Patent ID: 11968292
Assignee: AMAZON TECHNOLOGIES, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 1:
2. A system, comprising:
one or more hardware processors; and
a non-transitory computer-readable storage medium that stores instructions that, as a result of being executed by the one or more hardware processors, cause the system to:
obtain, at a computing device, a first ciphertext of plaintext;
generate, at the computing device, based at least on the first ciphertext of the plaintext, using an incremental hash function that computes elements of a binary Galois field based at least in part on a previous invocation of the hash function, a second ciphertext that comprises a plurality of authentication tags and a plurality of ciphertext chunks of the first ciphertext, the ciphertext chunks:
being interleaved with the plurality of authentication tags; and
the plurality of authentication tags including a first authentication tag and a second authentication tag that bounds a subset of ciphertext chunks of the plurality of ciphertext chunks, and an intermediary authentication tag between the first authentication tag and the second authentication tag, where the first authentication tag is positioned preceding the subset of ciphertext chunks and the second authentication tag is positioned after the subset of ciphertext chunks and the first authentication tag is determined based at least in part on the previous invocation of the hash function and an output of incrementing a number of the right-most bits of a ciphertext chunk of the subset of ciphertext chunks;

provide, from the computing device, the second ciphertext;
obtain a request to access a subsequence of plaintext of the plaintext, the subsequence of plaintext specifying a first byte and last byte of the subsequence of plaintext within the plaintext, where the subsequence of plaintext includes the intermediary authentication tag;
translate the subsequence of plaintext into the subset of ciphertext chunks bounded by the first authentication tag and the second authentication tag;
decrypt a first ciphertext chunk of the subset of ciphertext chunks between the first authentication tag and the intermediary authentication tag and a second ciphertext chunk of the subset of ciphertext chunks between the intermediary authentication tag and the second authentication tag; and
authenticate the first ciphertext chunk and the second ciphertext chunk based at least in part on the first authentication tag, the intermediary authentication tag, and the second authentication tag
receive a second request to retrieve a second range of the plaintext;
decrypt a portion of ciphertext that is less than all the ciphertext to obtain the second range of the plaintext;
authenticate the portion of the ciphertext without using at least one authentication tag of the plurality of authentication tags; and
provide the second range of the plaintext in response to the second request.