Side-channel resistant AES white box encryption method and related equipment

Abstract

The present invention provides an AES white box encryption method and related equipment that is resistant to side channels. The method comprises: randomly generating 16 masks and dividing them into 4 groups to form a 4x4 matrix, wherein the Hamming weight of the exclusive OR of any two masks in each group is a multiple of 4; constructing a cyclic mask so that the mask of each byte in the matrix circulates on the column, and the mask satisfies Mask r [i] = M[R[i] + ((C[i] + r) mod 4)] i∈ [0, 15], where R is the row index of the random mask for each byte, C is the column index, and r is the round number. Based on the matrix, mask, index, and round number, a round function is constructed to generate a white-box table. The white-box table is based on a random group index and is also random in each lookup. Through the present invention, a different initial mask is used for calculation in each encryption and decryption process through external dynamic offset of a fixed mask, making it difficult to restore the true key through side-channel attacks, thereby improving data security.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a side-channel resistant AES white box encryption method and related equipment. Background Art

[0002] In a white-box attack environment, attackers not only gain access to the input and output of a cryptographic algorithm but can even trace the key, thereby controlling the terminal device. In this context, in 2003, Chow et al. first employed a combination of lookup tables, input-output encoding, and bijective injection to hide the key and encoding information in a lookup table. Many subsequent white-box encryption schemes have been improved upon and based on Chow's white-box cryptographic construction ideas. The presence of a lookup table increases the difficulty for a white-box attacker to obtain the final key.

[0003] However, the above white box solution can restore the password by monitoring the energy changes of the cryptographic algorithm during operation and using side channel attacks.

[0004] To protect against side-channel attacks, white-box encryption requires adding randomly generated data to the cryptographic algorithm to obscure intermediate values. This added data is called a mask. However, once the white-box cryptographic table is generated, the randomly generated mask is also fixed. The correct key can be found by analyzing nonlinear transformations using differential statistics. Summary of the Invention

[0005] The main purpose of the present invention is to provide an AES white-box encryption method, device, equipment and readable storage medium that are resistant to side channels, aiming to solve the technical problem in the prior art that once the white-box cipher table is generated, the randomly generated mask is also fixed, and the nonlinear transformation can be analyzed by differential statistics to find the correct key.

[0006] In a first aspect, the present invention provides an AES white-box encryption method that is resistant to side channels, the method comprising:

[0007] Randomly generate 16 masks and divide them into 4 groups to form a 4x4 matrix, where the Hamming weight of the XOR of any two masks in each group is a multiple of 4;

[0008] Construct a circular mask so that the mask of each byte in the matrix is ​​circulated on the column, and the mask satisfies Mask r [i] = M[R[i] + ((C[i] + r) mod 4)]i∈[0,15], where R is the row index of each byte random mask, C is the column index, and r is the round number;

[0009] Based on the matrix, mask, index and round, a round function is constructed to generate a white-box table based on a random group index that is also random in each lookup.

[0010] After generating the white box table, the method further includes:

[0011] Searching the external input encoding table in the white box table to obfuscate the encrypted data;

[0012] Randomly generate a row index R for selecting the mask in the round function, so that the mask compensation table and round function table are different for each encryption and decryption query;

[0013] The mask compensation table and the round function table in the white box table are queried in rounds until the round ends, thereby obtaining the obfuscated data of each round.

[0014] After obtaining the obfuscated data of each round, the method further includes:

[0015] After searching the external output encoding table in the white box table to obtain the deobfuscated encrypted data, the deobfuscated encrypted data is decrypted using the standard AES algorithm.

