Segmented Mapping

• US 20120210139A2
• Filed: 07/07/2011
• Published: 08/16/2012
• Est. Priority Date: 06/18/2010
• Status: Active Grant

• Current Assignee: Axis Technology Software LLC
• Original Assignee: Axis Technology Software LLC
• Inventors: Taskaya, Ilker, Nauda, Alex
• Granted Patent: US 8,533,470 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Described are methods and apparatus, including computer program products for masking data. The inventions involves receiving a mapping scheme with a number of segments and a different cryptographic algorithm for each segment and then receiving a target value to be masked. The target value is then split into a number of segments based on the number of segments of the mapping scheme and the cryptographic algorithm is applied for each segment in the mapping scheme to each segment of the target value to generate an encrypted segment for each segment in the target value. Then, the encrypted segments are concatenated to create a masked value.

Claims

1. A method, executed on a computer processor, for masking data comprising:

receiving a mapping scheme comprising a number of segments and a different cryptographic algorithm for each segment;

receiving a target value to be masked;

splitting the target value into a number of segments based on the number of segments of the mapping scheme;

applying the cryptographic algorithm for each segment in the mapping scheme to each segment of the target value to generate an encrypted segment for each segment in the target value; and

concatenating the encrypted segments to create a masked value.

2. The method of claim 1 wherein the cryptographic algorithm for a segment comprises:

creating a table comprising rows of mask values, wherein the number of rows of the table corresponds to the length of each segment;

creating a random number for each row in the table;

sorting the rows of the table based on the random number associated with each row; and

performing a lookup function using the segment value as an index for the table to retrieve a mask value of a particular row.

3. The method of claim 1 wherein the cryptographic algorithm for a segment comprises:

creating a first table comprising all possible values for a variable of length equal to the length of the current segment;

creating a second table comprising rows of mask values, wherein the number of rows of the second table corresponds to the length of each segment;

creating a random number for each row in the second table;

sorting the rows of the second table based on the random number associated with each row;

joining the first table and the second table such that each possible value is paired with a mask value; and

performing a lookup function using the segment value as an index for the table to retrieve a mask value of a particular row.

4. A computer program product, tangibly embodied in a computer-readable storage medium, for masking data, the computer program product including instructions operable to cause a data processing apparatus to:

receive a mapping scheme comprising a number of segments and a different cryptographic algorithm for each segment;

receive a target value to be masked;

split the target value into a number of segments based on the number of segments of the mapping scheme;

apply the cryptographic algorithm for each segment in the mapping scheme to each segment of the target value to generate an encrypted segment for each segment in the target value; and

concatenate the encrypted segments to create a masked value.

5. The computer program product of claim 4, wherein the cryptographic algorithm instructions are operable to cause the data processing apparatus to:

create a table comprising rows of mask values, wherein the number of rows of the table corresponds to the length of each segment;

create a random number for each row in the table;

sort the rows of the table based on the random number associated with each row; and

perform a lookup function using the segment value as an index for the table to retrieve a mask value of a particular row.

6. The computer program product of claim 4, wherein the cryptographic algorithm instructions are operable to cause the data processing apparatus to:

create a first table comprising all possible values for a variable of length equal to the length of the current segment;

create a second table comprising rows of mask values, wherein the number of rows of the second table corresponds to the length of each segment;

create a random number for each row in the second table;

sort the rows of the second table based on the random number associated with each row;

join the first table and the second table such that each possible value is paired with a mask value; and

perform a lookup function using the segment value as an index for the table to retrieve a mask value of a particular row.