Micro Focus Lcc

Voltage Security, Inc.

Quark, Inc.

Other

Entit Software LLC

Quark Media House Sarl

Dainippon Screen Engineering of America Incorporated

Richard T Minner

Terence Spies

Matthew J Pauker

Thomas Wu

Jacob Green

Michael S Leong

Leslie Clayton Gutschow

Paul Wensley

Mark Boenke

Philip Smith, Iii

Richard Walker

Alexei Krainiouk

Phillip Hillyer Smith, Iii

A plaintext is received. For example, a plaintext may be a text record that is to be encrypted and then stored in a database. A determination is made to see if a size of the plaintext is above a threshold. The threshold is based on an efficiency of a Format Preserving Encryption (FPE) algorithm. In response to the size of the plaintext being above the threshold: the plaintext is divided into a plurality of blocks based on a block size; each of the blocks are individually encrypted using the FPE algorithm; and each of the blocks are stored as a single FPE cyphertext. This makes the FPE encryption process much more effacement than has previously been achieved. For example, the FPE process may be 30% more efficient depending on the size of the plain text.

Efficient length preserving encryption of large plaintexts

Techniques for Precision-Preserving Format-Preserving Encryption (PPFPE) to protect numeric values and strings with leading/trailing and special characters, while preserving their precision, both as a protected value (e.g., ciphertext) and when decrypted are provided. In one aspect, a plaintext string is parsed to detect a first and last sentinel characters, wherein any character(s) preceding the first sentinel character comprises a leading character(s) and any character(s) following the last sentinel character comprises a trailing character(s). Any leading character(s) preceding the first sentinel character and/or any trailing character(s) following the last sentinel character are passed through. A ciphertext string is generated by encrypting the first and last sentinel character using one or more subsets of a set of encryption characters; and encrypting the portion of the plaintext string between the first and last sentinel character using the set of encryption characters.

Method and apparatus for protecting numbers and strings using format-preserving encryption with automatic precision

A pointer is set to a first code unit of an original string that encodes characters via code units within an encoding scheme. Whether the code unit of the original string referenced by the pointer is valid within the encoding scheme is determined. If the code unit referenced by the pointer is valid, one or more code units of the original string that encode a single character within the encoding scheme are processed, starting at the code unit referenced by the pointer. The one or more code units as have been processed are appended to a processed string. A single shadow unit indicating that the one or more code units that have been processed are valid is appended to a shadow array. The pointer is advanced to the code unit of the original string following the one or more code units.

Encoded string processing

A token generating organization may include distributed tokenization systems for generating tokens corresponding to sensitive information. Sensitive information may include sensitive numbers such as social security numbers, credit card numbers or other private numbers. A tokenization system may include multiple physically distinct hardware platforms each having a tokenization server and a database. A tokenization server may run portions of a sensitive number through a predetermined number of rounds of a Feistel network. Each round of the Feistel network may include tokenizing portions of the sensitive number using a fractional token table stored an associated database and modifying the tokenized portions by reversibly adding portions of the sensitive number to the tokenized portions. The fractional token table may include partial sensitive numbers and corresponding partial tokens. A sensitive-information-recovery request including the token may be directed to the token generating organization from the token requestor to recover sensitive information.

System for protecting sensitive data with distributed tokenization

Examples discussed herein disclose, among other things, an encrypting device. The encrypting device may include a format preserving encryptor to obtain a plaintext, obtain a key from a plurality of keys stored in a key database, and encrypt the plaintext using the key to produce a ciphertext having a length of the plaintext. The encrypting device may also include a key reference embedder to obtain a key reference associated with the key, and generate an extended ciphertext by adding to the ciphertext a set of characters associated with the key reference, such that the key reference can be determined based on the extended ciphertext.

Extended ciphertexts

Examples discussed herein disclose, among other things, a method. The method includes, among other things, obtaining a plaintext, obtaining a key from a plurality of keys, and determining whether the plaintext is longer than a predefined threshold length. If the plaintext is longer than the predefined threshold length, the method may encrypt the plaintext with the key to generate a first ciphertext having a length of the plaintext, where the character at a predefined position within the first ciphertext belongs to a first subset of characters. And if the plaintext is not longer than the predefined threshold length, the method may encrypt the plaintext with the key to generate a second ciphertext, which is longer than the plaintext, where the character at the same predefined position in the second ciphertext belongs to a second subset of characters.