[0016] The step of constructing a round function based on the matrix, mask, index, and round number includes:

[0017] Construct row shift transformation matrix;

[0018] Construct a byte replacement with a mask, the construction method is:

[0019]

[0020]

[0021] Where Nr is the total number of rounds, SubByte represents the byte substitution transformation of the standard AES, X represents the protected intermediate value used as the input of the reconstructed S-box, M and M′ represent the input mask and output mask values ​​used to protect the sensitive intermediate value, respectively, and M and M′ are two adjacent elements in the same row and column in the matrix;

[0022] Construct T-Box in the following way:

[0023]

[0024]

[0025] Where x represents a byte in the matrix, i represents the input byte, and r is the round number. is the row shift transformation of the extended key, S is the table lookup operation of S-Box, Mask r is the mask table;

[0026] Construct the column confusion transformation matrix as follows:

[0027]

[0028] Wherein, MC0 represents the first two columns of the matrix, and MC1 represents the remaining two columns;

[0029] According to the wheel boundary, the mask compensation is obtained Where r is the round, MC represents the column confusion transformation of standard AES, and SR represents the standard row shift transformation.

[0030] The method further comprises:

[0031] Randomly generate two 128-bit linear reversible random maps IN and OUT, which are used to act on plaintext and ciphertext respectively as external encoding;

[0032] For the rth round, r∈[1, Nr], a 128-bit non-singular square matrix Y on a finite field r Instead of row shift transformation, it is expressed as:

[0033]

[0034] in

[0035] Randomly generate 8 16-bit linear reversible random maps A and A -1 , so that A acts on all elements of M, we have:

[0036] A·M′={A0·M′0, A1·M′1,...A7·M′7}

[0037] Where, AA = diag(A0, A1, ... A7),

[0038] Randomly generate 4 32-bit linear reversible random maps B and B -1 , use B to confuse the mask column, so

[0039] Construct mask row shift transformation confusion, expressed as SR(X)=AA·SR·BB -1 ;

[0040] Constructing masks to compensate for confusion;

[0041] For round r, r∈[1,Nr], use T for the mask r Operation, expressed as:

[0042]

[0043] In a second aspect, the present invention further provides an AES white-box encryption device resistant to side channels, the device comprising:

[0044] A generation module, used to randomly generate 16 masks divided into 4 groups to form a 4×4 matrix, where the Hamming weight of the XOR of any two masks in each group is a multiple of 4;

[0045] The first construction module is used to construct a cyclic mask so that the mask of each byte in the matrix circulates on the column, and the mask satisfies Mask r [i] = M[R[i] + ((C[i] + r) mod 4)] i∈[0, 15], where R is the row index of each byte random mask, C is the column index, and r is the round number;

[0046] The second construction module is used to construct a round function based on the matrix, the mask, the index and the round to generate a white box table. The white box table is based on a random group index and is also random in each lookup.

[0047] The device further includes an encryption module for:

[0048] Searching the external input encoding table in the white box table to obfuscate the encrypted data;

[0049] Randomly generate a row index R for selecting the mask in the round function, so that the mask compensation table and round function table are different for each encryption and decryption query;

[0050] The mask compensation table and the round function table in the white box table are queried in rounds until the round ends, thereby obtaining the obfuscated data of each round.

[0051] The device further includes a decryption module for:

[0052] After searching the external output encoding table in the white box table to obtain the deobfuscated encrypted data, the deobfuscated encrypted data is decrypted using the standard AES algorithm.

[0053] In a third aspect, the present invention also provides a side-channel-resistant AES white-box encryption device, comprising a processor, a memory, and a side-channel-resistant AES white-box encryption program stored on the memory and executable by the processor, wherein when the side-channel-resistant AES white-box encryption program is executed by the processor, the steps of the side-channel-resistant AES white-box encryption method described above are implemented.

[0054] In a fourth aspect, the present invention also provides a readable storage medium, on which a side-channel-resistant AES white-box encryption program is stored. When the side-channel-resistant AES white-box encryption program is executed by a processor, the steps of the side-channel-resistant AES white-box encryption method as described above are implemented.

