Format-translating encryption systems
View Patent ↗Format-translating encryption (FTE) cryptographic operations may be implemented using a cryptographic system that translates plaintext strings to ciphertext strings of a different format and that translates ciphertext strings to plaintext strings of a different format. Plaintext strings may have a format defined by a first regular expression. Corresponding ciphertext strings may have a format defined by a second regular expression that is different than the first regular expression. During encryption operations, a format-translating encryption algorithm may employ a format-preserving encryption (FPE) encryption algorithm. During decryption operations, a format-translating encryption algorithm may employ an FPE decryption algorithm.
1. A method for performing format translating cryptographic operations using computing equipment, comprising:
with the computing equipment, obtaining a plaintext version of a string of characters that have a format specified by a first regular expression;
with the computing equipment, performing regular expression ranking operations on the plaintext version of the string with the first regular expression to produce a unique binary value;
encrypting the unique binary value to produce a corresponding encrypted unique binary value; and
performing regular expression unranking operations on the encrypted unique binary value with a second regular expression that is different than the first regular expression to produce an encrypted version of the string that has a format specified by the second regular expression.
2. The method defined in claim 1 wherein encrypting the unique binary value comprises encrypting the unique binary value with a format preserving encryption algorithm.
3. The method defined in claim 2 wherein encrypting the unique binary value with the format preserving encryption algorithm comprises encrypting the unique binary value with a block cipher to produce the corresponding encrypted unique binary value.
4. The method defined in claim 1 further comprising computing and storing a length L of the plaintext version of the string in storage in the computing equipment.
5. The method defined in claim 4 further comprising:
after encrypting the unique binary value and before decrypting the encrypted version of the string, retrieving the length L from the storage.
6. The method defined in claim 5 further comprising:
using the length L to build a rank-unrank table.
7. The method defined in claim 1 further comprising:
computing a size index for the first regular expression.
8. The method defined in claim 7 further comprising computing a size index for the second regular expression.
9. The method defined in claim 8 further comprising:
comparing the size index for the first regular expression to the size index for the second regular expression.
10. The method defined in claim 9 further comprising:
determining that the size index for the second regular expression is less than the size index for the first regular expression; and
as a result of determining that the size index for the second regular expression is less than the size index for the first regular expression, aborting encryption of the plaintext version of the string.
11. The method defined in claim 1 further comprising:
determining that the size index for the second regular expression is not less than the index for the first regular expression; and
as a result of determining that the size index for the second regular expression is not less than the size index for the first regular expression, proceeding with encrypting the unique binary value to produce the corresponding encrypted unique binary value.
12. The method defined in claim 1 wherein the first format comprises a social security number format and wherein the second format comprises an email format and wherein performing the regular expression unranking operations on the encrypted unique binary value comprises producing an email address.
13. The method defined in claim 1 further comprising:
obtaining a cryptographic key, wherein encrypting the unique binary value to produce the corresponding encrypted unique binary value comprises encrypting the unique binary value with the cryptographic key to produce the corresponding encrypted unique binary value.
14. The method defined in claim 1 further comprising:
after performing the regular expression ranking operations and before encrypting the unique binary value, adding pad zeros to the unique binary value.
15. A method for performing format translating cryptographic operations using computing equipment, comprising:
with the computing equipment, obtaining a ciphertext version of a string of characters that have a format specified by a second regular expression;
with the computing equipment, performing regular expression ranking operations on the ciphertext version of the string with the second regular expression to produce an encrypted unique binary value;
decrypting the encrypted unique binary value to produce a corresponding unique binary value; and
performing regular expression unranking operations on the unique binary value with a first regular expression that is different than the second regular expression to produce a plaintext version of the string that has a format specified by the first regular expression.
16. The method defined in claim 15 wherein decrypting the encrypted unique binary value comprises decrypting the encrypted unique binary value with a format preserving encryption algorithm based on a block cipher.
17. The method defined in claim 16 wherein the plaintext version of the string has a length, the method further comprising:
retrieving the length of the plaintext version of the string from storage in the computing equipment.
18. The method defined in claim 17 further comprising:
using the length retrieved from the storage and the first regular expression in performing the regular expression unranking operations.
19. A method for performing format translating cryptographic operations using computing equipment, comprising:
with a format translating encryption engine implemented on the computing equipment, obtaining a plurality of plaintext strings of different lengths each of which has a format specified by a first regular expression;
with the format translating encryption engine, performing regular expression ranking operations on the plaintext strings with the first regular expression to produce a plurality of corresponding unique binary values;
encrypting each of the unique binary values to produce a plurality of corresponding encrypted unique binary values; and
performing regular expression unranking operations on the plurality of encrypted unique binary values with a second regular expression that is different than the first regular expression to produce a plurality of ciphertext strings at least some of which have different lengths than each of the plaintext strings.
20. The method defined in claim 19 further comprising:
computing and storing a length L for each of the plaintext strings;
computing a size index N for the first regular expression; and
computing a size index M for the second regular expression that is different than the size index N.