Encryption methods based on plaintext length

Techniques for using padding in format preserving encryption are provided. In one aspect, it may be determined if padding of a plaintext undergoing format preserving encryption is needed. A pseudo random padding length may be calculated when it is determined that padding is needed. The calculated length of padding may be added to the plaintext when it is determined that padding is needed. The plaintext and added padding may be encrypted using format preserving encryption to create a cipher text.

Format preserving encryption with padding

In one example in accordance with the present disclosure, a method may include receiving a digit sequence including a subset of N digits encoded with semantic information and determining a set of possible combinations for the N digits in the subset. The method may also include establishing a mapping between each possible combination in the set of possible combinations and a corresponding integer sequence belonging to a set of integer sequences. Each integer sequence in the set of integer sequences is of the length of N&#x2212;1. The method may also include identifying a selected integer sequence corresponding to the subset and replacing n&#x2212;1 digits from the subset with the selected integer sequence. The method may also include replacing a digit of the subset with a digit value calculated to produce a valid checksum for the entire first digit sequence, wherein the first digit is not included in the n&#x2212;1 digits.

Replacing a subset of digits in a sequence

A technique includes performing element-by-element encryption of a segment of the plaintext string to provide a segment of an encrypted string. Performing the element-by-element encryption includes, for a given string element of the segment of the plaintext string, encrypting the given string element to provide a given string element of the segment of the encrypted string; and tweaking the encryption of the given string element based on a selector that includes multiple string elements of the encrypted string. The technique may include searching an encrypted database based on the encrypted string.

Tweak-based string encryption

A system may include a point-of-sale system that gathers payment card track data from a payment card and a payment card gateway that processes the track data to authorize purchase transactions. The point-of-sale system may remove sensitive data such as a portion of a primary account number from the track data and may compress the removed data. The compressed version of the data may be appended to a discretionary field in the track data. The discretionary field may be encrypted following insertion of the compressed data. Track data that has been modified in this way may be conveyed to the payment gateway for processing.

System for structured encryption of payment card track data

Apparatus and method for rapid interactive viewing of a digital image over a network. A client computer displays a view of an image. The image is originally resident on a server computer. The client computer maintains a cache, initially empty, of image blocks already obtained from the server. When the client computer is asked to render a view of a particular portion of the image at a particular resolution, it first ascertains if any image blocks in the image-block cache intersect the requested view. It then computes the residual area of the view resulting from subtracting out from the view the intersecting portions of cached image blocks, and, if the residual area is positive, downloads from the server computer a set of image blocks comprising the residual portion of the view at the given resolution.

Method and system using non-uniform image blocks for rapid interactive viewing of digital image over a network

Method and system using non-uniform image blocks for rapid interactive viewing of digital images over a network

A system and method using inductive image generation with cached, state-specific image tiles for editing digital images. A computer system contains an archival digital image to be edited and viewed, a transformation state list, describing editing operations to be applied to the archival image in order to produce the current edited image rendition, and a viewing data set, describing the resolution, offset and extent of the current view of the current edited image rendition. The current view is constructed from a set of image tiles kept in a tile cache. In response to an instruction to generate the current view, the system identifies the requisite tiles, and then generates each tile by an inductive image generation process. The latter process comprises (a) ascertaining if the tile is in the tile cache, and, if not (b) ascertaining if the image is unedited and if so obtaining the requisite tile from the image file, and, if not (c) generating the tile by identifying and assembling the requisite supplier tiles in the previous state of the image-editing process and by then applying the current state's editing transformation function to the supplier tiles. The inductive image-generation process is recursive in that in case it is necessary to assemble supplier tiles in the course of the inductive image-generation process then they too are assembled by the process of inductive image generation.

Growing community of inventors

Carmichael, CA, United States of America

Richard T Minner