Micro Focus Lcc

Entit Software LLC

Timothy Roake

Luther Martin

Cheryl He

A computing device includes a processor and a machine-readable storage storing instructions. The instructions are executable by the processor to: receive an input string including sensitive data to be encrypted; identify a first portion and a second portion of the input string, the first portion comprising the sensitive data; select, from a plurality of hash functions, a hash function based on the second portion; and generate a hash value of the first portion using the selected hash function.

Generating hash values for input strings

A non-tokenized string is received. For example, a non-tokenized string could be a credit card number. The non-tokenized string is partitioned into a plurality of non-tokenized substrings. For example, if the credit card number is 16 digits long, it may be partitioned into substrings that are three, six, and seven digits in length. The non-tokenized substrings are used as an index into a plurality of lookup tables. As a result of the indexing, a plurality of tokenized substrings are retrieved. The plurality of tokenized substrings are combined into a tokenized string. The tokenized string is used as a token that represents the credit card number without disclosing the actual credit card number. The reverse of the above process can also occur.

System and method for tokenization of data

A technique includes encrypting plaintext to provide a set of projective coordinates that represents a point of an abelian variety curve and represents ciphertext. The technique includes encoding the projective coordinates with metadata, which is associated with the ciphertext.

Encoding abelian variety-based ciphertext with metadata

A technique includes accessing data representing a plurality of values; and determining a pseudonym value for a given value of the plurality of values. Determining the pseudonym includes encrypting the given value to provide a first encrypted value; encrypting an attribute that is associated with the given value to provide a second encrypted value; and generating the pseudonym value based on the first encrypted value and the second encrypted value.

Statistical property preserving pseudonymization

A technique includes converting a plurality of plaintext values to a corresponding plurality of pseudonym values. The conversion includes performing encryption of the plurality of plaintext values to provide a plurality of second values; perturbing the plurality of second values to provide the plurality of pseudonym values; and controlling the perturbing to cause an ordering of the plaintext values to be represented in the plurality of pseudonym values.

Perturbation-based order preserving pseudonymization of data

A technique includes accessing data that represents a plurality of values that are associated with a plurality of ranges. The technique includes determining a pseudonym value for a given value, where the given value is associated with a given range and determining the pseudonym includes encrypting the given value to provide the pseudonym value; controlling the encryption to cause the pseudonym value to be within the given range; and tweaking the encryption based on an attribute that is associated with the given value.

Determining pseudonym values using tweak-based encryption

A technique includes accessing data representing plaintext. The plaintext has a first string size. The technique includes using a table to retrieve data representing a token that corresponds to the plaintext. The table has an associated string lookup size smaller than the first string size.

Cycle walking-based tokenization

In some examples, with respect to hash offset based key version embedding, data that is to be encrypted may be ascertained, and a key, including a key version, that is to be used to encrypt the ascertained data may be ascertained. Encrypted data may be generated by encrypting the ascertained data based on the ascertained key, and hashed encrypted data may be generated by performing a hash operation on the encrypted data. Further, offset hashed encrypted data may be generated by embedding the key version into the hashed encrypted data, and the offset hashed encrypted data including the embedded key version may be stored.

Hash offset based key version embedding

In some examples, geographical track data obfuscation may include ascertaining geographical data points that include a first data point and subsequent data points. For each of the subsequent data points, a delta degree value may be determined as a difference between a subsequent data point and a corresponding previous data point. A first format preserving encryption (FPE) may be applied to encrypt longitude and latitude values of the first data point. A second FPE may be applied by applying a translation of a plurality of translations to encrypt each delta degree value. A total distance traveled, a total time, and/or a total elevation gain may be extracted from the encrypted first data point and the encrypted delta degree values.

Geographical track data obfuscation

In one example, a system for format preserving encryption utilizing a key version can include a processor, and a memory resource storing instructions executable by the processor to determine a quantity of significant bits for a value to be encrypted, mask the value to include the quantity of significant bits, perform format preserving encryption on the masked value to generate an encrypted value, and append a key version to the encrypted value.

Format preserving encryption utilizing a key version

In some examples, with respect to zone based key version encoding, data that is to be encrypted may be ascertained, and a key, including a key version, that is to be used to encrypt the ascertained data may be ascertained. Encrypted data may be generated by encrypting the ascertained data based on the ascertained key, and a zone representing the key version may be determined. Further, encrypted zoned data may be generated by applying the determined zone to the encrypted data to encode the key version, and the encrypted zoned data including the encoded key version may be stored.

Zone based key version encoding

In some examples, floating point cohort based encryption may include determining an exponent of a floating point cohort.

Floating point cohort based encryption

Format preserving encryption of floating point data is disclosed. One example is a system including at least one processor and a memory storing instructions executable by the at least one processor to receive floating point data to be secured, where the floating point data comprises a sign bit, exponent bits and fraction bits. A format preserving encryption (FPE) is applied to the received data, where the FPE is applied separately to the sign bit, the exponent bits and the fraction bits to generate an encrypted floating point data comprising an encrypted sign bit, encrypted exponent bits and encrypted fraction bits. The encrypted floating point data is provided to a service provider as a secure representative of the received data.

Format preserving encryption of floating point data

Format preserving encryption of object code is disclosed. One example is a system including at least one processor and a memory storing instructions executable by the at least one processor to identify object code to be secured, where the object code comprises a list of instructions, each instruction comprising an opcode and zero or more parameters. A format preserving encryption (FPE) is applied to the received object code, where the FPE is applied separately to a sub-plurality of instructions in the list of instructions, to generate an encrypted object code comprising a sub-plurality of encrypted instructions. An encrypted object code is provided to a service provider, where the encrypted object code comprises the sub-plurality of encrypted instructions, and any unencrypted portions of the object code.

Growing community of inventors

Sunnyvale, CA, United States of America

Timothy Roake