[0055] In the present invention, 16 masks are randomly generated and divided into 4 groups to form a 4×4 matrix, wherein the Hamming weight of the XOR of any two masks in each group is a multiple of 4; a cyclic mask is constructed so that the mask of each byte in the matrix circulates on the column, and the mask satisfies Mask r [i] = M[R[i] + ((C[i] + r) mod 4)] i∈[0, 15], where R is the row index of the random mask for each byte, C is the column index, and r is the round number. Based on the matrix, mask, index, and round number, a round function is constructed to generate a white-box table. The white-box table is based on a random group index and is also random in each lookup. Through the present invention, by externally dynamically offsetting the fixed mask, a different initial mask is used for calculation in each encryption and decryption process, making it difficult to restore the true key through side-channel attacks, thereby improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a flow chart of an embodiment of an AES white-box encryption method for side-channel resistance according to the present invention;

[0057] Figure 2 A schematic diagram of a round function in an embodiment of an AES white-box encryption system resistant to side channels of the present invention;

[0058] Figure 3 A schematic diagram of generating and exporting a white-box table in an embodiment of the side-channel resistant AES white-box encryption method of the present invention;

[0059] Figure 4 Schematic diagram of data encryption and decryption in an embodiment of the side-channel resistant AES white-box encryption method of the present invention;

[0060] Figure 5 This is a schematic diagram of the functional modules of an embodiment of an AES white-box encryption device resistant to side channels of the present invention;

[0061] Figure 6 Schematic diagram of the hardware structure of the side-channel resistant AES white-box encryption device involved in the embodiment of the present invention.

[0062] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0063] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0064] In a first aspect, an embodiment of the present invention provides an AES white-box encryption method that is resistant to side channels.

[0065] In one embodiment, referring to Figure 1 , Figure 1FIG. 1 is a flow chart of an embodiment of the AES white box encryption method for resisting side channels of the present invention. Figure 1 As shown, the method includes:

[0066] Step S10, randomly generating 16 masks and dividing them into 4 groups to form a 4x4 matrix, wherein the Hamming weight of the XOR of any two masks in each group is a multiple of 4;

[0067] In this embodiment, 16 masks are randomly generated and divided into 4 groups to form a 4x4 matrix, wherein the Hamming weight of the XOR of any two masks in each group is a multiple of 4. For example:

[0068]

[0069] Step S20, constructing a cyclic mask so that the mask of each byte in the matrix circulates on the column, and the mask satisfies Mask r [i] = M[R[i] + ((C[i] + r) mod 4)]i∈[0, 15], where R is the row index of each byte random mask, C is the column index, and r is the round number;

[0070] In this embodiment, i is a byte, and the mask of each byte in each round is not fixed by cyclic masking.

[0071] Step S30: constructing a round function based on the matrix, mask, index and round to generate a white box table. The white box table is based on a random group index and is also random in each lookup.

[0072] In this embodiment, a round function is constructed based on a 4x4 matrix, a mask, an index, and a round, thereby generating a white box table. The white box table is based on a random group index and is also random in each search.

[0073] In this embodiment, 16 masks are randomly generated and divided into 4 groups to form a 4×4 matrix, wherein the Hamming weight of the XOR of any two masks in each group is a multiple of 4; a cyclic mask is constructed so that the mask of each byte in the matrix circulates on the column, and the mask satisfies Mask r [i] = M[R[i] + ((C[i] + r) mod 4)] i∈[0, 15], where R is the row index of the random mask for each byte, C is the column index, and r is the round number. Based on the matrix, mask, index, and round number, a round function is constructed to generate a white-box table. The white-box table is based on a random group index and is also random in each lookup. Through this embodiment, a different initial mask is used for calculation in each encryption and decryption process by externally dynamically offsetting the fixed mask, making it difficult to restore the true key through side-channel attacks, thereby improving data security.

