Practical itemized encryption for cryptographic erasure (PIECE)

Patent metadata

Field	Value
Publication number	US-12341871-B2
Application number	US-202318223956-A
Country	US
Kind code	B2
Filing date	Jul 19, 2023
Priority date	Jul 19, 2023
Publication date	Jun 24, 2025
Grant date	Jun 24, 2025

Abstract

The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for determining to erase a plurality of ciphertext blocks stored in a memory device, in response to determining to erase the plurality of ciphertext blocks, performing a cryptographic erasure of the plurality of ciphertext blocks. The cryptographic erasure includes encrypting each of the plurality of ciphertext blocks with a random key and destroying the random key in response to encrypting each of the plurality of ciphertext blocks.

First claim

What is claimed is:

1. A method, comprising:
identifying a plurality of ciphertext blocks stored in a memory device to erase;
in response to identifying the plurality of ciphertext blocks to erase, performing a cryptographic erasure of the plurality of ciphertext blocks, wherein the cryptographic erasure comprises:
encrypting each of the plurality of ciphertext blocks with a random key; and
destroying the random key in response to encrypting each of the plurality of ciphertext blocks.

2. The method of claim 1 , further comprising:
generating a plurality of random keys, wherein the plurality of random keys comprises the random key for each of the plurality of ciphertext blocks; and
encrypting each the plurality of ciphertext blocks using a respective one of the plurality of random keys.

3. The method of claim 2 , wherein
the plurality of ciphertext blocks are encrypted using a plurality of encryption algorithms;
a first ciphertext block is encrypted using a first encryption algorithm of the plurality of encryption algorithms;
a second ciphertext block is encrypted using a second encryption algorithm of the plurality of encryption algorithms;
the first encryption algorithm and the second encryption algorithm are different.

4. The method of claim 2 , wherein each of the plurality of random keys is destroyed in response to encrypting a respective one of the plurality of ciphertext blocks.

5. The method of claim 3 , wherein one of the plurality of encryption algorithms is randomly selected to encrypt one of the plurality of ciphertext blocks.

6. The method of claim 1 , wherein the random key is generated using a Random Number Generator (RNG) or a Quantum Random Number Generators (QRNG).

7. The method of claim 1 , wherein encrypting each of the plurality of ciphertext blocks with a random key comprises performing a bitwise Exclusive Or (XOR) using each of the plurality of ciphertext blocks and the random key.

8. The method of claim 1 , wherein
the plurality of ciphertext blocks are generated by encrypting a plurality of cleartext blocks of a data file using at least one cryptographic key; and
a number of the plurality of cleartext blocks is same as a number of the plurality of ciphertext blocks.

9. The method of claim 8 , wherein a size of each of the plurality of ciphertext blocks is determined based on a mode of operation for encrypting the plurality of cleartext blocks.

10. The method of claim 1 , wherein the cryptographic erasure comprises:
generating a plurality of doubly-encrypted ciphertext blocks by encrypting each of the plurality of ciphertext blocks with the random key; and
storing the plurality of doubly-encrypted ciphertext blocks in the memory device in place of the plurality of ciphertext blocks.

11. A system, comprising:
a memory; and
a processor configured to:
identify a plurality of ciphertext blocks stored in a memory device to erase;
in response to identifying the plurality of ciphertext blocks to erase, perform a cryptographic erasure of the plurality of ciphertext blocks, wherein the cryptographic erasure comprises:
encrypting each of the plurality of ciphertext blocks with a random key; and
destroying the random key in response to encrypting each of the plurality of ciphertext blocks.

12. The system of claim 11 , wherein the processor is further configured to:
generate a plurality of random keys, wherein the plurality of random keys comprises the random key for each of the plurality of ciphertext blocks; and
encrypt each the plurality of ciphertext blocks using a respective one of the plurality of random keys.

13. The system of claim 12 , wherein
the plurality of ciphertext blocks are encrypted using a plurality of encryption algorithms; a first ciphertext block is encrypted using a first encryption algorithm of the plurality of encryption algorithms;
a second ciphertext block is encrypted using a second encryption algorithm of the plurality of encryption algorithms;
the first encryption algorithm and the second encryption algorithm are different.

14. The system of claim 12 , wherein each of the plurality of random keys is destroyed in response to encrypting a respective one of the plurality of ciphertext blocks.

15. The system of claim 13 , wherein one of the plurality of encryption algorithms is randomly selected to encrypt one of the plurality of ciphertext blocks.

16. The system of claim 11 , wherein encrypting each of the plurality of ciphertext blocks with a random key comprises performing a bitwise Exclusive Or (XOR) using each of the plurality of ciphertext blocks and the random key.

17. The system of claim 11 , wherein
a number of the plurality of cleartext blocks is same as a number of the plurality of ciphertext blocks.

18. The system of claim 17 , wherein a size of each of the plurality of ciphertext blocks is determined based on an encryption algorithm used for encrypting the plurality of cleartext blocks.

19. The system of claim 11 , wherein the cryptographic erasure comprises:
generating a plurality of doubly-encrypted ciphertext blocks by encrypting each of the plurality of ciphertext blocks with a random key; and
storing the plurality of doubly-encrypted ciphertext blocks in the memory device in place of the plurality of ciphertext blocks.

20. A non-transitory processor-readable medium comprising processor-readable instructions, such that, when executed, causes a processor to:
identify a plurality of ciphertext blocks stored in a memory device to erase;
in response to determining to erase the plurality of ciphertext blocks to erase, perform a cryptographic erasure of the plurality of ciphertext blocks, wherein the cryptographic erasure comprises:
encrypting each of the plurality of ciphertext blocks with a random key; and
destroying each random key in response to encrypting each of the plurality of ciphertext blocks.

Assignees

• Wells Fargo Bank Na

Inventors

• Stapleton Jeffrey J

Classifications

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/0637 Primary

  Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM] · CPC title