbol set, the decrypting comprising the operations of:

defining a first portion and a second portion of the encrypted symbol set,

encrypting a data string using the first key to generate the second key,

determining a number of encryption rounds performed to produce the encryption symbol set, and

producing the plaintext symbol set by successively performing decryption rounds for the number determined, wherein each decryption round comprises the operations of:

combining the second portion with the first portion using an inverse module operation to produce an encrypted intermediary first portion, decrypting the encrypted intermediary first portion using the second key to produced an unencrypted first portion, replacing the first portion in the encrypted symbol set with the unencrypted first portion, and replacing the second portion in the encrypted symbol set with the first portion; and

wherein the plaintext symbol set comprises the first portion and the second portion after performing the decryption rounds for the number determined, and the plaintext symbol set has the same format as the encrypted symbol set, has the same length as the encrypted symbol set, and uses the symbol set of the encrypted symbol set.

Assignments (9)