[0074] Furthermore, in one embodiment, based on step S10 and step S20, a round function is then constructed, referring to Figure 2 , Figure 2 This is a schematic diagram of a round function in an embodiment of the side-channel resistant AES white-box encryption system of the present invention. Based on the matrix, mask, index, and round number, a round function is constructed, including:

[0075] Construct row shift transformation matrix;

[0076] Construct a byte replacement with a mask, the construction method is:

[0077]

[0078]

[0079] Where Nr is the total number of rounds, SubByte represents the byte substitution transformation of the standard AES, X represents the protected intermediate value used as the input of the reconstructed S-box, M and M′ represent the input mask and output mask values ​​used to protect the sensitive intermediate value, respectively, and M and M′ are two adjacent elements in the same row and column in the matrix;

[0080] Construct T-Box in the following way:

[0081]

[0082]

[0083] Where x represents a byte in the matrix, i represents the input byte, and r is the round number. is the row shift transformation of the extended key, S is the table lookup operation of S-Box, Mask r is the mask table;

[0084] Construct the column confusion transformation matrix as follows:

[0085]

[0086] Wherein, MC0 represents the first two columns of the matrix, and MC1 represents the remaining two columns;

[0087] According to the wheel boundary, the mask compensation is obtained Where r is the round, MC represents the column confusion transformation of standard AES, and SR represents the standard row shift transformation.

[0088] In this embodiment:

[0089] (1) Construct a row shift transformation matrix; for example, the row shift transformation matrix of AES is expressed as:

[0090]

[0091] Construct a 128×128 byte matrix so that it satisfies this matrix.

[0092] Specifically: First, the 128×128 byte matrix is ​​divided into 4 blocks, so that M=[M0 M1 M2 M3].

[0093] The initial position is 0, let M0 = [x 00 00 00], M1 = [00 00 00 00], M2 = [00 00 00 00], M3 = [00 00 00 00].

[0094] Then shift 5 bytes, then M0 = [00 00 00 00], M1 = [00 00 00 00], M2 = [00 00 0000], M3 = [00 x 00 00].

[0095] Shifting 10 bytes again, we have M0 = [00 00 00 00], M1 = [00 00 00 00], M2 = [00 00x 00], M3 = [00 00 00 00].

[0096] Until all elements are moved according to the matrix of the inverse row shift transformation.

[0097] in That is, the set of all binary positions.

[0098] (2) Construct a byte replacement with a mask, which is constructed as follows:

[0099]

[0100]

[0101] Where SubByte represents the standard AES byte substitution transformation, X represents the protected intermediate value used as input to the reconstructed S-box, and M and M′ represent the input mask and output mask values ​​used to protect the sensitive intermediate value, respectively. M and M′ are two adjacent elements in the mask array, one row and one column apart. For example, M[0]M[1] represents row 0 and columns 0 and 1.

[0102] (3) Construct a T-Box for byte substitution + round key addition + mask transformation. Its construction method is:

[0103]

[0104]

[0105] Where x represents a byte in a 4×4 matrix, i represents the input byte, and r is the round number. is the row shift transformation of the extended key, and S is the table lookup operation of S-Box. r (i.e., mask table) is represented as:

[0106]

[0107] To increase the randomness of the mask's external structure, the row index R is generated externally and randomly, while the mask M and column index C are fixed in the generated white-box table. When the value of C[i]+r equals the maximum column index, C[i]+r = C[0]. Because the XOR Hamming weight of two adjacent masks is a multiple of 4, the energy levels are similar when executing the nonlinear T-Box. This prevents side channels from obtaining the correct key through energy variations.

[0108] (4) Construct the column confusion transformation matrix. Specifically, the 4×4 matrix MC is divided into two 4×2 matrices MC0 and MC1, where MC0 represents the first two columns of the matrix MC and MC1 represents the remaining two columns. MC0 and MC1 are used to perform column confusion transformation, and the construction method is as follows:

[0109]

[0110] (5) Mask compensation, used to offset the impact of the mask in the previous round. Figure 2 Middle wheel boundary, get mask compensation Where r is the round, MC represents the column confusion transformation of standard AES, and SR represents the standard row shift transformation.

[0111] Furthermore, in one embodiment, the method further includes:

[0112] Randomly generate two 128-bit linear reversible random maps IN and OUT, which are used to act on plaintext and ciphertext respectively as external encoding;

[0113] For the rth round, r∈[1, Nr], a 128-bit non-singular square matrix Yr over a finite field is used instead of the row shift transformation, expressed as:

[0114]

[0115] in

[0116] Randomly generate 8 16-bit linear reversible random maps A and A -1 , so that A acts on all elements of M, we have:

[0117] A·M′={A0·M′0, A1·M′1,...A7·M′7)

[0118] Where, AA = diag(A0, A1, ... A7),

[0119] Randomly generate 4 32-bit linear reversible random maps B and B -1 , use B to confuse the mask column, so

[0120] Construct mask row shift transformation confusion, expressed as SR(X)=AA·SR·BB -1 ;

[0121] Constructing masks to compensate for confusion;

[0122] For round r, r∈[1,Nr], use T for the mask r Operation, expressed as:

[0123]

[0124] In this embodiment, in order to increase the obfuscation, a linear reversible matrix is ​​added:

[0125] (1) Input and output obfuscation. Specifically: Two 128-bit linear reversible random mappings IN (i.e., external input encoding table) and OUT (i.e., external output encoding table) are randomly generated and used to act on plaintext and ciphertext respectively as external encoding.

[0126] (2) Round function obfuscation. Specifically:

[0127] For the rth round r∈[1,Nr], a 128-bit non-singular square matrix Yr over the finite field GF(2) replaces the row shift transformation. r The operation can be expressed as:

[0128]

[0129] in, Y r That is, the round function table.

[0130] (3) Mask obfuscation. Specifically:

[0131] a. Randomly generate 8 16-bit linear reversible random maps A and A -1 , so that A acts on all elements of M, that is:

[0132] A·M′={A0·M′0, A1·M′1,...A7·M′7}

[0133] Let AA=diag(A0, A1,...A7),

[0134] b. Randomly generate four 32-bit linear reversible random maps B and B -1, use matrix B to confuse the mask column.

[0135] c. Construct mask row shift transformation confusion, expressed as SR(X) = AA·SR·BB -1 .

[0136] d. Construct mask compensation confusion, its expression is:

[0137]

[0138] e. For round r r∈[1, Nr], use T for the mask r The operation can be expressed as:

[0139]

[0140] Among them, T r That is, the mask compensation table.

[0141] Furthermore, in one embodiment, after generating the white box table, the method further includes:

[0142] Searching the external input encoding table in the white box table to obfuscate the encrypted data;

[0143] Randomly generate a row index R for selecting the mask in the round function, so that the mask compensation table and round function table are different for each encryption and decryption query;

[0144] The mask compensation table and the round function table in the white box table are queried in rounds until the round ends, thereby obtaining the obfuscated data of each round.

[0145] In this embodiment, when data needs to be encrypted, the encrypted data is obfuscated by searching the external input encoding table IN in the white box table to prevent external injection; further, a row index R is randomly generated for selecting the mask in the round function, so that the mask compensation table and round function table are different for each encryption and decryption query; further, the mask compensation table and round function table are searched according to the round until the end of the round, and the obfuscated data of each round is obtained.

[0146] Furthermore, in one embodiment, after obtaining the obfuscated data of each round, the method further includes:

[0147] After searching the external output encoding table in the white box table to obtain the deobfuscated encrypted data, the deobfuscated encrypted data is decrypted using the standard AES algorithm.

[0148] In this embodiment, when the encrypted data needs to be decrypted, the external output encoding table OUT in the white box table is first looked up to obtain the deobfuscated encrypted data, and then the data is decrypted using the standard AES algorithm.

[0149] Furthermore, in one embodiment, referring to Figure 3 , Figure 3 Schematic diagram of generating and exporting a white box table in an embodiment of the AES white box encryption method for resisting side channels of the present invention. Figure 3 As shown,

[0150] The white box table construction module uses the above-mentioned side-channel resistant AES white box encryption method to generate a white box table. After the white box table is generated, the white box table generation module outputs the white box table in the memory as a file. Specifically, the white box table generation module is based on external instructions, and the input parameters include but are not limited to keys, random seeds, input and output file paths, and the output forms include but are not limited to source code files, JSON files, and binary stream files. The memory table uses defined rules to generate output files. The defined rules include but are not limited to segment starting positions, segment offsets, and segment encryption methods. In order to prevent external injection, the external input coding table IN and the external output coding table OUT files are stored separately. The white box table import module imports the white box table file and parses it into a format recognizable by the encryption and decryption module according to the defined rules.

[0151] Reference Figure 4 , Figure 4 Schematic diagram of data encryption and decryption in an embodiment of the AES white box encryption method for resisting side channels of the present invention. Figure 4 As shown, A103 is the encryption process, and A104 is the decryption process. In the encryption process, the data to be encrypted is first obfuscated by querying the external input encoding table IN to prevent external injection. A random row index R is then generated to select the mask in the round function, ensuring that the mask compensation table and round function table are different for each encryption and decryption query. The mask compensation table Mask and round function table Table are then searched by round until the round is completed, obtaining the obfuscated data for each round. The obfuscated data is then sent to the decryption end. In the decryption process, the deobfuscated encrypted data is first obtained by querying the external output encoding table OUT. The deobfuscated encrypted data is then decrypted using the standard AES algorithm.

[0152] In the second aspect, the embodiment of the present invention also provides an AES white box encryption device that is resistant to side channels, referring to Figure 5 , Figure 5 This is a functional module diagram of an embodiment of an AES white box encryption device that resists side channels of the present invention. Figure 5 As shown, the device includes:

[0153] A generating module 10 is configured to randomly generate 16 masks and divide them into 4 groups to form a 4x4 matrix, wherein the Hamming weight of the exclusive OR of any two masks in each group is a multiple of 4;

[0154] The first construction module 20 is used to construct a cyclic mask so that the mask of each byte in the matrix circulates on the column, and the mask satisfies Mask r [i] = M[R[i] + ((C[i] + r) mod 4)]i∈[0, 15], where R is the row index of each byte random mask, C is the column index, and r is the round number;

[0155] The second construction module 30 is used to construct a round function based on the matrix, mask, index and round to generate a white box table. The white box table is based on a random group index and is also random in each lookup.

[0156] Furthermore, in one embodiment, the device further includes an encryption module, configured to:

[0157] Searching the external input encoding table in the white box table to obfuscate the encrypted data;

[0158] Randomly generate a row index R for selecting the mask in the round function, so that the mask compensation table and round function table are different for each encryption and decryption query;

[0159] The mask compensation table and the round function table in the white box table are queried in rounds until the round ends, thereby obtaining the obfuscated data of each round.

[0160] Furthermore, in one embodiment, the device further includes a decryption module configured to:

[0161] After searching the external output encoding table in the white box table to obtain the deobfuscated encrypted data, the deobfuscated encrypted data is decrypted using the standard AES algorithm.

[0162] Furthermore, in one embodiment, the second construction module 30 is used to:

[0163] Construct row shift transformation matrix;

[0164] Construct a byte replacement with a mask, the construction method is:

[0165]

[0166]

[0167] Where Nr is the total number of rounds, SubByte represents the byte substitution transformation of the standard AES, X represents the protected intermediate value used as the input of the reconstructed S-box, M and M′ represent the input mask and output mask values ​​used to protect the sensitive intermediate value, respectively, and M and M′ are two adjacent elements in the same row and column in the matrix;

[0168] Construct T-Box in the following way:

[0169]

[0170]

[0171] Where x represents a byte in the matrix, i represents the input byte, and r is the round number. is the row shift transformation of the extended key, S is the table lookup operation of S-Box, Mask r is the mask table;

[0172] Construct the column confusion transformation matrix as follows:

[0173]

[0174] Wherein, MC0 represents the first two columns of the matrix, and MC1 represents the remaining two columns;

[0175] According to the wheel boundary, the mask compensation is obtained Where r is the round, MC represents the column confusion transformation of standard AES, and SR represents the standard row shift transformation.

[0176] Furthermore, in one embodiment, the apparatus further includes an obfuscation enhancement module, configured to:

[0177] Randomly generate two 128-bit linear reversible random maps IN and OUT, which are used to act on plaintext and ciphertext respectively as external encoding;

[0178] For the rth round, r∈[1, Nr], a 128-bit non-singular square matrix Y on a finite field r Instead of row shift transformation, it is expressed as:

[0179]

[0180] in

[0181] Randomly generate 8 16-bit linear reversible random maps A and A -1 , so that A acts on all elements of M, we have:

[0182] A·M′={A0·M′0, A1·M′1,...A7·M′7}

[0183] Where, AA = diag(A0, A1, ... A7),

[0184] Randomly generate 4 32-bit linear reversible random maps B and B -1 , use B to confuse the mask column, so

[0185] Construct mask row shift transformation confusion, expressed as SR(X)=AA·SR·BB -1 ;

[0186] Constructing masks to compensate for confusion;

[0187] For round r, r∈[1,Nr], use T for the mask r Operation, expressed as:

[0188]

[0189] Among them, the specific embodiments of the above-mentioned side-channel-resistant AES white-box encryption method are basically the same as the various embodiments of the above-mentioned side-channel-resistant AES white-box encryption system, and will not be repeated here.

[0190] In a third aspect, an embodiment of the present invention provides an AES white-box encryption device that is resistant to side channels. The AES white-box encryption device that is resistant to side channels may be a device with data processing capabilities, such as a personal computer (PC), a laptop, or a server.

[0191] Reference Figure 6 , Figure 6 This is a schematic diagram of the hardware structure of the side-channel resistant AES white-box encryption device involved in the embodiment of the present invention. In the embodiment of the present invention, the side-channel resistant AES white-box encryption device may include a processor 1001 (e.g., a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components; the user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard); the network interface 1004 may optionally include a standard wired interface, a wireless interface (such as a wireless fidelity WIreless-FIdelity, WI-FI interface); the memory 1005 may be a high-speed random access memory (RAM) or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may optionally be a storage device independent of the aforementioned processor 1001. Those skilled in the art will understand that Figure 6 The hardware structure shown in the figure does not constitute a limitation of the present invention, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0192] Continue to refer to Figure 6 , Figure 6The memory 1005, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a side-channel-resistant AES white-box encryption program. The processor 1001 may invoke the side-channel-resistant AES white-box encryption program stored in the memory 1005 and execute the side-channel-resistant AES white-box encryption method provided in an embodiment of the present invention.

[0193] In a fourth aspect, an embodiment of the present invention further provides a readable storage medium.

[0194] The readable storage medium of the present invention stores a side-channel-resistant AES white-box encryption program, wherein when the side-channel-resistant AES white-box encryption program is executed by a processor, the steps of the above-mentioned side-channel-resistant AES white-box encryption method are implemented.

[0195] Among them, the method implemented when the side-channel resistant AES white-box encryption program is executed can refer to the various embodiments of the side-channel resistant AES white-box encryption method of the present invention, and will not be repeated here.

[0196] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0197] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0198] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, or of course by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a terminal device to execute the methods described in various embodiments of the present invention.

[0199] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A side-channel resistant AES white-box encryption method, characterized in that: The method comprises: Randomly generate 16 masks and divide them into 4 groups to form a 4x4 matrix, where the Hamming weight of the XOR of any two masks in each group is a multiple of 4; Construct a circular mask so that the mask of each byte in the matrix is ​​circulated on the column, and the mask satisfies Mask r [i] = M[R[i] + ((C[i] + r) mod 4)]i∈[0,15], where R is the row index of each byte random mask, C is the column index, and r is the round number; Based on the matrix, the mask, the index and the round, construct a round function to generate a white-box table, wherein the white-box table is based on a random group index that is also random in each lookup; After generating the white box table, the method further includes: Searching the external input encoding table in the white box table to obfuscate the encrypted data; Randomly generate a row index R for selecting the mask in the round function, so that the mask compensation table and round function table are different for each encryption and decryption query; The mask compensation table and the round function table in the white box table are queried in rounds until the round ends, thereby obtaining the obfuscated data of each round.

2. The side-channel resistant AES white-box encryption method according to claim 1, wherein: After obtaining the obfuscated data of each round, the method further includes: After searching the external output encoding table in the white box table to obtain the deobfuscated encrypted data, the deobfuscated encrypted data is decrypted using the standard AES algorithm.

3. The side-channel resistant AES white-box encryption method according to claim 1, wherein: The constructing of a round function based on the matrix, the mask, the index and the round includes: Construct row shift transformation matrix; Construct a byte replacement with a mask, the construction method is: Where Nr is the total number of rounds, SubByte represents the byte substitution transformation of the standard AES, X represents the protected intermediate value used as the input of the reconstructed S-box, M and M′ represent the input mask and output mask values ​​used to protect the sensitive intermediate value, respectively, and M and M′ are two adjacent elements in the same row and column in the matrix; Construct T-Box in the following way: Where x represents a byte in the matrix, i represents the input byte, and r is the round number. is the row shift transformation of the extended key, S is the table lookup operation of S-Box, Mask r is the mask table; Construct the column confusion transformation matrix as follows: Wherein, MC0 represents the first two columns of the matrix, and MC1 represents the remaining two columns; According to the wheel boundary, the mask compensation is obtained Where r is the round, MC represents the column confusion transformation of standard AES, and SR represents the standard row shift transformation.

4. The side-channel resistant AES white-box encryption method according to claim 3, wherein: The method further comprises: Randomly generate two 128-bit linear reversible random maps IN and OUT, which are used to act on plaintext and ciphertext respectively as external encoding; For the rth round, r∈[1,Nr], a 128-bit non-singular square matrix Y on a finite field r Instead of row shift transformation, it is expressed as: in Randomly generate 8 16-bit linear reversible random maps A and A -1 , so that A acts on all elements of M, we have: A·M′={A0·M′0,A1·M′1,…A7·M′7} Among them, AA=diag(A0,A1,…A7), Randomly generate 4 32-bit linear reversible random maps B and B -1 , use B to confuse the mask column, so Construct mask row shift transformation confusion, expressed as SR(X)=AA·SR·BB -1 ; Constructing masks to compensate for confusion; For round r, r∈[1,Nr], use T for the mask r Operation, expressed as:

5. A side-channel resistant AES white box encryption device, characterized in that: The device comprises: A generation module, used to randomly generate 16 masks divided into 4 groups to form a 4×4 matrix, where the Hamming weight of the XOR of any two masks in each group is a multiple of 4; The first construction module is used to construct a cyclic mask so that the mask of each byte in the matrix circulates on the column, and the mask satisfies Mask r [i] = M[R[i] + ((C[i] + r) mod 4)]i∈[0,15], where R is the row index of each byte random mask, C is the column index, and r is the round number; A second construction module is used to construct a round function based on the matrix, the mask, the index and the round to generate a white box table, wherein the white box table is based on a random group index and is also random in each lookup; Cryptographic module for: Searching the external input encoding table in the white box table to obfuscate the encrypted data; Randomly generate a row index R for selecting the mask in the round function, so that the mask compensation table and round function table are different for each encryption and decryption query; The mask compensation table and the round function table in the white box table are queried in rounds until the round ends, thereby obtaining the obfuscated data of each round.

6. The side-channel resistant AES white-box encryption device according to claim 5, wherein: The device further includes a decryption module, configured to: After searching the external output encoding table in the white box table to obtain the deobfuscated encrypted data, the deobfuscated encrypted data is decrypted using the standard AES algorithm.

7. A side-channel resistant AES white box encryption device, characterized in that: The side-channel-resistant AES white-box encryption device includes a processor, a memory, and a side-channel-resistant AES white-box encryption program stored on the memory and executable by the processor, wherein when the side-channel-resistant AES white-box encryption program is executed by the processor, the steps of the side-channel-resistant AES white-box encryption method according to any one of claims 1 to 4 are implemented.

8. A readable storage medium, characterized in that: The readable storage medium stores a side-channel-resistant AES white-box encryption program, wherein when the side-channel-resistant AES white-box encryption program is executed by a processor, the steps of the side-channel-resistant AES white-box encryption method according to any one of claims 1 to 4 are implemented.

Images